Risk emergency control method, risk emergency control device and wind farm control system

Abstract

This application provides a risk emergency control method, a risk emergency control device, and a wind farm control system, belonging to the field of new energy power generation safety technology. The method includes: acquiring and fusing multi-dimensional state data of the wind farm control system to generate a structured feature vector; determining the risk scenario category based on the structured feature vector and generating a control takeover instruction package; determining whether to take over the control authority of the main control system based on the control takeover instruction package; if so, determining the target control strategy based on the control takeover instruction package and issuing differentiated emergency control instructions to the wind farm execution unit through a dedicated control channel; monitoring the health status information of the main control system in real time, and restoring the control authority of the main control system when the health status information meets preset reset conditions. This application can achieve the effect of decoupling the safety protection function from the main control system, improving the safety protection capability of the wind farm control system, and enriching the safety protection strategies of the wind farm control system.

Description

Technical Field

[0001] This application relates to the field of new energy power generation safety technology, specifically to a risk emergency control method, a risk emergency control device, and a wind farm control system. Background Technology

[0002] In recent years, with the acceleration of the global energy transition, the installed capacity of new energy power generation, represented by wind power, has continued to rise in the power system. As the main form of large-scale new energy grid integration, the operating characteristics of wind farms have an increasingly prominent impact on the safety and stability of the power system. Therefore, how to ensure the safe and reliable operation of the power grid under the background of high proportion of new energy integration has become a key technical problem that the power industry urgently needs to solve.

[0003] In related technologies, wind farms typically employ centralized control systems to achieve unified monitoring and scheduling of multiple wind turbine units within the farm. This control system undertakes core functions such as data acquisition, power regulation, and protection logic execution, and serves as a crucial hub connecting the wind farm and the power grid.

[0004] However, when using related technologies to uniformly monitor and schedule multiple wind turbines within a wind farm, the safety protection functions of the wind farm control system are highly dependent on the health status of the main control system itself. Once the main control system fails, the safety protection mechanism of the wind farm control system will be paralyzed, leaving the entire wind farm unprotected and out of control in critical moments requiring emergency intervention. Furthermore, while existing wind farm control systems can detect grid anomalies, they immediately trigger simultaneous grid disconnection of all wind turbines regardless of the type of anomaly detected, thus requiring grid risk intervention. Therefore, the relevant technological solutions suffer from high risks of safety protection function failure and a lack of simplistic safety protection strategies. Summary of the Invention

[0005] The purpose of this application is to provide a risk emergency control method, a risk emergency control device, and a wind farm control system, which can decouple the safety protection function from the main control system, improve the safety protection capability of the wind farm control system, and enrich the safety protection strategy of the wind farm control system.

[0006] The embodiments of this application are implemented as follows: A first aspect of this application provides a risk emergency control method, which is applied to a risk emergency control device, and the method includes: The system acquires multidimensional state data of the wind farm control system and fuses the multidimensional state data to generate a structured feature vector corresponding to the wind farm control system. Based on the structured feature vector, the risk scenario categories of the wind farm control system are determined, and a control takeover instruction package is generated based on the risk scenario categories. The control takeover instruction package includes: risk scenario category identifier code, key control parameters, and takeover confidence level. Based on the control takeover instruction package, determine whether to take over the control authority of the main control system in the wind farm control system; if so, determine the target control strategy corresponding to the wind farm control system based on the control takeover instruction package, and issue differentiated emergency control instructions to the wind farm execution unit through the dedicated control channel corresponding to the target control strategy. The system monitors the health status of the main control system in the wind farm control system in real time, and restores the control authority of the main control system when the health status meets the preset reset conditions.

[0007] As one possible implementation, the aforementioned structured feature vector includes: key control parameters, abnormal data flags, and key data freeze flags. Key control parameters include: actual power, actual power change rate, communication packet loss rate, database response latency, power deviation, grid frequency, and grid voltage. The risk scenario categories for the wind farm control system are determined, including: If the actual power exceeds the preset power safety threshold, and the actual power change rate exceeds the preset maximum allowable ramp rate, and the abnormal data flag is true, then the risk scenario category is determined to be power over-generation. If the communication packet loss rate is greater than the preset communication packet loss rate threshold, and the database response delay time is greater than the preset time threshold, or the key data freeze flag is true, and the power deviation is greater than the preset power deviation threshold, then the risk scenario category is determined to be out of control. If a shutdown command is detected, and the grid frequency is within the preset normal frequency range, the grid voltage is also within the preset normal voltage range, and no dispatch confirmation signal is detected, then the risk scenario category is determined to be abnormal load shedding.

[0008] As one possible implementation, based on the control takeover instruction package, it is determined whether to take over the control authority of the main control system in the wind farm control system, including: The control takeover instruction packet is parsed to extract valid fields from the parsed control takeover instruction packet, and the validity of the control takeover instruction packet is verified based on the valid fields. After verification, based on the takeover confidence level in the control takeover instruction package and the internal machine status of the risk emergency control device, it is determined whether the risk emergency control device meets the emergency control takeover conditions. If so, then determine the control authority of the main control system in the wind farm control system.

[0009] As one possible implementation, the target control strategy corresponding to the wind farm control system is determined based on the control takeover instruction package, including: If the risk scenario category indicated by the risk scenario category identifier code in the control takeover instruction package is power over-generation, then the target control strategy is determined to be a dynamic voltage reduction strategy. If the risk scenario category indicated by the risk scenario category identifier code in the control takeover instruction package is loss of control, then the target control strategy is determined to be the full-field target tracking strategy. If the risk scenario category indicated by the risk scenario category identifier code in the control takeover instruction package is abnormal load shedding, then the target control strategy is determined to be the instruction interception support strategy.

[0010] As one possible implementation, differentiated emergency control commands are issued to the wind farm execution unit through a dedicated control channel corresponding to the target control strategy, including: The highest priority safety takeover message is broadcast to all substation controllers in the wind farm control system through the dedicated control channel corresponding to the target control strategy, so that the command source of each substation controller is forcibly switched to the current emergency channel of the risk emergency control device. Based on the risk scenario category identifier code in the control takeover instruction package, activate the preset control algorithm corresponding to the risk scenario category identifier code, and inject the key control parameters in the control takeover instruction package into the preset control algorithm to generate differentiated emergency control instructions. Differentiated emergency control commands are issued to the wind farm execution unit through the dedicated control channel corresponding to the target control strategy.

[0011] As one possible implementation, differentiated emergency control commands are issued to the wind farm execution unit through a dedicated control channel corresponding to the target control strategy, including: If the target control strategy is a dynamic voltage reduction strategy, a smooth power reduction command is sent to the wind farm execution unit through a dedicated control channel; If the target control strategy is a full-field target tracking strategy, then the power setpoint command is sent to the wind farm execution unit through a dedicated control channel; If the target control strategy is a command interception support strategy, a shutdown command interception signal is sent to the substation controller corresponding to the wind farm execution unit through a dedicated control channel. At the same time, a power maintenance command is sent to the wind farm execution unit through a dedicated control channel.

[0012] As one possible implementation, multi-dimensional state data of the wind farm control system is obtained, including: The system acquires raw communication messages in the control network of the wind farm control system in real time, and determines the health of the communication link of the wind farm control system based on the heartbeat messages in the raw communication messages. Probe queries are initiated to the real-time database of the wind farm control system through independent network sessions. The response time and success rate of the probe queries are monitored in real time, and multi-level rationality checks are performed on key control parameters to determine the availability of the wind farm control system database. Real-time acquisition of electrical quantity data and grid dispatch instructions at grid connection points, and determination of the reliability of grid dispatch instructions and grid-side dynamic behavior based on electrical quantity data and grid dispatch instructions.

[0013] As one possible implementation, the health status information of the main control system in the wind farm control system is monitored in real time, and control is returned to the main control system when the health status information meets preset reset conditions, including: Real-time monitoring of the health status information of the main control system and the operational stability indicators of the wind farm control system; If the health status information and operational stability indicators both meet the preset reset conditions, and a manual confirmation signal is detected, a reset ready flag is generated, and a synchronous observation period is initiated to perform multi-cycle rolling comparisons of the differentiated emergency control commands sent by the risk emergency control device and the control commands sent by the main control system. If the comparison result between the emergency control command and the control command continues to exceed the preset non-disturbance threshold during the synchronous observation period, the command source of the entire substation controller in the wind farm control system will be switched to the main control system under the time synchronization mechanism, and a control release message will be broadcast to the wind farm execution unit.

