A safety optimization control method and system for a wind turbine in a limit operating state

Abstract

The present disclosure relates to a wind turbine limit operation state safety optimization control method and system, and relates to the technical field of wind turbine operation control, comprising: acquiring a state vector in the operation process of a wind turbine, generating a credible margin trajectory and a time-to-limit corresponding to each risk channel in multiple risk channels based on the state vector; generating a limit safety package according to the credible margin trajectory, the time-to-limit and a sensing credibility; generating optimization control and protection control in parallel based on the multiple risk channels, and performing arbitration and safety domain projection according to the limit safety package based on the optimization control and the protection control to obtain an execution control; executing the execution control, and determining a protection level update strategy of the wind turbine according to a projection conflict index, a credible residual error and the time-to-limit after the execution is completed. Through the cooperative optimization and dynamic protection level adjustment of multiple channels, the safety and stability of the wind turbine under extreme working conditions can be effectively improved.

Description

Technical Field

[0001] This disclosure relates to the field of wind turbine generator operation control technology, specifically to a safety optimization control method and system for wind turbine generators under extreme operating conditions. Background Technology

[0002] As wind turbines evolve towards larger capacities, longer blades, taller towers, and more complex onshore and offshore environments, the extreme operating conditions they face are becoming increasingly complex. Especially when faced with sudden low-altitude wind shear, sudden gusts, strong turbulence, rapid wind direction changes, grid voltage drops, frequency shifts, drivetrain torsional vibration, pitch actuator response hysteresis, yaw system tracking deviations, and the simultaneous occurrence of multiple risks, the wind turbine control system not only needs to maintain power output and grid goodness but also needs to prevent critical components such as blades, towers, hubs, main shafts, gearboxes, generators, and converters from entering overload or instability states. Traditional wind turbine control often employs zoned control strategies. For example, below rated wind speed, maximum power point tracking is achieved through torque control; above rated wind speed, rated power is maintained through pitch control; and derating, shutdown, or fault protection is implemented when specific faults or protection thresholds are triggered. This type of method has good engineering applicability under normal operating conditions, but under extreme operating conditions, there is a clear coupling relationship between risk channels. A single threshold judgment or a single actuator protection action often fails to reflect the true safety margin of the unit in a timely manner, resulting in poor safety and stability of wind turbine units under extreme operating conditions. Summary of the Invention

[0003] The purpose of this disclosure is to provide a safety optimization control method and system for wind turbine units under extreme operating conditions.

[0004] To achieve the above objectives, according to a first aspect of the present disclosure, a safety optimization control method for wind turbine generators under extreme operating conditions is provided, comprising: The state vector of the wind turbine during operation is obtained, and the state vector includes at least one of the following: wind speed, turbulence intensity, wind direction change rate, rotational speed, pitch angle, generator torque, blade root bending moment, tower bending moment, nacelle acceleration, grid connection voltage and grid connection frequency. Based on the state vector, a reliable margin trajectory and time to limit are generated for each of the multiple risk channels; wherein, the risk channel is used to characterize the risk sources that may trigger protection when the wind turbine is in extreme operating conditions; An extreme security package is generated based on the trusted margin trajectory, the time to limit, and the sensor trustworthiness; the extreme security package includes: extreme state label, dynamic security domain, protection level, unlocking conditions, and fallback strategy; Based on the multiple risk channels, optimized control quantities and protection control quantities are generated in parallel. Based on the optimized control quantities and protection control quantities, arbitration and security domain projection are performed according to the extreme security package to obtain the execution control quantity. The execution control variable is executed, and after execution, the protection level update strategy of the wind turbine is determined based on the projection conflict index, the reliable residual, and the time limit. The protection strategy includes: maintaining the current control, upgrading protection, downgrading protection, shutdown protection, and rollback.

[0005] Optionally, the plurality of risk channels include at least one of the following: speed risk channel, blade root load risk channel, tower load risk channel, transmission chain vibration risk channel, grid voltage risk channel, grid frequency risk channel, and actuator degradation risk channel.

[0006] Optionally, each risk channel includes: a continuous operation boundary and a protection exit boundary. The step of generating a reliable margin trajectory and time-to-limit for each of the multiple risk channels based on the state vector includes: The reliability margin trajectory of the first risk channel is determined based on the protection exit boundary, the continuous operation boundary, the risk channel observation, the sensor reliability, and the data degradation penalty amount; the first risk channel is any one of the plurality of risk channels. The time to reach the limit of the first risk channel is determined based on the protection exit boundary of the first risk channel, the risk channel observation, and the rate of change of the risk channel observation.

[0007] Optionally, the risk channel observation is the observation after the corresponding risk channel has been aligned with the danger direction.

[0008] Optionally, the extreme state label is used to indicate that the current state of the wind turbine belongs to the extreme state of sudden wind overspeed, load approach, grid connection crossing, actuator degradation, transmission chain vibration amplification, or a combination of extreme states. The dynamic safety domain is used to limit the allowable range of the pitch rate, torque change rate, yaw rate, active power change rate, and reactive power change rate of the wind turbine. The protection level is used to indicate the protection status of the wind turbine, which includes: continuous operation, derating operation, protection off or shutdown; The unlocking conditions are used to define the switching conditions for different protection levels among the protection levels; The rollback strategy is used to roll back to the security strategy of the previous cycle when the optimized control quantity and the protection control quantity in the current cycle meet the conflict condition.

[0009] Optionally, each of the risk channels includes: a protected exit boundary; The dynamic security domain is determined based on the protection exit boundary, the trusted margin trajectory, the time to limit, the trusted margin contraction coefficient, and the time to limit contraction coefficient.

