Medical circuit board intelligent control method and system based on electrochemical water decomposition feedback

Abstract

The application relates to the technical field of automatic control of medical equipment, and discloses a medical circuit board intelligent control method and system based on electrochemical water decomposition feedback, electrochemical water decomposition feedback data is acquired by surrounding a first electrochemical water decomposer group and a second electrochemical water decomposer group, group state quantities are constructed, and in sequence, continuous abnormality checking processing, takeover eligibility checking processing and inter-group collaborative switching control are executed, so that the medical circuit board can distinguish the starting transient state, external supply voltage disturbance and the real continuous abnormality of the current running group, and when the continuous abnormality occurs in the current running group, whether the standby group has the real takeover condition is checked before controlled switching is executed, thereby reducing the risk of misjudgment, mis-switching and invalid switching caused by single voltage overrun, short-time no-flow or transient state fluctuation; meanwhile, interlocking control of prohibiting all outputs is executed when the standby group does not have the takeover eligibility or the takeover fails.

Description

Technical Field

[0001] This application relates to the field of automatic control technology for medical equipment, and in particular to a smart control method and system for medical circuit boards based on electrochemical water decomposition feedback. Background Technology

[0002] In medical electrochemical water splitting equipment, the control board typically undertakes the coordinated control of the electrochemical water splitter group, solenoid valves, distilled water pumps, saline delivery units, pressure detection units, and flow detection units. This control is used to complete control processes such as equipment startup, steady-state operation, abnormal switching, maintenance operations, and shutdown protection. In hospital disinfection supply, instrument processing, medical fluid preparation, and related auxiliary processing scenarios, this type of equipment often needs to operate continuously for extended periods, maintaining high output stability and operational safety under varying load demands. In practical applications, the control board not only needs to control the corresponding electrochemical water splitter and valve / pump components to enter the working state based on startup commands from the operating or maintenance interface, but also needs to continuously collect feedback data such as electrochemical water splitter voltage, flow switch signals, pressure switch signals, and the cumulative effective operating time of the electrochemical water splitter to determine whether the current output link is in a normal supply state. Due to external factors such as fluctuations in water supply pressure, changes in influent concentration, changes in ambient temperature, and uneven fluid usage rhythm in medical settings, as well as internal factors such as polarization of the electrochemical water decomposer, attenuation of electrolysis efficiency, drift of the drive circuit, lag in valve response, and delay in the fluid build-up process in the pipeline, the same electrochemical water decomposer group may experience abnormal voltage, unstable output, or reduced continuous working capacity during operation. Therefore, the control board needs to provide stable, accurate, and interlocked program control for the two sets of electrochemical water decomposers and their corresponding actuators while ensuring continuous supply.

[0003] Most existing medical electrochemical water decomposition equipment uses board-level control logic based on threshold comparison and timing judgment. This means that when the voltage of the electrochemical water decomposer exceeds the allowable range or the operating time of a single group reaches a set upper limit, it directly executes alarm, shutdown, or switchover control actions to another group of electrochemical water decomposers. Some solutions further combine relay switching and basic interlocking to achieve dual-group alternating operation. While this type of solution can complete basic start-stop control and fault protection, its control basis is usually based on single sampling results or fixed-duration judgments, lacking unified verification of the persistence of abnormal states, the takeover capability of the backup group, and the overall output link security after switching. On the one hand, electrochemical water decomposers are prone to short-term voltage overruns during the initial flow path establishment, load fluctuations, or the instantaneous switching of solenoid valves. Existing technologies often struggle to distinguish between transient disturbances and real faults, easily leading to false alarms and erroneous switching. On the other hand, if the current group is determined to be abnormal, and if it is not simultaneously verified whether the other group has any unresolved alarms, whether it has the conditions for normal takeover, and whether the corresponding valves can form an effective output path, problems such as switching failure, concurrent abnormalities in both groups, or continuous output under abnormal conditions may occur. Therefore, existing technologies lack a closed-loop control mechanism for medical dual-group electrochemical water decomposers. They cannot coordinate control of abnormality confirmation, inter-group switching, and output suppression after switching failure, based on electrochemical water decomposer voltage feedback, effective cumulative operating time, duration of abnormality, and standby group status information. Consequently, it is difficult to balance supply continuity, control accuracy, and medical operational safety. Summary of the Invention

[0004] This application proposes a smart control method and system for medical circuit boards based on electrochemical water decomposition feedback to solve the problems mentioned in the background art.

[0005] To achieve the above objectives, this application adopts the following technical solution: a medical circuit board intelligent control method based on electrochemical water splitting feedback, comprising the following steps: S1. Obtain the electrochemical water decomposition feedback data corresponding to the first electrochemical water decomposer group and the second electrochemical water decomposer group, and construct the group state variables corresponding to the first electrochemical water decomposer group and the second electrochemical water decomposer group based on the electrochemical water decomposition feedback data. S2. Determine the current operating group in the first electrochemical water decomposer group and the second electrochemical water decomposer group, and perform continuous anomaly verification processing on the group status quantity corresponding to the current operating group based on the preset continuous anomaly verification rules to obtain the fault confirmation result corresponding to the current operating group. S3. When the fault confirmation result indicates that the current operating group has a continuous abnormality, the non-current operating group is identified as the standby group, and the standby qualification verification process is performed on the group status quantity corresponding to the standby group based on the preset takeover qualification verification rules to obtain the switchover qualification result corresponding to the standby group. S4. Based on the preset inter-group collaborative switching control rules, and according to the fault confirmation results and switching qualification results, perform inter-group collaborative switching control on the currently running group and the standby group to obtain the medical circuit board control results.

[0006] Furthermore, in step S1, the electrochemical water decomposition feedback data includes at least the electrochemical water decomposer voltage, electrochemical water decomposer operating status, flow switch status, pressure switch status, group alarm status, group reset status, group solenoid valve drive output status, group solenoid valve readback status, operation interface startup status, maintenance interface startup status, and gear status corresponding to the first and second electrochemical water decomposer groups. The startup states of the operation interface and the maintenance interface satisfy a mutual exclusion constraint.

[0007] Furthermore, in step S1, based on the electrochemical water decomposition feedback data, the group state variables corresponding to the first and second electrochemical water decomposer groups are constructed, including: The effective cumulative operating time of each electrochemical water decomposer group is determined based on the operating status of the electrochemical water decomposer and the status of the flow switch. Specifically, when the operating status of the electrochemical water decomposer indicates that the corresponding electrochemical water decomposer group is in operation and the status of the flow switch indicates that the flow switch is on, the effective cumulative operating time of the corresponding electrochemical water decomposer group is accumulated. The voltage anomaly characterization quantity corresponding to each electro-water decomposer group is determined based on the normalized deviation of the electro-water decomposer voltage from the preset voltage range. Determine the alarm reset characteristic quantity corresponding to each electrochemical water decomposer group based on the group alarm status and group reset status. Based on the consistency between the output state of the group solenoid valve drive and the readback state of the group solenoid valve, the valve group mapping consistency characterization quantity corresponding to each electrochemical water decomposer group is determined. Based on the effective cumulative operating time, voltage anomaly characterization, alarm reset characterization, and valve group mapping consistency characterization of each electrochemical water decomposer group, the group state quantity corresponding to each electrochemical water decomposer group is constructed. Among them, the solenoid valve readback status is the status represented by the solenoid valve readback signal, relay readback signal, or valve position feedback signal.

[0008] Furthermore, in step S2, based on preset continuous anomaly verification rules, continuous anomaly verification processing is performed on the group status variables corresponding to the current operating group to obtain the fault confirmation result corresponding to the current operating group, including: Based on whether the voltage of the electrochemical water decomposer corresponding to the current operating group exceeds the preset voltage range and whether the effective cumulative operating time of the current operating group reaches the preset time threshold, the instantaneous abnormal state of the current operating group is determined. When the transient abnormal state continues to reach the preset duration threshold, it is determined that the current running group has a continuous abnormality, and the corresponding fault confirmation result of the current running group is output.

[0009] Furthermore, step S2 also includes: After detecting that the operation interface startup status changes from invalid to valid, the system calculates the no-flow waiting time based on the flow switch status, and outputs the sodium chloride pump stop control when the no-flow waiting time reaches the preset waiting time. When the pressure switch changes from ON to OFF, the operation of the current operating group is suspended; when the pressure switch is turned ON again, the operation of the current operating group is resumed.

[0010] Furthermore, in step S3, based on preset takeover eligibility verification rules, takeover eligibility verification processing is performed on the group state variables corresponding to the standby group to obtain the handover eligibility result corresponding to the standby group, including: The alarm clearing status of the standby group is determined based on the group alarm status and group reset status of the standby group; The valve group mapping consistency state corresponding to the standby group is determined based on the consistency between the drive output state of the group solenoid valve corresponding to the standby group and the readback state of the group solenoid valve. When the alarm clearing status indicates that there are no alarms in the standby group or the alarms have been reset, and the valve group mapping consistency status indicates that the valve group mapping relationship corresponding to the standby group is normal, the standby group is determined to be qualified to take over, and the switching qualification result corresponding to the standby group is output.