[0014] A second aspect of this application provides a risk emergency control device, which includes: a perception and diagnosis module, a risk decision module, an adaptive control module, and a safety switching module. The perception and diagnosis module is used to acquire multi-dimensional state data of the wind farm control system and fuse the multi-dimensional state data to generate a structured feature vector corresponding to the wind farm control system. The risk decision module is used to determine the risk scenario category of the wind farm control system based on the structured feature vector, and generate a control takeover instruction package based on the risk scenario category. The control takeover instruction package includes: risk scenario category identifier code, key control parameters and takeover confidence level. The adaptive control module is used to determine whether to take over the control authority of the main control system in the wind farm control system based on the control takeover instruction package; if so, it determines the target control strategy corresponding to the wind farm control system based on the control takeover instruction package, and issues differentiated emergency control instructions to the wind farm execution unit through the dedicated control channel corresponding to the target control strategy. The safety switching module is used to monitor the health status information of the main control system in the wind farm control system in real time, and restore the control authority of the main control system when the health status information meets the preset reset conditions.

[0015] A third aspect of this application provides a wind farm control system, which includes the risk emergency control device described in the second aspect above.

[0016] A fourth aspect of this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the risk emergency control method described in the first aspect above.

[0017] The beneficial effects of the embodiments of this application include: This application provides a risk emergency control method that acquires multi-dimensional state data of a wind farm control system through a perception and diagnosis module in a risk emergency control device, performs fusion analysis on the multi-dimensional state data to generate a structured feature vector, and transmits the structured feature vector to a vector decision module. The risk decision module identifies risks in the structured feature vector to determine the risk scenario category of the wind farm control system, and generates a control takeover command package based on the risk scenario category, sending the control takeover command package to an adaptive control module. The adaptive control module parses the control takeover command package to determine whether the control takeover command is valid, and judges the risk response based on the internal machine state of the risk emergency control device. If the emergency control device has the capability to take over control authority, then based on the control takeover instruction package, it determines the target control strategy corresponding to the wind farm control system. The key control parameters in the control takeover instruction package are injected into the preset algorithm corresponding to the target control strategy to obtain differentiated emergency control instructions corresponding to the target control strategy. These differentiated emergency control instructions are then sent to the wind farm execution unit through a dedicated control channel corresponding to the target control strategy, forcibly switching the instruction source of the wind farm execution unit to the risk emergency control device. The safety switching module continuously monitors the health status information of the main control system until the health status of the main control system meets the preset reset conditions, at which point the risk emergency control device returns control authority to the main control system. This application utilizes a risk emergency control device independent of the main control system to perform risk emergency control on the wind farm control system, completely decoupling the safety protection functions of the wind farm control system from the main control system, thereby improving the safety protection capability of the wind farm control system. Furthermore, this application uses multi-dimensional state data fusion analysis to determine the risk scenario categories of the wind farm control system, and invokes different control strategies based on these risk scenario categories to generate dedicated emergency control commands. This enriches the safety protection strategies of the wind farm control system, thereby improving its stability and reliability. In this way, the safety protection functions are decoupled from the main control system, enhancing the safety protection capabilities of the wind farm control system and enriching its safety protection strategies. Attached Figure Description

[0018] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a schematic diagram of the structure of a wind farm control system provided in an embodiment of this application; Figure 2 This is a schematic diagram of the structure of a risk emergency control device provided in an embodiment of this application; Figure 3 A flowchart illustrating the first risk emergency control method provided in this application embodiment; Figure 4 A flowchart illustrating the second risk emergency control method provided in this application embodiment; Figure 5 A flowchart of the third risk emergency control method provided in the embodiments of this application; Figure 6 A flowchart of the fourth risk emergency control method provided in the embodiments of this application; Figure 7 A flowchart of the fifth risk emergency control method provided in the embodiments of this application; Figure 8 A flowchart of the sixth risk emergency control method provided in the embodiments of this application; Figure 9 A flowchart of the seventh risk emergency control method provided in the embodiments of this application; Figure 10 A flowchart of the eighth risk emergency control method provided in the embodiments of this application.

[0020] Reference numerals: 10: Wind farm control system; 101: Main control system; 102: Risk emergency control device; 1021: Sensing and diagnosis module; 1022: Risk decision module; 1023: Adaptive control module; 1024: Safety switching module; 103: Wind farm execution unit; 1031: Substation controller; 1032: Wind turbine. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0022] Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0023] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0024] Currently, wind farms typically employ centralized control systems to monitor and schedule multiple wind turbines within the farm. These systems handle core functions such as data sampling, power regulation, and safety protection. However, the safety protection functions of such wind farm control systems are highly dependent on the health of the main control system itself. If the main control system fails, the safety protection mechanisms of the wind farm control system will fail, leaving the entire wind farm unprotected and out of control in critical situations requiring emergency intervention. Furthermore, while such wind farm control systems can detect abnormal electrical data, they immediately trigger simultaneous grid disconnection of all wind turbines regardless of the type of electrical anomaly detected, thus enabling grid risk intervention.

[0025] To address this, this application provides an emergency risk control method. This method acquires multi-dimensional state data of the wind farm control system through a data acquisition channel independent of the main control system within the wind farm control system. The multi-dimensional state data is then fused to generate a structured feature vector corresponding to the wind farm control system. Based on the structured feature vector, the risk scenario category of the wind farm control system is determined, and a control takeover instruction package is generated based on the risk scenario category. According to the control takeover instruction package, it is determined whether the emergency risk control device can take over the control authority of the main control system in the wind farm control system at the current moment. If so, the target control strategy corresponding to the wind farm control system is determined according to the control takeover instruction package, and differentiated emergency control instructions are issued to the wind farm execution unit through a dedicated control channel corresponding to the target control strategy. The health status information of the main control system is monitored in real time, and when the main control system meets preset reset conditions, control authority is re-handed over to the main control system. This achieves decoupling of safety protection functions from the main control system, improving the safety protection capability of the wind farm control system and enriching the safety protection strategies of the wind farm control system.

[0026] The risk emergency control method provided in the embodiments of this application will be explained in detail below with reference to the accompanying drawings.

[0027] Figure 1See the schematic diagram of a wind farm control system provided in this application. Figure 1 The wind farm control system 10 provided in this application embodiment includes: a main control system 101, a risk emergency control device 102, and multiple wind farm execution units 103. The risk emergency control device 102 is independent of the main control system 101. The risk emergency control device 102 can monitor the real-time status of the wind farm control system 10 and determine whether the main control system 101 is faulty based on the real-time status of the wind farm control system 10. When the main control system 101 is faulty, the risk emergency control device 102 takes over the control authority of the main control system 101 to maintain the stable operation of the wind farm control system 10.

[0028] Specifically, each wind farm execution unit 103 in the wind farm control system 10 has its corresponding substation controller 1031 and wind turbine 1032. When the wind farm control system 10 is operating normally, each substation controller 1031 is controlled by the main control system 101, and each wind turbine 1032 operates under the control commands issued by the main control system 101. When there is an electrical abnormality in the wind farm control system 10 and the main control system 101 is unable to cope with the current electrical abnormality, the risk emergency control device 102 forcibly takes over the control authority of the main control system 101. Each substation controller 1031 is controlled by the risk emergency control device 102, and each wind turbine 1032 operates under the control commands issued by the risk emergency control device 102. After the electrical abnormality of the wind farm control system 10 is eliminated and the control capability of the main control system 101 is normal, the risk emergency control device 102 returns the control authority of the main control system 101 back to the main control system 101.

[0029] Figure 2 See the structural schematic diagram of a risk emergency control device provided in this application. Figure 2 The risk emergency control device 102 provided in this application embodiment includes: a perception and diagnosis module 1021, a risk decision module 1022, an adaptive control module 1023, and a safety switching module 1024. The input terminal of the perception and diagnosis module 1021 is connected to the detection point of the wind farm control system 10; the output terminal of the perception and diagnosis module 1021 is connected to the input terminal of the risk decision module 1022; the output terminal of the risk decision module 1022 is connected to the input terminal of the adaptive control module 1023; the output terminal of the adaptive control module 1023 is connected to the input terminal of the safety switching module 1024; the output terminal of the safety switching module 1024 is connected to each wind farm execution unit 103 in the wind farm control system 10; and the feedback output terminal of the safety switching module 1024 is connected to the feedback input terminal of the perception and diagnosis module 1021.