[0010] Optionally, the optimized control quantity includes at least two of the following: collective pitch increment, individual pitch increment, generator torque increment, yaw increment, active power command increment, and reactive power command increment; The protection control quantity is determined based on the risk channel with the shortest time to reach its limit among the plurality of risk channels.

[0011] Optionally, the projection conflict index is determined based on the deviation relationship between the execution control quantity, the optimization control quantity, and the protection control quantity.

[0012] Optionally, the reliable residual is determined based on the sensing reliability, the measured response vector, and the predicted response vector; wherein the measured response vector is the actual response data of the wind turbine after executing the executed control quantity, and the predicted response vector is the predicted response data of the wind turbine after executing the executed control quantity.

[0013] According to a second aspect of the present disclosure, a safety optimization control system for wind turbine generators under extreme operating conditions is provided, comprising: a status acquisition module, a reliable margin generation module, an extreme safety package generation module, a dual-channel control module, a safety arbitration and projection module, an execution interface module, and a protection upgrade and downgrade module; The state acquisition module is used to acquire the state vector during the operation of the wind turbine. The state vector includes at least one of the following: wind speed, turbulence intensity, wind direction change rate, rotational speed, blade pitch angle, generator torque, blade root bending moment, tower bending moment, nacelle acceleration, grid connection voltage, and grid connection frequency. The reliable margin generation module is used to generate a reliable margin trajectory and time to limit for each of the multiple risk channels based on the state vector; wherein, the risk channel is used to characterize the risk source that may trigger protection of the wind turbine under extreme operating conditions; The extreme security package generation module is used to generate an extreme security package based on the trusted margin trajectory, the time to limit, and the sensor trustworthiness; the extreme security package includes: extreme state label, dynamic security domain, protection level, unlocking conditions, and fallback strategy; The dual-channel control module is used to generate optimized control quantities and protection control quantities in parallel based on the multiple risk channels; The security arbitration and projection module is used to arbitrate and project the security domain based on the optimized control quantity and the protection control quantity according to the limit security package to obtain the execution control quantity; The execution interface module is used to execute the execution control quantity; The protection upgrade / downgrade module is used to determine the protection level update strategy of the wind turbine based on the projection conflict index, reliable residual and the time limit after the execution of the control quantity. The protection strategy includes: maintaining the current control, upgrading protection, downgrading protection, shutdown protection and rollback.

[0014] The above technical solution obtains a state vector during the operation of a wind turbine, which includes at least one of the following: wind speed, turbulence intensity, wind direction change rate, rotational speed, pitch angle, generator torque, blade root bending moment, tower bending moment, nacelle acceleration, grid connection voltage, and grid connection frequency. Based on this state vector, a reliable margin trajectory and time-to-limit are generated for each of multiple risk channels. This risk channel characterizes the risk sources that may trigger protection under extreme operating conditions. An ultimate safety protection mechanism is generated based on the reliable margin trajectory, the time-to-limit, and the sensor reliability. The system is fully inclusive; this extreme safety package includes: extreme state labels, dynamic safety domains, protection levels, unlocking conditions, and fallback strategies. Based on these multiple risk channels, optimized control quantities and protection control quantities are generated in parallel. Arbitration and safety domain projection are then performed on these optimized and protection control quantities according to the extreme safety package to obtain the execution control quantity. This execution control quantity is executed, and after execution, the protection level update strategy for the wind turbine is determined based on the projection conflict index, reliable residual, and the time-to-limit. The protection strategy includes: maintaining current control, escalating protection, downgrading protection, shutdown protection, and fallback. Through multi-channel collaborative optimization and dynamic protection level adjustment, the safety and stability of wind turbines under extreme operating conditions can be effectively improved.

[0015] Other features and advantages of this disclosure will be described in detail in the following detailed description section. Attached Figure Description

[0016] The accompanying drawings are provided to further illustrate the present disclosure and form part of the specification. They are used together with the following detailed description to explain the present disclosure, but do not constitute a limitation thereof. In the drawings: Figure 1 This is a flowchart illustrating a safety optimization control method for wind turbine units under extreme operating conditions, according to an exemplary embodiment.

[0017] Figure 2 This is a flowchart illustrating a safety optimization control method for wind turbine units under extreme operating conditions, according to an exemplary embodiment.

[0018] Figure 3 This is a schematic diagram illustrating an extreme security package according to an exemplary embodiment.

[0019] Figure 4 This is a schematic diagram of a safety optimization control system for a wind turbine under extreme operating conditions, according to an exemplary embodiment.

[0020] Figure 5 This is a block diagram illustrating an electronic device 500 according to an exemplary embodiment. Detailed Implementation

[0021] The specific embodiments of this disclosure will be described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are for illustration and explanation only and are not intended to limit this disclosure.

[0022] It should be noted that all actions involving the acquisition of signals, information, or data in this disclosure are performed with authorization from the owner of the relevant device.

[0023] Figure 1 This is a flowchart illustrating a safety optimization control method for wind turbines under extreme operating conditions, according to an exemplary embodiment. Figure 1 As shown, the method includes the following steps: In step S11, the state vector of the wind turbine during operation is obtained. The state vector includes at least one of the following: wind speed, turbulence intensity, wind direction change rate, rotational speed, pitch angle, generator torque, blade root bending moment, tower bending moment, nacelle acceleration, grid connection voltage, and grid connection frequency.

[0024] For example, the extreme operating state of a wind turbine refers to the operating state of a wind turbine where it may not have triggered shutdown protection, but one or more critical risk channels are approaching or rapidly approaching the protection boundary. This extreme operating state includes, but is not limited to, sudden wind overspeed, blade root load approaching, tower load approaching, amplified drivetrain vibration, grid voltage drop, grid frequency deviation, pitch actuator degradation, yaw actuator abnormal response, and composite extreme states where multiple of the above conditions occur simultaneously. Unlike traditional fault shutdown states, the extreme operating state emphasizes the intermediate state where "the wind turbine is still controllable, but the safety margin is rapidly decreasing."