[0011] Furthermore, in step S4, based on preset inter-group coordinated handover control rules, and according to the fault confirmation result and handover eligibility result, inter-group coordinated handover control is performed on the currently operating group and the standby group, including: When the switch qualification result indicates that the standby group is qualified to take over, the fault flag of the current operating group is output, and the solenoid valve drive output of the current operating group and the corresponding group of the current operating group is stopped. After a preset isolation time, the solenoid valve drive output of the corresponding group of the standby group is started and the standby group is started.

[0012] Furthermore, in step S4, the inter-group coordinated handover control also includes: When the switchover qualification result indicates that the standby group is not qualified to take over, an interlock control that prohibits all outputs is executed. After starting the solenoid valve drive output of the standby group and the standby group is running, the takeover confirmation process is performed based on the voltage and flow switch status of the electrochemical water decomposer corresponding to the standby group. When the takeover confirmation process indicates that the standby group has not formed an effective takeover, an interlock control that prohibits all outputs is executed.

[0013] Furthermore, in step S4, when the maintenance interface is in the active state, the automatic inter-group collaborative switching control between the current running group and the standby group is prohibited, and the maintenance output link corresponding to the current running group is controlled to run. The maintenance output link should include at least the intake solenoid valve, the distilled water pump, the group solenoid valve corresponding to the current operating group, and the current operating group; The distilled water pump operates at a low speed and stops maintenance output when the maintenance time reaches the preset maintenance time threshold or when a manual stop command is received.

[0014] The intelligent control system for medical circuit boards based on electrochemical water splitting feedback includes: The group state quantity construction module is used to obtain the electrochemical water decomposition feedback data corresponding to the first electrochemical water decomposer group and the second electrochemical water decomposer group, and construct the group state quantities corresponding to the first electrochemical water decomposer group and the second electrochemical water decomposer group based on the electrochemical water decomposition feedback data. The continuous anomaly verification module is used to determine the current operating group in the first electrochemical water decomposer group and the second electrochemical water decomposer group, and to perform continuous anomaly verification processing on the group status variables corresponding to the current operating group based on the preset continuous anomaly verification rules, so as to obtain the fault confirmation result corresponding to the current operating group. The takeover qualification verification module is used to identify non-current operating groups as standby groups when the fault confirmation result indicates that the current operating group has a continuous abnormality. Based on the preset takeover qualification verification rules, the module performs takeover qualification verification processing on the group status variables corresponding to the standby group to obtain the switchover qualification result corresponding to the standby group. The inter-group collaborative switching control module is used to perform inter-group collaborative switching control on the currently running group and the standby group based on preset inter-group collaborative switching control rules, and according to the fault confirmation result and switching qualification result, so as to obtain the control result of the medical circuit board.

[0015] The beneficial effects of this invention are as follows: By acquiring electrochemical water decomposition feedback data around the first and second electrochemical water decomposer groups, group state variables are constructed. Continuous anomaly verification, takeover eligibility verification, and inter-group coordinated switching control are then executed sequentially. This enables the medical circuit board to distinguish between startup transients, external pressure disturbances, and the actual continuous anomalies of the currently operating group. When a continuous anomaly occurs in the currently operating group, the system verifies whether the standby group meets the actual takeover conditions before performing controlled switching. This reduces the risk of misjudgment, incorrect switching, and invalid switching caused by single voltage exceedances, short-term flow absences, or instantaneous state fluctuations. Simultaneously, by implementing interlocking control to prohibit all outputs when the standby group is not eligible for takeover or takeover fails, and freezing the automatic inter-group coordinated switching control and maintaining controlled maintenance outputs in maintenance mode, the stability of the medical circuit board's control results, switching reliability, and overall operational safety can be further improved. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort: Figure 1 This is a flowchart of the method of the present invention; Figure 2 This is a system framework diagram of the present invention. Detailed Implementation

[0017] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] Example 1 like Figure 1 As shown, the present invention discloses a smart control method for medical circuit boards based on electrochemical water decomposition feedback, including steps S1, S2, S3 and S4.

[0019] In this embodiment, step S1 is used to acquire electrochemical water decomposition feedback data corresponding to the first and second electrochemical water decomposer groups, and to construct group state variables corresponding to the first and second electrochemical water decomposer groups based on the electrochemical water decomposition feedback data. It should be noted that the focus of this step is not on the conventional signal acquisition itself, but on the targeted organization, screening and characterization of the feedback data based on the electrochemical water decomposition operation characteristics of the dual electrochemical water decomposer groups, so as to construct group state variables that can be directly used for continuous anomaly verification processing in subsequent step S2 and for takeover qualification verification processing in step S3. As for the sampling circuit, analog-to-digital conversion, level sampling and register reading, they can all adopt the conventional implementation methods of existing medical circuit boards. This embodiment only provides necessary explanations.

[0020] Specifically, the medical circuit board acquires electrochemical water decomposition feedback data corresponding to the first and second electrochemical water decomposer groups in each control cycle. The electrochemical water decomposition feedback data includes at least the electrochemical water decomposer voltage, electrochemical water decomposer operating status, flow switch status, pressure switch status, group alarm status, group reset status, group solenoid valve drive output status, group solenoid valve readback status, operation interface startup status, maintenance interface startup status, and gear status.

[0021] The voltage of the electrochemical water splitter is preferably acquired through an analog-to-digital converter channel; the output status of the group solenoid valve drive is preferably read through the output register of the control board or the status of the drive port; the readback status of the group solenoid valve is preferably represented by one of the following: solenoid valve readback signal, relay readback signal, or valve position feedback signal. When the readback status of the group solenoid valve is represented by the solenoid valve readback signal or the relay readback signal, it is preferably used to represent whether the control output link has been executed. When it is necessary to further improve the representation accuracy of the actual conduction status of the valve body, the valve position feedback signal is preferred. The sampling period is preferably 20 milliseconds to 200 milliseconds, more preferably 50 milliseconds to 100 milliseconds. When the sampling period is less than 20 milliseconds, the sampling noise and transient jitter are more easily amplified, and the processing burden of the control board is increased. When the sampling period is greater than 200 milliseconds, the response accuracy of the subsequent continuous anomaly verification processing to the changes in the actual operating status will be reduced. Therefore, adopting the above range is more conducive to balancing real-time performance and stability.

[0022] Since the operation interface startup state and the maintenance interface startup state cannot be effective simultaneously in the control logic, after the feedback data collection is completed, it is preferable to perform a mutual exclusion check on the two first. Preferably, when the operation interface startup state and the maintenance interface startup state are detected to be effective at the same time in the same control cycle, the first effective startup state is taken as the current effective mode state, and the other startup state is blocked until the current effective mode exits. The purpose of this process is to avoid mode conflict and directly enter the group state quantity construction process.

[0023] It should be noted that the pressure switch status, operation interface startup status, maintenance interface startup status, and gear status are all collected and associated in this step, but are not directly incorporated into the group status entity. The reason is that the status is mainly used to characterize the operating context and mode context in the subsequent control process, while the group status entity constructed in this step should focus on reflecting the electrochemical water decomposition operating status and output path status of each electrochemical water decomposer group itself. If the above context conditions are directly mixed with the status of the electrochemical water decomposer group itself, it is easy to weaken the boundary clarity of the group status entity, which is not conducive to the unified calling in subsequent steps.

[0024] To reduce the impact of sampling spikes and isolated interferences on the voltage characterization results of the electrochemical water decomposer, this embodiment preferably performs short-window filtering on the original electrochemical water decomposer voltages of each electrochemical water decomposer group to obtain the filtered electrochemical water decomposer voltages. Preferably, the median value of the electrochemical water decomposer voltages within 3 to 7 consecutive sampling periods is taken as the filtered electrochemical water decomposer voltage corresponding to that control period. The filtering window length is preferably 3 to 7. When the filtering window length is less than 3, the suppression effect on single-point spikes is insufficient; when the filtering window length is greater than 7, it is easy to cause a lag in tracking the actual voltage changes. The reason for using median filtering instead of simple average filtering is that the electrochemical water decomposition device is prone to a small number of discrete spikes under valve switching, power supply ripple, or sampling transient interference. Median filtering has a better suppression ability for such outliers and is more suitable as a preprocessing method for voltage characterization in this step.

[0025] After obtaining the filtered electrochemical water decomposer voltage, this embodiment further constructs the voltage anomaly characterization quantity corresponding to each electrochemical water decomposer group. Specifically, with 2V to 22V as the preset voltage range, when the filtered electrochemical water decomposer voltage is between 2V and 22V, the voltage anomaly characterization quantity of the corresponding electrochemical water decomposer group is determined to be 0; when the filtered electrochemical water decomposer voltage is lower than 2V, its deviation value below 2V is divided by the 20V range bandwidth to obtain the voltage anomaly characterization quantity of the corresponding electrochemical water decomposer group; when the filtered electrochemical water decomposer voltage is higher than 22V, its deviation value above 22V is also divided by the 20V range bandwidth to obtain the voltage anomaly characterization quantity of the corresponding electrochemical water decomposer group.

