feat: support several remote load units

[FredM67]

Closes #156.

dev supports exactly one remote load unit, with local loads declared first and remote ones last, in two separate arrays. This lifts that to three units, each a separate Arduino carrying up to eight loads, declared in a single array in any order.

The abandoned Support-multiple-remote-units branch prototyped the design but was never compiled (it sat behind an #ifdef nobody defined). This is a port-forward of its delta with its defects fixed, not a rebase.

The load map

inline constexpr uint8_t physicalLoadPin[NO_OF_DUMPLOADS]{
  Load::local(5),      // load 0: local TRIAC on D5
  Load::remote(1, 8),  // load 1: remote unit 1, status LED on D8
  Load::remote(2, 9),  // load 2: remote unit 2, status LED on D9
  Load::remote(1)      // load 3: remote unit 1, no LED
};

One packed byte per load: bits 6-7 the unit (0 = local, 1-3 = remote), bits 0-5 the physical pin or, for a remote load, an optional status LED. NO_OF_REMOTE_LOADS, NO_OF_REMOTE_UNITS and REMOTE_LOADS_PRESENT are derived from the map by a constexpr census, so they can no longer contradict it — the prototype shipped with NO_OF_REMOTE_LOADS{3} and a two-unit manager.

Priorities index the map, so local and remote loads share one rotation; the "remote loads must come last" rule is gone.

Transmission

RemoteLoadCore<N> keeps one payload byte per unit, sent on change and refreshed every REMOTE_REFRESH_CYCLES mains cycles so a receiver that missed a frame catches up. Bit b of a unit's payload is the b'th load of that unit in ascending map order; on the receiver loadPins[0] is bit 0. Each unit is addressed separately — a change affecting only unit 2 sends nothing to unit 1.

RemoteLoadCore::sendPending(nodeIds, send) owns the send loop; the firmware passes a lambda around RFM69::send(). The pending flag shared with the ISR is volatile, like the other ISR-shared flags in shared_var.h — no interrupts-off window: flag and payload are single bytes, and the worst race sends the same byte twice.

The core has no Arduino dependency, so it runs in the native tests, and it is constant-initialized, so it stays out of .init_array (the regression PR #155 had to fix).

RemoteLoadReceiver/ needs no code change: build and upload it once per unit, changing only REMOTE_NODE_ID and the load list.

Bug fixes that fall out of the rewrite

• getDualTariffForcingBitmask() read out of bounds — it counted down from NO_OF_DUMPLOADS while indexing an array sized NO_OF_DUMPLOADS - NO_OF_REMOTE_LOADS, whenever DUAL_TARIFF and remote loads were both enabled.
• countLoadON[] ignored remote loads — sized NO_OF_DUMPLOADS but only incremented on the local path, so remote loads always datalogged 0.

New validation

0xFF — the unused_pin sentinel — decodes as unit 3 / pin 63 under the packed encoding, so a local load left unconfigured would silently become a remote one. That is now rejected, along with too many loads on one unit, more than 8 remote loads, a REMOTE_NODE_ID table shorter than the unit count, and node IDs that repeat, collide with the router or fall outside 1-30. Each was verified to fire by building a deliberately broken config.

Tests

48 native cases in test_remote_loads, no stubs. The helpers take the map (as a template argument), the node-ID table and the sender as parameters instead of reading the config globals, so the suite covers:

• the packed encoding, the census, unit grouping and bit order — including a regression pin for the prototype's index-reversal bug;
• change detection and the keep-alive refresh;
• the override pins derived from the map (LOAD(), ALL_LOADS()), fed through the real OverridePins;
• the two config checks behind validation.h;
• the send loop, with the radio replaced by a recording callable: unit n goes to REMOTE_NODE_ID[n-1], only due units are sent. Reversing that mapping fails three tests.

Not covered: the one-line radio().send() call and the countLoadON move inside the ISR path.

Verification

• basic, basic_debug, emonesp, rf build with no -Wtype-limits warnings; 170/170 native cases pass; CI green, embedded tests (simavr) and grid simulation included.
• .init_array is absent from every build; remoteLoads and RFM69:: are absent from basic.
• A 5-load / 2-unit / dual-tariff / temperature-sensor rf config compiles; remoteLoads is 8 constant-initialized .bss bytes.

Flash: basic is +6 bytes against dev, not byte-identical as intended — a printConfiguration() debug string. The ISR itself is 20 bytes smaller and RAM 1 byte lower. basic_debug +2, emonesp +6, rf +6.

ISR cost with remote units

updateLoads< physicalLoadPin >() takes the map as a template argument and builds each unit's payload by compile-time recursion, so every load's unit and bit are constants. At run time that leaves, per remote load, one state test and one OR into a register.

Static count from the disassembly, 6 loads over 3 units, every remote load ON and every unit due:

	First version	Now
Once per mains cycle (payloads + scheduling)	~430 cycles (~27 µs)	~125 cycles (~8 µs)
Every ISR call (9.6 kHz)	+13 cycles (stack frame)	0
Flash, this config	13176	12996

Worst allowed config (8 remote loads over 3 units): ~155 cycles (~10 µs), in line with dev's single-unit loop. Only builds with remote units pay any of this; default builds only carry the +6 bytes above.

Simulation

make -C sim check-rf (grid_sim, #169-#174) runs this firmware with configs/remote_loads.patch: 4 loads, 2 local and 1 on each of two remote units (nodes 15 and 16). Each remote unit runs the real RemoteLoadReceiver firmware in its own simulated AVR, over the RFM69 model, on the same clock as the router.

Scenario	What it checks
remote_step	surplus steps: loads switch on and off by priority, local and remote alike; no RF gap over 0.15 s for either unit
remote_override	the override pin forces every load on, the remote ones included; no RF gap over 0.15 s
link_loss	no frame reaches unit 15 for 1 s: it drops its load after the 500 ms timeout and takes it back once frames return, while unit 16 keeps its frames and its load
lossy_link	10 % of the frames lost at random: neither unit loses its link

The simulation found one limit of the receiver: with a refresh every 100 ms, 4 frames lost in a row already make a 500 ms gap, right at RF_TIMEOUT_MS. At 20 % loss, unit 16 lost its link once in 30 s (its load off for 0.2 ms).

Not yet run on hardware — neither the RF link with several units nor an oscilloscope check of the ISR.

Merge order

#163 (integer energy bucket) is merged, and this branch is up to date with dev. #162 (predictive switching) comes after this one: it is a real rework, not only a text conflict — its prediction uses the float bucket, and must move to Energy::contribution() and the cal / n table, which also removes its extra ISR cost.

🤖 Generated with Claude Code