Claude
8953be0362
The 0 W of shutdown and of the Stop button now waits (bounded, 2 s) for a write already on its way to the same unit, for every driver, GoodWe included. Once shutdown has begun, cycle, heartbeat and safety-stop writes are dropped right before the write is created. One shared wait (_await_inflight) serves the 0 W and SMA-10's _release_last. Co-Authored-By: Claude <noreply@anthropic.com>
22 lines
1.1 KiB
Markdown
22 lines
1.1 KiB
Markdown
# SAFETY-137 - the shutdown 0 W is the last write every unit hears
|
|
|
|
SMA-10 made a hand-back release wait for a write already on its way
|
|
(`_release_last`, `Inverter.inflight`). A GoodWe unit skipped that, and rig 5b
|
|
saw a cycle write (-2 823 W) land after the shutdown 0 W and stay until relaunch.
|
|
|
|
Now the 0 W of shutdown and of the Stop button is a *last* write
|
|
(`_write_unit(last=True)`), for every driver:
|
|
|
|
- It first waits, at most `SETTLE_BUDGET_S` (2 s), for the writes already on
|
|
its way to that unit (`_await_inflight`, shared with `_release_last`). A hung
|
|
write is not waited out and not cancelled; the 0 W goes anyway.
|
|
- Once shutdown has begun (`stopping`), every other write (cycle, heartbeat,
|
|
safety stop) is dropped at the same place, right before the write is created.
|
|
That is the gate that keeps the control cycle quiet; the cycle itself needs
|
|
no cancelling.
|
|
- Worst case for a GoodWe unit is 2 s + `WRITE_BUDGET_S` (4 s) = 6 s, the same
|
|
as `HAND_BACK_WORST_S`; the units are handled together.
|
|
|
|
Not touched: the heartbeat's own timing, safety-stop paths, the maintenance
|
|
abort (still a plain 0 W).
|