Building energy consumption optimization control method and system

Abstract

The invention relates to the technical field of building energy consumption management and automatic control, in particular to a building energy consumption optimization control method and system. Comprising the steps of collecting and forming periodic data; mapping equipment is configured according to regions, and a region state and intention model is generated; solving a control plan (set value / start-stop sequence) by the model; generating a contract, a candidate program and a monitor according to the model and the control plan; performing static verification on the candidate program, issuing the candidate program together with the contract and the monitor to a program controller when the candidate program passes the static verification, and loading a shadow channel; and outputting in a verification window according to a contract and a data verification shadow, switching the atom to an active program when the contract and the data verification shadow are consistent, and retaining the original program and forbidding the candidate when the contract and the data verification shadow are inconsistent. According to the method, constraint and operation consistency verification is completed on a candidate control program under PLC shadow channel and output virtualization isolation, after the verification is passed, the candidate control program is switched into an active program at a scanning period boundary atom, and if the verification is not passed, the candidate control program is forbidden, so that a new control program is safely online on the premise of not interrupting equipment operation.

Description

Technical Field

[0001] This invention relates to the field of building energy management and automatic control technology, and in particular to a building energy consumption optimization control method and system. Background Technology

[0002] In the field of building energy management and automation control, energy-consuming equipment such as HVAC equipment, lighting equipment, and power equipment are typically controlled by programmable logic controllers (PLCs) and other control devices to perform start-stop control and setpoint adjustment. As building load, outdoor environment, and operating strategies change, the control platform often needs to periodically calculate or adjust the control strategy based on energy consumption metering data, environmental parameter data, and equipment operating status data, and then send the corresponding control logic, control program, or control parameters to the field control devices for execution.

[0003] In the existing technology, there are already solutions for introducing advanced control algorithms into the PLC operating environment. For example, CN105103059A discloses a system and method for implementing model predictive control in a PLC. This method constructs a system process model and control logic using engineering tools, downloads the relevant model and control logic to the PLC, and then the PLC executes the corresponding control functions during runtime. This type of solution can realize the basic chain of "control side constructing / updating control logic—downloading to PLC—PLC running and executing".

[0004] However, in the actual operation of building energy-consuming equipment, the control logic or control program often needs to be updated as operating conditions change. For such "candidate control programs," before they are put into actual output, how to fully verify their output behavior and constraint satisfaction under the condition of periodic scanning execution by the PLC, and how to achieve smooth and reliable version switching and failure handling after verification to reduce the output risks and constraint violation risks introduced during the update process—existing technologies have not yet clearly provided a set of technical paths that match the operating characteristics of the PLC and are easy to implement in engineering.

[0005] Therefore, the main technical problem that this invention aims to solve is: in the scenario of building energy consumption optimization control, how to improve the safety and reliability of the candidate control program without affecting the continuous operation of energy-consuming equipment, and reduce the output risk and constraint violation risk introduced by the update process, when faced with the need to update the control program. Summary of the Invention

[0006] To overcome the aforementioned technical deficiencies, the present invention aims to provide a building energy consumption optimization control method and system. The present invention introduces a control contract file and a runtime safety monitor. First, candidate control programs are sent to the shadow execution channel of the PLC and constraint consistency and operational consistency are determined within a preset verification window under output virtualization isolation. If the determination is successful, the active control program is switched at the boundary atom of the scan cycle; otherwise, the candidate version is disabled. Thus, the control program update is safely and reliably launched without interrupting the operation of the equipment.

[0007] This invention discloses a building energy consumption optimization and control method, applicable to buildings including at least one energy-consuming device, which includes at least one of heating, ventilation, and air conditioning equipment, lighting equipment, and power equipment. The method is executed collaboratively by a control platform and a programmable controller, and includes: Step S1: In each control cycle, acquire energy consumption metering data, environmental parameter data, equipment operating status data, and external influence data, and align the data with timestamps to obtain control cycle data; Step S2: Based on the preset control area configuration, map the energy-consuming devices to at least one control area, generate area status data for each control area, and generate a control intent model based on the area status data. Step S3: Under the conditions of satisfying comfort constraints and safe operation constraints, the control plan is obtained by solving based on the control intention model. The control plan includes at least one of the setpoint sequence and / or start-stop sequence of each control variable in the prediction time domain. Step S4: Generate a control contract file based on the control intent model and control plan, and generate candidate control programs and runtime safety monitors based on the control contract file and control plan. The control contract file includes at least an input variable list, an output variable list, an output allowable range, an output change rate limit, a start / stop minimum interval limit, mutual exclusion and interlock conditions, and sequential steps. Step S5: Perform static verification on the candidate control program and generate a verification mark. When the static verification is passed, send the candidate control program, runtime security monitor, control contract file and verification mark to the program controller and load the candidate control program into the shadow execution channel. The program controller includes an output virtualization layer, which is used to write the output of the shadow execution channel into the shadow output buffer and does not drive the power-consuming device. Step S6: Within a continuous scan cycle of no less than the preset verification window cycle number, perform constraint consistency determination on the output of the shadow output buffer based on the control contract file, and perform runtime consistency determination on the shadow execution channel based on the control cycle data; when both constraint consistency determination and runtime consistency determination pass, perform an atomic commit at the scan cycle boundary, switch the candidate control program to the active control program, and enable the runtime security monitor to take effect on the output of the active control program; when either constraint consistency determination or runtime consistency determination fails, keep the current active control program as the active control program, and mark the candidate control program as a disabled version.

[0008] Preferably, the control contract document further includes: a sampling period identifier, a data type identifier, and a physical quantity unit identifier corresponding to each input variable and each output variable; the control intent model further includes a control variable and device execution interface mapping table, which includes a one-to-one correspondence between variable identifiers and program controller input / output point identifiers.

[0009] Preferably, the candidate control program includes sequential control logic and interlock control logic; the sequential steps are stored in the form of a sequential step table, and the mutual exclusion and interlock conditions are stored in the form of a mutual exclusion and interlock condition table; the sequential step table and the mutual exclusion and interlock condition table are stored in the program controller in the form of data segments, and are called and executed by preset function blocks during the scan cycle.

[0010] Preferably, static verification includes: constructing a state transition diagram based on sequential steps, and constructing an interlocking constraint diagram based on a mutual exclusion and interlocking condition table; performing reachability checks on the state transition diagram to identify dead loop states and unreachable states, and performing conflict checks on the interlocking constraint diagram to identify mutual exclusion and interlocking contradictions; determining that static verification passes when there are no dead loop states, unreachable states, or mutual exclusion and interlocking contradictions.

[0011] Preferably, the output virtualization layer includes an active output mapping table and a shadow output mapping table; the output of the active control program is bound to the physical output point through the active output mapping table, and the output of the shadow execution channel is bound to the shadow output buffer through the shadow output mapping table.

[0012] Preferably, the program controller generates a checkpoint before performing an atomic commit. The checkpoint includes at least the data segment state corresponding to the current active control program, the active output mapping table state, and the internal state of the runtime safety monitor. When the active control program is switched and a preset rollback trigger condition is met, the program controller restores the checkpoint to the running state at the time of checkpoint generation at the scan cycle boundary and switches the control program that was active at the time of checkpoint generation to the active control program. The preset rollback trigger condition includes: the runtime safety monitor triggers more than a preset number of times within a preset statistical window period and / or the number of consecutive scan cycles in which constraint consistency determination fails exceeds a preset period threshold.

[0013] Preferably, the constraint consistency determination includes: within a preset verification window period, determining whether the output of the shadow output buffer violates any one of the following: the output allowable range, the output change rate limit, the start / stop minimum interval limit, and the mutual exclusion and interlocking conditions; if none of them are violated, the constraint consistency determination is deemed successful.

[0014] Preferably, the operation consistency determination includes: within a preset verification window period, performing a consistency check between the input variable values ​​of the shadow execution channel and the corresponding input data in the control cycle data, and performing a deviation check between the output variable values ​​of the shadow execution channel and the corresponding execution feedback in the device operation status data; when both the consistency check and the deviation check meet the preset threshold conditions, the operation consistency determination is passed.

[0015] Preferably, the runtime safety monitor includes at least setpoint upper and lower limit monitoring, setpoint change rate monitoring, start / stop minimum interval monitoring, and mutual exclusion and interlock monitoring; the runtime safety monitor generates a restricted output when any monitoring is triggered, and replaces the corresponding output of the activity control program with the restricted output.

[0016] Preferably, at the beginning of each scan cycle, the program controller samples the input variables identified by the input variable list in the control contract file and generates an input snapshot; the input snapshot is simultaneously provided to the current active control program and the shadow execution channel; the operation consistency determination further includes: within a preset verification window period, performing a difference check between the output of the shadow output buffer and the output generated by the current active control program under the same input snapshot, and using the difference check meeting a preset difference threshold condition as one of the criteria for passing the operation consistency determination.