[0025] The state vector refers to the set of wind turbine operating states collected or calculated by the wind turbine control system at a sampling time. The state vector may include at least one of the following: wind speed, turbulence intensity, wind direction change rate, rotational speed, pitch angle, generator torque, blade root bending moment, tower bending moment, nacelle acceleration, grid connection voltage, and grid connection frequency. The wind speed can be collected by the wind turbine nacelle anemometer, lidar, or wind measurement equipment at the wind farm; the turbulence intensity can be determined by the ratio of the standard deviation of wind speed to the average wind speed within a certain time window; the wind direction change rate can be calculated by the change of nacelle wind direction angle or yaw error within adjacent sampling windows; the rotational speed can be obtained from the generator encoder or the rotor speed estimate; the pitch angle can be obtained from the pitch encoder; the generator torque can be obtained from the converter controller; the blade root bending moment can be obtained from the blade root load sensor or estimated based on blade strain; the tower bending moment can be obtained from the tower base strain gauge, the tower top acceleration estimation model, or the tower load observer; the nacelle acceleration can be obtained from the nacelle inertial measurement unit; and the grid connection voltage and grid connection frequency can be obtained from the grid connection point measurement device or the converter grid connection control module. In addition, depending on the wind turbine model and control system configuration, the state vector may also include: yaw angle, yaw error, pitch motor current, pitch driver temperature, generator stator temperature, gearbox vibration, main shaft torque, converter DC bus voltage, and active / reactive power dispatching commands at the wind farm.

[0026] It is understandable that the sensors collecting different types of data in this state vector may have different sampling frequencies. To improve data consistency, timestamp alignment and filtering can be performed on the various data sources before acquiring the state vector. For example, for data with sampling frequencies higher than the main control cycle, such as blade root bending moment, tower acceleration, and transmission chain vibration, the mean, peak value, root mean square value, rate of change, or frequency band energy can be extracted as input within the current control cycle. For data with sampling frequencies lower than the main control cycle, hold, interpolation, or observer estimation methods can be used to fill in the gaps. For obviously unreasonable data, such as wind speed jumps exceeding the physical limit, sensor output freezing, or short-term loss of grid voltage sampling, these can be marked as low-confidence data and output to the subsequent sensor confidence calculation process.

[0027] In step S12, based on the state vector, a reliable margin trajectory and time to limit are generated for each of the multiple risk channels; wherein, the risk channel is used to characterize the risk source that may trigger protection when the wind turbine is in extreme operating conditions.

[0028] Optionally, the plurality of risk channels includes at least one of the following: speed risk channel, blade root load risk channel, tower load risk channel, transmission chain vibration risk channel, grid voltage risk channel, grid frequency risk channel, and actuator degradation risk channel.

[0029] For example, the risk channel refers to a state evaluation channel used to characterize a certain type of safety risk of a wind turbine under extreme operating conditions, and is the source of risk that may trigger protection under extreme conditions. Each risk channel corresponds to at least one observation (the observation constitutes the data of the state vector), at least one boundary (the boundary refers to the control boundary corresponding to the observation), and at least one control response strategy (the control response strategy refers to the risk channel control strategy corresponding to the observation). The multiple risk channels may include at least one of the following: speed risk channel, blade root load risk channel, tower load risk channel, drive train vibration risk channel, grid voltage risk channel, grid frequency risk channel, and actuator degradation risk channel. For example, the rotational speed risk channel can use the rotor speed or generator speed as the main observation; the blade root load risk channel can use the blade root bending moment and blade flapping / swaying load as the main observation; the tower load risk channel can use the tower base bending moment, tower top acceleration or nacelle displacement as the main observation; the grid connection voltage risk channel can use the voltage drop depth and duration at the grid connection point as the main observation; and the actuator degradation risk channel can use pitch response error, yaw response error, actuator temperature rise, action delay and feedback anomaly as the main observation.

[0030] The credible margin trajectory refers to the trajectory formed over time by the change of the remaining safety margin of the corresponding protection boundary observed in the risk channel, considering both sensor reliability and data degradation factors. This credible margin trajectory is not simply a boundary difference, but rather the result obtained after reducing the safety margin by converting various anomalies such as measurement gaps, sensor malfunctions, inconsistent data redundancy, and actuator feedback anomalies. This allows the wind turbine's control system to behave more conservatively when data reliability decreases. The time to the limit refers to the remaining time required for the risk channel to reach the protection boundary according to its current trend. The shorter the time to the limit, the more proactive the risk channel needs to be. This time to the limit does not require precise prediction of the actual time of exceeding the limit; rather, it is used to prioritize the urgency of different risk channels within the control cycle. This allows for risk channel control in subsequent risk channel control based on the urgency of each risk channel and the credible margin trajectory.

[0031] Optionally, Figure 2 This is a flowchart illustrating a safety optimization control method for wind turbines under extreme operating conditions, according to an exemplary embodiment. Figure 2 As shown, each risk channel includes a continuous operation boundary and a protection exit boundary. Based on this state vector, step S12 includes the following steps: In step S121, the reliability margin trajectory of the first risk channel is determined based on the protection exit boundary, the continuous operation boundary, the risk channel observation, the sensing reliability, and the data degradation penalty amount of the first risk channel; the first risk channel is any one of the multiple risk channels.

