diff --git a/goodwe_controller/DECISIONS/SAFETY-119-bound-after-hand-back.md b/goodwe_controller/DECISIONS/SAFETY-119-bound-after-hand-back.md new file mode 100644 index 0000000..bb05e7e --- /dev/null +++ b/goodwe_controller/DECISIONS/SAFETY-119-bound-after-hand-back.md @@ -0,0 +1,96 @@ +# SAFETY-119 - no "not keeping up" when the loop takes the wire back + +**Status: for review.** Tests: `test_safety119.py`. + +**Cause.** When another owner (the peak guard, a maintenance charge) has set +the wire and the loop wins again, `cycle()` re-seeds the integrator from that +owner's command, and `compute()` adds `gain * error` from a meter that does +not show that command yet. On the TEST-23 rig (SAFETY-118 I-2) the guard +stepped from -2000 W to +429 W with 5 s left. A cycle later the loop's ask +crossed the +2500 W rail and beat the guard's floor, so SAFETY-85 rule 1 +counted it as the loop's own bound and raised `goodwe_integrator_bound`. The +battery gave what it was told, and the cap held. + +**Decision.** After a hand-back, the loop's integrator bound is not counted +until the plant's settle has passed (`SHORT_CYCLES` cycles and +`SHORT_SPAN_S`, the window SAFETY-85 grades a battery on). After that it +counts as before. An over-rating (`clamped`, a bug) on a cycle the loop +decided always counts. No command changes, and no text was added or changed. + +**A rolling budget (round 3).** The settle above is per hand-back, and +losing the wire restarts it. Across all hand-backs the bound is hidden on at +most a budget of cycles in any 15 minutes (`ROLLING_BUDGET`, `ROLLING_S`); a +cycle over the budget counts. Round 1 restarted the settle at every +hand-back, so a guard and a charge taking turns hid the bound for good (0 +warnings in 2 h where 28 were raised before). Round 2 gave each run of +hand-backs its own budget; at 10 s and 15 s meters each quarter then started +a fresh one and the loop's bound was never counted. A quarter-edge kick is a +few bound cycles in one quarter, a real bound that stays is many: a budget +per 15 minutes tells them apart. + +**The budget follows the cycle length.** 10 cycles up to a 3.5 s cycle, 8 up +to 11 s, 6 up to 16 s, 4 beyond. The cycle length is the time between two +decided cycles (a stop, or a gap over two minutes, is not one); until it is +known, and without a monotonic clock, the budget is 8. Without a monotonic +clock the budget never refills. + +**Why not one number.** Measured over 2 h (`goodwe-addon-checks:1`), the +quarter-edge case (house 800 W, cap 2500 W, no forecast, 30 seeds) and the +case below. No single budget held both at 1 to 15 s: 3 to 6 let the false +alarm back at 2 s; 7 on 10 of 30 seeds at 2 s; 8 on 1 of 30 (seed 25) at +2 s, and warned in only 1 to 3 of 7 quarters at 15 s; 9 and 10 miss quarters +at 10 s. A slow cycle needs a small budget to warn, a fast one a large budget +to stay quiet. Per band, the largest budget that still warns: up to 3.5 s, +10 (9 and 10 had no false alarm at 1 and 2 s; above 10 was not swept); up to +11 s, 8 (9 misses quarters at 10 s); up to 16 s, 6 (7 leaves two quiet +quarters in a row at 15 s, 4 false-alarms at 12 s on 7 of 30 seeds); beyond, +4 (3 false-alarms at 20 and 30 s on 14 of 30, 5 leaves five quiet quarters at +20 s). + +**What holds.** Quarter-edge case, 30 seeds each: 0 notifications at 1, 2, +3, 4, 5, 10, 12, 15, 20 and 30 s. Repeated hand-backs (2 x 2500 W, +cheap-window charge, no usable forecast, cap 5000 W, house 5050 and 5100 W, +constant and with noise, 8 runs per meter): + +| meter | warnings in 2 h | quarters warned (of 7 after the first) | without the fix | +|---|---|---|---| +| 1 s | 56 to 63 | 7 | 56 to 63 | +| 2 s | 49 to 56 | 7 | 54 to 56 | +| 5 s | 19 to 23 | 7 | 28 | +| 10 s | 7 to 10 | 7 | 14 | +| 15 s | 4 to 10 | 4 to 7, never two quiet in a row | 14 | +| 30 s | 3 to 7 | 3 to 5, up to two quiet in a row | 7 to 11 | + +At 30 s no budget does better: 4 leaves two quiet quarters, 3 brings back +the false alarm. Single hand-back, the loop at its rail, first warning after +the hand-back compared with no fix: 10 s at 1 s, 20 s at 2 s, 40 s at 5 s +(default), 80 s at 10 s, 90 s at 15 s, 80 s at 20 s, 120 s at 30 s, 240 s at +60 s. At 60 s the rig is a different regime (the house is not over the cap +in the case above), so nothing more is claimed there. The cap held at 1 to +10 s in the quarter-edge case and at 1 to 5 s in the case above; at slower +meters the meter's lag puts quarters over it, the same with and without the +fix (commands are identical). + +**Limits.** These runs have one cycle per meter reading, at a steady +interval. A 20 or 30 s cycle needs `cycle_floor_s` raised; at the default +15 s, a slower meter adds cycles on an old reading. Measured that way (11 +seeds): a 15 s meter that varies by up to 30 % false-alarmed on 5 seeds, a +30 s meter on 10 (0 to 4 in 2 h, 8 to 15 without the fix); a 20 s meter on +none. The case above still warned every quarter there. + +**Kept.** The loop in charge at its rail warns on the same cycle as before. +The start and a restart after a stop are not hand-backs. The quarter-edge +kick of `test_safety119.py` part 1 stays hidden (see above). + +**Re-pinned.