[0026] After this processing, the voltage anomaly characterization quantity is a dimensionless quantity, which can uniformly characterize the degree of voltage deviation of the electrochemical water decomposer from the preset voltage range, and keep the low-voltage deviation and high-voltage deviation measured on the same scale. Compared with the existing technology of directly comparing whether a single sampled voltage exceeds the limit, this embodiment first filters the voltage and then converts the degree of voltage deviation into a continuously changing voltage anomaly characterization quantity. This can reduce the risk of misjudgment caused by transient spikes and facilitate the subsequent step S2 to perform continuous anomaly verification processing under the same state system. The preset voltage range is preferably 2 volts to 22 volts. This value is determined based on the rated operating range of the electrochemical water decomposer corresponding to this embodiment, the factory calibration results of the whole machine, and long-term operating statistics. For different models of electrochemical water decomposers, the preset voltage range can also be corrected based on their rated operating range and corresponding calibration results.

[0027] To avoid mistaking the power-on time of the electrochemical water decomposer group for the actual working time, this embodiment also constructs an effective cumulative operating time for each electrochemical water decomposer group. Specifically, the effective cumulative operating time of the corresponding electrochemical water decomposer group is accumulated according to the control cycle duration only when the corresponding electrochemical water decomposer group is in operation and the flow switch is detected to be on. When the corresponding electrochemical water decomposer group is not in operation, or although an operation control is issued but the flow switch is not on, the effective cumulative operating time of the electrochemical water decomposer group is not accumulated. Therefore, only when the electrochemical water decomposer group has formed actual flow conditions and entered an effective output state is the time included in the effective cumulative operating time. The reason for adopting this processing method is... Therefore, the present invention aims to solve the problem of intelligent control of dual electrochemical water decomposer groups in the actual electrochemical water decomposition output process, rather than simply counting the duration of the electrochemical water decomposer group being powered on. The common method in the prior art of directly accumulating the running time based on the power-on time will include the waiting stage before the liquid circuit is established after startup, the short-term no-flow stage, or the ineffective output stage into the running time. This will cause the subsequent step S2 to prematurely determine that a certain electrochemical water decomposer group has reached the preset time threshold. This embodiment introduces the flow switch state as the timing gating condition, so that the effective running accumulated time can more accurately reflect the actual effective working degree of the electrochemical water decomposer group, thereby improving the reliability of the subsequent fault confirmation results.

[0028] To avoid ambiguity in the effective cumulative operating time during state switching, this embodiment further specifies its initialization and clearing method. Preferably, the effective cumulative operating time of each electrochemical water decomposer group is initialized to 0 when the equipment is first powered on; the effective cumulative operating times of the first and second electrochemical water decomposer groups are accumulated and stored independently, and do not overwrite each other during inter-group collaborative switching; after the corresponding electrochemical water decomposer group completes maintenance reset or receives a manual clearing command, the effective cumulative operating time of the electrochemical water decomposer group is cleared to zero. Through this process, it can be ensured that the effective cumulative operating time always corresponds to the effective working history of each electrochemical water decomposer group, avoiding the problem of cumulative time misalignment in dual-group switching and subsequent maintenance scenarios.

[0029] After constructing the effective cumulative operating time and voltage anomaly characterization quantities, this embodiment continues to construct the alarm reset characterization quantities corresponding to each electrochemical water decomposer group. Specifically, the group alarm state and group reset state are taken as common characterization objects, and the existence of alarms and whether resets have been completed for each electrochemical water decomposer group are jointly described. Preferably, the group alarm state and group reset state are stored together as two state components of the alarm reset characterization quantity, or the corresponding alarm reset characterization quantity is formed according to a preset state coding rule, instead of directly merging the two into a single binary state. The reason is that although both the group alarm state and group reset state are related to electrochemical water decomposition... While the availability of the equipment group is related, their control meanings differ. The group alarm status mainly indicates whether the corresponding electrochemical water decomposer group currently has a fault alarm or a locked state, while the group reset status mainly indicates whether the corresponding electrochemical water decomposer group has completed the recovery action that allows it to be put back into operation. If the two are simply merged, the differences between different control scenarios such as "no alarm", "alarm but reset" and "alarm but not reset" will be lost, which is not conducive to the subsequent step S3 accurately determining whether the standby group is qualified to take over. Therefore, this embodiment retains both the alarm status and the reset status in the alarm reset representation quantity to improve the accuracy of the subsequent takeover qualification verification process.

[0030] To further reflect whether the output path of the corresponding electrochemical water decomposer group is truly established, this embodiment also constructs a valve group mapping consistency representation quantity for each electrochemical water decomposer group. Specifically, the consistency of the group solenoid valve drive output state and the group solenoid valve readback state is compared. When the group solenoid valve drive output state and the group solenoid valve readback state are consistent, the valve group mapping consistency representation quantity is determined to be consistent; when they are inconsistent, the valve group mapping consistency representation quantity is determined to be inconsistent. The reason for adopting this representation method is that, in the intelligent control scenario of dual electrochemical water decomposer groups, it is not enough to know that a certain electrochemical water decomposer group has been enabled; it is also necessary to know the specific electrochemical water decomposer group. Whether the output path corresponding to the unit has been truly established according to the control intention is usually only read back and verified at the actuator level in the existing technology, without elevating this information to part of the state of the electrochemical water decomposer unit. This leads to subsequent fault confirmation and standby unit takeover judgment relying more on voltage or alarm status, making it difficult to fully reflect the actual operability of the electrochemical water decomposer unit. This embodiment directly incorporates the valve group mapping consistency characterization quantity into the group state quantity, so that the group state quantity not only includes the electrochemical operation characteristics of the electrochemical water decomposer unit itself, but also the execution consistency of its corresponding output path, thereby providing a more complete state basis for the takeover qualification verification process in the subsequent step S3.

[0031] Based on the above processing, this embodiment ultimately constructs a group state quantity for each electrochemical water decomposer group. Specifically, the effective cumulative operating time, voltage anomaly characterization, alarm reset characterization, and valve group mapping consistency characterization of the corresponding electrochemical water decomposer group are combined to form the group state quantity of that electrochemical water decomposer group. The group state quantity constructed in this way is not a simple stacking of the original electrochemical water decomposition feedback data, but rather the result of screening, normalizing, and uniformly organizing the state factors that are truly critical to subsequent control. Among them, the effective cumulative operating time is used to characterize the cumulative working degree of the corresponding electrochemical water decomposer group under the actual effective flow conditions; the voltage anomaly characterization is used to characterize the degree to which the current voltage of the corresponding electrochemical water decomposer group deviates from the preset voltage range; the alarm reset characterization is used to characterize the fault and recovery status of the corresponding electrochemical water decomposer group; and the valve group mapping consistency characterization is used to characterize whether the output path of the corresponding electrochemical water decomposer group is consistent with the control intention. Figure 1 Thus, the group state variables formed in this way not only retain the physical source and control meaning of each characterization quantity, but also provide a unified data input object for subsequent steps S2 and S3.

[0032] It should be noted that the pressure switch status, operation interface startup status, maintenance interface startup status, and gear status collected in this step are all output as context states associated with the group status variables to subsequent steps, but are not incorporated into the group status variable body. The reason for this is that the above states are mainly used for the operation pause recovery judgment in subsequent step S2 and the maintenance mode control judgment in step S4. Their function belongs to the control context, rather than the operating status of the electrochemical water decomposer group body. By organizing the group status variables and context states in layers, signals with different physical properties and different control levels can be avoided from being directly mixed.

[0033] Through the above step S1, the present invention unifies the effective cumulative operating time, voltage anomaly characterization quantity, alarm reset characterization quantity, and valve group mapping consistency characterization quantity into a group state quantity, so that the subsequent step S2 can perform continuous anomaly verification processing based on the group state quantity, and the step S3 can perform takeover qualification verification processing based on the group state quantity. Compared with the existing technology that directly uses single voltage over-limit judgment or power-on time accumulation, this embodiment can more accurately characterize the real operating status of each electrochemical water decomposer group and improve the reliability of fault confirmation results and switchover qualification results.

[0034] In this embodiment, step S2 is used to determine the current operating group in the first electrochemical water decomposer group and the second electrochemical water decomposer group, and to perform continuous anomaly verification processing on the group status quantity corresponding to the current operating group based on the preset continuous anomaly verification rules, so as to obtain the fault confirmation result corresponding to the current operating group; at the same time, after the start state of the operation interface changes from invalid to valid, no flow waiting processing is performed based on the flow switch state, and pause and resume control is performed on the current operating group when the pressure switch state changes. It should be noted that the innovation of this step is not to make isolated judgments on a single switch quantity or a single sample value, but to perform continuous anomaly identification on the current operating group based on the group status quantity constructed in step S1, and to distinguish the liquid circuit establishment process and external pressure supply condition disturbances in the start-up phase from the continuous anomaly of the current operating group itself. As for edge detection, timer accumulation and conventional status reading, they can all adopt the conventional implementation methods of existing medical circuit boards. This embodiment only provides necessary explanations.