[0032] For example, each of the multiple risk channels can be configured with: a continuous operation boundary, a derating operation boundary, a protection exit boundary, and a shutdown boundary. The continuous operation boundary indicates the boundary at which the wind turbine corresponding to the observed parameters of the risk channel can operate continuously for an extended period. For example, when the wind speed is within the rated allowable range, the blade root load is below the long-term fatigue control limit, and the grid-connected voltage is within the normal grid-connected range, it can be considered to be within the continuous operation boundary. The derating operation boundary indicates the boundary at which the observed parameters of the risk channel require power reduction or limiting actions. For example, when the wind speed increases rapidly and the blade root load approaches the preset derating threshold, the wind turbine control system can enter a derating operation state. The protection exit boundary indicates the boundary at which normal optimized control needs to be exited, with protection control taking priority. The shutdown boundary indicates the boundary at which shutdown protection must be triggered. The aforementioned continuous operation boundary, derating operation boundary, protection exit boundary, and shutdown boundary can all be determined based on the turbine design load, certification parameters, controller limits, grid specifications, and operation and maintenance experience.

[0033] Optionally, the risk channel observation is the observation after the corresponding risk channel has been aligned with the danger direction.

[0034] For example, the observations of different risk channels have different physical meanings and hazard directions. To facilitate unified processing, before determining the credible margin trajectory and time to the limit for the first risk channel (any risk channel among multiple risk channels), the hazard direction of the first risk channel observations can be aligned to obtain the observations of that risk channel. For example, taking the speed risk channel as an example, the higher the speed, the greater the risk; therefore, the hazard side deviation of the speed from the rated range can be directly used as the aligned observation. Taking the grid voltage risk channel as an example, the lower the voltage during low-voltage ride-through, the greater the risk; therefore, the difference between the rated voltage or the lower voltage limit and the actual voltage can be used as the aligned observation. Taking the actuator degradation risk channel as an example, the larger the response error between the pitch command and the actual pitch angle, the longer the action delay, and the more abnormal the drive current, the higher the risk; therefore, these indicators can be integrated into the actuator degradation observation.

[0035] After aligning the hazard directions, the corresponding credible margin trajectory for each risk path can be calculated using the following method:

[0036] in, For the first Each risk channel at the sampling time The reliable margin trajectory value; Number the risk channel; Sampling time; Sensing reliability is used to represent the degree of reliability of the current state data; For the first The protective exit boundary for each risk channel; For the first The continuous operating boundary of each risk channel; For the first Observations of each risk channel after aligning it with the direction of danger; For the first The data degradation penalty for each risk channel is used to represent the uncertainty caused by measurement missing, measurement jumps, redundancy inconsistencies, or actuator feedback anomalies in risk assessment.

[0037] Understandably, the reliability margin for each risk channel should not be determined solely by the distance between the observed measurement and the protection boundary, but should also be influenced by the reliability of the data. When the sensor reliability is high, the reliability margin is primarily determined by the distance between the actual observed measurement and the protection exit boundary; when the sensor reliability decreases, the wind turbine control system can automatically deduct the reliability margin, causing the subsequent dynamic safety domain to shrink earlier. In this way, even if the observed measurement itself has not exceeded the limit, as long as there is uncertainty in the sensor data or abnormal actuator feedback, the system will adopt a more conservative safety control strategy.

[0038] Furthermore, the reliability of this sensing can be obtained by fusing multiple factors. For example, the reliability is high when the sensor self-diagnosis is normal, historical changes are continuous, and multi-source redundancy is consistent; the reliability decreases when the sensor output freezes, adjacent periods abruptly change, there are excessive differences between similar sensors, or the actuator feedback is inconsistent with the control command. The data degradation penalty can be determined based on the missing rate, abrupt jump amplitude, redundancy difference, or feedback delay. The data degradation penalty can have different weights for different risk channels. For example, in grid connection crossing scenarios, the reliability weight of grid connection voltage measurement is higher; in load approach scenarios, the reliability weight of blade root load and tower load measurement is higher.

[0039] In step S122, the time to reach the limit of the first risk channel is determined based on the protection exit boundary of the first risk channel, the observation of the risk channel, and the rate of change of the observation of the risk channel.

[0040] For example, based on determining the credible margin trajectory of any risk path, the time to maturity of that risk path can be determined according to the following formula:

[0041] in, For the first Each risk channel at the sampling time The deadline has passed; For the first The protective exit boundary for each risk channel; For the first Observations of each risk channel after aligning it with the direction of danger; for Rate of change relative to time; To prevent positive numbers with a denominator of zero; This means that when the risk channel approaches the protection exit boundary, the larger of the rate of change and the positive number is used as the denominator.

[0042] As can be seen from the above formula, when the observed value of a risk channel increases rapidly along the dangerous direction, the time to the protection limit shortens, indicating that the risk channel requires priority attention. Furthermore, when the observed value of a risk channel does not approach the protection exit boundary along the dangerous direction, the risk channel can be marked as not approaching the protection boundary temporarily, but its historical protection level is not immediately removed. This setting can prevent frequent protection exits due to a temporary drop in risk value under conditions such as strong turbulence or grid disturbances.

[0043] In step S13, a limit security package is generated based on the trusted margin trajectory, the time to limit, and the sensor trustworthiness; the limit security package includes: limit state label, dynamic security domain, protection level, unlocking conditions, and fallback strategy.

[0044] For example, the extreme safety package is an online data structure jointly generated by the trusted margin trajectory, the time to the limit, and the sensor trustworthiness. The extreme safety package includes: extreme state labels, dynamic safety domains, protection levels, unlocking conditions, and fallback strategies. This extreme safety package can be generated using rule bases, state machines, lightweight machine learning classifiers, or expert systems, and is used to uniformly describe the current safety status of the wind turbine unit. Rule bases are suitable for engineering deployment, and machine learning classifiers can be used to assist in identifying complex extreme states without changing the basic implementation logic of this disclosure. The extreme safety package not only indicates the current state of the wind turbine unit but also includes information such as what control is currently allowed, whether escalation protection is required, when protection release is allowed, and what strategy to fall back to in case of an anomaly.