[0030] Specifically, the perception and diagnosis module 1021 acquires multi-dimensional state data of the wind farm control system 10 in real time, performs fusion analysis on the multi-dimensional state data to generate a structured feature vector, and sends the structured feature vector to the risk decision module 1022. The risk decision module 1022, based on its built-in multi-judgment logic, determines the risk scenario category represented by the structured feature vector, generates a control takeover instruction package based on the risk scenario category, and sends the control takeover instruction package to the adaptive control module 1023. The adaptive control module 1023, based on the received control takeover instruction package and the internal state of the risk emergency control device 102, determines the risk emergency control... If device 102 has the capability to take over the control authority of main control system 101, it determines the preset control strategy that wind farm control system 10 should adopt in the current risk scenario according to the control takeover instruction package, and sends differentiated emergency control instructions to wind farm execution unit 103 in wind farm control system 10 through the dedicated control channel corresponding to the preset control strategy to take over the control authority of main control system 101; safety switching module 1024 monitors the health status information of main control system 101 in real time, and returns the control authority to main control system 101 when main control system 101 meets the preset reset conditions, so as to ensure that the safety protection capability of wind farm control system 10 remains effective.

[0031] Figure 3 A flowchart of a risk emergency control method provided in this application is provided, which can be applied to Figure 2 The risk emergency control device 102 shown is deployed independently of the main control system 101 within the wind farm control system 10. (See also...) Figure 3 This application provides a risk emergency control method, including: S301. Obtain multi-dimensional state data of the wind farm control system and fuse the multi-dimensional state data to generate a structured feature vector corresponding to the wind farm control system.

[0032] Optionally, the risk emergency control device is deployed in the wind farm control system through multiple parallel acquisition channels independent of the main control system via a sensing and diagnostic module. This allows it to acquire multi-dimensional status data characterizing the health status of the wind farm control system itself from the points under test. This multi-dimensional status data includes: data characterizing the health of communication links, data characterizing the availability of the real-time database, and data characterizing grid-related behaviors such as the reliability of grid dispatch instructions and grid-side dynamic behavior.

[0033] Optionally, the perception and diagnosis module uses a timestamp synchronization mechanism to correlate and fuse the raw state data input from each parallel acquisition channel to generate a structured feature vector. This structured feature vector includes: quantized indicators, discrete state labels, and dynamic trend information. Quantized indicators may specifically be communication latency in milliseconds, power gradient values, etc. Discrete state labels may specifically be discontinuous instruction sequences, database ineffectiveness, etc., and dynamic trend information may specifically be the rate of change of communication link health score, etc. This application does not impose specific limitations on these aspects.

[0034] It should be noted that this structured feature vector is physically and logically independent of the main control system in the wind farm control system. This ensures that the perception and diagnosis module has stable perception functions. Even if the main control system fails, the perception and diagnosis module can still continuously provide the risk decision module with real-time, accurate, multi-dimensional and spatiotemporally synchronized status data, thereby realizing a forward-looking quantitative description of the internal faults and external risks of the wind farm control system.

[0035] S302. Based on the structured feature vector, determine the risk scenario category of the wind farm control system, and generate a control takeover instruction package based on the risk scenario category. The control takeover instruction package includes: risk scenario category identifier code, key control parameters, and takeover confidence level.

[0036] Optionally, the risk decision-making module identifies risk scenarios based on built-in preset judgment logic, mapping the structured feature vector to predefined risk scenario categories. These predefined risk scenario categories include: power over-generation risk, spatiotemporal control risk, and abnormal load shedding risk.

[0037] Specifically, when a structured feature vector satisfies the logical judgment conditions corresponding to any risk category in the preset judgment logic, the risk decision module will generate a risk scenario category identifier code corresponding to that risk category for the structured feature vector. Simultaneously, the risk decision module will also extract key control parameters related to that risk scenario from the structured feature vector, such as the safe power target value and maximum allowable rate of decline for power over-generation risk, the effective power setpoint before failure for control runaway risk, and the current actual power value for abnormal load shedding scenarios.

[0038] Furthermore, the risk decision-making module also calculates a takeover confidence level based on factors such as the deviation of various indicators in the structured feature vector and data consistency, which is used to characterize the credibility of the current risk assessment.

[0039] Optionally, the risk decision module encapsulates the risk scenario identifier, key control parameters, and takeover confidence into a structured control takeover instruction package, and initiates a synchronous call to the adaptive control module through a low-latency, deterministic internal communication interface.

[0040] S303. Based on the control takeover instruction package, determine whether to take over the control authority of the main control system in the wind farm control system; if so, based on the control takeover instruction package, determine the target control strategy corresponding to the wind farm control system, and issue differentiated emergency control instructions to the wind farm execution unit through the dedicated control channel corresponding to the target control strategy.

[0041] Optionally, after receiving the control takeover instruction packet, the adaptive control module parses and verifies the validity of the control takeover instruction packet. After the verification is successful, it extracts the takeover confidence from the control takeover instruction packet and queries the current working state of the internal state machine of the risk emergency control device (such as standby state, self-test state, activation state, fault state, etc.) to confirm whether the risk emergency control device is in a safe state range that can be taken over.

[0042] Optionally, if and only if the confidence level of the takeover command exceeds a preset confidence level threshold and the internal state machine of the risk emergency control device allows takeover, the adaptive control module determines that the risk emergency control device meets the emergency control takeover conditions and immediately triggers the control switching logic.

[0043] Optionally, when the adaptive control module determines that the risk emergency control device has the capability to take over control authority, the adaptive control module will automatically call the target control strategy corresponding to the risk scenario according to the risk scenario category identifier code in the control takeover instruction package, and inject the key control parameters in the control takeover instruction package into the algorithm corresponding to the target control strategy to obtain the differentiated risk control instruction corresponding to the target control strategy. The differentiated emergency control instruction will then be issued to the wind farm execution unit in the wind farm control system through the dedicated control channel corresponding to the target control strategy.

[0044] Optionally, after receiving a differentiated emergency control command, the wind farm execution unit automatically switches the port for listening to control commands to the dedicated control channel of the risk emergency control device, and from then on, it is only subject to the emergency control of the risk emergency control device until the main control system returns to normal and takes over control authority again.

[0045] S304. Monitor the health status information of the main control system in the wind farm control system in real time, and restore the control authority of the main control system when the health status information meets the preset reset conditions.

[0046] Among them, the preset reset conditions are the reset conditions set by the user in advance. The preset reset conditions can be normal communication service, normal core process data, consistent synchronization data, etc. This application does not make specific limitations on them.

[0047] Optionally, the security switching module continuously monitors the health status information of the main control system to determine when to return control to the main control system.

[0048] Specifically, currently, the main control system is considered to have the ability to regain control authority and triggers the control authority handover process only when all the health status information of the main control system meets the preset reset conditions and the wind farm control system is running stably under the emergency control of the risk emergency control system.

[0049] In this embodiment, the multi-dimensional state data of the wind farm control system is acquired by the perception and diagnosis module in the risk emergency control device, and the multi-dimensional state data is fused and analyzed to generate a structured feature vector. This structured feature vector is then transmitted to the vector decision module. The risk decision module performs risk identification on the structured feature vector to determine the risk scenario category of the wind farm control system, and generates a control takeover command package based on the risk scenario category. This control takeover command package is then sent to the adaptive control module. The adaptive control module parses the control takeover command package to determine whether the control takeover command is valid, and judges the status of the risk emergency control device based on its internal machine state. If the system possesses the capability to take over control authority, then based on the control takeover instruction package, it determines the target control strategy corresponding to the wind farm control system. Key control parameters from the control takeover instruction package are injected into the preset algorithm corresponding to the target control strategy to obtain differentiated emergency control instructions. These differentiated emergency control instructions are then sent to the wind farm execution unit through a dedicated control channel corresponding to the target control strategy, forcibly switching the instruction source of the wind farm execution unit to the risk emergency control device. The safety switching module continuously monitors the health status information of the main control system until the health status of the main control system meets the preset reset conditions, at which point the risk emergency control device returns control authority to the main control system. This application utilizes a risk emergency control device independent of the main control system to perform risk emergency control on the wind farm control system, completely decoupling the safety protection functions of the wind farm control system from the main control system, thereby improving the safety protection capability of the wind farm control system. Furthermore, this application uses multi-dimensional state data fusion analysis to determine the risk scenario categories of the wind farm control system, and invokes different control strategies based on these risk scenario categories to generate dedicated emergency control commands. This enriches the safety protection strategies of the wind farm control system, thereby improving its stability and reliability. In this way, the safety protection functions are decoupled from the main control system, enhancing the safety protection capabilities of the wind farm control system and enriching its safety protection strategies.

[0050] In one alternative implementation, see [link to implementation details]. Figure 4The aforementioned structured feature vector includes: key control parameters, abnormal data flags, and key data freeze flags. Key control parameters include: actual power, actual power change rate, communication packet loss rate, database response delay time, power deviation, grid frequency, and grid voltage. The operation of "determining the risk scenario category of the wind farm control system" in step S302 can specifically be as follows: S401. If the actual power is greater than the preset power safety threshold, and the actual power change rate is greater than the preset maximum allowable ramp rate, and the abnormal data flag is true, then the risk scenario category is determined to be power over-generation.