** test_safety84 (all six) and test_safety87 (`n1_crossing`, +`n1_above`, `n1_charge_low`): only OUTPUT_CLAMP log rows differ; commands and +claims are the same (`test_safety119.py` part 6). + +**Not hidden.** A battery that gives less than another owner told it still +alarms through SAFETY-85 rule 2. "Always counts" for an over-rating holds on +cycles the loop decided; on others SAFETY-85 rule 1 already dropped it. + +**Not changed.** The kick itself is control behaviour: for a few seconds at +a quarter's edge the loop asks up to its rail. In `test_safety119.py` part 1 +that is more discharge than the guard asked at a quarter's end, and a few +seconds of up to 500 W more charge at the next quarter's start. diff --git a/goodwe_controller/app/main.py b/goodwe_controller/app/main.py index 554b1d3..24aec7f 100644 --- a/goodwe_controller/app/main.py +++ b/goodwe_controller/app/main.py @@ -299,6 +299,14 @@ REFUSED_PROGRESS_W = _ctl.PROBE_ANSWER_W / 2 # was told over the same span as above (the plant's measured settle time), so # a healthy battery still settling on a new command is not short. SHORT_CYCLES, SHORT_SPAN_S = _ctl.SETTLE_CYCLES, REFUSED_SPAN_S +# SAFETY-119: across all hand-backs, the loop's bound is hidden on at most +# ROLLING_BUDGET cycles in any ROLLING_S seconds, fewer on a slower cycle: +# (cycle seconds up to, cycles), measured in +# DECISIONS/SAFETY-119-bound-after-hand-back.md. Without a monotonic clock +# the budget never refills. +ROLLING_S = 900.0 +ROLLING_BUDGET = ((3.5, 10), (11.0, 8), (16.0, 6), (float("inf"), 4)) +ROLLING_BOUND_CYCLES = 8 # the budget while the cycle length is unknown def _refused_interval(sign: int) -> tuple: @@ -1272,6 +1280,14 @@ class Controller: self._loop_decision = None self._asked_hist: dict = {} self._short_run = 0 + # SAFETY-119: did another owner set the wire last cycle; the window + # after a hand-back (monotonic s, the loop's cycles in a row); the + # monotonic s of the bound cycles hidden in the last ROLLING_S; the + # last cycle's monotonic s and the cycle length. + self._wire_lost = False + self._handback = None + self._hidden = () + self._settle_t, self._settle_dt = None, None self.stopping = False # SAFETY-61. time.monotonic() at the end of the last run_control() pass. self.loop_pass_mono = None @@ -5813,6 +5829,8 @@ class Controller: if d is None: self._short_run = 0 self._asked_hist = {} + self._wire_lost, self._handback = False, None + self._settle_t = None # a stop is not a cycle length return unmet = self.allocation.unmet_w if self.allocation is not None else 0 cut = (resolution.bound_by or "").split("(")[0] @@ -5838,7 +5856,9 @@ class Controller: and delivery_short(asked[inv.name], inv.batt, self.tuning.saturation_w)] self._short_run = self._short_run + 1 if short else 0 - if owns and self.loop_clamped[0]: + settling = self._settling(owns, now) + if owns and self.loop_clamped[0] and not ( + settling and not self.loop_clamped[2]): return engaged = self._short_run >= self.tuning.saturation_cycles named = len(self.inverters) > 1 @@ -5847,6 +5867,49 @@ class Controller: if engaged else "", False) self.loop_clamp_facts = () + def _settling(self, owns, now) -> bool: + """SAFETY-119: does the loop's bound on this cycle count? Not within + a settle after another owner handed the wire back: its integrator is + re-seeded from that owner's command and kicked by a meter that does + not show it yet. The settle is SHORT_CYCLES cycles and SHORT_SPAN_S + after the hand-back; losing the wire restarts it. Across all + hand-backs the bound is hidden on at most ROLLING_BUDGET[cycle + length] cycles in any ROLLING_S, so a bound that stays is counted + however often the wire changes hands. + DECISIONS/SAFETY-119-bound-after-hand-back.md.""" + def aged(t0, span): + return now is None or t0 is None or now - t0 >= span + + # The cycle length (a gap over two minutes is not one). + if now is not None and self._settle_t is not None \ + and 0.0 < now - self._settle_t <= 120.0: + self._settle_dt = now - self._settle_t + self._settle_t = now + if not owns: + self._wire_lost, self._handback = True, None + return False + if self._wire_lost: + self._wire_lost, self._handback = False, (now, 0) + if self._handback is None: + return False + tc, n = self._handback + n += 1 + self._handback = (tc, n) + if aged(tc, SHORT_SPAN_S) and n >= SHORT_CYCLES: + self._handback = None + return False + if self.loop_clamped[0] and not self.loop_clamped[2]: + kept = tuple(t for t in self._hidden if now is None or ( + t is not None and now - t < ROLLING_S)) + dt = self._settle_dt + budget = ROLLING_BOUND_CYCLES if dt is None else next( + m for up, m in ROLLING_BUDGET if dt <= up) + if len(kept) >= budget: + self._hidden = kept + return False + self._hidden = kept + (now,) + return True + async def check_output_clamp(self) -> None: """SAFETY-03. Alarm whenever a clamp actually engaged this cycle. diff --git a/goodwe_controller/test_safety119.py b/goodwe_controller/test_safety119.py new file mode 100644 index 0000000..706f08d --- /dev/null +++ b/goodwe_controller/test_safety119.py @@ -0,0 +1,667 @@ +"""Runnable check for SAFETY-119: no "Battery is not keeping up" when the +loop takes the wire back from another owner. `python3 test_safety119.py` + +During a maintenance charge with no usable peak forecast, the measured peak +guard steps in during a quarter's last seconds and hands back. On the cycle +the loop gets the wire back, its integrator is re-seeded from the other +owner's command and kicked by a meter reading taken before the battery moved. +It crossed its rail for one or two cycles, the loop's ask beat the one-sided +limit, so the cycle counted as the loop's own and raised +`goodwe_integrator_bound`. The battery gave what it was told. Now the loop's +bound does not count until the plant's settle (SHORT_CYCLES cycles and +SHORT_SPAN_S) has passed since the hand-back. Round 3: across all +hand-backs the bound is hidden on at most ROLLING_BUDGET[cycle length] cycles +(10 up to a 3.5 s cycle, 8 up to 11 s, 6 up to 16 s, 4 beyond) in any +ROLLING_S seconds, so a bound that stays warns when the guard and the charge +keep taking turns. DECISIONS/SAFETY-119-bound-after-hand-back.md. + +1. The rig's shape (1 s meter that lags the battery, 1 s battery lag, house + 800 W, rating 2500 W, limit 2500 W, margin 50, charge 2000 W, no + forecast), 2 h, three seeds: no notification, the cap held, every command + the same as without the fix; without the fix it warns. +2. A genuine integrator bound still warns: the loop in charge with the house + over the rating (at once, as before), and the loop at its rail after a + hand-back (after the settle). +3. With a usable forecast: the same commands and the same alarms as without + the fix. +4. Repeated hand-backs (N=2, the guard and the charge take turns), 2, 5, 10 + and 15 s meters: it warns (every quarter at 2, 5 and 10 s, every other + quarter at least at 15 s); the quarter-edge case stays silent at 2, 5, 10 + and 15 s, including the 2 s seed where a fixed budget of 8 warns; a start + or a blind cycle is not a hand-back; a slow meter delays by cycles. +5. The rule at its boundaries (`Controller._settling`): the settle, and the + rolling budget. +6. test_safety84's and test_safety87's re-pinned digests: the same commands + and claims; only OUTPUT_CLAMP log rows differ. + +Mutations (MUTATION.md, purged copies) are listed in the pull request. +""" + +import logging +import math +import os +import random +import sys +import time +from datetime import timedelta + +HERE = os.path.dirname(os.path.abspath(__file__)) +sys.path.insert(0, HERE) +sys.path.insert(0, os.path.join(HERE, "tools")) +logging.disable(logging.WARNING) + +import opt11_identity as rig # noqa: E402 +import safety79_identity as s79 # noqa: E402 +import safety84_identity as s84 # noqa: E402 +import app.main as app_main # noqa: E402 +from app import messages # noqa: E402 +from app.main import Controller # noqa: E402 +from app.p1 import make_sample, split_signed # noqa: E402 +from named_absence import first, nth, present # noqa: E402 + +fails = [] +OPT0 = dict(s84.OPT) +CAP = 2500.0 +QUARTER = 900.0 + + +def check(name, cond): + print(f" {'ok ' if cond else 'FAIL'} {name}") + if not cond: + fails.append(name) + + +async def _call(self, *a): + """The rig's Home Assistant, recording each notification (time, id).""" + if len(a) >= 3 and a[1] == "create" and isinstance(a[2], dict): + self.__dict__.setdefault("notes", []).append( + (self.t, a[2].get("notification_id"))) + return True + + +def _power(self, u, lag=1.0): + """The TEST-23 plant's battery: 800 W/s ramp, 1 s first-order lag.""" + st = self.__dict__.setdefault("_plant", {}) + a, tgt, tl = st.get(u, (0.0, 0.0, self.t)) + for _ in range(int(round((self.t - tl) / 0.1))): + d = self.cmd[u] - tgt + tgt += math.copysign(min(abs(d), 80.0), d) + a += (tgt - a) * (1 - math.exp(-0.1 / lag)) + st[u] = (a, tgt, self.t) + if self.cut(u, self.t) and self.cmd[u] >= -4.0: + return -4.0 + return float(round(a)) + + +_real_number, _real_power = rig._Hass.number, rig._Hass.power +_real_feed = s79._feed + + +async def _number(self, e, invert=False): + """sensor.fc: a usable demand forecast of 800 W (part 3).""" + if e == "sensor.fc": + return 800.0 + return await _real_number(self, e, invert) + + +rig._Hass.call, rig._Hass.power, rig._Hass.number = _call, _power, _number +rig.TICK = 1.0 +DELAY = [1] + + +def _feed(c, t): + """The P1 meter `DELAY` ticks behind the battery, as on the rig (the + meter reached HA after the battery reading). Records the true grid.""" + h = c.hass.