goodwe-addon/goodwe_controller/DECISIONS/SAFETY-73-refusal-per-inverter.md

SAFETY-73 - a battery that refuses, with two or more inverters

Decided 2026-09-27 by the owner, on the phase A plan (option R). All four new questions answered yes. SAFETY-52's four decisions carry over.

The defect

SAFETY-52 held a refusing battery at 0 W at one inverter only. At N>1 (main.py passed refused=None) nothing closed a unit that gives ~0 W while its state of charge reads above its configured cut-out, so the allocator kept handing it its weighted half. Measured on the real Controller, two units, house 3000 W, A cut out:

register	law	B gives	grid	A's gate trips / h
flat -4 W	old	533 W	+2471 W	46 (each stops the whole site)
flat -4 W	new	2000 W (its rating)	+1004 W	1
jitter	old	1910 W	+1094 W	0
jitter	new	2000 W	+1004 W	0

House 1200 W, which B alone carries: old +671 W (flat) and +284 W (jitter) standing import, new -16 W. Both cut out: old keeps asking two empty batteries (+1910 W each on the jitter shape), new holds the site at 0 W.

What was decided

1. A refusing unit is closed in that direction by its own P_SAFETY unit claim, source refused. It engages when the unit gives under REFUSED_BELOW_W (100 W) for SETTLE_CYCLES (12) cycles, spanning at least REFUSED_SPAN_S (22 s), in one direction while asked more than PROBE_W (200 W), or when its stale-reading gate trips on a held reading under 100 W. The allocator then hands its share to the others within their own limits (owner decision 1). It is a hard unit limit that always intersects, so OPT-11's P_MODE layer fits inside it.
2. It binds every strategy's ask on that unit (decision 2): peak guard, arbitrage and maintenance are placed around it like the loop.
3. A refusal to give power above the configured cut-out logs INFO plus one WARNING ending in REFUSES_ABOVE_CUT_OUT (decision 3). SAFETY-42/43 no longer report such a unit: its share is 0 W, and account() treats it as parked.
4. All units refusing the same way pass that sign to compute(), so the site holds 0 W with SAFETY-52's law (decision 4). Probes go one unit at a time.
5. Probe: every 15 min for 34 s the claim becomes a pin at +-200 W and the others carry the rest. The pin stands only while the resolved site target asks at least 200 W its way; otherwise it would make a sibling take the opposite direction, so it falls back to the closed limit for that cycle.
6. Exits: a reading of 100 W or more in the held direction (probe or not); 100 W or more taken the other way for 12 cycles (charge at the floor; one cycle of the loop overshooting through zero is not enough); stop or start. On every exit the site target and integrator restart from the watts on the wire, or the reopened unit is handed a parked remainder at once.

Why 200 W and not saturation_w. A unit's share is often small: a 400 W night load split two ways asks 200 W of each. With 500 W the empty battery kept a phantom share that SAFETY-43's relative arm then reported as not delivering, the ERROR decision 3 replaces. Shares of 200 W or less that give under 100 W are "too small to call" in account(): the sibling covers the meter and nothing is asked of the empty battery that matters.

Why one direction throughout. On TEST-19's flapping family a command that swaps sign each cycle reads ~0 through the plant's lag: 42 engagements in 21 no-fault runs without the rule, 0 with it.

N=1 is unchanged. Every SAFETY-73 path is gated on len(inverters) > 1. test_refusal_units.py part 6 runs SAFETY-52's whole suite with every SAFETY-73 method made to raise.

Evidence

• test_refusal_units.py: cases a, b and c on both register shapes against the old behaviour, probes and their spacing, one-at-a-time probing, the recovery reseed, each exit, the small-ask and small-site-target cases, the WARNING, the status row and shadow mode. Mutations U1-U13 in its docstring.
• No false engagements. TEST-19's no-fault campaign (admin/goodwe sim/delivery_window.py families, 2640 runs at N=2 and 2640 at N=1, every unit executing its share) graded with the engage clause: 0 engagements, the longest qualifying streak 5 cycles against 12. The grader is goodwe-session/scratch_s73/s73_nofault.py.
• Recovery. Case a, A recovering into a house that fell below the parked target: worst grid +0 W with the reseed. Phase A measured -1059 W without the reseed and the site hold.

Review changes

• The evidence must span 22 s, not only 12 cycles. At a 1 s meter the 12 cycles were 11 s, shorter than a healthy reading's lag (dead time plus a 10-17 s publish). The reviewer's harness (real Controller, both units with 6 s dead time and a 13-17 s publish, load steps 300/3000 W every 2 min) then refused both healthy units 10-16 times an hour, and each time the site held 0 W: +50-85 Wh import an hour and a +4.6 kW grid peak against +3.7 kW without the refusal. At a 2 s tick there were none. REFUSED_SPAN_S is (SETTLE_CYCLES - 1) * LOOP_TICK_S, so 2 s and slower ticks are unchanged.
• The cut-out WARNING is for a refusal to give power only. A full battery that stops taking charge is always above its cut-out level, and the WARNING told the installer to check a setting that has nothing to do with it.

Not covered

• A unit that gives a steady part of its ask (100 W or more) is a limit, as at N=1. SAFETY-42/43 still report it.
• pack_permissions stays SoC-based, so the peak guard may size a shave with a refusing battery counted. The shortfall shows as unmet_w.
• A wedged unit (HW-01) reading ~0 W is now shown as a refusal, not reported as not delivering. Its share still moves, which is the gain SAFETY-42 measured.