[0051] Optionally, the risk decision module extracts parameters related to power over-generation from the structured feature vector and performs real-time calculations and comparisons on these parameters to determine whether there is a risk of power over-generation in the wind farm control system.

[0052] Among them, actual power refers to the real-time active power measurement value at the grid connection point in the wind farm control system; the preset power safety threshold is the upper limit of power for safe operation of the wind farm set by the user in advance, which is usually determined based on the installed capacity of the wind farm, the thermal stability limit of the transmission line, or the grid dispatching protocol; the actual power change rate refers to the severity of the actual power fluctuation at the grid connection point; the maximum allowable ramp rate is the upper limit of the power change rate set by the user in the wind farm control system, which is usually determined based on the physical inertia limit of the wind turbine units in the wind farm control system and the frequency regulation capability of the grid; the abnormal data flag bit is the flag indicating that the real-time database response in the wind farm control system has timed out; the data freeze flag is the flag indicating that the real-time database response has timed out, the database update has been interrupted, or the key control parameters in the wind farm control system have been frozen.

[0053] Optionally, if the actual power output exceeds the preset power safety threshold, it indicates that the current active power output of the wind farm control system has exceeded the safe operating boundary. Without intervention, this could lead to equipment overload or transmission channel blockage. If the actual power change rate exceeds the preset maximum allowable ramp rate, it indicates that the wind farm control system has experienced a power surge exceeding physical limits. If the abnormal data flag is true, it indicates that the wind farm control system is experiencing a database unresponsiveness. Only when all three conditions are met simultaneously is the data anomaly of the wind farm control system considered a risk of over-generation.

[0054] S402. If the communication packet loss rate is greater than the preset communication packet loss rate threshold, and the database response delay time is greater than the preset time threshold, or the key data freeze flag is true, and the power deviation is greater than the preset power deviation threshold, then the risk scenario category is determined to be out of control.

[0055] Optionally, the risk decision module extracts parameters related to control runaway from the structured feature vector and performs real-time calculations and comparisons on these parameters to determine whether the wind farm control system faces control runaway risk. Control runaway includes both hardware and software failures.

[0056] Among them, the communication packet loss rate reflects the proportion of original communication message center jump messages lost in the control network of the wind farm control system; the preset communication packet loss rate threshold is a communication quality qualification threshold set by the user in advance; the database response delay time refers to the response delay time of the real-time database in the wind farm control system; the preset time threshold is the maximum allowable delay time of database response set by the user in advance; the critical data freeze flag bit refers to the abnormal flag bit that the critical control parameter remains unchanged in multiple control cycles; the power deviation refers to the deviation between the actual power of the wind farm control system and the current power set value; the preset power deviation threshold is the maximum power tracking error allowed by the wind farm control system in advance set by the user in advance.

[0057] Optionally, if the communication packet loss rate of the wind farm control system exceeds the standard and the database response times out completely, it indicates that the core infrastructure of the wind farm control system may have suffered physical failure or collapse. In this case, even if the control logic of the main control system itself may still be operating normally, the entire control system is essentially in a state of "out of control" because it cannot reliably communicate with the substation controller and cannot obtain or send valid data.

[0058] Optionally, when the critical data freeze flag is true, it indicates that the data update mechanism within the wind farm control system has failed. Simultaneously, if the power deviation exceeds the tolerance, it indicates that the power closed-loop regulation can no longer track the target value. Although the main control system may still be operating normally, its core control logic or data link has suffered functional failure, causing the actual power to deviate from the set value and become uncorrectable. In this fault mode, communication and database services may appear normal, but the control function has been lost.

[0059] S403. If a shutdown command is detected, and the grid frequency is within the preset normal frequency range, and the grid voltage is also within the preset normal voltage range, and no dispatch confirmation signal is detected, then the risk scenario category is determined to be abnormal load shedding.

[0060] Optionally, the risk decision module extracts parameters related to abnormal load shedding from the structured feature vector and performs real-time calculations and comparisons on these parameters to determine whether the wind farm control system has a risk of controlling load shedding.

[0061] Among them, the shutdown command is parsed from the original communication message of the control network; the grid frequency refers to the real-time frequency of the grid connection point in the wind farm control system; the normal frequency range is the normal frequency range of the grid connection point set by the user; the grid voltage refers to the real-time voltage of the grid connection point; the normal voltage range is the normal voltage range of the grid connection point set by the user; and the dispatch confirmation signal is parsed from the dispatch communication channel of the wind farm control system.

[0062] Optionally, if a shutdown command is detected, it indicates that the wind farm control system is attempting to perform a shutdown operation; if the grid frequency and grid voltage are normal, it indicates that there is currently no grid-side emergency requiring an emergency shutdown; if there is no dispatch confirmation signal, it indicates that the shutdown command did not originate from the main control system.

[0063] Optionally, if a shutdown command is received when the grid is stable and there is no dispatch confirmation signal, it indicates that the shutdown command is very likely a "false command" or "erroneous command" caused by a failure of the main control system (such as logical disorder or data error) or human error. If such commands are executed directly without intervention, it will cause the wind farm to suddenly shed load on a large scale when the grid does not need to reduce power, causing artificial power surges to the grid, which may lead to frequency drops or even cascading failures.

[0064] In one alternative implementation, see [link to implementation details]. Figure 5 The operation of "determining whether to take over the control authority of the main control system in the wind farm control system according to the control takeover instruction package" in step S303 above can be specifically as follows: S501. Parse the control takeover instruction packet to extract valid fields from the parsed control takeover instruction packet, and verify the validity of the control takeover instruction packet based on the valid fields.

[0065] Optionally, the adaptive control module parses the structured control takeover instruction package and extracts valid fields from the parsed package for validity verification. This ensures that the received control takeover instruction package is complete, tamper-proof, and contains all the necessary information for executing emergency control, providing reliable input for subsequent takeover decisions. Validity verification includes: integrity verification, format correctness verification, timeliness verification, and source legitimacy verification, etc., which are not specifically limited in this application.

[0066] S502. After successful verification, based on the takeover confidence level in the control takeover instruction package and the internal status of the risk emergency control device, determine whether the risk emergency control device meets the emergency control takeover conditions.

[0067] Optionally, after confirming that the received control takeover instruction packet is valid, the adaptive control module further determines whether control takeover should be performed.

[0068] Specifically, the adaptive control module first extracts the takeover confidence level from the received takeover command packet and compares it with a preset confidence threshold to determine whether the current risk scenario identification is highly credible. The preset confidence threshold is a configurable parameter, typically set to a high value (e.g., 0.9 or 90%), to ensure that emergency takeover is only triggered when the risk scenario assessment is highly credible, thereby avoiding erroneous actions due to false alarms.

[0069] Furthermore, the adaptive control module assesses the internal status of the risk emergency control device to determine whether the risk emergency control device is in standby mode. If so, it determines that the risk emergency control device has the ability to take over the control authority of the main control system.

[0070] The internal device status includes: standby, self-test, activation, fault, and recovery. Standby means the risk emergency control device is operating normally but has not intervened in wind farm control, only in listening and monitoring mode. Self-test means the risk emergency control device is performing a power-on self-test or periodic self-test, checking the hardware, communication, and algorithm modules for normal operation. Activation means the risk emergency control device has taken over control of the main control system and is executing emergency control strategies. Fault means the risk emergency control device has an unrecoverable fault and cannot operate normally, requiring manual intervention. Recovery means the risk emergency control device is executing a control authority handover process, in the synchronous observation period or switchover preparation phase.

[0071] S503. If so, then determine the control authority of the main control system in the wind farm control system.

[0072] Optionally, if the risk emergency control device meets the emergency control takeover conditions, the adaptive control module enters the control authority takeover process and triggers specific control switchover logic.

[0073] In one alternative implementation, see [link to implementation details]. Figure 6 The operation of "determining the target control strategy corresponding to the wind farm control system based on the control takeover instruction package" in step S303 above can be specifically as follows: S601. If the risk scenario category indicated by the risk scenario category identifier code in the control takeover instruction package is power over-generation, then the target control strategy is determined to be the dynamic voltage reduction strategy.

[0074] Optionally, when the risk scenario identifier code is power over-generation, the adaptive control module determines that the target control strategy to be executed is a dynamic voltage reduction strategy, that is, to smoothly and controllably reduce the actual power of the wind farm from the over-generation state to within the safe limit without causing secondary impact on the power grid.

[0075] Among them, the dynamic buck strategy is suitable for scenarios where the main control system fails, causing uncontrolled power surges, or communication anomalies prevent the power command from being reduced normally.