[0045] Optionally, Figure 3 This is a schematic diagram illustrating an extreme safety package according to an exemplary embodiment, such as... Figure 3 As shown, the extreme security package may include: extreme state labels, dynamic security domains, protection levels, unlocking conditions, and fallback policies; This extreme state label is used to indicate that the current state of the wind turbine is either a sudden wind overspeed, load approach, grid connection crossing, actuator degradation, transmission chain vibration amplification, or a combination of extreme states. This dynamic safety domain is used to limit the allowable range of the pitch rate, torque change rate, yaw rate, active power change rate, and reactive power change rate of the wind turbine. This protection level is used to indicate the protection status of the wind turbine, which includes: continuous operation, derating operation, protection off or shutdown; This unlocking condition is used to limit the switching conditions between different protection levels within this protection level; This rollback strategy is used to roll back to the safety strategy of the previous cycle when the optimized control quantity and the protection control quantity in the current cycle meet the conflict conditions.

[0046] For example, the limit state label can be used to indicate which limit state the current state of the wind turbine belongs to. Specifically, the limit state label can include: sudden wind overspeed, load approach, grid connection ride-through, actuator degradation, drivetrain vibration amplification, or a combination of limit states. It is understood that the limit state label is not simply determined by a single sensor threshold, but rather by the combined reliability margin trajectory, time to limit, and sensor reliability of multiple risk channels. For example, when the reliability margin of the speed risk channel is greater than the corresponding rate of change threshold, and the time to limit is less than a preset time, while wind speed and turbulence intensity increase, the limit state label can be sudden wind overspeed; when the blade root load and tower load risk channels simultaneously approach the protection exit boundary, and the nacelle acceleration increases, the limit state label can be load approach or a combination of limit states; when the grid connection voltage drops, the grid connection frequency deviates, and the converter power command is limited, it can be marked as a grid connection ride-through state; when the pitch actuator response delay increases, the feedback error increases, or the drive temperature is abnormal, it can be marked as an actuator degradation state.

[0047] This dynamic safety domain can be used to define the range of permissible control quantities within the current control cycle of the wind turbine. For example, the dynamic safety domain may include the permissible ranges of pitch rate, torque rate of change, yaw rate, active power rate of change, and reactive power rate of change. For any risk path, the dynamic safety domain can be determined in the following way.

[0048] Optionally, each risk channel includes: a protective exit boundary; The dynamic security domain is determined based on the protection exit boundary, the trusted margin trajectory, the time to limit, the trusted margin contraction coefficient, and the time to limit contraction coefficient.

[0049] For example, this dynamic security domain is not a fixed boundary, but rather shrinks in real time along with the trusted margin trajectory and the time to the limit. The dynamic security domain can be determined by defining its dynamic security boundary in the following manner:

[0050] in, For the first Each risk channel at the sampling time Dynamic security boundaries; For the first The protective exit boundary for each risk channel; The credible margin shrinkage coefficient; For the first The credible margin trajectory value of each risk channel; The shrinkage coefficient at the time limit; For the first The expiration time of each risk channel; The value is positive. This formula can be interpreted as follows: when the confidence margin trajectory decreases or the time to the limit shortens, the dynamic safety boundary contracts towards the safety side in advance, thereby limiting high-risk control actions before the wind turbine control system actually triggers the protection exit boundary.

[0051] For example, in practical engineering, this dynamic safety domain can manifest as upper and lower limits of control variables, limits on the rate of change, control combination exclusion zones, or priority rules. For instance, when the speed risk channel dominates, the dynamic safety domain can limit the generator torque from decreasing too quickly, preventing the speed from increasing further, while allowing the pitch angle to increase with higher priority; when the tower load risk channel dominates, the dynamic safety domain can limit yaw rate and torque abrupt changes, preventing the induction of tower vibration; during grid-connected crossing, the dynamic safety domain can limit the rate of change of active power and reserve control margin for reactive power support; in actuator degradation state, the dynamic safety domain can reduce the action amplitude of the corresponding actuator and prioritize the invocation of other redundant execution strategies.

[0052] This protection level indicates whether the current wind turbine's protection status is in continuous operation, derating operation, protection off, or shutdown. Continuous operation indicates the wind turbine can operate under normal optimized control; derating operation indicates the turbine can still generate electricity, but power needs to be reduced or some actions limited; protection off indicates optimized control of the wind turbine no longer has priority, and protection control should take precedence; shutdown indicates the wind turbine must execute shutdown protection. This protection level can be updated based on minimum reliable margin, minimum time-to-limit, reliable residual, and projected conflict index.

[0053] This unlocking condition can be used to define the conditions that must be met when returning from a high protection level to a low protection level. This condition can include at least: risk channel stabilization time, a lower confidence limit, and an upper residual limit. For example, when the protection level returns to derating operation after protection exit, not only must the confidence margin of the dominant risk channel recover to above the unlocking margin threshold, but the confidence residual must also be below the unlocking residual threshold for a certain period of time. This setting prevents wind turbines from immediately returning to a low protection level after a brief period of relief from extreme conditions, thus avoiding frequent fluctuations in the protection level or repeated crossings of the safety boundary.

