feat(falcon): v1.120 — sag-compensated coulomb-counted battery state (BATTERY-P02) - #278
Merged
Conversation
…(BATTERY-P02) Raw pack voltage lies in both directions: a throttle punch sags a half-full pack through the failsafe threshold, and a rebounding spent pack hides a genuine emergency. New relay-batt engine + supervisor wiring make the failsafe act on the ESTIMATED state instead: - relay-batt: coulomb-counted consumption (drift-bounded), online internal-resistance estimate from V/I steps, sag-compensated resting voltage, conservative min-fusion of coulomb and OCV SoC, debounced LATCHED low/critical flags, and a FLAGGED voltage-only fallback with wider per-cell margins when current sensing is absent. SYS_STATUS battery mapping helper (mV/cA/%, health bit). Kani BATT-K01..K03 (sanitize totality; latch never clears; no trip without excursion); f32 arithmetic proptest-gated per the relay-rc split. In kani.yml. - falcon-core: FlightBackend::read_battery_i seam (default None); SimBackend exposes a current sense physically consistent with its sag model (I = 12.5·collective A at R = 24 mΩ) plus a scriptable battery_i for tests; FlightSupervisor runs the estimator every step — failsafe trigger and pre-arm battery_ok are estimator-driven; battery() getter is the telemetry seam. LoggingBackend forwards the current sense (TickRecord schema-v2 follow-up: #277). - Supervisor-level sag oracle: a 300 A punch sagging the terminal to 8.2 V (far below the old 14 V raw threshold) does NOT trip; the same voltage sustained at rest DOES. Endurance-drain + pre-arm tests now run through the estimator (compensated and fallback paths). falcon-core 49 + relay-batt 9 tests green; clippy -D warnings clean; rivet validate PASS. SWREQ-FALCON-BATTERY-P02 → implemented (verify PR follows per the two-commit rule). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HvusAXYbHLyv3uTzfBcMbG
avrabe
added a commit
that referenced
this pull request
Jul 16, 2026
…ry state (#279) Code-free promotion per the two-commit rule. Evidence on merged main (6bb6ebd, impl PR #278 merged on a 58/58 green rollup): - Sag criterion at estimator AND supervisor level (300 A punch to 8.2 V: no trip; same voltage at rest: trips). - Coulomb error measured < 2% over a simulated 20-min noisy flight. - Flagged voltage-only fallback with wider margins; SYS_STATUS health bit clears. - Kani BATT-K01..K03 verified; relay-batt enrolled in kani.yml at birth. New FV-FALCON-BATTERY-002 (id-grepped free; -001 taken). SWREQ-FALCON-BATTERY-P02: implemented → verified. Claude-Session: https://claude.ai/code/session_01HvusAXYbHLyv3uTzfBcMbG Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Verify-Filter: (has-tag "v1.120")
Implements BATTERY-P02 (→
implemented; verify PR follows per the two-commit rule) — the PX4BAT1_R_INTERNAL/ ArduPilot sag-compensated-failsafe parity gap: today the supervisor failsafe compares raw voltage, so a throttle punch can false-trigger RTL and a rebounding spent pack can hide.What lands
New engine
relay-batt(no_std, pure, forbid(unsafe)):v + i·R).degradedflag, surfaced via the SYS_STATUS mapping helper (health bit clears).falcon-core wiring:
FlightBackend::read_battery_iseam (defaultNone— no breakage; jess binds the PM02D ADC).battery_ifor tests.FlightSupervisorruns the estimator every step; the low-battery failsafe trigger and the pre-arm battery check are now estimator-driven;battery()getter is the telemetry seam.Requirement criteria → oracles
sag_punch_does_not_trip_supervisor_failsafe); the same voltage at rest trips.Existing endurance-drain and pre-arm tests now run through the estimator (compensated and fallback paths respectively); the fixed-voltage failsafe test extended past the 2 s debounce — the sustained-excursion requirement is the point of the slice.
Gates
cargo test -p relay-batt -p falcon-core: 9 + 49 pass, 0 fail.cargo kani(relay-batt): 3/3 harnesses verified.-D warningsclean;rivet validatePASS.🤖 Generated with Claude Code
https://claude.ai/code/session_01HvusAXYbHLyv3uTzfBcMbG