[0076] S602. If the risk scenario category indicated by the risk scenario category identifier code in the control takeover instruction package is loss of control, then the target control strategy is determined to be the full-field target tracking strategy.

[0077] Optionally, when the risk scenario identifier code is "control out of control", the adaptive control module determines that the target control strategy to be executed is the full-field target tracking strategy, that is, in the case of complete failure of the main control system, communication interruption or data freeze, the wind farm output is kept stable and the power fluctuation is avoided due to the lack of control.

[0078] Among them, the full-field target tracking strategy uses the last effective power setpoint before the main control system fails as the tracking target, and achieves zero steady-state error tracking of the total power of the entire field by allocating power according to the available power ratio and slow closed-loop correction.

[0079] S603. If the risk scenario category indicated by the risk scenario category identifier code in the control takeover instruction package is abnormal load shedding, then the target control strategy is determined to be the instruction interception support strategy.

[0080] Optionally, when the risk scenario identifier code is abnormal load shedding, the adaptive control module determines that the target control strategy to be executed is the command interception support strategy. This strategy prevents a full-scale shutdown command caused by misjudgment or misoperation of the main control system, thus avoiding the impact of large-scale load shedding on the power grid. Simultaneously, the command interception support strategy switches the wind farm control system to power maintenance mode, maintaining output based on the current actual power, or, if necessary, slowly reducing power at an extremely low rate, buying time for operators to troubleshoot the fault.

[0081] In one alternative implementation, see [link to implementation details]. Figure 7 The operation of "issuing differentiated emergency control commands to the wind farm execution unit through the dedicated control channel corresponding to the target control strategy" in step S303 above can be specifically as follows: S701. Broadcast the highest priority safety takeover message to all substation controllers in the wind farm control system through the dedicated control channel corresponding to the target control strategy, so that the command source of each substation controller is forcibly switched to the current emergency channel of the risk emergency control device.

[0082] Optionally, the adaptive control module broadcasts a high-priority safety takeover message to the entire substation controller in the wind farm control system via a dedicated hardware link (such as a separate Ethernet port, serial bus, or hardwired) independent of the main control system. The safety takeover message includes: an encrypted priority identifier, a timestamp, the authentication code of the risk emergency control device, and a forced switching command.

[0083] Optionally, upon receiving a secure takeover message, each substation controller first verifies the legality and integrity of the message. If verification is successful, each substation controller immediately switches its command receiving source from the main control system's control channel to the dedicated control channel designated by the risk emergency control device, and suspends its response to control commands issued by the main control system.

[0084] S702. Based on the risk scenario category identifier code in the control takeover instruction package, activate the preset control algorithm corresponding to the risk scenario category identifier code, and inject the key control parameters in the control takeover instruction package into the preset control algorithm to generate differentiated emergency control instructions.

[0085] Optionally, the strategy selector in the adaptive control virtual module switches the algorithm execution path to the corresponding algorithm module according to the risk scenario category identifier code in the control takeover instruction package, and injects the key control parameters in the control takeover instruction package into the algorithm module. The algorithm module calculates the specific instruction signal to be issued in each control cycle according to the injected real-time parameters and the preset control logic.

[0086] For example, the dynamic buck algorithm outputs the power target value that should be achieved in the current cycle; the target tracking algorithm outputs the power allocation value for each unit; and the command interception algorithm generates a Boolean interception signal.

[0087] It should be noted that these preset control algorithms are pre-installed in the adaptive control module in the form of software modules or firmware. Specifically, they may be dynamic buck PID controllers, target tracking power dividers, command interception logic, etc. This application does not make specific limitations on them.

[0088] S703. Differentiated emergency control commands are issued to the wind farm execution unit through the dedicated control channel corresponding to the target control strategy.

[0089] In one alternative implementation, see [link to implementation details]. Figure 8 The specific operation of step S703 above can be as follows: S801. If the target control strategy is a dynamic voltage reduction strategy, a smooth power reduction command is issued to the wind farm execution unit through a dedicated control channel.

[0090] Optionally, if the target control strategy executed by the risk emergency control device is a dynamic voltage reduction strategy, the adaptive control module generates a smooth power reduction command based on the injected key control parameters. Specifically, the smooth power reduction command can be a sequence of target power values ​​issued for each control cycle.

[0091] Optionally, the dynamic buck PID controller generates the power target value based on the following formulas (1) and (2), which are as follows: (1) (2) Where e(t) represents the power deviation at the grid connection point, Used to represent the actual power at the grid connection point. Used to indicate a preset power safety threshold, , , These are the control parameters of the dynamic buck PID controller. Used to represent power target values.

[0092] Optionally, the adaptive control device typically adopts a broadcast method, simultaneously sending power target values ​​to all wind turbines via a high-speed digital communication network. After receiving the smooth power reduction command, each wind turbine adjusts its converter or pitch angle according to the given power target value to achieve a smooth power reduction.

[0093] S802. If the target control strategy is a full-field target tracking strategy, then a power setpoint command is sent to the wind farm execution unit through a dedicated control channel.

[0094] Optionally, if the target control strategy executed by the risk emergency control device is a full-field target tracking strategy, the adaptive control module generates a power setpoint instruction based on the injected key control parameters. This power setpoint instruction may include an independent power setpoint for each wind turbine, calculated based on the proportion of available power allocated to each wind turbine and slow closed-loop correction.

[0095] Optionally, the target tracking power divider determines the power setting value of each wind turbine according to the following formulas (3), (4) and (5), which are as follows: (3) (4) (5) in, Used to represent the power setpoint of each wind turbine at time t. This is used to indicate the effective power setting value at the last moment before the main control system fails. Used to represent the available power of each wind turbine at time t. Used to represent the global closed-loop correction offset. Used to represent integral correction coefficients. Used to indicate the actual power of each wind turbine unit. Used to represent the target power setting value output by the target tracking power distributor.

[0096] Optionally, since the adaptive control module needs to transmit power setpoints to multiple wind turbines simultaneously, a high-speed digital communication network (such as a fiber optic ring network) is typically used to issue power setpoint commands in a point-to-point or multicast manner to ensure that all wind turbines receive the commands within the same control cycle; each wind turbine adjusts its output according to the received power setpoint to achieve accurate tracking of the total power of the entire field.

[0097] S803. If the target control strategy is a command interception support strategy, a shutdown command interception signal is sent to the substation controller corresponding to the wind farm execution unit through a dedicated control channel. At the same time, a power maintenance command is sent to the wind farm execution unit through a dedicated control channel.

[0098] Optionally, if the target control strategy executed by the risk emergency control device is a command interception support strategy, the adaptive control module generates power maintenance command and shutdown command interception signals based on the injected key control parameters. The shutdown command interception signal can be a hardwired level signal or an interception flag in a dedicated communication message. Its function is to block shutdown commands issued by the main control system at the physical layer or data link layer, preventing them from reaching the wind turbines. The power maintenance command is used to control each wind turbine to maintain its current output or to slowly reduce power at a very low rate.

[0099] Optionally, the adaptive control module can send shutdown command interception signals to all substation controllers through an independent hard-wired channel to ensure high reliability and minimal delay of the shutdown command interception signals; the adaptive control module can also send power maintenance commands to the wind farm execution unit through a digital communication channel.

[0100] Optionally, after receiving the shutdown command interception signal, the substation controller blocks the shutdown command from the main control system; at the same time, the wind turbine maintains its output according to the power maintenance command.

[0101] In one alternative implementation, see [link to implementation details]. Figure 9 The operation of "acquiring multi-dimensional state data of the wind farm control system" in step S301 above can be specifically as follows: S901. Real-time acquisition of raw communication messages in the control network of the wind farm control system, and determination of the health of the communication link of the wind farm control system based on the heartbeat messages in the raw communication messages.

[0102] Optionally, by using the mirror port of the network switch deployed in the wind farm control system, all raw communication message data related to the control commands and scheduling commands of the wind farm execution unit in the control network of the wind farm control system are captured from the bypass. Heartbeat messages periodically exchanged between key devices are selected from the raw communication message data. The bidirectional transmission delay is determined by comparing the timestamps of the sending and receiving times of these heartbeat messages. The packet loss rate is calculated to determine the connectivity of the communication link. Cyclic redundancy check is performed on all captured messages, and the bit error rate is calculated to evaluate the channel quality of the communication link. The calculated bidirectional transmission delay, packet loss rate, bit error rate, and other indicators are compared with the corresponding preset thresholds in real time to generate a quantitative indicator of the health of the communication link. The health of the communication link of the wind farm control system is determined based on this quantitative indicator.