[0054] This rollback strategy can be used to invoke the safety strategy of the previous cycle or a preset safety strategy when there is a conflict between the optimized control quantity and the protection control quantity, the predictive model is inaccurate, or the actuator feedback is abnormal. The safety strategy of the previous cycle can be a combination of execution control quantities that has been verified as safe in the previous control cycle, or it can be a control strategy that has recently moved the risk path away from the protection boundary. The preset safety strategy can include: derating operation strategy, rapid feathering strategy, yaw unloading strategy, active power limiting strategy, or reactive power support strategy; the derating operation strategy can refer to a preset safety strategy that reduces the active power of the unit or limits the torque output; the rapid feathering strategy can refer to a preset strategy that adjusts the pitch angle to a safe position at the maximum permissible rate; the yaw unloading strategy can refer to a preset safety strategy that reduces the load by adjusting the yaw angle; the active power limiting strategy can refer to a preset safety strategy that limits the active power output; and the reactive power support strategy can refer to a preset safety strategy that provides reactive power to stabilize the voltage.

[0055] In step S14, optimized control quantities and protection control quantities are generated in parallel based on the multiple risk channels, and arbitration and security domain projection are performed based on the optimized control quantities and protection control quantities according to the limit security package to obtain the execution control quantity.

[0056] For example, the optimized control quantity refers to the control quantity generated with power point tracking, load suppression, smooth execution, and grid goodness as comprehensive objectives. This optimized control quantity is generated by predictive control, model optimization, gain scheduling control, or rule-based optimized controllers, with the goal of maintaining power generation capacity and operational stability within the safety boundary as much as possible. The protective control quantity refers to the control quantity generated with the primary objective of keeping risk channels away from the protection boundary. This protective control quantity does not prioritize maximum power generation, but rather prioritizes reducing speed, reducing blade root load, reducing tower load, suppressing drive train vibration, meeting grid crossing constraints, or compensating for actuator degradation; this protective control quantity can be generated based on the dominant risk channel corresponding to the minimum time to limit of multiple risk channels. The execution control quantity represents the control quantity actually issued to the wind turbine actuators.

[0057] Optionally, the optimized control quantity includes at least two of the following: collective pitch increment, individual pitch increment, generator torque increment, yaw increment, active power command increment, and reactive power command increment; The protection control quantity is determined based on the risk channel with the shortest time to reach its limit among the multiple risk channels.

[0058] For example, the optimized control quantity may include at least two of the following: collective pitch increment, individual pitch increment, generator torque increment, yaw increment, active power command increment, and reactive power command increment. For instance, when the wind speed is above the rated speed and the load is low, the optimized control quantity may aim to maintain the rated power and reduce load fluctuations; when there are grid voltage disturbances, the optimized control quantity may coordinate between active and reactive power; when determining the optimized control quantity, predictive control may be used, with power point tracking, blade root load suppression, tower load suppression, smooth execution, and grid goodness as optimization objectives, and the objective function may be constructed using the following formula:

[0059] in, To optimize the objective function; To predict the step number in the time domain; To predict the off-step number in the time domain; As power deviation weight; For the first Step active power reference value; For the first Predict active power step by step; For load weights; For the first Step-normalized predicted load vector; This is the load weight matrix; Weights for the actions to be performed; For the first Step control quantity change; For soft constraint penalty weights; For the first Step soft constraint relaxation amount.

[0060] In the protection and control channels corresponding to risk channels, protection control quantities can be generated based on the dominant risk channel. The dominant risk channel can be jointly determined by the minimum time to limit, minimum reliable margin, or highest protection level among multiple risk channels. For example, when the dominant risk channel is a speed risk channel, the protection control quantity prioritizes increasing the pitch angle and limiting the generator torque change rate to prevent the speed from continuing to rise; when the dominant risk channel is a blade root load risk channel or a tower load risk channel, the protection control quantity prioritizes adjusting individual pitch increments and yaw increments to reduce asymmetric loads and tower vibration; when the dominant risk channel is a grid voltage risk channel or a grid frequency risk channel, the protection control quantity prioritizes adjusting active power command increments and reactive power command increments to meet grid connection support and cross-connection requirements; when the dominant risk channel is an actuator degradation risk channel, the protection control quantity limits the corresponding actuator's action amplitude and invokes redundant execution strategies, such as reducing the action frequency of the degraded pitch shaft, increasing independent pitch compensation for other blades, reducing power reference, or enabling yaw unloading.

[0061] For example, the arbitration refers to determining the priority of the optimized control quantity and the protection control quantity based on the extreme safety package. Under the continuous operation protection level, the executed control quantity can primarily approximate the optimized control quantity; under the derated operation protection level, the executed control quantity is weighted between the optimized control quantity and the protection control quantity, and actions that may increase the dominant risk are restricted; under the protection exit protection level, the executed control quantity preferentially approximates the protection control quantity, and the optimized control quantity only participates without increasing risk; under the shutdown protection level, the executed control quantity is issued according to the shutdown policy.

[0062] This safety domain projection refers to adjusting the arbitrated candidate control variable to fit within the dynamic safety domain. For example, let the optimal control variable be... The protection control quantity is The execution control quantity is The projection process can be understood as follows: under the conditions of satisfying the dynamic safety domain boundary, actuator rate limit, power change rate limit, and protection level requirements, select the control variable that is most conducive to reducing risks and ensuring continuous action as the execution control variable. For pitch actuators, projection can limit the pitch angle change rate and maximum pitch angle; for converters, projection can limit the torque change rate, active power slope, and reactive current limit; for yaw systems, projection can limit the yaw rate and yaw action frequency; for station interfaces, projection can limit the active power derating rate and reactive power support change rate.

[0063] In step S15, the execution control variable is executed, and after execution, the protection level update strategy of the wind turbine is determined based on the projection conflict index, the reliable residual and the time limit. The protection strategy includes: maintaining the current control, upgrading protection, downgrading protection, shutdown protection and rollback.

[0064] For example, after determining the execution control quantity, it can be output to the pitch system, converter, yaw system, and power control interface of the wind turbine to enable the wind turbine to operate according to the execution control quantity. The execution control quantity can include at least two of the following: collective pitch increment, individual pitch increment, generator torque increment, yaw increment, active power command increment, and reactive power command increment. For wind turbines without individual pitch capability, only collective pitch, torque, yaw, and power commands can be output; for turbines with independent pitch capability, independent pitch corrections for each blade can be further output.