__dict__.setdefault("grid_true", []) + h.append((t, c.hass.grid())) + g = h[max(0, len(h) - 1 - DELAY[0])][1] + imp, exp = split_signed(g) + c.p1.submit(make_sample("ha_signed", imp, exp, phases=1, + ingest_ts=rig.BASE + timedelta(seconds=t), + ingest_mono=time.monotonic())) + + +s79._feed = _feed + + +def house(seed, base=800.0, step=None): + """800 W +- 30 W, a new value each second; `step` = (t, W) from then.""" + rnd = random.Random(seed) + noise = [rnd.uniform(-30.0, 30.0) for _ in range(4000)] + + def load(t): + if step is not None and t >= step[0]: + return step[1] + return base + noise[int(t) % 4000] + return load + + +def run(load, *, n=1, dur=7200.0, delay=1, extra=None, cheap=True, cut=None, + charging=True, blind=0.0): + """One run of `n` inverters of 2500 W; `charging=False`: no maintenance, + the loop in charge; `blind`: no meter reading until that second.""" + extra = dict(extra or {}) + s84.OPT = dict(OPT0, peak_cap_w=int(CAP * n), peak_margin_w=50, + maintenance_charge_w=2000) + if not charging: + extra.update(maintenance_enabled=False, peak_cap_w=20000) + for k in [k for k in extra if k in s84.OPT]: + s84.OPT[k] = extra.pop(k) + DELAY[0] = delay + try: + feed = s84.feed(cheap) + + def before(c, t): + if t >= blind: # before that: no meter reading + return feed(c, t) + return s84.run(n, load=load, cheap=cheap, + store=(s79.store_charging(n) if charging + else rig._Store()), + soc=lambda u, t: 60.0, dur=dur, cut=cut, + before=before if blind else None, + extra=dict({"max_w": 2500, "slew_w": 0}, **extra)) + finally: + s84.OPT = OPT0 + + +def patched(obj, name, value): + def wrap(fn): + real = getattr(obj, name) + setattr(obj, name, value) + try: + return fn() + finally: + setattr(obj, name, real) + return wrap + + +no_fix = patched(Controller, "_settling", lambda self, owns, now: False) + + +def notes(c): + return [t for t, i in getattr(c.hass, "notes", []) + if i == messages.ID_LOOP_BOUND] + + +def quarters(c, tick=1.0): + """Each whole quarter's true average import (W).""" + q = {} + for t, g in c.hass.grid_true: + q.setdefault(int(t // QUARTER), []).append(g) + return [sum(v) / len(v) for v in q.values() + if len(v) == QUARTER / tick] + + +def commands(rows): + return [(r[0], r[1], r[2]) for r in rows] + + +def guard_steps(c): + return sum(1 for e in c.events if "PEAK_GUARD:" in e) + + +# ============================================================================ # +print("1. a maintenance charge with no forecast, the guard steps in at each " + "quarter's end, 2 h") +NEW, OLD = {}, {} +for seed, delay in ((1, 1), (2, 1), (3, 2)): + NEW[seed] = run(house(seed), delay=delay) + OLD[seed] = no_fix(lambda: run(house(seed), delay=delay)) + print(f" seed {seed} meter {delay} s behind: notifications " + f"{notes(NEW[seed][1])} (without the fix {notes(OLD[seed][1])}), " + f"highest quarter {max(quarters(NEW[seed][1])):.0f} W, guard " + f"step-ins in the last 40 log rows {guard_steps(NEW[seed][1])}") +check("⭐ no 'Battery is not keeping up' notification, cycle or episode", + all(notes(c) == [] and c.clamp_wd.bound == 0 + and c.clamp_wd.bound_episodes == 0 for _r, c in NEW.values())) +check("⭐ the peak cap is held: every quarter's average is under 2500 W", + all(len(quarters(c)) == 8 and max(quarters(c)) < CAP + for _r, c in NEW.values())) +check("⭐ control is unchanged: every command the same as without the fix", + all(commands(NEW[k][0]) == commands(OLD[k][0]) for k in NEW)) +check("...the charge ran and the guard stepped in near each quarter's end", + all(any(r[1] == -2000.0 for r in rows) and any( + r[-1][1] and r[-1][1][0] and r[0] % QUARTER >= QUARTER - 40 + for r in rows) for rows, _c in NEW.values())) +check("non-vacuous: without the fix every run warns, at a quarter's edge", + all(len(notes(c)) >= 1 for _r, c in OLD.values()) + and all(min(t % QUARTER, QUARTER - t % QUARTER) <= 40 + for _r, c in OLD.values() for t in notes(c))) + +# ============================================================================ # +print("\n2. a genuine integrator bound still warns") +_rail = run(house(1, base=4000.0), dur=600.0, + charging=False) +_rail_old = no_fix(lambda: run(house(1, base=4000.0), dur=600.0, + charging=False)) +print(f" loop in charge, house 4000 W over the 2500 W rating: " + f"{notes(_rail[1])}, without the fix {notes(_rail_old[1])}") +check("⭐ the loop in charge at its rail warns (log and notification), at " + "the same cycle as before", + len(notes(_rail[1])) >= 1 and notes(_rail[1]) == notes(_rail_old[1]) + and _rail[1].clamp_wd.bound == _rail_old[1].clamp_wd.bound + and any("OUTPUT_CLAMP episode" in e for e in _rail[1].events)) + +# The charge sets the wire until 600 s, then a solar surplus of 6000 W: the +# loop takes the wire back and stands at its -2500 W rail. +_hb = run(house(1, step=(600.0, -6000.0)), dur=1200.0, + extra={"peak_cap_w": 20000}) +_hb_old = no_fix(lambda: run(house(1, step=(600.0, -6000.0)), dur=1200.0, + extra={"peak_cap_w": 20000})) +_first = notes(_hb[1])[:1] +print(f" hand-back to a loop at its rail at 600 s: first notification " + f"{_first}, without the fix {notes(_hb_old[1])[:1]}; command at the " + f"end {_hb[0][-1][1]}") +MB = 10 # the budget at a 1 s cycle +check(f"⭐ the loop at its rail after a hand-back still warns, once " + f"{MB} of its bound cycles are hidden (1 s meter: {MB} s)", + _first and 600.0 + MB <= _first[0] <= 600.0 + MB + 4.0 + and _hb[0][-1][1] == -2500.0 + and _hb[1].clamp_wd.bound > 100) +check("...without the fix it warned at once (non-vacuous)", + notes(_hb_old[1])[:1] and notes(_hb_old[1])[0] < 600.0 + MB) +# The same charge with no forecast; at 1795 s, under the guard's step-in at +# the quarter's end, the house goes to 4000 W, over the 2500 W rating. +_up = run(house(1, step=(1795.0, 