[0103] S902. Initiate probe queries to the real-time database of the wind farm control system through an independent network session, monitor the response time and success rate of the probe queries in real time, and perform multi-level rationality checks on key control parameters to determine the availability of the wind farm control system database.

[0104] Optionally, lightweight probe queries are periodically initiated to the real-time database in the wind farm control system through independent network sessions. The response time and success rate of the real-time database to the probe query are monitored in real time. At the same time, the key control parameters of the wind farm control system at the current moment are read and parsed, and multi-level rationality checks are performed on these key control parameters. The availability of the wind farm control system database is directly determined based on the response time and success rate of the real-time database to the probe query and the rationality check results of the key control parameters.

[0105] The multi-level rationality verification includes: range rationality verification (such as whether the actual power is between 0 and the installed capacity of the wind farm execution unit), freeze rationality verification (such as whether the value remains abnormally unchanged in multiple cycles), and logical association rationality verification (such as whether the target setting value of the whole field matches the sum of the setting values ​​of each substation controller).

[0106] It is worth noting that the process of determining database availability can independently verify the integrity and logical consistency of the data source, and can identify deep database failures such as database service crashes, data update terminals, or data logic errors.

[0107] S903. Real-time acquisition of electrical quantity data and grid dispatch instructions at grid connection points, and determination of the reliability of grid dispatch instructions and grid-side dynamic behavior based on electrical quantity data and grid dispatch instructions.

[0108] Optionally, real-time electrical quantity data from the grid connection point can be received directly through an independent communication interface, and original grid dispatching instructions sent from the grid dispatching master station to the main control system can be obtained through a dedicated channel. The grid behavior diagnosis engine performs fusion analysis on the original grid dispatching instructions and real-time electrical quantity data to determine the reliability of the grid dispatching instructions and the dynamic behavior of the grid side. The real-time electrical quantity data includes: real-time grid frequency, real-time grid voltage, and real-time grid power.

[0109] Specifically, by verifying the continuity of instruction sequence numbers, the gradient of changes in power grid dispatch instructions is calculated to identify faults such as lost, repeated, or excessive ramp rates in power grid dispatch instructions. Simultaneously, based on physical laws, gradient compliance analysis is performed on real-time power grid power in real-time electrical quantity data. By comparing real-time power grid power with the physical inertia limits of the wind farm execution unit group, abnormal electrical quantity data with abrupt measurement changes or physical unreliability are identified.

[0110] In one alternative implementation, see [link to implementation details]. Figure 10 The specific operation of step S304 above can be as follows: S1001, Real-time monitoring of the health status information of the main control system and the operational stability indicators of the wind farm control system.

[0111] Optionally, the risk emergency control device monitors the health status information of the main control system and the operational stability indicators of the wind farm control system in real time through the safety switching module, and evaluates the operational stability of the wind farm control system under the emergency control of the risk emergency control device based on the reset judgment logic built into the safety switching module. The health status information includes: communication service status, core process status, data consistency self-check results, and command output continuity; the operational stability indicators include: power fluctuation, frequency deviation, voltage stability, and wind turbine status consistency.

[0112] Optionally, the safety switching module can acquire health status information such as the communication service status, core process status, data consistency self-test results, and command output continuity of the main control system in the wind farm control system in real time through an independent monitoring channel.

[0113] Specifically, by sending lightweight heartbeat probe messages to the core communication process of the main control system, the response time and success rate of the main control system are monitored to determine the communication service status of the main control system. If the response time is lower than a preset threshold (e.g., response time < 50ms) for several consecutive cycles and there is no packet loss, the communication service status of the main control system is considered to have returned to normal. The running status flags of key processes such as data acquisition process, power regulation process, and protection logic process inside the main control system are read to determine the status of the core processes of the main control system. If the status of all core processes of the main control system is normal, it means that the status of the core processes of the main control system has returned to normal. During the recovery process, the main control system will perform internal data consistency checks, such as comparing the deviation between real-time data and historical data, and verifying the validity of key control parameters. The safety switching module obtains these self-check results through a dedicated communication interface to determine whether the main control system has the ability to provide accurate control commands. It monitors whether the main control system has started to periodically issue effective control commands, and if the sequence number of the control commands is continuous and the sequence number gradient change is reasonable, it is determined that the output channel of the main control system can be used normally.

[0114] Optionally, the safety switching module assesses the operational stability of the wind farm control system under emergency control by the risk emergency control device in real time to determine whether to return control authority to the main control system. The main stability indicators monitored by the safety switching module include: power fluctuation, frequency deviation, voltage stability, and turbine status consistency.

[0115] Specifically, the standard deviation or range of the total active power of the wind farm control system within a specified time window (e.g., 10 seconds, 60 seconds, etc.) is calculated to determine the power fluctuation of the wind farm control system. If the power fluctuation amplitude is less than the preset fluctuation threshold (e.g., ±1%), it is determined that the power output of the wind farm control system tends to be stable. The frequency deviation and frequency change rate between the real-time grid frequency and the rated frequency at the grid connection point of the wind farm control system are monitored. If the real-time grid frequency is always maintained within the normal frequency range and the frequency change rate is flat, it indicates that the wind farm control system has not caused adverse disturbances to the grid. The real-time grid fluctuation at the grid connection point of the wind farm control system is monitored to ensure that the real-time grid does not fluctuate drastically within the normal voltage allowable range. The consistency of the operating status of each wind turbine in the wind farm control system is evaluated, such as whether there are wind turbines that frequently start and stop or have abnormal alarms, to ensure that the wind turbine group is in a controllable state.

[0116] It is worth noting that the main control system only has the basic conditions to regain control authority when both the health status information of the main control system and the operational stability indicators of the wind farm control system meet the preset reset conditions.

[0117] S1002. If the health status information and operational stability indicators both meet the preset reset conditions, and a manual confirmation signal is detected, a reset ready flag is generated, and a synchronous observation period is started to perform multi-cycle rolling comparisons of the differentiated emergency control commands sent by the risk emergency control device and the control commands sent by the main control system.

[0118] The preset reset conditions include: main control system recovery conditions and operational stability conditions. Specifically, if the main control system's communication service is normal, all core processes are running normally, data consistency self-test passes, and command output is continuously valid during the continuous control period, it indicates that the main control system has recovered to normal. If the wind farm control system's overall power fluctuation, frequency deviation, voltage fluctuation, and other indicators are all better than the preset stability thresholds, and the continuous stability time reaches the preset time threshold, it indicates that the wind farm control system is operating stably under the control of the risk emergency control device.

[0119] Optionally, the safety switching module compares health status information and operational stability indicators with a preset reset threshold based on its built-in reset judgment logic to determine whether the main control system meets the basic reset conditions. If so, the safety switching module generates a reset ready flag based on its built-in reset judgment logic and, upon receiving a manual confirmation signal from the operator, initiates a synchronous observation period. During this period, the risk emergency control device maintains control over the wind farm control system and continues to execute the original emergency control strategy. However, it also activates a high-priority parallel processing thread specifically for receiving and decoding the control command stream issued after the main control system recovers.

[0120] Optionally, the preset non-disturbance threshold can be a threshold set by the user in advance. There are corresponding non-disturbance thresholds for different comparison dimensions, such as power command deviation being less than 0.5% of rated power, gradient difference being less than the maximum allowable gradient, etc. This application does not make specific limitations on this.

[0121] Furthermore, during the synchronous observation period, the safety switching module performs multi-cycle rolling comparisons of the control commands issued by the main control system and the differentiated emergency control commands issued by the risk emergency control device based on the built-in comparison algorithm.

[0122] Multi-cycle rolling comparison can be used to compare the instantaneous value deviation of control commands, the consistency of the changing trend of control commands, or the logical pattern of control commands. The internal details do not specify any particular limitations on this.

[0123] It is worth noting that, in order to ensure the safe operation of the wind farm control system, the control authority handover action is not triggered immediately after receiving the reset ready flag. Instead, it waits for the operator's manual confirmation signal and starts the synchronous observation period after receiving the manual confirmation signal. During the synchronous observation period, the control actions issued by the main control system and the risk emergency control device are compared multiple times until the disturbance-free handover conditions are met, and then the control authority handover operation is carried out.

[0124] Optionally, if the comparison result in any control cycle exceeds the preset non-disturbance threshold, it is determined as a comparison failure, and the synchronous observation period will restart the timing, or the reset process will be terminated directly and an alarm will be issued.

[0125] S1003. If the comparison result between the emergency control command and the control command continues to be greater than the preset non-disturbance threshold during the synchronous observation period, the command source of the whole substation controller in the wind farm control system will be switched to the main control system under the time synchronization mechanism, and the control right release message will be broadcast to the wind farm execution unit.