[0065] After the execution control variable is completed, the protection level update strategy of the wind turbine can be determined based on the projection conflict index, the reliable residual and the time limit. The protection strategy includes: maintaining the current control, upgrading protection, downgrading protection, shutdown protection and rollback.

[0066] For example, "maintaining current control" means continuing to maintain the current level of control and protection.

[0067] The unlocking conditions for this upgraded protection can include any one or more of the following: the reliable residual is greater than the residual threshold; the projected conflict index is greater than the conflict threshold; the time-to-limit for any risk channel is continuously less than the minimum time-to-limit threshold; the reliable margin trajectory for any risk channel continues to decrease; the actuator feedback anomaly persists; and the dynamic safety domain has shrunk to the protection exit domain but still cannot prevent the risk channel from approaching the boundary. When the above conditions are met, the protection level update strategy for the wind turbine can be determined as this upgraded protection, that is, the protection level is upgraded. For example, the protection level can be upgraded from continuous operation to derated operation, from derated operation to protection exit, and from protection exit to shutdown.

[0068] The unlocking conditions for this upgraded protection are typically more stringent than those for the upgraded protection itself, but once triggered, it should be executed with priority. For example, the system directly triggers a protective shutdown when the rotational speed reaches the shutdown boundary, the blade root load or tower load reaches the shutdown boundary, the grid voltage or frequency exceeds the allowable range specified by the grid regulations, the pitch system loses its critical response capability, or the drivetrain vibration exceeds the shutdown threshold. During the shutdown process, the risk path monitoring and reliable residual judgment disclosed herein can still be used to constrain the pitch rate, torque reduction rate, and yaw state to avoid excessive load impact caused by the shutdown action itself.

[0069] This rollback strategy can be used to handle situations where there is a severe conflict between the optimized control and the protective control, inaccurate model predictions, or abnormal responses after control execution. For example, if the projected conflict index exceeds the conflict threshold multiple times consecutively, it indicates that the optimized control and the protective control have been in opposite directions for a long period. In this case, the system should not continue to trust the output of the optimized controller, but should roll back to the previous verified safety strategy or the preset safety strategy. The previous verified safety strategy can be a combination of control variables from the previous control cycle that increases the reliable margin trajectory, decreases the reliable residual, and does not trigger a higher level of protection. The preset safety strategy can be a derating strategy, a fast feathering strategy, a yaw unloading strategy, or a grid-connected ride-through strategy pre-configured according to the unit design.

[0070] This downgrade protection mechanism is a crucial design feature of this disclosure to prevent accidental release of protection. When the protection level is downgraded from a high level to a low level, the unlocking conditions in the extreme safety package must be met. Specifically, these conditions may include: the trusted margin trajectory of all dominant risk channels is greater than the unlocking margin threshold; the trusted residual is less than the unlocking residual threshold; the sensing trustworthiness is greater than the lower trustworthiness limit; the time to reach the limit for the dominant risk channels recovers and remains greater than the safe time; and the duration of the above conditions is greater than the unlocking duration. Only when all of the above conditions are met simultaneously is a downgrade of the protection level permitted. If any one of the conditions is not met, the current protection level is maintained or a fallback strategy is executed.

[0071] For example, under gust overspeed conditions, the wind turbine control system may escalate from continuous operation to derating operation. If the wind speed drops briefly but the rotational speed remains close to the protection exit boundary, and the blade root load remains highly volatile, then even if the observed values ​​drop at a certain moment, immediate derating is not permitted. Only when the reliable margin trajectories of both the rotational speed risk channel and the blade root load risk channel recover to above the unlocking margin threshold, the reliable residual is below the unlocking residual threshold, and this condition persists for a period of time, is it permissible to return from derating operation to continuous operation. Similarly, under actuator degradation conditions, the restriction on the actuator's actuation amplitude is only allowed to be lifted when the pitch feedback error recovers, the drive temperature decreases, the action delay decreases, and the reliable residual meets the requirements.

[0072] Optionally, the projection conflict index is determined based on the deviation relationship between the execution control quantity, the optimization control quantity, and the protection control quantity.

[0073] Furthermore, this disclosure may also introduce a projection conflict index, used to characterize the degree of conflict between the optimization control variable, the protection control variable, and the final execution control variable. The projection conflict index can be determined as follows:

[0074] in, Sampling time The projection conflict index; This refers to the actual execution control quantity issued. To optimize control parameters; To protect control quantities; To prevent positive numbers with a denominator of zero. When When the value is relatively small, it indicates that the executed control quantity is close to the optimized control quantity, and the conflict between the optimized control and the protection objective is small, indicating that the optimized control can be executed relatively safely; when When the value is large, it indicates that the execution control quantity is significantly pushed away from the optimal control quantity by the projection of the security domain, and there is a significant conflict between the optimal control and the protection objective; the direct release of the protection level should be avoided.

[0075] Optionally, the reliable residual is determined based on the sensing reliability, the measured response vector, and the predicted response vector; wherein the measured response vector is the actual response data of the wind turbine after the execution of the control variable, and the predicted response vector is the predicted response data of the wind turbine after the execution of the control variable.