[0035] Specifically, after the medical circuit board calls the group status quantities corresponding to the first and second electrochemical water decomposer groups output in step S1, it first determines the current operating group from the first and second electrochemical water decomposer groups. Preferably, when the operating status of the electrochemical water decomposer corresponding to the first electrochemical water decomposer group indicates that the first electrochemical water decomposer group is in operation and the operating status of the electrochemical water decomposer corresponding to the second electrochemical water decomposer group indicates that the second electrochemical water decomposer group is not in operation, the first electrochemical water decomposer group is determined as the current operating group; when the operating status of the electrochemical water decomposer corresponding to the second electrochemical water decomposer group indicates that the second electrochemical water decomposer group is in operation and the operating status of the electrochemical water decomposer corresponding to the first electrochemical water decomposer group indicates that the first electrochemical water decomposer group is not in operation, the first electrochemical water decomposer group is determined as the current operating group. When the equipment is powered on for the first time and has not yet formed a current operating group, it is preferable to determine the electrochemical water decomposer group that has entered a stable operating state for the first time as the current operating group. In the case of short-term overlap that may occur during the inter-group coordinated switching, if both groups are in the operating state within the same control cycle, it is preferable to keep the current operating group determined in the previous control cycle as the current operating group in this control cycle until only one group remains in stable operation. The reason for adopting this processing method is that the continuous anomaly verification processing must be performed on a unique anomaly verification object. Otherwise, in the case of short-term overlap between two groups, the anomaly attribution may be confused, which will affect the correspondence between the fault confirmation result and the subsequent processing links of steps S3 and S4.

[0036] After determining the current operating group, it is preferable to perform continuous anomaly verification processing on the group status variables corresponding to the current operating group only when the operation interface startup status is valid and the maintenance interface startup status is invalid. The reason for this setting is that continuous anomaly verification processing mainly serves the anomaly identification in automatic operation scenarios. When the maintenance interface startup status is valid, the equipment control logic switches to maintenance mode. The operating purpose and control constraints of the current operating group are different from the normal supply scenario in operation mode. Therefore, it is not appropriate to directly include the transient process in maintenance mode into continuous anomaly verification processing.

[0037] In the continuous anomaly verification process, the instantaneous anomaly state of the current operating group is first formed based on the group state variables. Specifically, the voltage anomaly characterization quantity and the effective cumulative operating time of the current operating group are called. When the voltage anomaly characterization quantity indicates that the voltage of the electrolyzed water decomposer corresponding to the current operating group exceeds the preset voltage range, or the effective cumulative operating time reaches the preset time threshold, the current operating group is determined to be in an instantaneous anomaly state. When the voltage anomaly characterization quantity does not indicate that the voltage of the electrolyzed water decomposer corresponding to the current operating group exceeds the preset voltage range, and the effective cumulative operating time does not reach the preset time threshold, the current operating group is determined to be not in an instantaneous anomaly state. The reason for this processing is that the voltage anomaly characterization quantity has already been processed in step [step 1]. S1 completes the normalization characterization of the voltage deviation of the electrochemical water decomposer, which can reflect whether the electrochemical water decomposition working point corresponding to the current operating group deviates from the normal working range; while the effective cumulative operating time can reflect the working time that the current operating group has undertaken under the condition of actually forming effective flow. The two work together to unify the two abnormal sources that affect the switching of the two groups into the formation conditions of the instantaneous abnormal state. Compared with the existing technology that directly judges the fault based on a single voltage over-limit or a single time over-limit, this implementation first forms the instantaneous abnormal state and then performs continuous abnormality verification processing, thereby providing a basis for distinguishing between short-term disturbances and real continuous abnormalities.

[0038] The purpose of the preset time threshold is to limit the effective operating limit of a single electrochemical water decomposer group in an automatic operation scenario, thereby reserving reaction time for the subsequent takeover qualification verification process in step S3 and the inter-group coordinated switching control in step S4. Preferably, the preset time threshold is determined based on the rated life of the electrochemical water decomposer, the continuous load capacity of a single group, the dual-group switching cycle, and the overall maintenance strategy. For medical circuit board control scenarios using dual-group switching supply, the preset time threshold is preferably set to 70% to 95% of the rated continuous effective operating limit of a single group, and more preferably to 80% to 90%. If the preset time threshold is set too low, the current operating group will enter a transient abnormal state too early, reducing the utilization rate of a single group; if the preset time threshold is set too high, it will compress the processing margin of subsequent inter-group coordinated switching, which is not conducive to maintaining the continuity of supply. Therefore, the above range can achieve a good balance between the utilization rate of a single group and the safety margin of dual-group switching.

[0039] After a transient abnormal state is formed, a continuous abnormality verification process is further performed. Specifically, an abnormality duration timing unit is set for the current operating group. When the current operating group is determined to be in a transient abnormal state, the abnormality duration is accumulated according to the control cycle duration. When the current operating group is determined not to be in a transient abnormal state, the abnormality duration is cleared to zero. Preferably, the abnormality duration is initialized to 0 when the equipment is first powered on. When the current operating group is switched, the abnormality duration corresponding to the newly determined current operating group is re-initialized to 0. When the maintenance interface startup status becomes valid, the abnormality duration is cleared to zero. The reason for this setting is that the abnormality duration should only be used to characterize the degree of continuous abnormality of the current operating group in the current automatic operation phase. If it is not initialized or cleared in the above scenarios, it is easy to incorrectly splice together abnormal segments from different operating phases, affecting the accuracy of the fault confirmation results.

[0040] Furthermore, when the duration of the anomaly reaches a preset duration threshold, it is determined that a continuous anomaly has occurred in the current operating group, and the corresponding fault confirmation result for the current operating group is output. When the duration of the anomaly does not reach the preset duration threshold, the corresponding fault confirmation result for the current operating group is not output. The preset duration threshold is used to distinguish between short-term fluctuations and true continuous anomalies. Preferably, the preset duration threshold is 3 to 10 seconds, more preferably 5 seconds. If the preset duration threshold is less than 3 seconds, short-term deviations or sampling disturbances during startup transients or valve switching processes are more likely to be misjudged as continuous anomalies. If the preset duration threshold is greater than 10 seconds, the response to true anomalies will be significantly delayed, which may increase the duration of the anomaly. According to the dual-group control rhythm of the equipment corresponding to this embodiment, 5 seconds is preferably used as the preset duration threshold to balance anti-misjudgment capability and response timeliness.

[0041] In order to enable the fault confirmation result to directly serve the subsequent steps S3 and S4, preferably, the fault confirmation result includes at least the current operating group identifier and the continuous abnormality source information. The continuous abnormality source information preferably includes at least one of the following: the voltage of the electrochemical water decomposer corresponding to the current operating group exceeds the preset voltage range, the effective cumulative operating time corresponding to the current operating group reaches the preset time threshold, or both of the above are true. By writing the current operating group identifier and the continuous abnormality source information together into the fault confirmation result, the subsequent steps can not only identify which group has a continuous abnormality, but also identify the cause of the continuous abnormality, thereby improving the targeting of the subsequent processing links.

[0042] In this embodiment, step S2 also includes no-flow waiting processing after the operation interface is started. Specifically, after detecting that the operation interface start state changes from invalid to valid, it is preferable to take the moment of this state change as the starting moment and calculate the no-flow waiting time based on the flow switch status. When the operation interface start state remains valid and the flow switch status indicates that it is not connected, the no-flow waiting time is accumulated according to the control cycle duration. When it is detected that the flow switch status indicates that the flow switch is connected, the no-flow waiting time is cleared to zero and the current no-flow waiting processing ends. When the operation interface start state returns to invalid, the no-flow waiting time is also cleared to zero. When the equipment enters maintenance mode or the current operating group is switched, it is also preferable to terminate the current no-flow waiting processing and clear the time. By supplementing the above clearing and termination conditions, it can be ensured that the no-flow waiting time only corresponds to the liquid circuit establishment process after the current automatic start, avoiding misjudgment caused by accumulation across start-up stages.

[0043] Furthermore, when the no-flow waiting time reaches the preset waiting time, the output sodium chloride pump stops control. The preset waiting time is used to distinguish between the normal liquid circuit establishment process during the startup phase and the long-term no-flow abnormality. Preferably, the preset waiting time is 5 to 15 seconds, more preferably 10 seconds. If the preset waiting time is less than 5 seconds, the sodium chloride pump may be prematurely triggered to stop control while the liquid circuit is still in the normal establishment phase. If the preset waiting time is greater than 15 seconds, the no-flow abnormality will last too long, increasing the duration of ineffective delivery and abnormal operating conditions. Based on the pipeline length, liquid circuit establishment time, and startup rhythm of the equipment corresponding to this embodiment, 10 seconds is preferably used as the preset waiting time. Compared with the rigid judgment method of the flow switch status immediately after startup in the prior art, this embodiment introduces the no-flow waiting time as a buffer criterion, which can effectively distinguish between the "normal waiting phase after startup" and the "abnormal phase of no flow establishment for a long time".

[0044] Considering that there may still be a continuous no-flow scenario after the sodium chloride pump is stopped, this embodiment also preferably sets up a safety protection branch. Specifically, after the output sodium chloride pump stops control, if the flow switch status indicator indicating the flow switch is turned on is not detected within a preset protection observation time, the operation enable of the current operating group is further revoked. As a preferred safety protection measure, the preset protection observation time is used to determine whether the no-flow state continues after the pump stops. It is preferably 1 to 10 seconds, more preferably 3 to 5 seconds. If the preset protection observation time is too short, the operation enable of the current operating group may be revoked too early before the brief state transition is completed after the pump stops. If the preset protection observation time is too long, it will prolong the abnormal state maintenance time. The above range can achieve a good balance between safety and control stability. It should be noted that this safety protection branch is a preferred implementation method, used to improve the protection integrity in the no-flow abnormal scenario, and does not change the basic processing logic of "the output sodium chloride pump stops control when the preset waiting time is reached".

