# Temperature Control Profile Recovery and Steady-State Regulation Workpackage

Disposition: abandoned by owner; unfinished completion gates are not passed

Status: deferred by owner; current Controller A live profile is valid, while persistence and all heater/chamber behavior remain unproven
Type: workpackage
Updated: 2026-09-23
Next Action: none; retained as history; any new execution requires a new explicit owner instruction
Campaign Reason: Deferred delivery detail for campaign 017-complete-temperature-control-profile-recovery-and-regulation; the campaign remains the owner execution surface.
Campaign: standalone

Project Map: work/maps/map-smi-firmware-stabilization-and-qualification.md
Canonical Truth after completion: E:/dev/high_point/7520553_SMI_FW/docs/configuration-validation-and-recovery.md

## Deferral and Entry Gate

This work is intentionally planned but must not interrupt or mutate the current
candidate before activation. Do not change live I-limit values, soft-reset
behavior, PID state, semantic rules, or controller firmware under this
workpackage while it is deferred.

The original July gate requiring four then-open workpackages to close is
superseded by campaign 017's 2026-08-15 chamber-based reactivation contract.
Activation now requires an actual chamber to be scheduled and available,
attended heater-safe testing authority, approved quantitative regulation and
overshoot limits, and a defined successor-firmware scope. At activation,
re-confirm controller/setup identity, recoverability, the accepted tuning
schedule, and required release regression. Prior run 07949 remains evidence
for its exact firmware hash only.

## Reconciled Current State — 2026-09-03

Read-only Controller A sampling was interpreted only after its code signature
matched the exact current Debug ELF. Effective configuration permission and
requested main-temperature control were both true. The installed profile held
the complete nonzero 125/250/400/525/675-tick schedule with factor 1.10, and the
21.000 C setpoint produced `main_Ilim = 138` ticks.

Three samples over ten seconds showed adjusted temperature declining from
21.887 C to 21.873 C while above setpoint. PID error remained negative and the
commanded heater ticks remained zero. Because the heater was physically
disconnected, this is only a control-calculation observation; it proves neither
physical heat-off behavior nor closed-loop regulation and does not exercise
integral holding control. The focused semantic source-contract check passed
16/16 and current source now rejects nonpositive I-limit capacity.

Controller A's current live RAM profile is valid as a current-state fact. The
read did not prove how that profile was recovered or whether both VEEPROM copies
contain it. The following work remains:

- service 524 still restores all five cached I-limit fields unconditionally;
- services 48--53 still edit and save individual fields without an atomic
  profile validate/apply transaction and reliable PID reinitialization; and
- both VEEPROM copies still require persistence and semantic-equality readback;
  and
- testing with an actual connected heater and chamber must prove physical
  heating, heat-off behavior, steady-state accuracy, overshoot, settling, door
  recovery, and power recovery against approved limits.

## Historical Context — 2026-07-14

Read-only target diagnosis found repeatable regulation near 36.60 C against a
37.00 C setpoint. PID gains are populated, the door is closed, and the
post-door freeze interval has elapsed, but all five persisted main-temperature
I-limit values are zero. Live PID samples show `main_Ilim = 0` and an integral
term of zero while proportional output supplies holding heat. The controller is
therefore effectively PD-controlled and requires an approximately 0.4 C
steady-state error.

The immediate mechanism is established:

- full factory defaults set the schedule to 125, 250, 400, 525, and 675 ticks;
- service 524 then unconditionally restores the cached five I-limit fields;
- the earlier incomplete profile contained zeros, so service 524 persisted
  zeros over the valid defaults;
- semantic validation at the time accepted a nondecreasing all-zero schedule;
- service codes 48--53 save individual fields but do not reliably reinitialize
  the active limit and PID state after successful entry.

`main..dev` comparison found no PID-equation change. The I-limit preservation
assignments originated in commit `eb55fbd7` and exist in both branches. See
`work/evidence/temperature-steady-state-offset-diagnosis-20260714.md`.

## Recommendation

Treat the I-limit schedule as one safety-relevant temperature-control profile,
not five unrelated in-range floats. Soft reset may preserve identity,
calibration, alarms, and setpoint according to the approved contract, but it
must not overwrite known-good tuning defaults with an invalid cached profile.

Do not patch live RAM, force heater GPIO, silently increase heater authority on
boot, or claim the existing SD/temperature evidence for a later firmware hash.
Recovery and tuning must be attended, persisted through normal firmware paths,
read back from both VEEPROM blocks, and followed by closed-loop qualification.