[0126] Specifically, after the synchronous observation period ends, if the comparison results of the emergency control commands issued by the risk emergency control device and the control commands issued by the main control system during the synchronous observation period continue to meet the preset non-disturbance threshold, it is determined that the main control system and the risk emergency control device have the conditions for non-disturbance handover of control authority, and the risk emergency control device will return the control authority to the main control system under the time synchronization mechanism.

[0127] The control authority handover process under the time synchronization mechanism is as follows: The safety switching module pre-locks the starting boundary of a future control cycle as the control authority handover time point; before the control authority handover time point arrives, the safety switching module needs to complete the synchronization and state alignment of all internal cached data (such as keeping the last valid value of the emergency control command in the output cache) to ensure that the output value at the handover time point will not change abruptly; when the control authority handover time point arrives, the safety switching module first seamlessly switches the data source of the issued command from the internal command generator of the risk emergency control device to the command receiving cache of the main control system; after the data source switch is completed, the safety switching module broadcasts a control release message containing an encrypted sequence number to all sub-station controllers in the wind farm control system through an independent safety channel; after receiving the control release message, each sub-station controller verifies the validity and integrity of the control release message, and after successful verification, switches the command listening port from the dedicated control channel of the risk emergency control device back to the control channel of the main control system, so that each sub-station controller only responds to the control commands issued by the main control system. The control release message includes: message type identifier, timestamp, encryption verification code, and target sub-site group address.

[0128] It should be noted that determining this handover time point requires consideration of the clock synchronization accuracy of all substation controllers in the wind farm control system. Typically, network-wide time synchronization of the wind farm control system is achieved based on Precision Time Protocol (PTP) or Network Time Protocol (NTP). This handover time point is usually set at the start of the next integer second or integer control cycle; this application does not impose specific limitations on this.

[0129] It should also be noted that data source switching is usually completed at the hardware or driver level, ensuring strict continuity of the output command stream in terms of timestamps and values. For example, before the handover time point arrives, the last value of the output port of the safety switching module is the final value of the differentiated emergency command; after the handover time point arrives, the output port of the main control system immediately outputs the first value of the main control system's control command, and the difference between the two has been verified to be less than the preset non-disruption threshold, so that the actual output waveform of the main control system has no visible step.

[0130] After receiving manual confirmation, the module immediately initiates the crucial "synchronous observation and command comparison period." During this period, the emergency controller maintains the operation of the current control closed loop, but simultaneously activates a high-priority parallel thread to receive and decode the control command stream issued by the main energy management system in real time. The module's built-in comparison algorithm performs a rigorous multi-cycle rolling comparison of the two commands (emergency commands and main system commands), comparing the instantaneous deviation of the command values, the consistency of the first derivative (gradient) of the changing trend, and the degree of consistency of the logical patterns (such as the direction of rise and fall). This observation period will last for at least dozens of control cycles. The module is only finally verified when the difference between the two commands in all comparison dimensions remains below the dynamically calculated non-disturbance threshold (e.g., the power command deviation remains less than 0.5% of the rated value and the trend is consistent).

[0131] Optionally, the entire control authority handover process can usually be completed within milliseconds, and for the controlled wind turbine, the power command sequence it receives has no step or interruption in time or amplitude, thus avoiding secondary power disturbances that may be caused by the transfer of control authority.

[0132] The following describes the apparatus and computer-readable storage medium used to implement the risk emergency control method provided in this application. The specific implementation process and technical effects are described above and will not be repeated below.

[0133] Figure 2 This is a structural schematic diagram of a risk emergency control device provided in this application. See also... Figure 2 The risk emergency control device 102 includes: a perception and diagnosis module 1021, a risk decision module 1022, an adaptive control module 1023, and a safety switching module 1024; The perception and diagnosis module 1021 is used to acquire multi-dimensional state data of the wind farm control system and fuse the multi-dimensional state data to generate a structured feature vector corresponding to the wind farm control system. The risk decision module 1022 is used to determine the risk scenario category of the wind farm control system based on the structured feature vector, and generate a control takeover instruction package based on the risk scenario category. The control takeover instruction package includes: risk scenario category identifier code, key control parameters and takeover confidence level. The adaptive control module 1023 is used to determine whether to take over the control authority of the main control system in the wind farm control system according to the control takeover instruction package; if so, it determines the target control strategy corresponding to the wind farm control system according to the control takeover instruction package, and issues differentiated emergency control instructions to the wind farm execution unit through the dedicated control channel corresponding to the target control strategy. The safety switching module 1024 is used to monitor the health status information of the main control system in the wind farm control system in real time, and restore the control authority of the main control system when the health status information meets the preset reset conditions.

[0134] Optionally, the structured feature vector includes: key control parameters, abnormal data flags, and key data freeze flags. The key control parameters include: actual power, actual power change rate, communication packet loss rate, database response delay time, power deviation, grid frequency, and grid voltage. The risk decision module 1022 is specifically used to: determine the risk scenario category as power over-generation if the actual power is greater than a preset power safety threshold, the actual power change rate is greater than a preset maximum allowable ramp rate, and the abnormal data flag is true; determine the risk scenario category as control failure if the communication packet loss rate is greater than a preset communication packet loss rate threshold, the database response delay time is greater than a preset time threshold, or the key data freeze flag is true and the power deviation is greater than a preset power deviation threshold; determine the risk scenario category as abnormal load shedding if a shutdown command is detected, the grid frequency is within a preset normal frequency range, the grid voltage is also within a preset normal voltage range, and no dispatch confirmation signal is detected.

[0135] Optionally, the aforementioned adaptive control module 1023 is specifically used to: parse the control takeover instruction package to extract valid fields from the parsed control takeover instruction package, and verify the validity of the control takeover instruction package based on the valid fields; after successful verification, determine whether the risk emergency control device meets the emergency control takeover conditions based on the takeover confidence level in the control takeover instruction package and the internal machine status of the risk emergency control device; if so, determine the control authority of the main control system in the wind farm control system to take over.

[0136] Optionally, the adaptive control module 1023 is further configured to: if the risk scenario category indicated by the risk scenario category identifier code in the control takeover instruction package is power over-generation, then determine the target control strategy as a dynamic voltage reduction strategy; if the risk scenario category indicated by the risk scenario category identifier code in the control takeover instruction package is control failure, then determine the target control strategy as a full-field target tracking strategy; if the risk scenario category indicated by the risk scenario category identifier code in the control takeover instruction package is abnormal load shedding, then determine the target control strategy as an instruction interception support strategy.

[0137] Optionally, the aforementioned adaptive control module 1023 is further configured to: broadcast a highest-priority safety takeover message to all substation controllers in the wind farm control system through a dedicated control channel corresponding to the target control strategy, so that the command source of each substation controller is forcibly switched to the current emergency channel of the risk emergency control device; activate the preset control algorithm corresponding to the risk scenario category identifier code in the control takeover instruction package, and inject the key control parameters in the control takeover instruction package into the preset control algorithm to generate differentiated emergency control instructions; and issue differentiated emergency control instructions to the wind farm execution unit through the dedicated control channel corresponding to the target control strategy.

[0138] Optionally, the aforementioned adaptive control module 1023 can also be used to: if the target control strategy is a dynamic voltage reduction strategy, then send a smooth power reduction command to the wind farm execution unit through a dedicated control channel; if the target control strategy is a full-field target tracking strategy, then send a power setpoint command to the wind farm execution unit through a dedicated control channel; if the target control strategy is a command interception support strategy, then send a shutdown command interception signal to the substation controller corresponding to the wind farm execution unit through a dedicated control channel, and at the same time, send a power maintenance command to the wind farm execution unit through a dedicated control channel.

[0139] Optionally, the aforementioned perception and diagnosis module 1021 is specifically used for: acquiring the original communication messages in the control network of the wind farm control system in real time, and determining the health of the communication link of the wind farm control system based on the heartbeat messages in the original communication messages; initiating probe queries to the real-time database of the wind farm control system through independent network sessions, monitoring the response time and success rate of the probe queries in real time, and performing multi-level rationality checks on key control parameters to determine the availability of the database of the wind farm control system; acquiring the electrical quantity data and grid dispatch instructions at the grid connection point in real time, and determining the credibility of the grid dispatch instructions and the dynamic behavior of the grid side based on the electrical quantity data and grid dispatch instructions.