[0045] In this embodiment, step S2 also includes pause and resume control involving the pressure switch state. Specifically, when the pressure switch state changes from on to off, the operation of the current operating group is paused. The pause of the current operating group operation preferably includes canceling the operation enable of the current operating group and freezing the abnormal duration timing unit corresponding to the current operating group. The reason for adopting this processing method is that the pressure switch state mainly reflects whether the external pressure supply conditions of the whole machine meet the operating requirements. Its essence is the change of external operating conditions, rather than the current operating group itself having experienced a continuous abnormality. If the abnormal duration continues to accumulate during the period when the pressure switch state is off, it is easy to mistakenly include the external pressure supply disturbance in the continuous abnormality of the current operating group. By freezing the abnormal duration timing unit during the pause, the fluctuation of external pressure supply conditions can be distinguished from the continuous abnormality of the current operating group itself.

[0046] When the pressure switch is restored to the ON state, the current operating group resumes operation. To avoid repeated pauses and restarts of the current operating group caused by mechanical vibration of the pressure switch, it is preferable to continuously monitor the ON state for a preset recovery confirmation time after detecting that the pressure switch has been restored to the ON state before resuming operation of the current operating group. The preset recovery confirmation time is used to filter out contact vibration during the pressure switch recovery phase, preferably 0.2 seconds to 2 seconds, more preferably 0.5 seconds to 1 second. If the preset recovery confirmation time is too short, it will be difficult to filter out the mechanical vibration of the pressure switch; if the preset recovery confirmation time is too long, it will increase unnecessary recovery delay. The above range can achieve a good balance between recovery stability and recovery timeliness. Furthermore, it is preferable to restore the current operating group that was determined before the pause, rather than reselecting the current operating group. The reason for this setting is that the restoration of the pressure switch state triggers the restoration of the original operating state, rather than a new inter-group selection process, thereby avoiding interference from external pressure supply fluctuations on the determination of the current operating group.

[0047] Through step S2 above, this invention does not mechanically respond to single instances of voltage exceeding limits, single instances of duration reaching thresholds, single instances of no flow, or single instances of pressure switch disconnection. Instead, it establishes three collaborative logics around the current operating group: continuous anomaly verification processing, no flow waiting processing, and pause recovery processing involving pressure switch status. Among them, continuous anomaly verification processing is used to identify the true continuous anomaly of the current operating group and form a fault confirmation result; no flow waiting processing is used to distinguish between the normal liquid circuit establishment stage after startup and long-term no flow anomaly; and pause recovery processing involving pressure switch status is used to distinguish between external pressure supply disturbances and continuous anomalies of the current operating group. After the three are coordinated, misjudgments caused by startup transients, valve switching stages, or external pressure fluctuations can be significantly reduced, thereby improving the accuracy of fault confirmation results and providing reliable input for the subsequent takeover qualification verification processing in step S3 and the inter-group collaborative switching control in step S4.

[0048] In this embodiment, step S3, based on the fault confirmation result output in step S2, identifies the non-currently operating group as the standby group, and performs a standby qualification verification process on the group status variable corresponding to the standby group based on the preset takeover qualification verification rules, thereby obtaining the switchover qualification result corresponding to the standby group. It should be noted that the focus of this step is to perform a layered verification of whether the standby group truly has the takeover conditions under the condition that the current operating group has been confirmed to have a continuous abnormality. In the prior art, the common practice is to directly attempt to switch to another group after the current operating group is abnormal, or to determine whether to allow the switchover based solely on whether the standby group has an alarm. Such processing methods are difficult to distinguish between different scenarios such as "the standby group has no alarms but has not yet completed recovery", "the standby group has completed recovery but the output link response is abnormal", and "the standby group is theoretically available but the takeover path has not been truly established". This embodiment performs a joint verification of the standby group's group alarm status, group reset status, and the consistency of the group solenoid valve execution link, so that the switchover qualification result can better reflect the standby group's true takeover capability at the current moment.

[0049] Specifically, the medical circuit board first calls the fault confirmation result output in step S2. When the fault confirmation result indicates that the current operating group is experiencing a continuous abnormality, the non-current operating group is determined as the backup group. Preferably, when the fault confirmation result indicates that the first electrochemical water decomposer group is the current operating group and the first electrochemical water decomposer group is experiencing a continuous abnormality, the second electrochemical water decomposer group is determined as the backup group; when the fault confirmation result indicates that the second electrochemical water decomposer group is the current operating group and the second electrochemical water decomposer group is experiencing a continuous abnormality, the first electrochemical water decomposer group is determined as the backup group. The reason for adopting this processing method is that the present invention adopts a dual electrochemical water decomposer group collaborative control structure. The takeover qualification verification process in step S3 should be performed on another electrochemical water decomposer group that is complementary to the current operating group, rather than searching again among multiple candidate groups. This is beneficial to maintaining the clear object and stable link of the inter-group collaborative switching control in the subsequent step S4.

[0050] After determining the standby group, the group status variables corresponding to the standby group that have been constructed in step S1 are called, and the standby qualification verification process is performed on the group status variables corresponding to the standby group based on the preset takeover qualification verification rules. It should be noted that the takeover qualification verification process in this step is mainly performed on the standby group body status and its corresponding output link status. Therefore, it is preferable to focus on the group alarm status, group reset status, group solenoid valve drive output status, and group solenoid valve readback status of the standby group, rather than directly incorporating the pressure switch status, operation interface startup status, and maintenance interface startup status into the verification conditions of this step. The reason for this is that the pressure switch status and mode status are mainly used to characterize external operating conditions and control mode constraints, and their role is mainly reflected in steps S2 and S4. The core objective of step S3 is to determine whether the standby group itself has takeover capability. If the external context conditions are directly mixed with the standby group body status, it is easy to blur the boundary between whether the standby group body is takeoverable and whether the system currently allows the switchover.

[0051] In this embodiment, the takeover qualification verification process first establishes the alarm clearance status corresponding to the standby group. Specifically, it calls the group alarm status and group reset status corresponding to the standby group, preferably performing the verification in the order of first determining whether an alarm exists, and then determining whether a reset has been completed. When the group alarm status of the standby group indicates that the standby group currently has no alarms, the alarm clearance status of the standby group is directly determined to meet the takeover requirements. When the group alarm status of the standby group indicates that the standby group has alarms, the group reset status of the standby group is called for a second verification. If the group reset status indicates that the standby group has completed a reset, the alarm clearance status of the standby group is determined to meet the takeover requirements. If the group reset status indicates that the standby group has not yet completed a reset, the alarm clearance status of the standby group is determined to meet the takeover requirements. The reason for adopting this joint judgment method to meet the takeover requirements is that although both group alarm status and group reset status are related to the availability of the standby group, the control meanings they express are different. Group alarm status indicates whether the standby group is still in a fault alarm or locked state, while group reset status indicates whether the standby group has completed the recovery action after the fault is cleared. If only "whether there is an alarm" is used as the sole judgment, standby groups that "have alarms but have completed the reset and can actually be put back into service" will be mixed with standby groups that "have alarms but have not completed the reset and cannot be put back into service". This is not conducive to improving the flexibility and accuracy of the dual-group switching strategy. By forming an alarm clearing status, the fault recovery capability of the standby group can be extracted separately, providing a clear basis for the formation of subsequent switching qualification results.

[0052] After the alarm clearing state is established, the valve group mapping consistency state corresponding to the standby group is further established. It should be noted that the valve group mapping consistency state in this embodiment is not simply judged based on whether the "group solenoid valve drive output state is the same as the group solenoid valve readback state value" at a certain moment. Instead, it is used to characterize whether the control output link of the group solenoid valve corresponding to the standby group has the ability to respond correctly according to the takeover control intention. In order to avoid misjudging the "non-drive state before entering the takeover preparation stage" as the "consistent state that meets the takeover requirements", it is preferable to establish the valve group mapping consistency state under the preset detection scenario.

[0053] The preferred preset detection scenario is a pre-operational drive detection scenario before the backup group is taken over, or a periodic self-check scenario during equipment operation. Under the preset detection scenario, the control board applies a detection drive consistent with the takeover preparation to the group solenoid valves corresponding to the backup group, and then reads the corresponding group solenoid valve readback status. When the group solenoid valve drive output status and the group solenoid valve readback status are consistent under the preset detection scenario, the valve group mapping consistency status corresponding to the backup group is determined to meet the takeover requirements. When the group solenoid valve drive output status and the group solenoid valve readback status are inconsistent under the preset detection scenario, the valve group mapping consistency status corresponding to the backup group is determined to not meet the takeover requirements.

[0054] The reason for adopting this approach is that whether a standby group is qualified to take over depends not only on whether the standby group is logically allowed to be put into operation, but also on whether its corresponding output path can respond correctly according to the control intention during the takeover preparation stage. If the preset detection scenario is not limited, and only the "drive and readback consistency" at a certain moment is used as the basis for the formation of the valve group mapping consistency state, it is easy for the standby group to be mistakenly regarded as consistent simply because it is "not driven and not readback connected" when no takeover preparation detection is performed, thereby weakening the effectiveness of the takeover qualification verification process. By introducing a preset detection scenario, the valve group mapping consistency state can truly reflect whether the execution link of the solenoid valve of the corresponding group of the standby group has the responsiveness, thereby enhancing the accuracy of the switching qualification result in representing the actual takeover capability.

