glenn schrooyenandClaude
e76c70ecb0
A hand-back used to restart the window, so a guard and a charge taking turns hid the loop's integrator bound for good (0 warnings in 2 h; 28 before the fix). A run of hand-backs (the wire away less than a settle between them) now hides the bound for at most 11 bound cycles and 22 s in all, then it counts. The quarter-edge kick stays hidden. No command or text changes. Tests for the two reviewer mutants that only unit checks caught (a restart counted as a hand-back; span only), DECISIONS gives the delay at 2 s, 5 s and 60 s. test_safety87.py:543 shortened. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Bdqr7PiaHcBnzPituu2yTC
3.2 KiB
SAFETY-119 - no "not keeping up" when the loop takes the wire back
Status: for review. Tests: test_safety119.py.
Cause. When another owner (the peak guard, a maintenance charge) has set
the wire and the loop wins again, cycle() re-seeds the integrator from that
owner's command, and compute() adds gain * error from a meter that does
not show that command yet. On the TEST-23 rig (SAFETY-118 I-2) the guard
stepped from -2000 W to +429 W with 5 s left. A cycle later the loop's ask
crossed the +2500 W rail and beat the guard's floor, so SAFETY-85 rule 1
counted it as the loop's own bound and raised goodwe_integrator_bound. The
battery gave what it was told, and the cap held.
Decision. After a hand-back, the loop's integrator bound is not counted
until the plant's settle has passed (SHORT_CYCLES cycles and
SHORT_SPAN_S, the window SAFETY-85 grades a battery on). After that it
counts as before. An over-rating (clamped, a bug) on a cycle the loop
decided always counts. No command changes, and no text was added or changed.
One window per run of hand-backs (round 2). A run is hand-backs with the wire away less than a settle (12 cycles and 22 s) between them. It ends when the loop holds the wire, or the wire is away, a whole settle in a row. Each hand-back restarts the settle, but a run hides the bound for at most 11 bound cycles and 22 s in all. Round 1 restarted the window at every hand-back, so a guard and a charge taking turns hid the bound for good (0 warnings in 2 h where 28 were raised before). Now a bound that stays warns after at most 11 of its cycles, however often the wire changes hands.
Delay. The first counted bound cycle, from the hand-back (worst case):
| meter | one hand-back | repeated hand-backs |
|---|---|---|
| 2 s | 22 s | 264 s |
| 5 s (default) | 55 s | 660 s |
| 60 s | 660 s | 7920 s |
One hand-back: 11 cycles, never less than 22 s. Repeated: the worst case is one bound cycle per turn with the wire away 11 cycles between (22 at 1 s), so 11 turns. It grows with the meter; it stays under a quarter (900 s) up to a 5 s meter. Measured: N=2, 5 s meter, cheap-window charge, no usable forecast, house 50 W over the 5000 W rating: 14 warnings in 2 h (two in each quarter after the first), 0 with round 1, 28 without any rule. The cap held.
Kept. The loop in charge at its rail warns on the same cycle as before.
The start and a restart after a stop are not hand-backs. The quarter-edge
kick of test_safety119.py part 1 stays hidden (0 warnings in 2 h).
Re-pinned. test_safety84 (all six) and test_safety87 (n1_crossing,
n1_above, n1_charge_low): only OUTPUT_CLAMP log rows differ; commands and
claims are the same (test_safety119.py part 6).
Not hidden. A battery that gives less than another owner told it still alarms through SAFETY-85 rule 2. "Always counts" for an over-rating holds on cycles the loop decided; on others SAFETY-85 rule 1 already dropped it.
Not changed. The kick itself is control behaviour: for a few seconds at
a quarter's edge the loop asks up to its rail. In test_safety119.py part 1
that is more discharge than the guard asked at a quarter's end, and a few
seconds of up to 500 W more charge at the next quarter's start.