[0140] Optionally, the aforementioned safety switching module 1024 is specifically used for: real-time monitoring of the health status information of the main control system and the operational stability indicators of the wind farm control system; if the health status information and operational stability indicators both meet the preset reset conditions, and a manual confirmation signal is detected, a reset ready flag is generated, and a synchronous observation period is initiated to perform multi-cycle rolling comparisons between the differentiated emergency control commands sent by the risk emergency control device and the control commands sent by the main control system; if the comparison result between the emergency control commands and the control commands is continuously greater than the preset non-disturbance threshold during the synchronous observation period, the command source of the entire substation controller in the wind farm control system is switched to the main control system under the time synchronization mechanism, and a control release message is broadcast to the wind farm execution unit.

[0141] The above-described device is used to execute the method provided in the foregoing embodiments, and its implementation principle and technical effect are similar, so they will not be described again here.

[0142] These modules can be one or more integrated circuits configured to implement the above methods, such as one or more Application Specific Integrated Circuits (ASICs), one or more microprocessors, or one or more Field Programmable Gate Arrays (FPGAs). Alternatively, when a module is implemented using processing element scheduler code, the processing element can be a general-purpose processor, such as a Central Processing Unit (CPU) or other processor capable of calling program code. Furthermore, these modules can be integrated together as a system-on-a-chip (SOC).

[0143] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, can implement the steps in the various method embodiments described above.

[0144] Optionally, this application also provides a program product, such as a computer-readable storage medium, including a program that, when executed by a processor, performs any of the above-described risk emergency control method embodiments.

[0145] In the several embodiments provided by this invention, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0146] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0147] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or in the form of hardware plus software functional units.

[0148] The integrated units implemented as software functional units described above can be stored in a computer-readable storage medium. These software functional units, stored in a storage medium, include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute partial steps of the methods of the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0149] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0150] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A risk emergency control method, characterized in that, The method, applied to risk emergency control devices, includes: The multidimensional state data of the wind farm control system is acquired and fused to generate a structured feature vector corresponding to the wind farm control system. Based on the structured feature vector, the risk scenario category of the wind farm control system is determined, and a control takeover instruction package is generated based on the risk scenario category. The control takeover instruction package includes: risk scenario category identifier code, key control parameters, and takeover confidence level. Based on the control takeover instruction package, determine whether to take over the control authority of the main control system in the wind farm control system; if so, determine the target control strategy corresponding to the wind farm control system based on the control takeover instruction package, and issue differentiated emergency control instructions to the wind farm execution unit through the dedicated control channel corresponding to the target control strategy. The system monitors the health status information of the main control system in the wind farm control system in real time, and restores the control authority of the main control system when the health status information meets the preset reset conditions.

2. The risk emergency control method according to claim 1, characterized in that, The structured feature vector includes: key control parameters, abnormal data flag bits, and key data freeze flag bits. The key control parameters include: actual power, actual power change rate, communication packet loss rate, database response delay time, power deviation, power grid frequency, and power grid voltage. The determination of the risk scenario categories for the wind farm control system includes: If the actual power is greater than the preset power safety threshold, and the actual power change rate is greater than the preset maximum allowable ramp rate, and the abnormal data flag is true, then the risk scenario category is determined to be power over-generation. If the communication packet loss rate is greater than a preset communication packet loss rate threshold, and the database response delay time is greater than a preset time threshold, or the key data freeze flag is true, and the power deviation is greater than a preset power deviation threshold, then the risk scenario category is determined to be out of control. If a shutdown command is detected, and the grid frequency is within a preset normal frequency range, the grid voltage is also within a preset normal voltage range, and no dispatch confirmation signal is detected, then the risk scenario category is determined to be abnormal load shedding.

3. The risk emergency control method according to claim 1, characterized in that, The step of determining whether to take over the control authority of the main control system in the wind farm control system based on the control takeover instruction package includes: The control takeover instruction packet is parsed to extract valid fields from the parsed control takeover instruction packet, and the validity of the control takeover instruction packet is verified based on the valid fields. After verification, based on the takeover confidence level in the control takeover instruction package and the internal machine status of the risk emergency control device, it is determined whether the risk emergency control device meets the emergency control takeover conditions. If so, then the control authority to take over the main control system in the wind farm control system is determined.

4. The risk emergency control method according to claim 1, characterized in that, The step of determining the target control strategy corresponding to the wind farm control system based on the control takeover instruction package includes: If the risk scenario category indicated by the risk scenario category identifier code in the control takeover instruction package is power over-generation, then the target control strategy is determined to be a dynamic voltage reduction strategy. If the risk scenario category indicated by the risk scenario category identifier code in the control takeover instruction package is loss of control, then the target control strategy is determined to be a full-field target tracking strategy. If the risk scenario category indicated by the risk scenario category identifier code in the control takeover instruction package is abnormal load shedding, then the target control strategy is determined to be an instruction interception support strategy.

5. The risk emergency control method according to claim 1, characterized in that, The process of issuing differentiated emergency control commands to the wind farm execution unit through a dedicated control channel corresponding to the target control strategy includes: The highest priority safety takeover message is broadcast to all substation controllers in the wind farm control system through the dedicated control channel corresponding to the target control strategy, so that the command source of each substation controller is forcibly switched to the current emergency channel of the risk emergency control device. Based on the risk scenario category identifier code in the control takeover instruction package, activate the preset control algorithm corresponding to the risk scenario category identifier code, and inject the key control parameters in the control takeover instruction package into the preset control algorithm to generate differentiated emergency control instructions; The differentiated emergency control command is issued to the wind farm execution unit through the dedicated control channel corresponding to the target control strategy.

6. The risk emergency control method according to claim 5, characterized in that, The process of issuing differentiated emergency control commands to the wind farm execution unit through a dedicated control channel corresponding to the target control strategy includes: If the target control strategy is a dynamic voltage reduction strategy, then a smooth power reduction command is sent to the wind farm execution unit through a dedicated control channel; If the target control strategy is a full-field target tracking strategy, then a power setpoint command is sent to the wind farm execution unit through a dedicated control channel; If the target control strategy is an instruction interception support strategy, then a shutdown instruction interception signal is sent to the substation controller corresponding to the wind farm execution unit through a dedicated control channel. At the same time, a power maintenance instruction is sent to the wind farm execution unit through a dedicated control channel.

7. The risk emergency control method according to claim 1, characterized in that, The acquisition of multi-dimensional state data of the wind farm control system includes: The system acquires raw communication messages in the control network of the wind farm control system in real time, and determines the health of the communication link of the wind farm control system based on the heartbeat messages in the raw communication messages. Probe queries are initiated to the real-time database of the wind farm control system through independent network sessions. The response time and success rate of the probe queries are monitored in real time, and multi-level rationality checks are performed on key control parameters to determine the availability of the wind farm control system database. Real-time acquisition of electrical quantity data and grid dispatch instructions at grid connection points, and determination of the reliability of grid dispatch instructions and grid-side dynamic behavior based on the electrical quantity data and grid dispatch instructions.

8. The risk emergency control method according to claim 1, characterized in that, The real-time monitoring of the health status information of the main control system in the wind farm control system, and the return of control to the main control system when the health status information meets preset reset conditions, includes: Real-time monitoring of the health status information of the main control system and the operational stability indicators of the wind farm control system; If the health status information and the operational stability indicators both meet the preset reset conditions, and a manual confirmation signal is detected, a reset ready flag is generated, and a synchronous observation period is started to perform multi-cycle rolling comparisons between the differentiated emergency control commands sent by the risk emergency control device and the control commands sent by the main control system. If the comparison result between the emergency control command and the control command is continuously greater than the preset non-disturbance threshold during the synchronous observation period, the command source of the whole substation controller in the wind farm control system will be switched to the main control system under the time synchronization mechanism, and a control release message will be broadcast to the wind farm execution unit.

9. A risk emergency control device, characterized in that, The risk emergency control device includes: a perception and diagnosis module, a risk decision-making module, an adaptive control module, and a safety switching module; The perception and diagnosis module is used to acquire multi-dimensional state data of the wind farm control system and fuse the multi-dimensional state data to generate a structured feature vector corresponding to the wind farm control system. The risk decision module is used to determine the risk scenario category of the wind farm control system based on the structured feature vector, and generate a control takeover instruction package based on the risk scenario category. The control takeover instruction package includes: risk scenario category identifier code, key control parameters, and takeover confidence level. The adaptive control module is used to determine whether to take over the control authority of the main control system in the wind farm control system according to the control takeover instruction package; if so, it determines the target control strategy corresponding to the wind farm control system according to the control takeover instruction package, and issues differentiated emergency control instructions to the wind farm execution unit through the dedicated control channel corresponding to the target control strategy. The safety switching module is used to monitor the health status information of the main control system in the wind farm control system in real time, and restore the control authority of the main control system when the health status information meets the preset reset conditions.

10. A wind farm control system, characterized in that, The wind farm control system includes: the risk emergency control device as described in claim 9.

Images