[0055] To accommodate different hardware implementations, this embodiment further limits the source of the group solenoid valve readback status. The group solenoid valve readback status is preferably represented by one of the following: solenoid valve readback signal, relay readback signal, or valve position feedback signal. When using solenoid valve readback signal or relay readback signal, the valve group mapping consistency status is mainly used to characterize whether the control output link of the corresponding group solenoid valve of the standby group has been correctly executed according to the preset detection scenario. When using valve position feedback signal, the valve group mapping consistency status can also further characterize whether the corresponding group solenoid valve of the standby group has reached the actual conduction or position state. The reason for this setting is that the feedback forms that can be obtained by different equipment hardware structures are different.

[0056] After establishing the alarm clearing status and valve group mapping consistency status for the backup group, the system further determines whether the backup group is qualified to take over based on these two conditions, and outputs the switching qualification result for the backup group. Specifically, when the alarm clearing status of the backup group indicates that there are no alarms or the alarms have been reset, and the valve group mapping consistency status of the backup group indicates that the control output link of the solenoid valves of the backup group can respond correctly according to the takeover control intention under the preset detection scenario, the backup group is determined to be qualified to take over, and the switching qualification result for the backup group is output. When the alarm clearing status of the backup group does not meet the takeover requirements, or the valve group mapping consistency status of the backup group does not meet the takeover requirements, the backup group is determined not to be qualified to take over, and the switching qualification result for the backup group is output.

[0057] Preferably, the switching qualification result includes at least the standby group identifier and takeover qualification determination information; more preferably, it may also include reason information for why the standby group does not have takeover qualification. The reason information preferably includes at least one of the following: the standby group has an uncleared alarm, the standby group has not completed a reset, and the solenoid valve execution link of the corresponding standby group has an abnormal response. By adopting the above output method, the subsequent step S4 can not only know "whether switching is allowed", but also know "which group has takeover qualification" and "if it does not have takeover qualification, what is the source of its restriction", thereby providing a more direct input basis for the subsequent execution of inter-group coordinated switching control or interlocking control that prohibits all outputs.

[0058] In this embodiment, the takeover qualification verification process preferably adopts a rule-based judgment method rather than relying on a complex black-box model. The reason for this setting is that the present invention aims to solve the real-time control problem of the medical circuit board of the dual electrochemical water splitter group in the switching scenario. Its focus is on making an interpretable, verifiable and quickly executable judgment on whether the standby group truly has the qualification to take over. There are clear physical and control relationships between the group alarm status, group reset status, group solenoid valve drive output status and group solenoid valve readback status of the standby group. By adopting the above-mentioned rule-based takeover qualification verification process, the real-time control requirements can be met while ensuring sufficient disclosure, and it is also conducive to the direct invocation of the subsequent step S4.

[0059] It is important to note that the alarm clearing status is determined by the absence of alarms in the standby group, or by the fact that the standby group has alarms but has been reset. This status indicates whether the standby group has recovered from a fault state to a state where it can be put back into service. Secondly, the valve group mapping consistency status is determined by the consistency between the solenoid valve drive output state and the solenoid valve readback state of the corresponding group solenoid valve in the preset detection scenario. This status indicates whether the corresponding output link of the standby group has the ability to respond correctly according to the takeover control intention. Thirdly, the switching qualification result is determined by the simultaneous fulfillment of the takeover requirements by the alarm clearing status and the valve group mapping consistency status. This status comprehensively indicates the actual takeover capability of the standby group.

[0060] Through the above step S3, after the current operating group has been confirmed to have a continuous abnormality in step S2, the present invention no longer mechanically regards another group as a takeover target. Instead, it first performs a takeover qualification verification process on the standby group. Only when the alarm clearing status and valve group mapping consistency status of the standby group meet the takeover requirements will the switching qualification result indicating that the standby group has takeover qualification be output. Compared with the processing methods of "directly switching to another group if the current group is abnormal" or "only using the absence of alarms in another group as the switching condition" in the prior art, this implementation can effectively reduce the risks of erroneous switching, invalid switching, and failure to establish a path after switching, thereby improving the reliability of subsequent inter-group collaborative switching control and the overall operational safety of the system.

[0061] In this embodiment, step S4 is used to perform inter-group collaborative switching control on the current operating group and the standby group based on the fault confirmation result output in step S2 and the switching qualification result output in step S3, thereby obtaining the medical circuit board control result. At the same time, when the maintenance interface is in a valid startup state, the system switches to the maintenance mode control branch, disables automatic inter-group collaborative switching control, and controls the maintenance output link to run. It should be noted that the innovation of this step is not simply issuing a switching command, but rather organizing the current operating group exit, the standby group takeover, the takeover confirmation process, the interlocking control that disables all outputs, and the maintenance mode control branch into a controlled closed loop. In the prior art, a common approach is to directly start another group after the current operating group becomes abnormal, or to assume that the other group has already formed a valid takeover after startup. Such approaches are difficult to guarantee the stability of the switching process and are also difficult to identify takeover failure scenarios in a timely manner. This embodiment, through the processing link of "isolation first, switching then confirmation" and the unified execution of interlocking control that disables all outputs in abnormal scenarios, ensures that both the automatic switching result and the abnormal convergence result have clear boundaries.

[0062] Specifically, the medical circuit board first calls the fault confirmation result output in step S2 and the switching qualification result output in step S3. When the fault confirmation result indicates that the current operating group has a continuous abnormality and the switching qualification result indicates that the standby group has the qualification to take over, automatic inter-group coordinated switching control is executed. Preferably, the automatic inter-group coordinated switching control is executed in the following order: first, the fault flag of the current operating group is output, then the current operating group and the corresponding group solenoid valve drive output are stopped, and then after a preset isolation time, the group solenoid valve drive output of the standby group and the standby group operation are started. The reason for adopting this order is that if the standby group is started directly before the current operating group has finished exiting, in the scenario where the dual electrochemical water decomposer groups share some control links or liquid circuit branches, short-term overlapping drives, valve competition and status readback confusion are likely to occur. By introducing an isolation time between the exit of the current operating group and the takeover of the standby group, the two groups of control actions can be controlled and separated in time, thereby improving the stability of the inter-group coordinated switching control.

[0063] The output of the current operating group fault flag is preferably used to indicate that the current operating group has entered the exit state, and is used for subsequent status recording, fault log recording, and control link linkage invocation. Stopping the current operating group preferably includes canceling the operation enable of the current operating group; stopping the drive output of the group solenoid valve corresponding to the current operating group preferably includes canceling the drive output of the group solenoid valve corresponding to the current operating group. The reason for this setting is that the exit of the current operating group is not only the exit of the electrochemical water decomposer body, but also the exit of its corresponding passage. If only the operation enable of the current operating group is canceled without canceling the drive output of the group solenoid valve corresponding to the current operating group, the passage state may remain. If only the drive output of the group solenoid valve is canceled without canceling the operation enable of the current operating group, the electrochemical water decomposer may remain in an abnormal state when the passage is not closed. Therefore, this embodiment requires the current operating group and its corresponding group solenoid valve drive output to be canceled in a coordinated manner to ensure the consistency of the exit action.

[0064] After canceling the operation enable of the current operating group and the solenoid valve drive output of the corresponding group, the solenoid valve drive output of the standby group and the operation of the standby group are started after a preset isolation time. The purpose of the preset isolation time is to provide a necessary transition window between the exit of the current operating group and the takeover of the standby group, so as to avoid short-term overlap between the two groups. Preferably, the preset isolation time is 100 milliseconds to 500 milliseconds, more preferably 200 milliseconds to 300 milliseconds. If the preset isolation time is less than 100 milliseconds, the relay release, solenoid valve shutdown and control board output refresh may not have been completed, which may easily cause short-term overlap between the two groups. If the preset isolation time is greater than 500 milliseconds, it will prolong the supply interruption time, which is not conducive to maintaining output continuity. The preset isolation time is preferably determined based on the relay release time, the solenoid valve mechanical response time, the control board output refresh cycle and the liquid circuit switching stabilization time. Using the above range can achieve a good balance between switching safety and supply continuity.

[0065] After completing the startup of the solenoid valve drive output and the startup of the standby group, this embodiment does not directly assume that the standby group has completed effective takeover. Instead, it further performs a takeover confirmation process. The reason for this setting is that the switching qualification result output in step S3 only indicates that the standby group has takeover qualification before the switch, and does not necessarily mean that the standby group has formed an actual effective takeover after the switch. If the takeover confirmation process is missing after the switch, there may be a situation where the standby group has been started, but its electrochemical water decomposer voltage has not returned to the preset voltage range or the liquid circuit has not formed an effective flow condition, which may lead to the system misjudging the switch as successful.

[0066] Specifically, the preferred procedure for connection confirmation includes the following: after starting the solenoid valve drive output of the standby group and the standby group is in operation, the connection confirmation duration is measured starting from the time of switch completion. During this connection confirmation duration, the voltage and flow switch status of the electrochemical water decomposer corresponding to the standby group are continuously monitored. When the voltage of the electrochemical water decomposer corresponding to the standby group returns to the preset voltage range and the flow switch status indicates that the flow switch is turned on during the connection confirmation duration, a valid connection is not immediately determined. Instead, the condition of whether the above conditions are continuously met is further verified.

