# Failsafe model
> No-surprises fallbacks per element, interval-only commitments, pool ramp limits, and fallback that is locally determinable without a remote peer.
- Repository: g2tf-org/g2tf-standards
- GitHub: https://github.com/g2tf-org/g2tf-standards
- Human docs: https://grok-wiki.com/public/docs/g2tf-org-g2tf-standards-436ba3f3e0ff
- Complete Markdown: https://grok-wiki.com/public/docs/g2tf-org-g2tf-standards-436ba3f3e0ff/llms-full.txt
## Source Files
- `architecture/failsafe-model.md`
- `members/use.md`
- `members/buffer.md`
- `members/source.md`
- `members/allocator.md`
- `specs/g2p/spec.md`
---
---
title: "Failsafe model"
description: "No-surprises fallbacks per element, interval-only commitments, pool ramp limits, and fallback that is locally determinable without a remote peer."
---
`architecture/failsafe-model.md` is the living **no surprises** contract for Grid 2 v26.0-draft. Every Member Element and Allocator that loses peers, fresh context, or a current-interval Commitment MUST revert to a Grid 1 baseline that is locally determinable from its own state and last-known configuration. Failure of the orchestration plane MUST NOT leave the physical grid worse off than the pre-Grid 2 status quo.
The file is **Draft — seeking input**. RFC #1's Protocol Interactions table is the archival source; G2P §3.2 / §5 and GCAP §5 / §6 make the same fallbacks normative on the wire and in clearing.
A Member MUST NOT wait for a remote peer to authorize fallback. Missing or stale Commitment for the current one-minute interval is itself the trigger.
## Principle
Grid 2 is an overlay. On any Member↔Allocator fault, stale Commitment, invalid clearing inputs, or lost context, the element behaves as it would have under prior Grid 1 curtailment and interconnection regimes, inside agreed ramp rates.
RFC 2119 / RFC 8174 keywords in `architecture/failsafe-model.md` and the member files apply.
| Property | Normative rule |
|---|---|
| Objective | No surprises versus pre-Grid 2 Grid 1 behavior |
| Commitment lifetime | Valid for the identified interval only; expires with that interval |
| Detection | Local: own state + last-known configuration. MUST NOT depend on reaching any remote element |
| Transition | Into fallback, out of fallback, and between interval allocations MUST honor host-utility ramp rates |
| Pool bound | Simultaneous fallback of all Members MUST stay inside manageable Grid 1 system ramp limits |
This is the **No surprises** row of `architecture/design-principles.md`: failsafe defaults with status quo Grid 1, managed to local and regional ramp limits.
## What triggers fallback
Treat the element as in fallback when any of the following is true.
| Trigger | Who detects it | Required action |
|---|---|---|
| No `commit-%` / committed dispatch / committed take for the **current** interval | Member | Enter element-specific Grid 1 fallback |
| Commitment present but stale for this interval | Member | Same as missing Commitment |
| Loss of peers or context | Member | Same as missing Commitment |
| Loss of connectivity | Member (G2P §5) | Element-specific fallback |
| Missed Commitments beyond the (still unspecified) staleness threshold | Member (G2P §5) | Element-specific fallback |
| Stale or invalid local Grid 1 constraint inputs | Allocator | MUST NOT clear; Members then miss a Commitment and fall back |
| Domain partition that prevents a fresh local clear | Allocator | MUST NOT clear; Members fall back |
| Grid 1 dispatch instruction conflicts with a Grid 2 allocation | Member (`architecture/temporal-position.md`) | Grid 1 instruction prevails (even outside fallback) |
G2P still owes explicit staleness timers (missed-interval count). Until those land, the living failsafe rule is stricter on interval identity: a Member that has not received a Commitment **for the current interval** MUST treat itself as in fallback. Do not invent a grace window.
G2P Commitments MUST identify the **interval**, the **domain**, and the **clearing inputs version** they were computed against. Members match on those fields; they do not reuse last interval's `commit-%`.