[0017] Preferably, when the constraint consistency determination fails or the runtime consistency determination fails, the program controller generates a counterexample trajectory and reports it to the control platform; the counterexample trajectory includes at least: the violation entry identifier in the control contract file, the input snapshot sequence corresponding to the violation entry identifier, the output sequence of the shadow output buffer, and the scan cycle timestamp of the violation.

[0018] Preferably, a two-phase commit protocol is used for the issuance, which includes: The control platform sends a preparation message to the program controller. The preparation message includes at least a preparation identifier, a candidate control program, a runtime safety monitor, a control contract file, and a verification flag. After the program controller loads the candidate control program into the shadow execution channel and completes the verification of the verification mark, it generates a preparation confirmation message and returns it to the control platform. The preparation confirmation message includes at least a preparation identifier and candidate version verification information. The candidate version verification information includes at least a candidate version number and a verification code. Upon receiving a commit message from the control platform, the program controller performs an atomic commit at the scan cycle boundary; if no commit message is received within the preset timeout window period, the program controller cancels the candidate version corresponding to the preparation message and releases the shadow execution channel resources.

[0019] Preferably, the program controller sets coverage count points for sequential steps and mutual exclusion conditions in the shadow execution channel, and generates a coverage table within a preset verification window period; the coverage table includes at least the number of accesses for each sequential step and the number of judgments for each mutual exclusion condition; the atomic submission further satisfies the following condition: the coverage table satisfies a preset coverage threshold condition.

[0020] Preferably, the candidate control program is generated in a templated form, which includes a template identifier and a contract parameter set. The control platform sends the template identifier and contract parameter set to the program controller, and the program controller calls the preset template program based on the template identifier, instantiates the candidate control program based on the contract parameter set, and then loads it into the shadow execution channel.

[0021] Preferably, the program controller generates version fingerprints based on the control contract file and candidate control programs, and maintains a disabled fingerprint table; when a candidate control program is marked as a disabled version, the version fingerprint is written into the disabled fingerprint table; within a preset blocking window period, the program controller refuses to load candidate control programs whose version fingerprints are the same as any fingerprint in the disabled fingerprint table.

[0022] In view of this, a second objective of the present invention is to provide a building energy consumption optimization control system, comprising: The data acquisition unit is used to acquire energy consumption metering data, environmental parameter data, equipment operating status data, and external influence data, and generate control cycle data; The region modeling unit is used to generate region status data and a control intent model based on the control region configuration. An optimized solution unit is used to solve for the control plan while satisfying comfort and safe operation constraints; The contract generation unit is used to generate control contract documents based on the control intent model and control plan. The program synthesis unit is used to generate candidate control programs and runtime safety monitors based on control contract documents and control plans; The verification unit is used to perform static verification on the candidate control program and generate verification markers. The program controller includes a shadow execution channel, an output virtualization layer, and a shadow output buffer. The shadow execution channel is used to execute candidate control programs and its output is written to the shadow output buffer and does not drive the power-consuming device. The judgment and submission unit is used to perform constraint consistency judgment and operational consistency judgment within a preset verification window period number, and when both constraint consistency judgment and operational consistency judgment pass, it performs atomic submission at the scan period boundary to switch the candidate control program to the active control program. The system is configured to perform the steps described above.

[0023] Compared with existing technologies, the above technical solution has the following advantages: 1. In existing technologies, engineers typically modify the control program logic on the host computer, download the new control program to the field program controller, and switch directly to the running version within a short time. This lacks a systematic shadow verification, constraint verification, and rollback protection mechanism. If the new program has logical defects or is incompatible with field conditions, problems such as sudden output changes, constraint violations, or even control interruptions can easily occur, making it difficult to guarantee building safety and comfort. This invention introduces technical solutions including a control contract file, a shadow execution channel, an output virtualization layer, a two-phase commit protocol, atomic commit at scan cycle boundaries, and checkpoint rollback. The candidate control program first runs in the shadow execution channel, and its output is only written to the shadow output buffer without driving physical devices. Within the verification window, consistency judgments are made based on the control contract file, including output range, rate of change, minimum start / stop interval, mutual exclusion and interlocking, and cross-region shared capacity and setpoint difference. Combined with operational consistency judgments and coverage thresholds, the program is atomically switched to the active control program only when all judgments pass. If constraint violation anomalies occur within the statistics window after going live, a rollback based on checkpoints can restore the program to the stable version before the switch. Through the above technical solutions, the present invention significantly reduces the operational risks caused by control program updates and switching, effectively avoids problems such as output spikes, frequent malfunctions and control interruptions, and significantly improves the safety and stability of the building energy consumption optimization control system.

[0024] 2. Traditional building energy consumption control often focuses on single areas or single devices, lacking unified modeling and coordinated control of shared capacity constraints and setpoint difference constraints across multiple areas. This easily leads to problems such as excessive cooling / heating in certain areas, prolonged operation of some devices in uneconomical zones, and poor overall energy efficiency. Furthermore, in demand response scenarios, adjustments are often made crudely using simple peak shaving or power limiting methods. This invention, through a multi-area collaborative control intent model and control plan solution module, simultaneously considers energy consumption, comfort bias, and start-stop switching penalties in the comprehensive objective function. By using shared capacity constraints and cross-area setpoint difference limits, it coordinates the setpoints and energy loads of multiple areas within the building as a whole. Simultaneously, it adaptively adjusts the weight of comfort items based on demand response status, achieving a dynamic trade-off between energy saving and comfort. Through the above technical solution, this invention can more fully utilize shared cold and heat sources and power distribution capacity without sacrificing the comfort of critical areas, thereby reducing energy consumption and peak load per unit time, achieving multi-area collaborative energy saving, and significantly improving the overall building energy efficiency.

[0025] 3. In existing technologies, pre-deployment judgments for control programs typically rely on the experience of engineers, making it difficult to quantify and evaluate performance based on factors such as constraint violation counts, deviation magnitudes, and output drift. Deployment decisions are highly subjective, and there is a lack of continuous risk monitoring and dynamic threshold adjustment mechanisms after deployment. This invention quantifies the operational status of the shadow validation and canary deployment phases by setting a risk scorer and an adaptive threshold: the risk score is calculated based on indicators such as constraint trigger counts, comfort bias, and output drift, while the adaptive threshold is automatically adjusted based on the mean and standard deviation of recent risk statistics. The system only allows entry into the next phase or full submission when the risk score remains consistently below the adaptive threshold and consistency and coverage thresholds are met; otherwise, phase blocking, rollback evaluation, or process disabling are triggered. Through this technical solution, this invention constructs a quantifiable and dynamically adjustable risk gating mechanism, providing objective and traceable decision-making basis before and after control program deployment, reducing reliance on human experience and improving the reliability of deployment decisions.

[0026] 4. In existing technologies, control program verification is often conducted in laboratories or small-scale field operations, making it difficult to cover complex working conditions and boundary scenarios. Problems are only gradually exposed after deployment. Direct full-scale switchover, if it fails, has a wide impact and high rollback costs. This invention addresses this by using a scenario coverage generator and a digital twin sandbox to inject synthetic input snapshots into candidate control programs in non-production environments and shadow execution channels. This proactively triggers branches that are difficult to occur naturally under sequential steps and mutually exclusive conditions, improving coverage within the verification window. Furthermore, through a canary release manager and a canary release partition table, the building is divided into multiple regional batches. Candidate control programs are gradually enabled in batches, and the pass rate of each batch is statistically analyzed. Only when the pass rate meets a preset threshold is the process expanded to the next batch or full deployment. Through these technical solutions, this invention improves verification sufficiency through scenario coverage before deployment and reduces the risk of a single switchover during deployment through partitioned deployment. This achieves a progressive control program update path of "shadow verification first, then small-scale trial operation, and finally full-scale switchover," significantly reducing the impact of deployment failures on the overall building operation. Attached Figure Description

[0027] Figure 1 A schematic diagram illustrating the transient output curve update for the control program; Figure 2 A schematic diagram illustrating the cumulative number of violations of constraints; Figure 3 This is a schematic diagram of the rate of change curve of the setpoint; Figure 4 This is a schematic diagram of the coverage growth curve during the shadow verification phase. Figure 5 This is a schematic diagram of the electricity cost curve per unit time. Figure 6 This is a schematic diagram of the comfort deviation index curve; Figure 7 A schematic diagram of the pass rate curve during the canary release phase; Figure 8 This is a schematic diagram of the risk score and adaptive threshold curve; Figure 9 This is a schematic diagram of the change curve of the setpoint difference caused by multi-regional collaboration. Figure 10 This is a schematic diagram illustrating the steps of a building energy consumption optimization control method and system according to the present invention. Detailed Implementation