4000.0)), dur=1900.0) +_up_old = no_fix(lambda: run(house(1, step=(1795.0, 4000.0)), dur=1900.0)) +print(f" guard step-in, then the house over the rating from 1795 s: " + f"{notes(_up[1])}, without the fix {notes(_up_old[1])}") +check("⭐ a genuine bound in the rig's own scenario still warns, within the " + "settle of the guard's hand-back", + notes(_up[1]) and 1795.0 <= notes(_up[1])[0] <= 1795.0 + 40.0 + and any("OUTPUT_CLAMP episode" in e for e in _up[1].events)) + +# ============================================================================ # +print("\n3. with a usable forecast (800 W): unchanged") +FC = {"peak_forecast_entity": "sensor.fc"} +_fc = run(house(1), extra=FC) +_fc_old = no_fix(lambda: run(house(1), extra=FC)) +print(f" notifications {notes(_fc[1])} (without the fix " + f"{notes(_fc_old[1])}), highest quarter " + f"{max(quarters(_fc[1])):.0f} W, charge " + f"{min(r[1] for r in _fc[0][:300]):.0f} W") +check("⭐ the same commands and the same alarms as without the fix, and " + "the cap held", + commands(_fc[0]) == commands(_fc_old[0]) + and notes(_fc[1]) == notes(_fc_old[1]) + and _fc[1].clamp_wd.engagements == _fc_old[1].clamp_wd.engagements + and max(quarters(_fc[1])) < CAP) +check("...the forecast was used (the charge is shaped under -2000 W)", + -2000.0 < min(r[1] for r in _fc[0][:300]) < 0.0) + +# ============================================================================ # +print("\n4. repeated hand-backs: the guard and the charge take turns") + + +def round1(self, owns, now): + """Round 1's rule, kept here to show what it hid: every hand-back + restarts the window, so a loss within the settle never lets it end.""" + d = self.__dict__ + if not owns: + d["_r1"], d["_r1_n"] = True, None + return False + if d.get("_r1"): + d["_r1"], d["_r1_n"] = False, (now, 0) + if d.get("_r1_n") is None: + return False + t0, n = d["_r1_n"] + d["_r1_n"] = (t0, n + 1) + if n + 1 >= app_main.SHORT_CYCLES and ( + now is None or t0 is None or now - t0 >= app_main.SHORT_SPAN_S): + d["_r1_n"] = None + return False + return True + + +# N=2 (2 x 2500 W), a cheap-window charge, no usable forecast, the house 50 W +# over the 5000 W rating from 300 s: the loop never held the wire for more +# than 10 cycles. Round 1: no notification in 2 h; round 2: none at 10 s or +# 15 s meters. +def never(tick, hw=5050.0, fix=True): + rig.TICK = tick + try: + f = lambda: run(house(1, step=(300.0, hw)), n=2) + return f() if fix else no_fix(f) + finally: + rig.TICK = 1.0 + + +def per_quarter(c): + return [sum(1 for t in notes(c) if int(t // QUARTER) == q) + for q in range(8)] + + +_nv = {t: never(t) for t in (2.0, 5.0, 10.0, 15.0)} +_nv_old = {t: never(t, fix=False) for t in (2.0, 5.0, 10.0, 15.0)} +_nv_r1 = patched(Controller, "_settling", round1)(lambda: never(5.0)) +for _t in _nv: + print(f" N=2, {_t:.0f} s meter, house 5050 W: notifications " + f"{len(notes(_nv[_t][1]))} (per quarter " + f"{per_quarter(_nv[_t][1])}), without the fix " + f"{len(notes(_nv_old[_t][1]))}, highest quarter " + f"{max(quarters(_nv[_t][1], _t)):.0f} W") +print(f" round 1's rule at 5 s: {len(notes(_nv_r1[1]))}") +check("⭐ 2 s and 5 s meters: it warns in every quarter after the first", + all(per_quarter(_nv[t][1])[q] >= 1 for q in range(1, 8) + for t in (2.0, 5.0))) +check("⭐ 10 s meter: it warns in every quarter after the first (round 2 " + "gave none)", + all(per_quarter(_nv[10.0][1])[q] >= 1 for q in range(1, 8))) +check("⭐ 15 s meter: it warns at least every other quarter after the first " + "(round 2 gave none)", + not any(a == 0 and b == 0 for a, b in zip( + per_quarter(_nv[15.0][1])[1:], per_quarter(_nv[15.0][1])[2:]))) +check("non-vacuous: round 1's rule (a window per hand-back) never warned " + "here, and the fix still hides some of what was raised without it", + notes(_nv_r1[1]) == [] and all( + _nv[t][1].clamp_wd.bound < _nv_old[t][1].clamp_wd.bound + for t in _nv)) +check("...every command is the same as without the fix, at 2, 5, 10 and " + "15 s", + all(commands(_nv[t][0]) == commands(_nv_old[t][0]) for t in _nv)) +check("...and at 5 s the cap held", + len(quarters(_nv[5.0][1], 5.0)) == 8 + and max(quarters(_nv[5.0][1], 5.0)) < 5000.0) + +# The quarter-edge case (part 1) at the slower meters: still no warning. +# The meter's own lag limits the cap there, the same with and without the fix. +_qe = {} +# Seeds 1 to 3 are the brief's fixed set; 2 s seed 25 is the one where the +# sweep's fixed budget of 8 warned (DECISIONS), kept here so that stays seen. +for _t in (2.0, 5.0, 10.0, 15.0): # with part 1: 1, 2, 5, 10, 15 s + rig.TICK = _t + for _seed, _dl in ((1, 1), (2, 1), (3, 2)) + ( + ((25, 2),) if _t == 2.0 else ()): + _qe[_t, _seed] = (run(house(_seed), delay=_dl), + no_fix(lambda: run(house(_seed), delay=_dl))) + rig.TICK = 1.0 + print(f" {_t:.0f} s meter, quarter edge: notifications " + f"{[len(notes(r[0][1])) for k, r in _qe.items() if k[0] == _t]} " + f"(without the fix " + f"{[len(notes(r[1][1])) for k, r in _qe.items() if k[0] == _t]})") +check("⭐ the quarter-edge case at 2, 5, 10 and 15 s meters, seeds 1 to 3 " + "and (2 s) 25: no notification", + all(notes(r[0][1]) == [] and