## Goal

Ensure every enabled main-temperature controller has a coherent, effective,
and diagnosable tuning/limit profile; service 524 cannot preserve an unusable
profile; configuration changes take effect predictably; and an attended target
demonstrates approved steady-state accuracy without unacceptable overshoot or
loss of unrelated configuration.

## Major Outcomes

- Approved field ownership and preservation policy for main-temperature
  tuning, calibration, setpoint, alarms, and identity.
- Deterministic handling of zero, partial-zero, descending, non-finite, and
  excessive I-limit schedules.
- Correct service-524 recovery from the confirmed legacy zero-profile case.
- Safe recalculation and bumpless PID-state handling after service edits.
- VEEPROM convergence/readback evidence and operator-visible diagnostics.
- Automated, simulated, and attended target evidence for regulation and
  recovery.
- A separately hashed and requalified successor firmware image.

## Required Mitigations

### Configuration and soft reset

- Remove unconditional restoration of cached `MainTemp_Ilim_30C` through
  `MainTemp_Ilim_70C` during soft reset.
- Preserve the complete cached tuning profile only when the owner-approved
  validator accepts it; otherwise retain approved factory defaults or inhibit
  control for commissioning, according to the reviewed recovery policy.
- Decide and document whether the exact all-zero legacy signature is repaired
  only by explicit service 524 or by a versioned migration. Automatic enabling
  or increased heater authority must not be inferred without safety review.
- Preserve identity, calibration, alarm, setpoint, door, and 4--20 mA fields
  only according to the existing semantic contract.

### Semantic validation

- Reject an all-zero I-limit schedule when main-temperature control is enabled.
- Validate the schedule as one unit: finite, owner-approved positive lower
  bounds, nondecreasing ordering, bounded values, positive bounded factor, and
  a positive interpolated limit at the active setpoint.
- Produce a distinct finding/diagnostic for ineffective temperature tuning.
- Keep heater control inhibited when the profile cannot be safely repaired.

### Runtime application and service UI

- After service codes 48--53 successfully persist a coherent profile,
  recalculate the active limit and reinitialize PID state through a reviewed
  bumpless path.
- Do not recalculate from a partially edited five-value schedule; use an atomic
  edit/validate/commit flow or require an explicit apply step.
- Extend PID diagnostics to expose the active I limit, P/I/D/total output,
  integral-freeze state and timer, output saturation, profile source, and
  recovery/fault status.
- Add a bounded persistent-deviation diagnostic so ineffective integral action
  cannot remain invisible indefinitely.

### Persistence and failure behavior

- Commit only a complete coherent profile to both VEEPROM blocks.
- Read back and verify CRC plus semantic equality after reset or tuning change.
- A failed/interrupted write must leave a recoverable prior copy or a fail-safe
  next boot; it must not run heat from mixed old/new profile fields.

## Delivery Stages

| Stage | Outcome | Entry Evidence | Exit Evidence |
| --- | --- | --- | --- |
| 0. Activate and baseline | Deferral gate is cleared and the successor effort has an inventoried safe target | Chamber scheduled; attended heater-safe authority, quantitative limits, successor scope, and owner activation recorded | Fresh code/config/VEEPROM/temperature baseline and approved quantitative limits |
| 1. Approve policy | Preservation, migration, invalid-profile, and bumpless-transfer behavior are unambiguous | Confirmed diagnosis and existing semantic contract | Reviewed field matrix and explicit all-zero/partial-profile outcomes |
| 2. Implement mitigations | Soft reset, validator, service edits, diagnostics, and dual-block persistence follow the policy | Stage 1 approval | Focused review plus clean static and automated tests |
| 3. Exercise failure paths | Zero/partial/corrupt/interrupted profiles cannot silently run ineffective heat control | Instrumented host or simulator harness | Negative corpus, idempotence, and power-loss/recovery results |
| 4. Recover and qualify target | Approved profile is persisted and closed-loop behavior meets signed limits | Attended heater-safe setup and recovery image | VEEPROM readback, live PID trace, multi-setpoint regulation/overshoot evidence |
| 5. Requalify successor release | Later image is not covered by earlier candidate evidence | Exact successor hashes and completed focused qualification | Required regression, SD endurance, release evidence, and settled documentation |

## Automated Test Matrix

- Soft reset from the confirmed all-zero legacy profile.
- Valid custom schedule preservation and invalid schedule default/fail-safe
  behavior.
- All-zero, each individual zero, partial-zero, descending, equal, NaN,
  infinity, out-of-range, invalid factor, and setpoint-interpolation cases.
- No-op/idempotent validation of a valid profile.
- Atomic edit behavior for service codes 48--53 and rejection of partial state.
- Recalculation and bounded PID-state transition after apply.
- Both VEEPROM copies valid, one corrupt, both corrupt, write/readback failure,
  and interruption between redundant-block writes.
- Preservation of serial, model, Part ID, calibration, alarms, setpoint, door,
  and 4--20 mA fields according to policy.
- Closed-loop model showing integral action removes steady-state error without
  violating approved output/overshoot limits.