[0028] See Figure 10As shown, this embodiment provides a building energy consumption optimization control method, applied to a building including at least one energy-consuming device, wherein the energy-consuming device includes at least one of HVAC equipment, lighting equipment, and power equipment. The method is executed collaboratively by a control platform and a programmable controller, including: Step S1, in each control cycle, acquiring energy consumption metering data, environmental parameter data, equipment operating status data, and external influence data, and aligning the data with timestamps to obtain control cycle data; Step S2, based on a preset control area configuration, mapping the energy-consuming device to at least one control area, generating the area status of each control area. The system first obtains state data and generates a control intent model based on the state data of the region; Step S3: Under the condition of satisfying comfort constraints and safe operation constraints, a control plan is obtained based on the control intent model. The control plan includes at least one setpoint sequence and / or start-stop sequence of each control variable in the prediction time domain; Step S4: A control contract file is generated according to the control intent model and the control plan, and a candidate control program and a runtime safety monitor are generated based on the control contract file and the control plan. The control contract file includes at least an input variable list, an output variable list, an output allowable range, and an output change rate limit. The steps are as follows: Step S5: Perform static verification on the candidate control program and generate a verification flag. When the static verification passes, send the candidate control program, the runtime security monitor, the control contract file, and the verification flag to the program controller, and load the candidate control program into the shadow execution channel. The program controller includes an output virtualization layer, which is used to write the output of the shadow execution channel into the shadow output buffer without driving the power-consuming device. Step S6: Within a continuous scan cycle of no less than a preset verification window cycle number, perform constraint consistency determination on the output of the shadow output buffer based on the control contract file, and perform runtime consistency determination on the shadow execution channel based on the control cycle data. When both constraint consistency determination and runtime consistency determination pass, perform an atomic commit at the scan cycle boundary, switch the candidate control program to the active control program, and enable the runtime security monitor to take effect on the output of the active control program. When either constraint consistency determination or runtime consistency determination fails, keep the current active control program as the active control program and mark the candidate control program as a disabled version.

[0029] For ease of explanation and understanding, this embodiment will be described in detail through the following Embodiment 1 and Embodiment 2.

[0030] Example 1

[0031] This embodiment addresses an energy consumption optimization and control scenario for an office building. The building contains at least one energy-consuming device, including one or more of the following: HVAC equipment, lighting equipment, and power equipment. The system side includes a control platform. With programmable controller The control platform is used to aggregate data, construct control intentions, and form control plans within the control cycle, while the programmable controller is used to execute the control program and implement control outputs to the field power-consuming equipment within the scan cycle. The control platform and the programmable controller communicate via industrial Ethernet. The programmable controller adopts a periodic scan execution mode, and the scan cycle can be configured from 0.1s to 1s.

[0032] In this first embodiment, the control period is set to s, scan cycle set to s. Preset verification window period count Set the value to 200, and set the preset timeout window period to [number]. Set the value to 600, and preset the number of statistical window periods. Set the value to 900, and set the preset blocking window period. Select 3600. The above parameters are example configurations and are not the only options. In actual implementation, they can be adjusted according to the response speed of the energy-consuming equipment and the requirements for on-site stability.

[0033] like Figure 1 As shown, Figure 1 This is a schematic diagram of the transient output curve updated by the control program. The horizontal axis represents time (illustrative, labeled). , , , The vertical axis represents the valve opening setting value (%), used to compare the continuity of the setting values ​​near the update time between the two strategies of "direct activation after download" and "submission after shadow verification".

[0034] like Figure 2 As shown, Figure 2 The diagram illustrates the cumulative number of constraint violations, with the horizontal axis representing time (illustrated) and the vertical axis representing the cumulative number of constraint violations (times). This is used to compare the cumulative constraint violations of the two strategies during operation.

[0035] like Figure 3 As shown, Figure 3 This is a schematic diagram of the setpoint change rate curve, with the horizontal axis representing time (illustrated) and the vertical axis representing the setpoint change rate (% / unit time), used to illustrate the relationship between the output change rate limit and the suppression of transient spikes.

[0036] Figure 4As shown in Figure 4, the shadow verification phase coverage growth curve is a schematic diagram. The horizontal axis represents time (illustrated) and the vertical axis represents coverage (0~1). It is used to illustrate the process by which the coverage of sequential steps and mutually exclusive interlocking conditions in the shadow verification phase increases over time and reaches the threshold.

[0037] like Figure 5 As shown, Figure 5 This is a schematic diagram of the electricity cost curve per unit time. The horizontal axis represents time (hours), and the vertical axis represents the electricity cost per unit time (illustrated). It is used to compare the electricity cost fluctuations of the two strategies during multiple updates.

[0038] like Figure 6 As shown, Figure 6 This is a schematic diagram of the comfort deviation index curve, with the horizontal axis representing time (hours) and the vertical axis representing the comfort deviation index (illustrated), used to compare the fluctuations in comfort deviation between the two strategies during multiple updates.

[0039] Step S1: Acquire control cycle data and align it with the timestamp (to form control cycle data)

[0040] At the beginning of each control cycle, the control platform collects energy consumption data, environmental parameter data, equipment operating status data, and external influence data from energy consumption metering devices, environmental sensors, and equipment controllers, and timestamps the data to form control cycle data. The energy consumption metering data should include at least the electricity metering value, steam metering value and / or compressed air metering value; the environmental parameter data should include at least the outdoor temperature, outdoor humidity, indoor temperature, indoor humidity and carbon dioxide concentration; the equipment operation status data should include at least the equipment start-up and shutdown status, valve opening feedback, fan speed feedback, supply and return water temperature, etc.; and the external impact data should include at least the time-of-use electricity price signal and / or demand response event signal.

[0041] To ensure input consistency in subsequent solution processes, the control platform uses a unified control cycle time base to process the raw sequences from different acquisition sources. Alignment. For example, any measurement can be aligned. Alignment using linear interpolation:

[0042] in, and To surround The adjacent sampling times are used. For missing data, forward hold or interpolation can be used to fill in the gaps; for obvious outliers, they can be removed and then aligned, thus forming control cycle data that is comparable in time and can be used for subsequent optimization and consistency determination in numerical dimension.

[0043] In addition, to facilitate project implementation and subsequent constraint verification, the control platform configures a sampling period identifier for each input and output variable. Data type identifier with unit identification And keep consistent records in subsequent control contract documents to avoid judgment errors caused by inconsistent variable definitions.

[0044] Step S2: Control area mapping, area state generation, and control intent modeling (forming a control intent model)

[0045] The control platform reads the control area configuration. The system maps energy-consuming devices to at least one control area. For example, office area A and office area B can be designated as two control areas, and the air handling units, supply fans, chilled water valves, and lighting circuits within each area can be assigned to their respective control areas. The control platform generates area status data based on control cycle data and control area configurations. The regional status data should include at least the load estimate, comfort deviation, equipment availability status and energy consumption statistics for the control area.

[0046] Regarding load estimation, the control platform can use simplified regression or energy balance methods to obtain regional load estimates, for example: .

[0047] in, For the first Load estimates for each control cycle Outdoor temperature Indoor temperature, This refers to the concentration of carbon dioxide. For the intensity of personnel occupancy, ~ These are the fitting coefficients. Comfort deviation can be characterized by temperature exceedances, for example, by the temperature comfort range. :

[0048] After obtaining the regional status data, the control platform generates a control intent model. The control intent model is used at least to characterize the control objectives, constraints, and the mapping relationship between control variables and device execution interfaces. To ensure clear point binding on the programmable controller side, the control platform organizes the mapping relationship between control variables and device execution interfaces into a control variable-device execution interface mapping table. The mapping table must contain at least the control variable identifier, the program controller input / output point identifier, the data type identifier, and the unit identifier.

[0049] Table 1. Example of mapping between control variables and device execution interfaces (mapping table) )

[0050] Step S3: Solve for the control plan under comfort and safe operation constraints (form the control plan).

[0051] The control platform meets comfort constraints With safety operation constraints Under the given conditions, the control plan is obtained by solving based on the control intent model. The control plan includes the setpoint sequence and / or start / stop sequence for each control variable within the prediction time domain. In this embodiment, the prediction time domain length is set to... One control cycle (example taken) ).

[0052] Exemplary integrated objective function It can be written as:

[0053] in, For the first Electricity price for each control cycle This is the predicted value of electricity consumption. As a comfort deviation index, Penalty for start / stop switching and For weights.