## Per-element fallback
Normative rows from `architecture/failsafe-model.md`, restated in `members/use.md`, `members/buffer.md`, `members/source.md`, and `members/allocator.md`.
| Element | On loss of Allocator / peers / fresh context |
|---|---|
| **Use** (load) | MUST revert to its Grid 1 baseline (**firm load limit**) or **manual curtailment**; MUST follow allowed ramp rates while transitioning |
| **Buffer** (storage) | MUST revert to its **standalone Grid 1 schedule**; carries **no Grid 2 support commitment** while in fallback; MUST follow allowed ramp rates |
| **Source** (supply) | MUST revert to **Grid 1 baseline interconnection behavior**; MUST follow allowed ramp rates |
| **Allocator** | If constraint inputs are stale or the **domain** is partitioned, MUST NOT clear. Members that detect a missed clearing fall back per the rows above |
### Use
Listens for per-class `commit-%`. On stale Commitment or lost peers: Grid 1 firm load limit or manual curtailment, on the agreed ramp. Self-dispatch and G2P §3.4 verified telemetry remain Member obligations while the overlay is live; fallback-compliance audit telemetry is still an open item.
### Buffer
Listens for **committed dispatch**, which GCAP clears **before any load is curtailed**. In fallback the Buffer is not a shock absorber for the overlay. It MUST NOT keep a Grid 2 support commitment after it loses the Allocator.
### Source
Listens for **committed take**. Fallback is interconnection behavior already allowed under Grid 1, on the agreed ramp — not a continued Grid 2 take schedule.
### Allocator
Holds no discretion. On stale inputs or a partition of **its own domain**, it withholds the entire clear rather than publishing a partial or last-known Commitment. Whole-pool participation MUST stay sized so that if every Member falls back at once, aggregate ramps remain manageable.
## Interval-only commitments
GCAP §4: allocations apply to the **coming interval only** and expire with it. G2P messages are per-interval (one minute) unless noted.
Commitment validity key. A Commitment for interval *n* MUST NOT be executed as the allocation for interval *n+1*.
Domain the Allocator cleared. Members MUST NOT apply a Commitment from another domain.
Inputs the Allocator used. GCAP SHOULD publish this digest in-domain so any party can reproduce the clear.
Wire format, intra-interval deadlines (descriptor, clear, publish), and clock-sync requirements are unspecified in G2P §4 / §7.
## Allocator withhold vs federation partition
Do not collapse these two "partition" cases. Living federation text is more precise than the one-line Allocator failsafe row.
```mermaid
flowchart TD
subgraph member [Member Element]
Mq{Commitment for this interval present and fresh?}
Mop[Self-dispatch to commit-% / dispatch / take]
Mfb[Local Grid 1 fallback on agreed ramp]
Mq -->|yes| Mop
Mq -->|missing, stale, or lost peers| Mfb
end
subgraph alloc [Allocator local domain]
Aq{Local Grid 1 constraint inputs fresh and valid?}
Acl[Run GCAP and publish Commitment]
Ahold[MUST NOT clear]
Aq -->|yes| Acl
Aq -->|stale, invalid, or domain partition| Ahold
end
subgraph fed [Allocator federation]
Fmiss[Required peer announcement missing]
Fcons[Clear locally as if boundary adds no headroom]
Fpart[Partition between peer Allocators]
Flocal[Local clear continues; do not trip unrelated Members]
Fmiss --> Fcons
Fpart --> Flocal
end
Ahold --> Mfb
Acl --> Mq
```
| Fault | Allocator | Members in this domain | Members in an unrelated domain |
|---|---|---|---|
| Stale / invalid **local** constraint inputs | MUST NOT clear (GCAP §5) | Missed Commitment → fallback | Unaffected |
| Partition that blocks **this** domain's local context or publish | MUST NOT clear | Fallback | Unaffected |
| Missing **peer** federation announcement | MUST still clear **conservatively** (boundary contributes no extra headroom) | Stay on the local clear | Unaffected |
| Partition **between peer Allocators** | MUST NOT be prevented from local clearing | MUST NOT be forced into fallback | MUST NOT be tripped |
Peer announcements MAY add boundary headroom and MUST NOT relax local limits. Conservative federation degrade is independent local operation, not a domain-wide trip.