[0067] Preferably, the connection confirmation process indicates that the standby group has formed an effective connection only if the voltage and flow switch status of the electrolytic water decomposer corresponding to the standby group continuously meet the effective connection conditions within the connection confirmation period. If, within the connection confirmation period, the voltage of the electrolytic water decomposer corresponding to the standby group fails to return to the preset voltage range, or the flow switch status continuously indicates that the flow switch is not connected, or although the effective connection conditions are met briefly but not continuously, the connection confirmation process indicates that the standby group has not formed an effective connection. The reason for adopting this stability judgment method is that there may be short-term fluctuations in the initial stage of connection. If the connection is considered successful only based on the voltage returning to the range and the flow switch closing at a certain moment, it is still possible to misjudge the short-term recovery as a real connection. By adding the requirement of "continuously meeting the effective connection conditions", the connection confirmation process can be made closer to the real connection status of the standby group.

[0068] The purpose of the takeover confirmation time is to provide a reasonable observation window for the establishment of the standby group's status after takeover. Preferably, the takeover confirmation time is 1 to 8 seconds, more preferably 2 to 5 seconds. If the takeover confirmation time is less than 1 second, the short-term fluctuations after the standby group starts up have not yet ended, and it is easy to draw the conclusion of takeover failure too early. If the takeover confirmation time is greater than 8 seconds, it will prolong the identification time of takeover failure and increase the duration of abnormal state. The takeover confirmation time is preferably determined based on the standby group start-up establishment time, the liquid circuit recovery time, the voltage stabilization time of the electrochemical water decomposer, and the continuity requirements of the whole machine output. Using the above range can achieve a good balance between the reliability of takeover confirmation and the timeliness of abnormal response.

[0069] When the takeover confirmation process indicates that the standby group has formed an effective takeover, the standby group is identified as the new current operating group, and the solenoid valve drive output of the corresponding standby group and the standby group operation enable are maintained. Preferably, the temporary control state of the original current operating group during this switchover process is cleared at the same time, and the current operating group identifier in the subsequent control link is updated. Through this process, the medical circuit board control result output in step S4 includes not only the switching action itself, but also the result that the group state has been stably migrated, thereby providing a unified basis for the cyclical calling of steps S1 to S4 in the subsequent control cycle.

[0070] When the switching qualification result indicates that the standby group is not qualified to take over, this embodiment does not perform automatic inter-group coordinated switching control, but performs interlock control that prohibits all outputs. Specifically, it is preferable to simultaneously cancel the operation enable of the first electrochemical water decomposer group and the second electrochemical water decomposer group, and cancel the solenoid valve drive output of the first electrochemical water decomposer group and the second electrochemical water decomposer group respectively. The reason for this setting is that the current operating group has been confirmed to have a continuous abnormality in step S2, and the standby group is not qualified to take over. If any group is allowed to maintain output at this time, the system may be in an uncontrollable or high-risk state. Therefore, under the condition that a safe and effective takeover cannot be formed, the system can be uniformly put into a controlled shutdown state by interlock control that prohibits all outputs, which can prioritize ensuring operational safety.

[0071] When the switching qualification result indicates that the standby group is qualified to take over, but the takeover confirmation process further indicates that the standby group has not formed an effective takeover, the interlock control that prohibits all outputs is also executed. The reason for using the same interlock process in both scenarios is that although one occurs before the switch and the other occurs after the switch, the control essence of the two is the same, that is, the system has failed to form a safe, effective and verifiable takeover result. By unifying "the standby group is not qualified to take over" and "the standby group failed to take over" into the interlock control branch that prohibits all outputs, step S4 can be kept consistent in terms of abnormal convergence strategy, avoiding the increase in control logic complexity due to the dispersion of processing paths. Preferably, after executing the interlock control that prohibits all outputs, the interlock lock state is maintained until a manual reset command is received or the preset release condition is met. This setting helps to prevent the system from being automatically pulled up repeatedly when the abnormality is not resolved.

[0072] In this embodiment, step S4 further includes a maintenance mode control branch. When the maintenance interface is in a valid startup state, the automatic inter-group collaborative switching control between the current operating group and the standby group is prohibited, and the maintenance output link corresponding to the current operating group is controlled to run. Here, "prohibiting the execution of automatic inter-group collaborative switching control" preferably includes freezing the inter-group collaborative switching control branch automatically triggered based on the output of step S2 and step S3, so that the system does not automatically switch the standby group due to short-term state changes of the current operating group in maintenance mode. The reason for adopting this processing method is that the goal of maintenance mode is to perform controlled maintenance, flushing or verification on the current operating group or the corresponding maintenance link, rather than to maintain automatic supply continuity. If automatic inter-group collaborative switching control is still allowed in maintenance mode, it may cause state changes during the maintenance process to be misinterpreted as requiring switching, thereby destroying the stability of the maintenance process.

[0073] To make the object boundaries of the maintenance mode control branch clearer, preferably, the current operating group is the current operating group that was determined before entering the maintenance mode. That is, when the maintenance interface starts from invalid to valid, the electrochemical water decomposer group that was in the current operating state before the maintenance interface started is taken as the current operating group in the maintenance mode, and the maintenance output link is established based on the current operating group. The reason for adopting this processing method is that in the equipment scenario corresponding to the present invention, the maintenance mode preferably uses the electrochemical water decomposer group that was already in the operating state before entering the maintenance mode, so as to keep the maintenance object continuous and clear, and avoid changing the group again in the maintenance mode, which would increase the control uncertainty.

[0074] The maintenance output link includes at least an intake solenoid valve, a distilled water pump, a group solenoid valve corresponding to the current operating group, and the current operating group. The distilled water pump operates at a low speed. The reason for using low speed operation is that the maintenance mode emphasizes a controlled, gentle, and observable maintenance process rather than high-intensity output. Preferably, the low speed operation of the distilled water pump corresponds to 20% to 60% of the rated operating speed, more preferably 30% to 50%. If the low speed operation is lower than 20% of the rated operating speed, the liquid circuit establishment and maintenance medium exchange may be insufficient; if it is higher than 60% of the rated operating speed, the flow fluctuation and impact during the maintenance process will increase, which is not conducive to the stable performance of maintenance operations. The low speed operation is preferably determined based on the rated flow of the distilled water pump, the allowable flow of the maintenance link, and the stability requirements of the maintenance conditions.

[0075] In maintenance mode, the maintenance output link stops operating when the maintenance timer reaches a preset maintenance time threshold or a manual stop command is received. The preset maintenance time threshold is another key parameter in this step, which limits the duration of a single maintenance mode to prevent the maintenance output link from running without boundaries for a long time. Preferably, the preset maintenance time threshold is 30 to 600 seconds, more preferably 60 to 300 seconds. If the preset maintenance time threshold is less than 30 seconds, the maintenance link has usually not completed the necessary flushing, verification, or observation process. If the preset maintenance time threshold is greater than 600 seconds, the maintenance process may last too long, which is not conducive to equipment resource management and maintenance safety. The preset maintenance time threshold is preferably determined based on the maintenance medium replacement time, the fluid circuit stability establishment time, the typical duration of the maintenance item, and the equipment's factory maintenance process requirements. By using the preset maintenance time threshold and the manual stop command as maintenance termination conditions, both the automatic termination requirements of standardized maintenance processes and the manual intervention requirements in special maintenance scenarios can be met.

[0076] When the maintenance mode ends, it is preferable to simultaneously deactivate the intake solenoid valve, distilled water pump, the group solenoid valve corresponding to the current operating group, and the operating enable of the current operating group, and clear the temporary control state in the maintenance mode, so that there is a clear initial boundary when re-entering the automatic operation mode or re-entering the maintenance mode. Through this process, the residual maintenance output link can be avoided from affecting subsequent mode switching.

[0077] Through the above steps S4, this invention forms a unified closed loop around the current operating group exit, the standby group takeover, the takeover confirmation process, the interlock control that prohibits all outputs, and the maintenance mode control branch. Among them, the inter-group collaborative switching control is used to realize the controlled migration of the current operating group to the standby group, the takeover confirmation process is used to determine whether the standby group has truly formed an effective takeover, the interlock control that prohibits all outputs is used to put the system into a unified safety state when the standby group does not have the qualifications to take over or the takeover fails, and the maintenance mode control branch is used to freeze automatic switching and maintain controlled maintenance outputs when the maintenance interface is in an effective start state. Compared with the existing technology of "directly switching to another group after the current group is abnormal" or "defaulting to takeover after switching", this embodiment can significantly reduce the risks of incorrect switching, invalid switching, short-term overlap of two groups, and unidentified takeover failures, while improving the clarity of the boundary between the maintenance process and the automatic operation process, thereby improving the stability and operational safety of the medical circuit board control results.