[0054] To ensure executability, safe operation constraints must include at least the following criteria and be satisfied during the solution phase, thus providing a consistent source of constraints for subsequent contracts and verification: Output allowed range constraints: ; Output rate of change limit: ; Minimum start / stop interval limit: for start / stop variables At least an interval between two switching operations One control cycle; Mutual exclusion and interlocking restrictions: for mutex groups No two devices in the group can both be set to 1, for example: ; in, For the first The first control cycle Each output variable is set to a value. and These are the upper and lower limits. For the maximum allowed increment, For the minimum interval, and These are start / stop variables within a mutual exclusion group.

[0055] Step S4: Generate control contract documents, candidate control programs, and runtime security monitors (forming candidate versions).

[0056] The control platform generates control contract documents based on the control intent model and control plan. The control contract document must include at least a list of input variables. Output variable list Output allowed range Output rate of change limit Minimum start-stop interval limit Mutual exclusion and interlock conditions and sequential steps And ensure that the field definitions are consistent with the mapping table and unit identifiers, so that the program controller can directly perform verification.

[0057] For ease of explanation, the output constraint entries in the control contract file can be defined as follows: Table 2 Examples of Constraint Entries in Control Contract Documents (Excerpt) )

[0058] In this embodiment, mutual exclusion and interlocking conditions are organized into a mutual exclusion and interlocking condition table. Organize the sequential steps into a sequential step table. : Table 3 Examples of Mutual Exclusion and Interlock Conditions (Mutual Exclusion and Interlock Condition Table) )

[0059] Table 4. Examples of Sequential Steps (Sequential Steps Table) )

[0060] The control platform generates candidate control programs based on the control contract documents and control plan. And generate a runtime security monitor based on the control contract file. .

[0061] The runtime safety monitor includes at least the monitoring of upper and lower limits of setpoints, monitoring of the rate of change of setpoints, monitoring of the minimum start-stop interval, and monitoring of mutual exclusion and interlock. When any monitoring is triggered, a restricted output is generated and the corresponding output is replaced by the restricted output.

[0062] To improve distribution efficiency and consistency, this embodiment further adopts a template-based generation method: candidate control programs are generated in a template-based format, which includes template identifiers. With contract parameter set The control platform sends a template identifier and a set of contract parameters to the program controller. The program controller then calls a preset template program based on the template identifier and instantiates a candidate control program based on the set of contract parameters.

[0063] Step S5: Static verification, two-phase deployment, and shadow execution loading (forming shadow isolation verification)

[0064] The control platform performs static verification on candidate control programs and generates verification markers. Static verification includes constructing a state transition graph based on a sequential step table and performing reachability checks to identify infinite loops and unreachable states. Simultaneously, it involves constructing an interlock constraint graph based on a mutual exclusion and interlock condition table and performing conflict checks to identify mutual exclusion and interlock contradictions. Static verification is considered successful and a verification flag is generated when no infinite loops, unreachable states, or mutual exclusion and interlock contradictions exist. The verification flag includes at least a static verification success identifier and candidate control program verification information.

[0065] After static verification is passed, the control platform adopts a two-phase commit protocol. Perform distribution and switching control. The two-phase commit protocol includes a preparation message. Prepare to confirm the message With Submit Message The control platform sends a preparation message to the program controller. This message includes at least a preparation identifier, candidate control programs, a runtime security monitor, a control contract file, and a verification flag. After loading the candidate control programs into the shadow execution channel and verifying the verification flags, the program controller generates a preparation confirmation message and returns it to the control platform. This confirmation message includes at least a preparation identifier and candidate version verification information, which includes at least the candidate version number and a checksum. Upon receiving a commit message, the program controller performs an atomic commit at the scan cycle boundary. ;exist If no commit message is received within a scan cycle, the program controller cancels the candidate version corresponding to the preparation message and releases resources.

[0066] To ensure that the candidate control program does not drive actual energy-consuming equipment during the verification phase, the program controller includes an output virtualization layer. The output virtualization layer contains an active output mapping table. Mapping table with shadow output The output of the activity control program is bound to the physical output point through the activity output mapping table; shadow execution channel The output is bound to the shadow output buffer through the shadow output mapping table. Furthermore, the output of the shadow output buffer does not drive the power-consuming device, thereby achieving the isolation verification of the candidate control program as "runnable, observable, and unactable".

[0067] Step S6: Consistency determination, coverage threshold, atomic commit / disable, negative example traces, rollback and blocking loop closure.

[0068] Not less than Within each scan cycle, the program controller performs constraint consistency determination on the output of the shadow output buffer based on the control contract file. And based on the control cycle data, the consistency of the shadow execution channel is determined. When both constraint consistency and operational consistency checks pass and the coverage threshold is met, the program controller performs an atomic commit at the scan cycle boundary, switching the candidate control program to the active control program. When either constraint consistency or operational consistency checks fail, the program controller keeps the current active control program running and marks the candidate control program as a disabled version.

[0069] Input snapshot and same input comparison mechanism

[0070] Not less than Within each scan cycle, the program controller performs constraint consistency determination on the output of the shadow output buffer based on the control contract file. And based on the control cycle data, the consistency of the shadow execution channel is determined. When both constraint consistency and operational consistency checks pass and the coverage threshold is met, the program controller performs an atomic commit at the scan cycle boundary, switching the candidate control program to the active control program. When either constraint consistency or operational consistency checks fail, the program controller keeps the current active control program running and marks the candidate control program as a disabled version.

[0071] Input snapshot and same input comparison mechanism

[0072] At the beginning of each scan cycle, the program controller samples the input variables identified by the input variable list and generates an input snapshot. The input snapshot is provided to both the current active control program and the shadow execution channel to ensure that the two channels are under the same input conditions.

[0073] Consistency determination of constraints (range / rate of change / interval / mutual exclusion / interlocking)

[0074] Let the shadow output buffer be at the th The first scan cycle generated the first The output is The output allowed range check is as follows: ; The output change rate check is as follows: ; in, , , It originates from the corresponding entry in the control contract document. Figure 3 This illustration shows that near the update time, the rate of change curve is more likely to spike under the "use immediately after downloading" strategy, while it is smoother under the "submit after shadow verification" strategy (see...). Figure 3 ).

[0075] The minimum start / stop interval can be limited by maintaining the distance from the last switch count. And require: ; Mutual exclusion and interlock conditions are evaluated one by one according to the mutual exclusion and interlock condition table. For example, for starting and stopping outputs within a mutual exclusion group. and Mutual exclusion check is as follows: ; Operational consistency determination (feedback deviation + output difference threshold) Operational consistency determination includes checking for discrepancies between the shadow execution channel output and the device execution feedback, for example:

[0076] in, For device execution feedback, The quantity in the shadow execution channel output that is comparable to this feedback. The deviation threshold condition (the deviation threshold condition as a whole is denoted as) And configured by component).

[0077] At the same time, the program controller performs a difference check between the shadow output and the output generated by the currently active control program under the same input snapshot: ; in, Output for the current activity control procedure. The difference threshold condition (denoted as ) (and configured by component). This mechanism is used to avoid transient risks caused by excessive deviation in output of candidate versions at the moment of deployment. Figure 1 This illustration demonstrates the difference in output continuity between the two strategies near the update time (see...). Figure 1 ).

[0078] Coverage threshold (sufficiency of verification of sequential steps and mutually exclusive lock conditions)

[0079] The program controller sets coverage count points for sequential steps and mutual exclusion / interlock conditions in the shadow execution channel. and in Generate coverage table within each scan cycle The coverage table should include at least the number of accesses for each sequential step and the number of checks for each mutual exclusion / lock condition. Coverage can be represented as follows: ; in, The number of entries that are triggered at least once. Total number of entries. Coverage threshold condition. It can be configured to achieve a critical sequential step coverage of 1 and a mutual exclusion and interlock condition coverage of a preset ratio. Figure 4 This illustration shows the process by which coverage increases over time and reaches a threshold (see...). Figure 4 ).

[0080] Counterexample trajectory (used to pinpoint the cause of failure)

[0081] When a constraint consistency check or a runtime consistency check fails, the program controller generates a counterexample trajectory. The violation trajectory must be reported to the control platform. It must include at least the violation entry identifier in the control contract file, the corresponding input snapshot sequence, the shadow output sequence, and the scan cycle timestamp of the violation.

[0082] When a constraint consistency check or a runtime consistency check fails, the program controller generates a counterexample trajectory. The violation trajectory must be reported to the control platform. It must include at least the violation entry identifier in the control contract file, the corresponding input snapshot sequence, the shadow output sequence, and the scan cycle timestamp of the violation.