## Pool sizing and ramp discipline
Two separate bounds, both MUST:
1. **Whole-pool fallback (domain growth cap).** The participating pool in a domain MUST be sized so simultaneous fallback of **all** Members produces aggregate ramps inside manageable Grid 1 system ramp limits. `architecture/failsafe-model.md` calls this the binding constraint on domain growth. Sizing methodology is an open engineering question.
2. **Per-transition ramp.** All transitions — into fallback, out of fallback, and between consecutive interval allocations — MUST respect ramp rates agreed with the host utility. GCAP §6: per-member allocation deltas between consecutive intervals MUST respect each member's agreed rates. Use, Buffer, and Source member files all MUST self-dispatch / honor dispatch inside those rates.
DESP lists per-class ramp-rate and snap-back limits as **open**. Research cited there suggests 15-minute ramp discipline; that figure is not a v26.0 protocol constant. Implement against the host-utility agreement, not a DESP default.
Domain descriptors that would publish ramp limits in machine-readable form are also open (`architecture/allocation-domains.md`).
## Local determinism
Fallback MUST be computable from:
- the Member's own operating state
- last-known configuration (firm load limit, standalone Grid 1 schedule, interconnection baseline, agreed ramp rates)
It MUST NOT require:
- a live Allocator
- a peer Member
- a federation announcement
- a remote "enter fallback" message
That is the same edge-intelligence rule as clearing: every asset runs the same algorithm against locally observable signals. The Allocator's corresponding rule is withhold-on-stale — it does not invent a last-good clear when inputs are untrustworthy.
## Security posture
Transmission-level deployments are expected on **private networks**. G2P: all Service Descriptors and Commitments MUST be authenticated; integrity MUST be verifiable end-to-end.
NERC CIP applicability, key management, PKI, replay protection, and message-authentication details are open (Discussion: Engineering; G2P §6). Isolation of the comms plane is a **fallback trigger**, not a reason to hold the last Grid 2 set-point.
## Apply fallback
Operate on the one-minute interval in `architecture/temporal-position.md`. Grid 2 allocations apply to whole minutes. Sub-second primary controls stay Grid 1.
Use Members apply per-class `commit-%`. Buffers apply committed dispatch. Sources apply committed take. Reject a Commitment whose interval, domain, or inputs version does not match this interval.
No current Commitment, stale Commitment, lost peers/context, or G2P connectivity loss → execute the element row above. Do not query a remote element first.
Transition on the agreed ramp to firm load limit / manual curtailment (Use), standalone Grid 1 schedule with **no** Grid 2 support (Buffer), or Grid 1 interconnection behavior (Source).
If local constraint inputs are stale or invalid, publish nothing. Do not replay the previous interval. Members will fail closed on the missed Commitment.
Missing peer announcements → conservative local clear (no extra boundary headroom). Peer partition MUST NOT trip Members in unaffected domains.
## Open items
Still unspecified in the living failsafe file and adjacent specs:
- Quantitative staleness thresholds (how many missed intervals before fallback, versus the current-interval rule)
- Re-entry procedure and hysteresis after fallback
- Coincidental-fallback stability analysis (Discussion: Reliability assurance)
- Audit / telemetry to verify fallback compliance (distinct from G2P §3.4 verified self-dispatch)
- Allocator redundancy (active/standby per domain)
- Pool-sizing methodology for the whole-pool ramp bound
Allocator hosting (utility-operated vs third-party under utility authority) is an Allocator open item, not a change to withhold-on-stale.
## Related pages
Overlay membership, NERC/FERC/TSO non-interference, and why fallback is the Grid 1 baseline.
Interval clock, commit-before-open, and Grid 1-prevails on conflicting dispatch.
Commitment fields, authenticated descriptors, and stale-commitment faults.
Withhold-on-stale, identical-input determinism, and pool / ramp-safety bounds.
No-discretion clearing and whole-pool ramp sizing.
Missing-announcement conservative clear and partition that does not trip unrelated Members.
Firm-limit fallback, commit-% listen, and ramp MUSTS.
Standalone Grid 1 schedule and no Grid 2 support while in fallback.
Grid 1 interconnection fallback and committed take.