[0078] Example 2 like Figure 2 As shown, this invention also discloses a medical circuit board intelligent control system based on electrochemical water splitting feedback, comprising: The group state quantity construction module is used to obtain the electrochemical water decomposition feedback data corresponding to the first electrochemical water decomposer group and the second electrochemical water decomposer group, and construct the group state quantities corresponding to the first electrochemical water decomposer group and the second electrochemical water decomposer group based on the electrochemical water decomposition feedback data. The continuous anomaly verification module is used to determine the current operating group in the first electrochemical water decomposer group and the second electrochemical water decomposer group, and to perform continuous anomaly verification processing on the group status variables corresponding to the current operating group based on the preset continuous anomaly verification rules, so as to obtain the fault confirmation result corresponding to the current operating group. The takeover qualification verification module is used to identify non-current operating groups as standby groups when the fault confirmation result indicates that the current operating group has a continuous abnormality. Based on the preset takeover qualification verification rules, the module performs takeover qualification verification processing on the group status variables corresponding to the standby group to obtain the switchover qualification result corresponding to the standby group. The inter-group collaborative switching control module is used to perform inter-group collaborative switching control on the currently running group and the standby group based on preset inter-group collaborative switching control rules, and according to the fault confirmation result and switching qualification result, so as to obtain the control result of the medical circuit board.

[0079] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A smart control method for medical circuit boards based on electrochemical water splitting feedback, characterized in that, Includes the following steps: S1. Obtain the electrochemical water decomposition feedback data corresponding to the first electrochemical water decomposer group and the second electrochemical water decomposer group, and construct the group state variables corresponding to the first electrochemical water decomposer group and the second electrochemical water decomposer group based on the electrochemical water decomposition feedback data. S2. Determine the current operating group in the first electrochemical water decomposer group and the second electrochemical water decomposer group, and perform continuous anomaly verification processing on the group status quantity corresponding to the current operating group based on the preset continuous anomaly verification rules to obtain the fault confirmation result corresponding to the current operating group. S3. When the fault confirmation result indicates that the current operating group has a continuous abnormality, the non-current operating group is identified as the standby group, and the standby qualification verification process is performed on the group status quantity corresponding to the standby group based on the preset takeover qualification verification rules to obtain the switchover qualification result corresponding to the standby group. S4. Based on the preset inter-group collaborative switching control rules, and according to the fault confirmation results and switching qualification results, perform inter-group collaborative switching control on the currently running group and the standby group to obtain the medical circuit board control results.

2. The intelligent control method for medical circuit boards based on electrochemical water decomposition feedback according to claim 1, characterized in that, In step S1, the electrochemical water decomposition feedback data includes at least the electrochemical water decomposer voltage, electrochemical water decomposer operating status, flow switch status, pressure switch status, group alarm status, group reset status, group solenoid valve drive output status, group solenoid valve readback status, operation interface startup status, maintenance interface startup status, and gear status corresponding to the first and second electrochemical water decomposer groups. The startup states of the operation interface and the maintenance interface satisfy a mutual exclusion constraint.

3. The intelligent control method for medical circuit boards based on electrochemical water decomposition feedback according to claim 2, characterized in that, In step S1, based on the electrochemical water decomposition feedback data, the group state variables corresponding to the first and second electrochemical water decomposer groups are constructed, including: The effective cumulative operating time of each electrochemical water decomposer group is determined based on the operating status of the electrochemical water decomposer and the status of the flow switch. Specifically, when the operating status of the electrochemical water decomposer indicates that the corresponding electrochemical water decomposer group is in operation and the status of the flow switch indicates that the flow switch is on, the effective cumulative operating time of the corresponding electrochemical water decomposer group is accumulated. The voltage anomaly characterization quantity corresponding to each electro-water decomposer group is determined based on the normalized deviation of the electro-water decomposer voltage from the preset voltage range. Determine the alarm reset characteristic quantity corresponding to each electrochemical water decomposer group based on the group alarm status and group reset status. Based on the consistency between the output state of the group solenoid valve drive and the readback state of the group solenoid valve, the valve group mapping consistency characterization quantity corresponding to each electrochemical water decomposer group is determined. Based on the effective cumulative operating time, voltage anomaly characterization, alarm reset characterization, and valve group mapping consistency characterization of each electrochemical water decomposer group, the group state quantity corresponding to each electrochemical water decomposer group is constructed. Among them, the solenoid valve readback status is the status represented by the solenoid valve readback signal, relay readback signal, or valve position feedback signal.

4. The intelligent control method for medical circuit boards based on electrochemical water decomposition feedback according to claim 3, characterized in that, In step S2, based on preset continuous anomaly verification rules, continuous anomaly verification processing is performed on the group status variables corresponding to the current operating group to obtain the fault confirmation result corresponding to the current operating group, including: Based on whether the voltage of the electrochemical water decomposer corresponding to the current operating group exceeds the preset voltage range and whether the effective cumulative operating time of the current operating group reaches the preset time threshold, the instantaneous abnormal state of the current operating group is determined. When the transient abnormal state continues to reach the preset duration threshold, it is determined that the current running group has a continuous abnormality, and the corresponding fault confirmation result of the current running group is output.

5. The intelligent control method for medical circuit boards based on electrochemical water splitting feedback according to claim 4, characterized in that, Step S2 also includes: After detecting that the operation interface startup status changes from invalid to valid, the system calculates the no-flow waiting time based on the flow switch status, and outputs the sodium chloride pump stop control when the no-flow waiting time reaches the preset waiting time. When the pressure switch changes from ON to OFF, the operation of the current operating group is suspended; when the pressure switch is turned ON again, the operation of the current operating group is resumed.

6. The intelligent control method for medical circuit boards based on electrochemical water decomposition feedback according to claim 5, characterized in that, In step S3, based on preset takeover eligibility verification rules, takeover eligibility verification is performed on the group state variables corresponding to the standby group to obtain the handover eligibility result corresponding to the standby group, including: The alarm clearing status of the standby group is determined based on the group alarm status and group reset status of the standby group; The valve group mapping consistency state corresponding to the standby group is determined based on the consistency between the drive output state of the group solenoid valve corresponding to the standby group and the readback state of the group solenoid valve. When the alarm clearing status indicates that there are no alarms in the standby group or the alarms have been reset, and the valve group mapping consistency status indicates that the valve group mapping relationship corresponding to the standby group is normal, the standby group is determined to be qualified to take over, and the switching qualification result corresponding to the standby group is output.

7. The intelligent control method for medical circuit boards based on electrochemical water decomposition feedback according to claim 6, characterized in that, In step S4, based on preset inter-group coordinated handover control rules, and according to the fault confirmation result and handover qualification result, inter-group coordinated handover control is performed on the currently operating group and the standby group, including: When the switch qualification result indicates that the standby group is qualified to take over, the fault flag of the current operating group is output, and the solenoid valve drive output of the current operating group and the corresponding group of the current operating group is stopped. After a preset isolation time, the solenoid valve drive output of the corresponding group of the standby group is started and the standby group is started.

8. The intelligent control method for medical circuit boards based on electrochemical water splitting feedback according to claim 7, characterized in that, In step S4, the inter-group coordinated handover control also includes: When the switchover qualification result indicates that the standby group is not qualified to take over, an interlock control that prohibits all outputs is executed. After starting the solenoid valve drive output of the standby group and the standby group is running, the takeover confirmation process is performed based on the voltage and flow switch status of the electrochemical water decomposer corresponding to the standby group. When the takeover confirmation process indicates that the standby group has not formed an effective takeover, an interlock control that prohibits all outputs is executed.

9. The intelligent control method for medical circuit boards based on electrochemical water decomposition feedback according to claim 8, characterized in that, In step S4, when the maintenance interface is in the active state, the automatic inter-group collaborative switching control between the current running group and the standby group is prohibited, and the maintenance output link corresponding to the current running group is controlled to run. The maintenance output link should include at least the intake solenoid valve, the distilled water pump, the group solenoid valve corresponding to the current operating group, and the current operating group; The distilled water pump operates at a low speed and stops maintenance output when the maintenance time reaches the preset maintenance time threshold or when a manual stop command is received.

10. A medical circuit board intelligent control system based on electrochemical water decomposition feedback, employing the medical circuit board intelligent control method based on electrochemical water decomposition feedback as described in any one of claims 1-9, characterized in that, include: The group state quantity construction module is used to obtain the electrochemical water decomposition feedback data corresponding to the first electrochemical water decomposer group and the second electrochemical water decomposer group, and construct the group state quantities corresponding to the first electrochemical water decomposer group and the second electrochemical water decomposer group based on the electrochemical water decomposition feedback data. The continuous anomaly verification module is used to determine the current operating group in the first electrochemical water decomposer group and the second electrochemical water decomposer group, and to perform continuous anomaly verification processing on the group status variables corresponding to the current operating group based on the preset continuous anomaly verification rules, so as to obtain the fault confirmation result corresponding to the current operating group. The takeover qualification verification module is used to identify non-current operating groups as standby groups when the fault confirmation result indicates that the current operating group has a continuous abnormality. Based on the preset takeover qualification verification rules, the module performs takeover qualification verification processing on the group status variables corresponding to the standby group to obtain the switchover qualification result corresponding to the standby group. The inter-group collaborative switching control module is used to perform inter-group collaborative switching control on the currently running group and the standby group based on preset inter-group collaborative switching control rules, and according to the fault confirmation result and switching qualification result, so as to obtain the control result of the medical circuit board.

Images