[0083] Table 5 Example of the counterexample trajectory field (counterexample trajectory) )

[0084] Checkpoint rollback (can be restored after going live)

[0085] The program controller generates checkpoints before performing atomic commits. The checkpoints include at least the data segment status corresponding to the current activity control program, the activity output mapping table status, and the internal status of the runtime security monitor. When the activity control program switches, the rollback trigger condition is met. At the scan cycle boundary, the program controller restores the checkpoint to the running state at the time the checkpoint was generated and switches the control program that was active at the time the checkpoint was generated to the active control program. Rollback trigger conditions include: the runtime safety monitor... The number of triggers within a single scan cycle exceeds a preset threshold, and / or the number of consecutive scan cycles in which the constraint consistency determination fails exceeds a preset cycle threshold.

[0086] Version fingerprint and blocking window (to suppress duplicate failures)

[0087] The program controller generates version fingerprints based on the control contract file and candidate control programs. And maintain the fingerprint table that is disabled. When a candidate control program is marked as a disabled version, its version fingerprint is written to the disabled fingerprint table; Within each scan cycle, the program controller refuses to load candidate control programs whose version fingerprints are the same as any fingerprint in the disabled fingerprint table.

[0088] To facilitate the explanation of the operational risk control mechanism during the control program update process, this embodiment constructs "Comparative Embodiment A (Prior Art Path)" and "Embodiment B (This Embodiment)" for comparison under the same building simulation / integration environment as steps S1 to S6 described above. Comparative Embodiment A adopts the implementation path closest to the prior art in the background technology, that is, the control logic / control program is generated or updated by the engineering side and downloaded to the program controller for direct activation, and the program controller executes the corresponding control logic during runtime; Comparative Embodiment A does not include shadow execution channel, output virtualization layer, consistency determination within the verification window, atomic commit at the scan cycle boundary, disabling version blocking, and checkpoint rollback mechanism. Embodiment B is executed according to the aforementioned steps S1 to S6, and includes control contract file, candidate control program, runtime security monitor, shadow execution channel, output virtualization layer, verification window determination, coverage threshold, atomic commit at the scan cycle boundary, negative example trajectory, checkpoint rollback, and version fingerprint blocking mechanisms.

[0089] Near the update time, in Comparative Implementation A, setpoints are more prone to sudden changes or exceeding limits; in Implementation B, because the candidate control program runs first in the shadow execution channel and its output is written to the shadow output buffer via the output virtualization layer without driving the device, atomic commits are only performed at the scan cycle boundary after the consistency judgment and coverage threshold are met within the verification window. Therefore, the setpoint changes are more continuous, as can be seen from the illustrative comparison. Figure 1 A schematic comparison of the dimensions constrained by the rate of change is shown below. Figure 3 Constraint violations are visible upon cumulative comparison. Figure 2 A schematic comparison of fluctuations in energy costs and fluctuations in comfort deviations can be seen respectively. Figure 5 and Figure 6 .

[0090] The statistical period is defined as 24 hours of continuous operation, and the control period is defined as follows: s, scan cycle The system sets up several policy updates during operation to trigger the download and activation process. The statistical results are shown in the table below.

[0091] Table 6. Statistical results of the comparative experiment (example, 24 hours)

[0092] Example 2

[0093] This second embodiment addresses an energy consumption optimization control scenario for multi-area office buildings. The building is divided into at least two control zones, with shared energy capacity constraints between them, such as shared chiller units, shared boilers, or shared transformer capacity. The system includes a control platform. Programmable controller and edge gateway The control platform is used to construct control intentions and solve control plans; the program controller is used to periodically scan and execute activity control programs and output control quantities to energy-consuming devices; and the edge gateway is used to carry the digital twin sandbox and scene coverage generator and provide coverage and risk statistics results to the control platform.

[0094] In this second embodiment, the control cycle Set to 300 s, program controller scan cycle Set to 0.2 s. Preset verification window period. Set the value to 250, and set the preset timeout window period to [number]. Set the value to 600, and preset the number of statistical window periods. Set the value to 1200, and set the preset blocking window period. Use 3600. The above parameters are example values ​​and can be adjusted according to the equipment response speed and on-site stability requirements.

[0095] It should be noted that the scanning period boundary mentioned in this embodiment two... This refers to the boundary moment between the input sampling, logic operation, and output refresh of the programmable controller (PCC) for one scan cycle and the start of the next scan cycle. Switching at this boundary moment ensures consistency between output mapping and control logic within the same scan cycle. (Digital twin sandbox) This is used for offline / semi-online model simulation playback on the edge gateway side. Its input is control cycle data or synthetic input snapshot sequences, and its output is simulation predictions and statistics. The digital twin sandbox is not bound to physical output points; a shadow execution channel is used. For online parallel execution on the programmable controller side, it uses the same input snapshot as the activity control program, writes the output to a shadow output buffer without actuating the device, and is used for online constraint verification and gating decisions; output virtualization layer Used to isolate shadow output from physical output, ensuring that shadow execution channel output does not drive powered devices.

[0096] It should be noted that, for reference Figure 7 As shown, Figure 7 This is a schematic diagram of the pass rate curve during the canary release phase. The horizontal axis represents time (minutes), and the vertical axis represents the canary pass rate (0-1), used to illustrate the change in the pass rate of candidate control programs during the gradual release process in different partitions; see reference. Figure 8 As shown, Figure 8 This diagram illustrates the relationship between risk scoring and adaptive threshold curves, with the horizontal axis representing time (minutes) and the vertical axis representing numerical values ​​(0-1). It explains the gating relationship between the risk scorer output and the adaptive threshold over time. (See also...) Figure 9 As shown, Figure 9 This is a schematic diagram of the change curve of the setpoint difference caused by multi-region collaboration. The horizontal axis is time (illustrated) and the vertical axis is the regional setpoint difference (%), which is used to illustrate the impact of multi-region collaborative coupling constraints on output differences.

[0097] Step S1: Acquire, align, and unify the shared capacity caliber of control cycle data (to form control cycle data).

[0098] At the beginning of each control cycle, the control platform collects and aggregates energy consumption metering data, environmental parameter data, equipment operating status data, and external impact data, and aligns them with timestamps to form control cycle data. External impact data should include at least time-of-use pricing and demand response event identifiers.

[0099] To ensure that shared capacity constraints across multiple regions can be handled consistently, the control platform establishes shared capacity measurement values. Shared capacity limit This maps the capacity calibers of different metering sources to a unified unit and a unified time base. Alignment is expressed using linear interpolation as follows:

[0100] in, To unify the time base, and To surround The adjacent sampling times are considered. Missing data is filled in using forward hold or interpolation, and outlier data is removed by thresholding and then aligned to ensure that the subsequent solution is consistent with the input criteria for verification.

[0101] Step S2: Multi-region mapping, region state generation, and multi-region collaborative control intent modeling (forming a control intent model)

[0102] The control platform reads the control area configuration. The energy-consuming equipment is mapped to a specific region and regional status data is generated. Unlike single-region schemes, this embodiment explicitly introduces cross-regional coupling terms during control intent modeling to form a multi-regional collaborative control intent model. A multi-regional collaborative control intent model should include at least the following: mapping of control variables and device execution interfaces within a region, cross-regional shared capacity constraints, cross-regional mutual exclusion and interlocking conditions, and cross-regional setpoint difference limits.

[0103] The control platform establishes a mapping table between control variables and device execution interfaces. And establish a coupling mapping table for cross-regional coupling. The coupling mapping table includes at least the identifiers of the shared capacity associated equipment set, the capacity metering point identifiers, and the capacity limit identifiers, so that the same set of coupling constraints can be uniformly referenced in subsequent control plan solutions and operational verification.

[0104] Step S3: Solving the control plan (including cross-regional coupling constraints and adaptive weights)

[0105] Based on comfort and safe operation constraints, the control platform further incorporates cross-regional shared capacity constraints and cross-regional setpoint difference limits to obtain the control plan. An exemplary comprehensive objective function for:

[0106] in, For electricity price, This is the predicted value of electricity consumption. (k) is the comfort deviation index. Penalty for start / stop switching To switch weights.

[0107] The weight of comfort items can be adaptively adjusted according to the demand response status: ; in, Indicates the first Is the cycle within the demand response window? , It is a constant.

[0108] Cross-region shared capacity constraints are exemplified as follows: ; in, For the number of regions, For the first The region in Periodically predicted shared capacity occupancy. Cross-regional set value difference limits are exemplified as follows: ; in, and Set values ​​for similar output variables in two regions. This represents the upper limit of the allowed difference. Figure 9 This schematically illustrates the trend of convergence of the regional setpoint difference over time under the influence of collaborative constraints (see...). Figure 9 ).

[0109] Step S4: Generate control contract file (including extended fields), candidate control program, runtime security monitor, and risk scorer.