## Target Qualification

- Capture pre-change program flash, both VEEPROM blocks, configuration decode,
  calibration, actual/setpoint history, PID terms, door state, and heater demand.
- Recover tuning through operator-visible firmware behavior only; no J-Link RAM
  write or GPIO forcing.
- Verify both persisted copies and the live computed limit before heat testing.
- Run attended setpoint steps across the approved operating range and record
  rise time, steady-state error, overshoot, settling, P/I/D/output, saturation,
  alarms, watchdog/system errors, and sensor plausibility.
- Exercise a door-open/close cycle and verify the 300-second freeze behavior and
  bumpless integral resumption.
- Repeat cold boot and configuration save/reload checks.
- Run the regression scope required for the new firmware hash, including the
  SD endurance evaluator if it remains part of the release qualification plan.

## Milestones

### Milestone 1: Deferred scope activated and policy approved

- [ ] An actual chamber window, attended heater-safe authority, quantitative limits, and successor-firmware scope are recorded.
- [ ] Owner explicitly activates this workpackage.
- [ ] Heater-safe target authority and quantitative limits are recorded.
- [ ] Recovery/migration and preservation policy is approved.

### Milestone 2: Mitigations implemented and automated

- [ ] Soft reset cannot restore an ineffective cached I-limit schedule.
- [ ] Semantic validation rejects every approved invalid-profile class.
- [ ] Service edits apply atomically and reinitialize control safely.
- [ ] Dual-block persistence/readback and diagnostics are implemented.
- [ ] Automated and clean Debug/Release build gates pass.

### Milestone 3: Target and release qualification complete

- [ ] Current affected controller is recovered through the approved path.
- [ ] Multi-setpoint and door-cycle traces meet signed limits.
- [ ] Configuration/calibration preservation and both VEEPROM copies pass.
- [ ] Successor firmware regression and required SD rerun pass.
- [ ] Exact hashes, evidence, accepted limitations, and operator/reviewer
  approvals are recorded.

## Open Questions

- Should the exact all-zero legacy signature default the tuning profile only
  after explicit service 524, or is a versioned startup migration approved?
- Are equal adjacent limits valid for any approved model, or must the schedule
  be strictly increasing?
- What steady-state accuracy, overshoot, settling-time, output, and persistent
  deviation limits are approved per model/setpoint?
- Should service codes 48--53 remain individual editors or be replaced by an
  atomic profile editor/apply flow?
- What PID state is preserved during a valid tuning edit, and what bumpless
  initialization is required?
- Which prior regression evidence may be reused for a source-only HMI change,
  and which tests must repeat for every exact image hash?

## Completion Standard

This workpackage is complete when the confirmed zero-I-limit recovery defect is
removed; ineffective profiles cannot run enabled heat control; soft reset and
service edits preserve only approved coherent state; redundant persistence and
failure recovery are demonstrated; the affected controller regulates within
signed limits under attended testing; the successor image passes required
regression/requalification; and settled behavior is promoted to repository
documentation.

## Closeout Routing

- Current truth promoted to: `E:/dev/high_point/7520553_SMI_FW/docs/configuration-validation-and-recovery.md` and temperature-control documentation selected at activation
- Historical context remains in: this workpackage and `work/evidence/temperature-steady-state-offset-diagnosis-20260714.md`
- Runtime/status evidence: `work/evidence/setup-<a|b>/temperature-control/`
- Cleanup deferred to: unrelated PID retuning or control-algorithm redesign beyond the confirmed recovery defect

## Owner-directed reconciliation — 2026-09-23

Delivery detail for abandoned CAMP-0017; no thermal-performance or persistence pass is claimed.

Authorization: Owner instruction in this conversation on 2026-09-23 to close/abandon the named work and mitigate older active records.

Previous header retained for evidence interpretation:

> Status: deferred by owner; current Controller A live profile is valid, while persistence and all heater/chamber behavior remain unproven
> Next Action: none; reactivate with campaign 017 when its chamber, heater-safe authority, quantitative-limit, and successor-firmware gates are satisfied

Earlier observations, unchecked historical criteria, and procedures below/above remain history. This administrative disposition does not qualify a new firmware candidate, physical card, thermal system, ECO, or release. Current 00.05.01 obligations in IDEA-0006, IDEA-0007, MAP-0009, and CAMP-0028 remain unchanged.