r[0][1].clamp_wd.bound == 0 + for r in _qe.values())) +check("...every command the same as without the fix; without it the false " + "alarm is there at each meter (non-vacuous)", + all(commands(r[0][0]) == commands(r[1][0]) for r in _qe.values()) + and all(any(len(notes(_qe[_t, k][1][1])) >= 1 for k in (1, 2, 3)) + for _t in (2.0, 5.0, 10.0, 15.0))) +rig.TICK = 2.0 +_q25_8 = patched(app_main, "ROLLING_BUDGET", ((math.inf, 8),))( + lambda: run(house(25), delay=2)) +rig.TICK = 1.0 +print(f" 2 s meter, seed 25, a fixed budget of 8: notifications " + f"{notes(_q25_8[1])}") +check("...2 s seed 25 is the sweep's known case: a fixed budget of 8 warns " + "there (why the budget follows the cycle length)", + len(notes(_q25_8[1])) >= 1) +check("the budget is the one the sweep chose. Changing it means re-running " + "the sweep in DECISIONS/SAFETY-119-bound-after-hand-back.md", + app_main.ROLLING_BUDGET == ((3.5, 10), (11.0, 8), (16.0, 6), + (math.inf, 4)) + and app_main.ROLLING_BOUND_CYCLES == 8 and app_main.ROLLING_S == 900.0) + +# A start, or a blind cycle, is not a hand-back: the loop at its rail after +# 20 s of not running warns at once (R2: a restart counted as a hand-back). +_bl = run(house(1, base=4000.0), dur=120.0, charging=False, blind=20.0) +_bl_old = no_fix(lambda: run(house(1, base=4000.0), dur=120.0, + charging=False, blind=20.0)) +print(f" the loop not running until 20 s, then at its rail: " + f"{notes(_bl[1])}, without the fix {notes(_bl_old[1])}") +check("⭐ a start after a blind spell is not a hand-back: it warns at the " + "same cycle as without the fix", + notes(_bl[1])[:1] and 20.0 <= notes(_bl[1])[0] <= 26.0 + and notes(_bl[1]) == notes(_bl_old[1])) + +# The budget is cycles, not seconds (R4): at a 5 s meter the loop at its +# rail after a hand-back warns 8 cycles (40 s) later, not 8 s. +MB = 8 # the budget at a 5 s cycle +rig.TICK = 5.0 +_sl = run(house(1, step=(600.0, -6000.0)), dur=900.0, + extra={"peak_cap_w": 20000}) +rig.TICK = 1.0 +_sl1 = [t for t in notes(_sl[1]) if t >= 600.0][:1] +print(f" 5 s meter, hand-back to a loop at its rail at 600 s: first " + f"notification {_sl1}") +check(f"⭐ at a 5 s meter the budget is cycles, not seconds: the first " + f"warning comes {MB} cycles ({MB * 5} s) after the hand-back", + _sl1 and 600.0 + MB * 5.0 <= _sl1[0] <= 600.0 + MB * 5.0 + 10.0) + +# ============================================================================ # +print("\n5. the rule at its boundaries") + + +class _C: + _settling = Controller._settling + + def __init__(self): + self._wire_lost, self._handback, self._hidden = False, None, () + self._settle_t, self._settle_dt = None, None + self.loop_clamped = (False, "", False) + + +def seq(c, steps): + """(owned, time[, the loop's bound that cycle]) -> does it count not.""" + out = [] + for st in steps: + c.loop_clamped = (len(st) > 2 and st[2], "", False) + out.append(c._settling(st[0], st[1])) + return out + + +N, SPAN = app_main.SHORT_CYCLES, app_main.SHORT_SPAN_S +M, ROLL = 8, 900.0 # the chosen budget, written out on purpose +_c = _C() +check("from the start, owned every cycle: never settling (no hand-back)", + seq(_c, [(True, float(i)) for i in range(30)]) == [False] * 30) +_c = _C() +_out = seq(_c, [(False, 0.0)] + [(True, 2.0 * i) for i in range(1, N + 3)]) +check(f"after another owner: settling for {N - 1} owned cycles, then not " + f"(12 cycles at 2 s span {SPAN:.0f} s)", + _out == [False] + [True] * (N - 1) + [False] * 3) +_c = _C() +_out = seq(_c, [(False, 0.0)] + [(True, 0.5 * i) for i in range(1, 60)]) +_end = _out.index(False, 1) if False in _out[1:] else -1 +check(f"at a 0.5 s meter the span decides: settling until {SPAN:.0f} s", + _end == 1 + int(SPAN / 0.5) and all(_out[1:_end])) +_c = _C() +_out = seq(_c, [(False, 0.0), (True, 2.0), (True, 4.0), (False, 6.0), + (True, 8.0), (True, 10.0)]) +check("losing the wire again restarts the settle", + _out == [False, True, True, False, True, True] + and _c._handback == (8.0, 2)) +_c = _C() +check("no monotonic clock: the cycle count alone decides", + seq(_c, [(False, None)] + [(True, None)] * (N + 1)) + == [False] + [True] * (N - 1) + [False] * 2) + +# The rolling budget: the loop's bound is hidden on at most M cycles in any +# ROLL seconds, across all hand-backs. T = the loop's bound that cycle. +assert M < N - 1, "the budget is meant to run out inside one settle" + + +def turns(c, tick, lost, periods, first=0.0, bound=True): + """A hand-back, then `periods` x (1 owned cycle with the loop's bound, + `lost` cycles away). Returns [(time, hidden)] of the owned cycles.""" + t, out = first, [] + for _ in range(lost): + c._settling(False, t) + t += tick + for _ in range(periods): + c.loop_clamped = (bound, "", False) + out.append((t, c._settling(True, t))) + t += tick + for _ in range(lost): + c._settling(False, t) + t += tick + return out, t + + +_c = _C() +_o = seq(_c, [(False, 0.0)] + [(True, 5.0 * i, True) for i in range(1, N)]) +check(f"one hand-back at 5 s, the bound on every cycle: {M} are hidden, " + f"then it counts for the rest of the settle ({N - 1} cycles)", + _o == [False] + [True] * M + [False] * (N - 1 - M)) +_c = _C() +_o, _ = turns(_c, 5.0, 3, 60) +_hid = [t for t, h in _o if h] +check(f"across hand-backs (one bound cycle per turn, 5 s): the first {M} " + "are hidden, then every one counts", + [h for _t, h in _o[:M + 5]] == [True] * M + [False] * 5) +check(f"...never more than {M} hidden in any {ROLL:.0f} s, and they come " + f"back as the oldest ages out (exactly {M} in the first {ROLL:.0f} s " + "after the first)", + all(sum(1 for x in _hid if t <= x < t + ROLL) <= M for t in _hid) + and sum(1 for x in _hid if x < _hid[0] + ROLL) == M + and any(x >= _hid[0] + ROLL for x in _hid)) +_c = _C() +_c._hidden = (0.0,) * M +_c._wire_lost, _c._handback = False, (ROLL - 30.0, 0) +_c.loop_clamped = (True, "", False) +_a = _c._settling(True, ROLL - 1.0) +_c.loop_clamped = (True, "", False) +_b = _c._settling(True, ROLL) +check(f"the budget refills {ROLL:.0f} s after the oldest hidden cycle: " + f"counted at {ROLL - 1:.0f} s, hidden again at {ROLL:.0f} s", + _a is False and _b is True) +_c = _C() +_o1, _t = turns(_c, 2.0, 3, 20) +for _ in range(N): # the wire away a whole settle + _c._settling(False, _t) + _t += 2.0 +_o2, _ = turns(_c, 2.0, 3, 5, first=_t) +check("the budget is not per hand-back or per run: after a whole settle " + "with the wire away, a new hand-back within the same " + f"{ROLL:.0f} s hides nothing more", + [h for _t2, h in _o1[:M]] == [True] * M + and not any(h for _t2, h in _o2)) +_c = _C() +_o1, _t = turns(_c, 2.0, 3, 20) +_ = [_c._settling(True, _t + 2.0 * i) for i in range(N + 1)] +_c._settling(False, _t + 40.0) +_c.loop_clamped = (True, "", False) +check("the loop holding the wire a whole settle ends the window: the next " + "hand-back hides nothing more while the budget is spent", + _c._settling(True, _t + 42.0) is False) +_c = _C() +_c._wire_lost = True +_t = 0.0 +for _ in range(M + 4): # an over-rating: always counts + _c.loop_clamped = (True, "", True) + _c._settling(True, _t) + _c._wire_lost = True + _t += 5.0 +_c._settling(False, _t) +_c.loop_clamped = (True, "", False) +check("an over-rating does not use up the budget", + _c._settling(True, _t + 5.0) is True and len(_c._hidden) == 1) + +# The budget follows the cycle length: bound cycles hidden before the first +# one counts, one hand-back per turn. +_bud = {} +for _tick in (1.0, 2.0, 3.0, 5.0, 10.0, 15.0, 20.0, 30.0, 60.0): + _c = _C() + _o, _ = turns(_c, _tick, 1, min(14, int(880.0 // (2 * _tick)))) + _bud[_tick] = sum(1 for _t2, h in _o if h) +print(f" hidden before the first counts, by cycle length: {_bud}") +check("the budget by cycle length: 10 at 1-3 s, 8 at 5-10 s, 6 at 15 s, 4 " + "at 20-60 s", + _bud == {1.0: 10, 2.0: 10, 3.0: 10, 5.0: 8, 10.0: 8, 15.0: 6, + 20.0: 4, 30.0: 4, 60.0: 4}) +_c = _C() +_o, _t = turns(_c, 2.0, 3, 8) +_o2, _ = turns(_c, 121.0, 1, 3, first=_t + 119.0) +check("a gap over two minutes is not a cycle length: the 2 s budget (10) " + "stays", + [h for _t2, h in _o + _o2] == [True] * 10 + [False]) + +# No monotonic clock: the budget cannot refill, so a bound that stays is +# counted after the budget however often the wire changes hands. +_c = _C() +_nc = [] +for _ in range(40): + for _ in range(3): + _c._settling(False, None) + _c.loop_clamped = (True, "", False) + _nc.append(_c._settling(True, None)) +check("no monotonic clock, repeated hand-backs: the budget holds (8 hidden, " + "then every bound counts)", _nc == [True] * M + [False] * (40 - M)) + +# An over-rating (a command over `max_w`) is a bug, never settled away. +_ctl = _hb[1] +_ctl.loop_clamped = (True, "x", True) +_ctl._wire_lost, _ctl._handback, _ctl._hidden = True, None, () + + +class _Res: + winner, bound_by, target_w = "loop", "", 0.0 + unit_bounds = {} + + +class _D: + held, target_w = False, 0.0 + + +_ctl._loop_decision, _ctl.allocation = _D(), None +_ctl._loop_alarm_input(_Res()) +check("an over-rating on a hand-back cycle still counts (bug=True kept)", + _ctl.loop_clamped == (True, "x", True) and _ctl._handback is not None) +_ctl.loop_clamped = (True, "y", False) +_ctl._loop_alarm_input(_Res()) +check("...while the integrator bound on the next cycle is not counted", + _ctl.loop_clamped[0] is False) + +_ctl._wire_lost, _ctl._handback = True, (1.0, 3) +_ctl._loop_decision = None # stopped or blind +_ctl._loop_alarm_input(_Res()) +check("a stop clears it: the next start is not a hand-back, and the stop " + "is not a cycle length", + (_ctl._wire_lost, _ctl._handback, _ctl._settle_t) + == (False, None, None)) + +# ============================================================================ # +print("\n6. the pinned digests of test_safety84 and test_safety87: only the " + "log changes") +# Those harnesses run at the 5 s tick with a battery that follows at once. +rig._Hass.power, rig.TICK, s79._feed = _real_power, 5.0, _real_feed +rig._Hass.number = _real_number +import safety87_identity as s87 # noqa: E402 + +RUNS = dict({f"s84 {k}": (lambda v=v: s84.run(**v)) + for k, v in s84.SCENARIOS.items()}, + **{f"s87 {k}": (lambda v=v: s87_run(v)) + for k, v in s87.SCENARIOS.items()}) + + +def s87_run(v): + v = dict(v) + return s84.run(1, dur=s87.DUR, store=s87.store(v.pop("store", None)), **v) + + +_moved, _gone = [], 0 +for k, fn in RUNS.items(): + new, old = fn()[0], no_fix(fn)[0] + same = all(a[:-1] == b[:-1] and a[-1][:4] == b[-1][:4] + for a, b in zip(new, old)) and len(new) == len(old) + logs = {e for r in old for e in [r[-1][5]] if e} - { + e for r in new for e in [r[-1][5]] if e} + _gone += len(logs) + if not same or any("OUTPUT_CLAMP episode" not in e for e in logs): + _moved.append(k) + print(f" {k}: commands and claims " + f"{'the same' if same else 'DIFFER'}, log rows differ {len(logs)}, " + f"digest {s84.digest(new)[:16]}") +check("⭐ in all twelve, every command, loop field, claim, guard decision " + "and phase is the same as without the fix; the only log rows that " + "differ are OUTPUT_CLAMP rows (gone, or a lower count)", + not _moved and _gone > 0) + +print() +if fails: + print(f"FAILED: {len(fails)} check(s)") + for f in fails: + print(f" - {f}") + sys.exit(1) +print("all SAFETY-119 checks passed") diff --git a/goodwe_controller/test_safety84.py b/goodwe_controller/test_safety84.py index 9fc4502..e239b37 100644 --- a/goodwe_controller/test_safety84.py +++ b/goodwe_controller/test_safety84.py @@ -472,19 +472,22 @@ print("\n8. the N=1 and N=2 digests") # charge pin stands. n2_charge and _banked change only the loop's reason and # claim on 2 cycles; n2_charge_dear changes commands on 98 cycles, where A's # pin lifts (t=1800) and B no longer jumps 1390 W, and after the surplus step. +# SAFETY-119 re-pinned all six: only the log. OUTPUT_CLAMP rows from the +# loop's bound just after the guard hands back are gone; every command and +# claim is the same (test_safety119.py part 6). PINNED = { "n1_charge": - "0ed25c856456b97acb07a39299a8cb7b1a762c4d0005b88a0823c03057a80be5", + "19781f90b9751b10994dedeaafb38e42d48ad2551640792e601336b7f9b5bb4f", "n1_charge_dear": - "c25340b56060d4581f7204e200b07e7c8618711be2baca3b1667b7ebeb600dc3", + "eeeb0fa19a6fdc04d44a0838bb2bb911f506a936b0f93d8a6f4d87159053ec74", "n1_charge_banked": - "2619acdd06b04e56c000b168d64e1d044346c6ba3f929c94258d6ad8189ec609", + "a51f125a8c1c98fdbb009fce72b6781d20d384bdf0f5ce7bbfe367d86e5477db", "n2_charge": - "b16d692128f14bcce3d87b142d290e0d6b13724289680e44a05215c9eaa24a7c", + "e37e98390baa5dad9128991fabf8b170894395fe026d8a33c8a51de7ed0789cc", "n2_charge_dear": - "00a197d89a5dd1e8b3ae6a5d1af66329a4dc4850476569c5931c125fa4d9eaee", + "7727372de423f62d77b4426a7226eae31a30f3bb89a3cf70272cc7c1823d7263", "n2_charge_banked": - "a6973faea916e4c88ca1770047f94478346eeb1efa4889b154fad0747f91267f", + "c77e26006c026b953e9c3dcc9a02f3993589f885cb52c7cbceac6bd59b600551", } _now = s84.digests() for k in PINNED: @@ -492,7 +495,8 @@ for k in PINNED: f"{_now[k][:16]}") check("⭐ at N=1 a charge in and out of a cheap window and under a banked " "month peak is byte-identical to 9d5b7d1 (commands, reasons and every " - "claim), and N=2 outside a cheap window matches its SAFETY-85 pin", + "claim; the log as re-pinned by SAFETY-119), and N=2 outside a cheap " + "window matches its SAFETY-85 pin", all(_now[k] == PINNED[k] for k in ("n1_charge", "n1_charge_dear", "n1_charge_banked", "n2_charge_dear"))) diff --git a/goodwe_controller/test_safety87.py b/goodwe_controller/test_safety87.py index 0f3309d..6f0229a 100644 --- a/goodwe_controller/test_safety87.py +++ b/goodwe_controller/test_safety87.py @@ -518,17 +518,21 @@ check("...a stopped controller still says so: the peak alarm does not take " # ============================================================================ # print("\n9. N=1 is byte-identical to release/1.0 b8ddfd7") +# SAFETY-119 re-pinned n1_crossing, n1_above and n1_charge_low: only the +# log. The loop's bound just after a hand-back is not counted, so OUTPUT_CLAMP +# rows are gone or count fewer; every command and claim is the same +# (test_safety119.py part 6). PINNED = { # tools/safety87_identity.py on b8ddfd7 "n1_under": "d2395ef8d74fb23607ad864d5a4bf62c03044bbd9367e873675d7ad10e8c169f", "n1_crossing": - "97f7321017d9d34ee17a40dfd4abf73d915f25b9faef086a483d2b5cd124b198", + "20f8e542c1ee3eb3a58c8fd6ba3b3e5b6b1486800cd63b675abc68bc222a172b", "n1_above": - "45726a285aa84f40542d56482652397c3c1e212ba4fe2009f6cc52f537ccad52", + "3a79f1394b2b49fa88f3c054da1d9da450153ad5f0d2a2c2f960d02a7abe2208", "n1_under_banked": "a2876c7cc873bc4c974d2b4bd98e23bba2d007b84545587d2fe0b713b0a6249b", "n1_charge_low": - "91336e3c0314985a3b00f314c79b5ffb5a740d218de3ad44f88a4db6e4235b32", + "2e1ee6db0d4f9f18836c4cbbe406fddd496656b54b97f329da513a1591f0ce6c", "n1_hold": "0a1df347754c69166b20d04c15ee878bbcefb02abb824b9b452334f68f03e46d", } @@ -536,8 +540,9 @@ _now = s87.digests() for k in PINNED: print(f" {k} {'same' if _now[k] == PINNED[k] else 'DIFFERS'}") check("⭐ every N=1 digest (claims, commands, the guard's decision and the " - "log) equals b8ddfd7's, under, crossing and above the reserve, in a " - "charge and a HOLD, and under a banked peak", + "log) equals b8ddfd7's (the log as re-pinned by SAFETY-119), under, " + "crossing and above the reserve, in a charge and a HOLD, and under a " + "banked peak", _now == PINNED) # ============================================================================ #