[0110] The control platform generates control contract documents based on the control intent model and control plan. The control contract document is used to uniformly describe the input / output list, constraint boundaries, sequential steps, mutual exclusion and interlock conditions, and cross-region coupling and partitioned release information on the program controller side, so that subsequent shadow verification, canary release and atomic commit have a consistent source of criteria.

[0111] To facilitate project implementation and subsequent consistency verification, the control contract documents must contain at least the set of fields shown in Table 7.

[0112] Table 7. Control Contract File Field Definitions (Control Contract File) )

[0113] The control platform generates candidate control programs based on the control contract document. With runtime security monitor The runtime safety monitor is used to monitor the execution range, rate of change, minimum interval, and mutual exclusion interlocks of active outputs, and generates restricted outputs to replace the original outputs when triggered.

[0114] This embodiment further adds a risk score generator. The risk scorer outputs a risk score. Gating is used for the shadow and canary phases. The risk score is represented as follows: ; in, To cut off to The operation, To constrain the normalized value of the trigger count, This is the normalized value of the comfort deviation. To output the drift normalized value, ~ is a coefficient.

[0115] Risk thresholding uses adaptive thresholds It can be updated based on sliding window statistics: ; in, and Recent The mean and standard deviation of the risk score for each period. It is a constant. This is the window length. Figure 8 This illustration illustrates the gating relationship between risk scores and thresholds (see...). Figure 8 ).

[0116] Step S5: Static verification, two-phase commit and distribution, shadow execution loading and digital twin sandbox replay

[0117] The control platform performs static verification on candidate control programs and generates verification markers. Static verification includes at least: sequential step reachability checks, mutual exclusion and interlock conflict checks, and checks for the consistency of references between shared capacity entries and setpoint difference entries to avoid non-executability caused by inconsistencies in entry reference points, units, or variable identifiers. The verification flag includes at least a static verification pass flag and candidate version verification information, which can be a checksum or a digest value.

[0118] After static verification is passed, the control platform adopts a two-phase commit protocol. The candidate control program, runtime safety monitor, and control contract file are distributed to the program controller. The two-phase commit protocol includes a preparation message, a preparation confirmation message, and a commit message. The program controller returns a preparation confirmation message after completing shadow execution channel loading and verification mark validation; the control platform sends a commit message when gating conditions are met; and the program controller sends a commit message at scan cycle boundaries. Perform an atomic commit, switch the active control procedure to the candidate control procedure, and enable the runtime safety monitor to apply the active output; if in If no commit message is received within a scan cycle, the program controller withdraws the candidate version and releases resources.

[0119] To ensure that the candidate control program does not actuate the device during the shadow phase, the program controller sets up an output virtualization layer. Output virtualization layer maintenance activity output mapping table Mapping table with shadow output The active output mapping table is bound to the physical output point; the shadow output mapping table is bound to the shadow output buffer. The shadow output buffer is not connected to the physical output point, thereby making the shadow output unactable, observable, and verifiable.

[0120] This embodiment also runs a digital twin sandbox on the edge gateway. The digital twin sandbox replays candidate control programs based on control cycle data or synthetic input snapshot sequences, and outputs offline risk scores and coverage predictions. This output serves as an auxiliary basis for the control platform to decide whether to enter the canary release phase. Neither the digital twin sandbox nor the shadow execution channel directly drives the device. The difference between the two is that the digital twin sandbox focuses on simulation replay, while the shadow execution channel focuses on online parallel verification.

[0121] Step S6: Consistency determination, coverage threshold, risk gating, canary release, atomic commit / disable, and closed-loop recovery

[0122] The programmable controller is continuously not less than Constraint consistency determination is performed on the shadow output within each scan cycle. Consistency determination with operation And generate a coverage table. Coverage is represented as an example: ,

[0123] in, To verify the number of sequential step entries that are triggered at least once within the window, Na This represents the total number of sequential steps; the same applies to mutually exclusive and locked entries. The coverage threshold is determined by the coverage threshold condition. definition.

[0124] Scene coverage generator (improves coverage accessibility)

[0125] Edge gateway running scene coverage generator This is used to provide a synthetic input snapshot sequence to the digital twin sandbox and shadow verification logic without affecting the on-site physical output, in order to trigger branches in sequential steps and mutually exclusive interlocking conditions that are difficult to cover under natural operating conditions. The synthetic input snapshot sequence satisfies the dimensional and range constraints defined in the input variable list and is only used for simulation playback and verification statistics, and is not written to the physical output.

[0126] Risk gating (shared by the shadow phase and the canary phase)

[0127] The program controller or edge gateway periodically calculates the risk score. and with adaptive threshold Comparison. When satisfied. Furthermore, if the constraint consistency check passes, the operational consistency check passes, and the coverage threshold is met, the process is allowed to proceed to the next stage; otherwise... This will trigger a phase block, rollback assessment, or disabling of the process. Figure 8 A schematic illustration of gating relationships (see) Figure 8 ).

[0128] Canary Release (Gradual Increase in Volume by Region)

[0129] After meeting consistency criteria, coverage thresholds, and risk gating during the shadow phase, the control platform does not directly commit the entire dataset; instead, the canary release manager handles the rest. Canary release partition table Perform partitioned batch submissions. The partition table must contain at least the batch number, region set, duration of each batch, pass criteria, and rollback criteria. Canary pass rate. For example, it is represented as: ,in, To meet the criteria for the number of batches or cycles, This refers to the total number of batches or cycles. Figure 7 This illustration shows the process of the pass rate changing and stabilizing over time during the expansion of the partition (see...). Figure 7 ).

[0130] The program controller only enters the scan cycle boundary when the pass rate threshold is met and the risk gating is continuously satisfied during the canary release phase. Perform a full atomic commit and switch the candidate control procedure to the active control procedure; if the consistency judgment fails or the risk score exceeds the threshold during the canary stage, the ramp-up will be terminated and the rollback or disabling process will begin.

[0131] Counterexample trajectory (used to pinpoint the cause of failure)

[0132] When constraint consistency determination fails, operational consistency determination fails, or risk gating fails, the program controller generates a counterexample trajectory. The data is then reported to the control platform. To avoid difficulties in reproducing the problem due to unclear fields, this embodiment defines at least the fields of the counterexample trajectory as shown in Table 8.

[0133] Table 8 Definition of the Counterexample Trajectory Field (Counterexample Trajectory) )

[0134] Checkpoint rollback (can be restored after going live)

[0135] The program controller generates checkpoints before performing atomic commits. The checkpoints include at least the internal state of the activity control program, the activity output mapping state, and the internal state of the runtime safety monitor. When the rollback trigger condition is met... At this time, the program controller restores the checkpoint at the scan cycle boundary and switches to the active control program corresponding to the checkpoint. The rollback trigger conditions include at least: If the number of monitoring triggers exceeds a preset threshold within a scan cycle, or if the consistency determination fails consecutively for more than a preset number of cycles.

[0136] Version fingerprint and blocking window (suppressing duplicate failed versions)

[0137] To avoid repeatedly trying to deploy failed versions, the program controller generates version fingerprints. And maintain and disable fingerprint tables An example of a version fingerprint generation caliber is as follows:

[0138] in, For serialization operations, For candidate control program version number or version identifier, For template identification (if template generation is used), the symbol " " indicates a concatenation operation. This is for the digest operation.

[0139] The fingerprint table fields to be disabled must include at least the set of fields shown in Table 9.

[0140] Table 9 Disable fingerprint table field definitions (Disable fingerprint table) )

[0141] Number of blocking window periods Internally, the program controller refuses to load candidate control programs that hit the version fingerprint and disable the fingerprint table, thereby reducing the impact of repeated failures on stability.

[0142] For ease of explanation, this embodiment constructs a comparative embodiment A, whose implementation path involves generating or updating the control program on the engineering side, downloading it to the program controller, and directly enabling it. It does not include shadow execution channels, output virtualization layers, coverage thresholds, risk scoring gating, canary releases, checkpoint rollback, or version fingerprint blocking mechanisms. Embodiment B is this embodiment, which includes shadow verification, coverage thresholds, risk gating, canary releases, atomic commits at scan cycle boundaries, negative example traces, checkpoint rollback, and version fingerprint blocking.

[0143] Multiple update triggers are set and statistical indicators are recorded within a continuous 24-hour statistical period. An example result is shown below: Table 10 Comparative Statistical Results (Example, 24 hours)

[0144] It should be noted that in the above Embodiment 1 and Embodiment 2, the technical names (e.g., the control platform used in Embodiment 1) are different. In Example 2, the control platform uses The part indicating inconsistency is only for the purpose of distinguishing between Example 1 and Example 2 when reading, and does not mean that their meanings are inconsistent.

[0145] It should be noted that, based on the aforementioned building energy consumption optimization and control method, this embodiment also provides a building energy consumption optimization and control system for executing the steps of the above-mentioned building energy consumption optimization and control method. This system can be applied to scenarios such as multi-area office buildings and commercial complexes to optimize and control the overall energy consumption of the building while meeting comfort and safe operation constraints.

[0146] In this embodiment, the building energy consumption optimization control system includes at least a control platform, a programmable controller, and an edge gateway, wherein: The control platform is used to construct multi-regional collaborative control intentions, solve control plans, generate control contract documents, candidate control programs, and runtime safety monitors, and to perform static verification and two-phase commit management of candidate control programs. The program controller is used to periodically scan and execute the activity control program. It runs the shadow execution channel in parallel based on the input snapshot. It verifies the candidate control program online through the output virtualization layer, constraint consistency judgment, runtime consistency judgment, coverage threshold, risk gating and canary release mechanism. When the conditions are met, it performs atomic commit at the scanning cycle boundary and performs checkpoint rollback and version fingerprint blocking when the trigger conditions are met. The edge gateway is used to carry the digital twin sandbox and scene coverage generator, simulate and replay candidate control programs and expand scenes, calculate auxiliary risk indicators and coverage prediction information, and work with the control platform and program controller to execute risk gating and partitioned release.

[0147] Structure and Functions of the Control Platform

[0148] The control platform may include several functional modules, which may be deployed as software on one or more servers, or implemented using a combination of hardware and software. In this embodiment, the control platform includes at least: The control cycle data acquisition and alignment module is used to acquire energy consumption metering data, environmental parameter data, equipment operating status data, and external influence data from energy consumption metering devices, environmental sensors, equipment controllers, and external systems within each control cycle, and to timestamp-align the data to form control cycle data. This module can interpolate or hold forward missing data and remove abnormal data to ensure the consistency of control cycle data in terms of time reference and numerical caliber.

[0149] The multi-region mapping and region status generation module is used to map energy-consuming devices to different control regions according to the control region configuration, and generate region status data for each control region based on control cycle data. The region status data includes at least region load estimation, comfort deviation, equipment availability status, and shared capacity occupancy information. This module can also generate a coupling mapping table for cross-regional coupling, which describes the shared capacity metering points and their associated device sets.

[0150] The multi-region collaborative control intent modeling module is used to build a multi-region collaborative control intent model based on regional state data. The control intent model includes at least the control objectives, constraints, and mapping relationship between control variables and device execution interfaces of each control region. It also introduces cross-region shared capacity constraints and cross-region setpoint difference limits to describe the collaborative relationship between regions.

[0151] The control plan solver module is used to solve the integrated objective function under comfort constraints, safe operation constraints, and cross-regional coupling constraints to obtain the control plan in the predictive time domain. The control plan includes at least the output setpoint sequence, start-stop sequence, and predicted shared capacity occupancy at each time step. The integrated objective function may include energy consumption, comfort bias, and start-stop switching penalties, where the weight of the comfort term can be adaptively adjusted according to the demand response status.

[0152] The control contract document generation module is used to generate control contract documents based on the control intent model and control plan. The control contract document includes at least the following fields: input variable list, output variable list, output allowable range, output change rate limit, minimum start / stop interval limit, mutual exclusion and interlock condition table, sequence step table, as well as shared capacity entries, setpoint difference entries, and canary release partition table. These fields are used to uniformly describe the constraints and execution steps that need to be followed on the program controller side.

[0153] The candidate control program generation module is used to generate candidate control programs based on the control contract file and control plan. These candidate control programs can be constructed using a template-based approach, that is, instantiated on the program controller side using template identifiers and contract parameter sets, to reduce the amount of data sent and improve consistency.

[0154] The runtime safety monitor building module is used to generate a runtime safety monitor based on the control contract file. The runtime safety monitor implements range restrictions, rate of change restrictions, minimum start-stop interval restrictions, and mutual exclusion and interlock monitoring on the active output in the program controller, and generates restricted output to replace the original output when triggered.

[0155] The risk scorer configuration module is used to generate and configure the parameters of the risk scorer, including input dimensions such as comfort deviation index, number of constraint violations, and output drift used to calculate the risk score, as well as sliding window length and magnification factor used to update the adaptive threshold.

[0156] The static verification module performs static verification on candidate control programs, including reachability checks based on the sequence step table, conflict checks based on the mutual exclusion and interlock condition table, and reference consistency checks on shared capacity entries and setpoint difference entries. Upon successful static verification, this module generates a verification flag containing a static verification pass identifier and validation information.

[0157] The two-phase commit management module is used to distribute candidate control programs, runtime safety monitors, and control contract files to the program controller based on the two-phase commit protocol. This module is responsible for sending preparation messages, receiving preparation confirmation messages, and sending commit messages when gating conditions are met. It coordinates the program controller to perform atomic commits at scan cycle boundaries or to withdraw candidate versions if no commit message is received within the timeout window.

[0158] The canary release strategy generation module is used to generate a canary release partition table based on the control area division and business requirements. The partition table defines at least the set of control areas included in each batch, the duration, and the pass and fallback criteria, which are used by the subsequent program controller to execute partition release control.

[0159] Structure and Function of Edge Gateway

[0160] Edge gateways can be deployed as embedded devices or industrial computers, running the following functional modules: The digital twin sandbox module is used to simulate and replay candidate control programs based on control cycle data and equipment models, and output simulation predictions, offline risk indicators, and coverage estimates for the control platform to evaluate before entering the canary release phase.

[0161] The scene coverage generation module is used to generate a synthetic input snapshot sequence that meets the input variable constraints without affecting the physical output on site. It injects digital twin sandbox and shadow verification logic to trigger uncovered branches in sequential steps and mutually exclusive interlocking conditions, thereby improving the coverage level within the verification window.

[0162] The risk scoring calculation module can be used to calculate risk scores and adaptive thresholds at the edge and synchronize the risk gating results to the control platform and program controller to achieve rapid local decision-making and upper-level coordination.

[0163] Structure and function of programmable controller

[0164] The programmable controller can be a programmable logic controller or an industrial control computer, and it operates in a scan cycle manner. In this embodiment, the programmable controller includes at least: The input snapshot acquisition module samples each input signal indicated by the input variable list at the beginning of each scan cycle to form an input snapshot. The input snapshot is simultaneously provided to the activity control program and the shadow execution channel to ensure that both operate under the same input conditions.

[0165] The shadow execution channel is used to execute candidate control programs in shadow mode. The shadow execution channel operates based on input snapshots, writing its output to a shadow output buffer instead of directly to the physical output points. This allows for online verification of candidate control programs without affecting field control.

[0166] The output virtualization layer, including the active output mapping table and the shadow output mapping table, is used to map the output of the active control program to physical output points and to map the output of the shadow execution channel to the shadow output buffer. Through the output virtualization layer, complete isolation between shadow output and physical output can be achieved, ensuring that the shadow execution channel does not power the device.

[0167] The runtime safety monitoring and execution module is used to monitor the execution range limits, change rate limits, minimum start / stop interval limits, and mutual exclusion and interlocking of active outputs based on the runtime safety monitor. When a violation of constraints is detected, the output is restricted or protection logic is triggered.

[0168] The constraint consistency determination module is used to perform constraint consistency determination on the output in the shadow output buffer based on the control contract file. The determination content includes at least whether the output upper and lower limits, output change rate, minimum start and stop interval, mutual exclusion and interlock, and cross-region shared capacity and set value difference meet the pre-agreed conditions.

[0169] The consistency determination module is used to determine the differences between the output of the shadow execution channel and the active control program under the same input snapshot, and can combine the device execution feedback to determine the deviation, which is used to evaluate the operational consistency between the candidate control program and the existing control logic.

[0170] The coverage statistics module is used to statistically analyze the triggering of sequential steps and mutual exclusion conditions, generate a coverage table, calculate the sequential step coverage and mutual exclusion coverage within the verification window, and compare them with the coverage threshold condition to determine whether the verification is sufficient.

[0171] The risk score receiving and gating execution module is used to receive risk scores and adaptive thresholds calculated by the control platform or edge gateway, or to calculate risk scores locally based on runtime information, and to gating the state transitions, canary release process and atomic commits of candidate control programs according to risk gating conditions.

[0172] The canary execution management module is used to enable candidate control programs in batches for different regions or device sets according to the canary release partition table, count the pass status of each batch, calculate the canary pass rate, and allow the next batch or execute the full submission if the pass rate threshold and risk gate conditions are met.

[0173] The atomic submission module is used to perform candidate control program switching at the scan cycle boundary, replace the candidate control program with the active control program, and update the output mapping relationship to ensure the consistency of output within the same scan cycle and the atomicity of the switching process.

[0174] The checkpoint management module is used to save the running state, mapping relationship and internal state of security monitoring of the current activity control program before atomic commit, forming a checkpoint; when the rollback trigger condition is met, it restores to the checkpoint state at the scan cycle boundary to realize the rollback of the committed version.

[0175] The version fingerprint and disable table maintenance module is used to generate version fingerprints based on the control contract file, candidate control program version identifiers and template identifiers, and maintain the disable fingerprint table. Within the blocking window, it prevents the loading of candidate control programs with fingerprints identical to those in the disable fingerprint table, thereby preventing failed versions from repeatedly trying to go online.

[0176] The communication and management module is used to communicate with the control platform and edge gateway, receive preparation messages, submission messages, control contract documents and candidate control programs, issue counterexample trajectories, operation statistics and event information, and coordinate the operation of the above modules.

[0177] As can be seen from the above structural description, the building energy consumption optimization control system in this embodiment forms a synergy among the control platform, programmable controller, and edge gateway: The control platform is responsible for data aggregation, intent modeling, optimization and solution, contract and program generation, and static verification. The edge gateway is responsible for digital twin simulation and scene coverage generation; The program controller is responsible for controlling the safe switching of the program at the scan cycle boundary based on shadow execution, output virtualization, constraint consistency determination, runtime consistency determination, coverage threshold, risk gating, and canary release mechanism.

[0178] It should be noted that the embodiments of the present invention have better implementability and are not intended to limit the present invention in any way. Any person skilled in the art may use the above-disclosed technical content to change or modify it into equivalent effective embodiments. However, any modifications or equivalent changes and modifications made to the above embodiments based on the technical essence of the present invention without departing from the content of the technical solution of the present invention shall still fall within the scope of the technical solution of the present invention.

Claims

1. A method for optimizing and controlling building energy consumption, characterized in that, Applied to buildings including at least one energy-consuming device, said energy-consuming device including at least one of heating, ventilation and air conditioning equipment, lighting equipment, and power equipment, the method is executed collaboratively by a control platform and a programmable controller, including: Step S1: In each control cycle, acquire energy consumption metering data, environmental parameter data, equipment operating status data, and external influence data, and align the data with timestamps to obtain control cycle data; Step S2: Based on the preset control area configuration, map the energy-consuming device to at least one control area, generate area status data for each control area, and generate a control intent model based on the area status data. Step S3: Under the conditions of satisfying comfort constraints and safe operation constraints, the control plan is obtained by solving based on the control intention model. The control plan includes at least one of the setpoint sequence and / or start-stop sequence of each control variable in the prediction time domain. Step S4: Generate a control contract file based on the control intent model and the control plan, and generate candidate control programs and runtime safety monitors based on the control contract file and the control plan. The control contract file includes at least an input variable list, an output variable list, an output allowable range, an output change rate limit, a start / stop minimum interval limit, mutual exclusion and interlock conditions, and sequential steps. Step S5: Perform static verification on the candidate control program and generate a verification flag. When the static verification passes, send the candidate control program, the runtime security monitor, the control contract file, and the verification flag to the program controller, and load the candidate control program into the shadow execution channel. The program controller includes an output virtualization layer, which is used to write the output of the shadow execution channel into the shadow output buffer without driving the power-consuming device. Step S6: Within a continuous scan cycle of no less than a preset verification window cycle number, perform constraint consistency determination on the output of the shadow output buffer based on the control contract file, and perform runtime consistency determination on the shadow execution channel based on the control cycle data; when both the constraint consistency determination and the runtime consistency determination pass, perform an atomic commit at the scan cycle boundary, switch the candidate control program to the active control program, and enable the runtime security monitor to take effect on the output of the active control program; when the constraint consistency determination fails or the runtime consistency determination fails, keep the current active control program as the active control program, and mark the candidate control program as a disabled version.

2. The method according to claim 1, characterized in that, The control contract file further includes: sampling period identifier, data type identifier, and physical quantity unit identifier corresponding to each input variable and each output variable; the control intent model further includes a mapping table between control variables and device execution interfaces, the mapping table including a one-to-one correspondence between variable identifiers and program controller input / output point identifiers.

3. The method according to claim 1, characterized in that, The candidate control program includes sequential control logic and interlock control logic; the sequential steps are stored in the form of a sequential step table, and the mutual exclusion and interlock conditions are stored in the form of a mutual exclusion and interlock condition table. The sequential step table and the mutual exclusion and interlock condition table are stored in the program controller in the form of data segments, and are called and executed by preset function blocks during the scan cycle.

4. The method according to claim 1, characterized in that, The output virtualization layer includes an active output mapping table and a shadow output mapping table; the output of the active control program is bound to the physical output point through the active output mapping table, and the output of the shadow execution channel is bound to the shadow output buffer through the shadow output mapping table.

5. The method according to claim 4, characterized in that, Before executing the atomic commit, the program controller generates a checkpoint. The checkpoint includes at least the data segment state corresponding to the current active control program, the active output mapping table state, and the internal state of the runtime security monitor. When the active control program is switched and a preset rollback trigger condition is met, the program controller restores the checkpoint to the running state at the time the checkpoint was generated at the scan cycle boundary, and switches the control program that was active at the time the checkpoint was generated to the active control program. The preset rollback trigger condition includes: the runtime security monitor triggers more than a preset number of times within a preset statistical window period and / or the number of consecutive scan cycles in which the constraint consistency determination fails exceeds a preset period threshold.

6. The method according to claim 1, characterized in that, At the beginning of each scan cycle, the program controller samples the input variables identified in the input variable list in the control contract file and generates an input snapshot; the input snapshot is simultaneously provided to the currently active control program and the shadow execution channel. The operational consistency determination further includes: within the preset verification window period, performing a difference check between the output of the shadow output buffer and the output generated by the current activity control program under the same input snapshot, and using the difference check meeting a preset difference threshold condition as one of the criteria for passing the operational consistency determination.

7. The method according to claim 6, characterized in that, When the constraint consistency determination fails or the operation consistency determination fails, the program controller generates a counterexample trajectory and reports it to the control platform; The counterexample trajectory includes at least: a violation entry identifier in the control contract file, an input snapshot sequence corresponding to the violation entry identifier, an output sequence of the shadow output buffer, and a scan cycle timestamp of the violation.

8. The method according to claim 1, characterized in that, The distribution adopts a two-phase commit protocol, which includes: The control platform sends a preparation message to the program controller. The preparation message includes at least a preparation identifier, the candidate control program, the runtime security monitor, the control contract file, and the verification flag. After the program controller completes the loading of the candidate control program into the shadow execution channel and completes the verification of the verification mark, it generates a preparation confirmation message and returns it to the control platform. The preparation confirmation message includes at least the preparation identifier and candidate version verification information. The candidate version verification information includes at least the candidate version number and the verification code. Upon receiving the commit message from the control platform, the program controller executes the atomic commit at the scan cycle boundary; if the commit message is not received within a preset timeout window period, the program controller cancels the candidate version corresponding to the preparation message and releases the shadow execution channel resources.

9. The method according to claim 1, characterized in that, The program controller sets coverage count points for the sequential steps and the mutual exclusion and interlocking conditions in the shadow execution channel, and generates a coverage table within the preset verification window period number; the coverage table includes at least the number of accesses for each sequential step and the number of judgments for each mutual exclusion and interlocking condition; the atomic submission further satisfies the following condition: the coverage table satisfies the preset coverage threshold condition.

10. A building energy consumption optimization control system, wherein, The system is configured to perform the method according to any one of claims 1 to 9, characterized in that it includes: The data acquisition unit is used to acquire energy consumption metering data, environmental parameter data, equipment operating status data, and external influence data, and generate control cycle data; The region modeling unit is used to generate region status data and a control intent model based on the control region configuration. An optimized solution unit is used to solve for the control plan while satisfying comfort and safe operation constraints; A contract generation unit is used to generate a control contract file based on the control intent model and the control plan. A program synthesis unit is used to generate candidate control programs and a runtime safety monitor based on the control contract file and the control plan; The verification unit is used to perform static verification on the candidate control program and generate verification markers; The program controller includes a shadow execution channel, an output virtualization layer, and a shadow output buffer. The shadow execution channel is used to execute the candidate control program and its output is written to the shadow output buffer without driving the power-consuming device. The determination and submission unit is used to perform constraint consistency determination and operational consistency determination within a preset verification window period, and when both the constraint consistency determination and the operational consistency determination pass, to perform an atomic submission at the scan period boundary to switch the candidate control program to the active control program.

Images