[0076] After the wind turbine executes the control input, the measured response vector of that control input can be collected. This measured response vector can include the rotational speed, blade root bending moment, tower bending moment, nacelle acceleration, grid-connected voltage, grid-connected frequency, pitch angle feedback, torque feedback, and yaw feedback after the control input is executed. Simultaneously, the wind turbine's control system can obtain the predicted response vector corresponding to the control input based on a model or observer. Comparing the measured response vector with the predicted response vector, and combining this with sensor reliability, yields the reliable residual. This reliable residual can be determined as follows:

[0077] in, Sampling time credible residuals; To ensure the reliability of the sensor; The measured response vector after the control input is executed; The predicted response vector corresponding to the control input; To prevent positive numbers with a denominator of zero, this formula indicates that when the measured response differs greatly from the predicted response, the reliability residual increases; when the sensing reliability decreases, even if the prediction error is temporarily small, the reliability residual will increase accordingly, thus making the system more inclined to protective control.

[0078] In summary, this disclosure generates reliable margin trajectories and time-to-limit for multiple risk channels, including rotational speed, blade root load, tower load, transmission chain vibration, grid voltage, grid frequency, and actuator degradation. This enables early identification of dangerous trends when risks are rapidly approaching the protection boundary before exceeding the limit, avoiding the problem of delayed intervention in traditional fixed threshold protection. By encapsulating limit state labels, dynamic safety domains, protection levels, unlocking conditions, and backoff strategies into a limit safety package, the model parameters, control boundaries, and protection logic under different limit states can be uniformly scheduled, improving the consistency and traceability of control strategies under complex extreme conditions. Furthermore, by generating optimized control and protection control quantities in parallel and performing arbitration and safety domain adjustments based on the limit safety package, this disclosure achieves better protection. Projection enables the establishment of clear priorities among power point tracking, load suppression, and safety protection, avoiding the direct issuance of unsafe control quantities when optimization control objectives conflict with protection control objectives. By setting a projection conflict index and reliable residual, the degree of conflict between optimization control and protection control, as well as the degree of deviation between the prediction model and the measured response, can be quantitatively determined. This allows for timely escalation of protection, protection shutdown, or reversion to the previous safety strategy when predictions are inaccurate, sensor reliability decreases, or actuator responses are abnormal. By setting unlocking conditions, the return of protection level from a high level to a low level must meet the requirements of reliable margin recovery, residual reduction, and sustained stabilization time. This prevents premature release of protection after a brief relief of the extreme state and reduces frequent fluctuations in protection level. Therefore, this invention can improve the safety, robustness, and operational continuity of wind turbines under complex extreme operating conditions, reduce the risk of blades, towers, transmission chains, and electrical systems being subjected to extreme loads or abnormal impacts, and maintain the unit's power generation capacity and grid-friendliness as much as possible while ensuring safety boundaries.

[0079] Figure 4 This is a schematic diagram illustrating a safety optimization control system for a wind turbine under extreme operating conditions, according to an exemplary embodiment. Figure 4 As shown, the system includes: a status acquisition module, a trusted margin generation module, a limit security package generation module, a dual-channel control module, a security arbitration and projection module, an execution interface module, and a protection upgrade and downgrade module; This state acquisition module is used to acquire the state vector during the operation of the wind turbine. The state vector includes at least one of the following: wind speed, turbulence intensity, wind direction change rate, rotational speed, blade pitch angle, generator torque, blade root bending moment, tower bending moment, nacelle acceleration, grid connection voltage, and grid connection frequency. The reliable margin generation module is used to generate a reliable margin trajectory and time to limit for each of the multiple risk channels based on the state vector; wherein, the risk channel is used to characterize the risk source that may trigger protection of the wind turbine under extreme operating conditions; The extreme security package generation module is used to generate an extreme security package based on the trusted margin trajectory, the time to limit, and the sensor trustworthiness; the extreme security package includes: extreme state label, dynamic security domain, protection level, unlocking conditions, and fallback strategy; This dual-channel control module is used to generate optimized control quantities and protective control quantities in parallel based on these multiple risk channels; The security arbitration and projection module is used to arbitrate and project the security domain based on the optimized control quantity and the protection control quantity according to the limit security package to obtain the execution control quantity; This execution interface module is used to execute this execution control variable; The protection upgrade / downgrade module is used to determine the protection level update strategy for the wind turbine after the execution of the control quantity is completed, based on the projection conflict index, the reliable residual, and the time limit. The protection strategy includes: maintaining the current control, upgrading protection, downgrading protection, shutdown protection, and rollback.

[0080] Optionally, the system may also include an event tracing module for recording state vectors, reliable margin trajectories, timeouts, extreme safety packages, optimized control variables, protective control variables, executed control variables, projected conflict indices, and reliable residuals. This event tracing module may also record the reasons for protection level switching, triggered risk channels, unlocking times, rollback strategy numbers, and manual intervention records. Through event tracing, extreme events can be reviewed after unit operation and used for strategy correction under similar extreme conditions.

[0081] The system may also include an event server for storing and archiving the aforementioned traceability data for remote access.

[0082] For example, such as Figure 4 As shown, the status acquisition module may include a wind speed / direction sensor, a rotational speed sensor, a load sensor, a nacelle acceleration sensor, and a grid-connected measurement unit; each sensor is used to collect corresponding status data during the operation of the wind turbine. The dual-channel control module is used to generate optimized control and protection control quantities for the pitch system, converter, and yaw system in parallel across multiple risk channels.

[0083] The above technical solution obtains a state vector during the operation of a wind turbine, which includes at least one of the following: wind speed, turbulence intensity, wind direction change rate, rotational speed, pitch angle, generator torque, blade root bending moment, tower bending moment, nacelle acceleration, grid connection voltage, and grid connection frequency. Based on this state vector, a reliable margin trajectory and time-to-limit are generated for each of multiple risk channels. This risk channel characterizes the risk sources that may trigger protection under extreme operating conditions. An ultimate safety protection mechanism is generated based on the reliable margin trajectory, the time-to-limit, and the sensor reliability. The system is fully inclusive; this extreme safety package includes: extreme state labels, dynamic safety domains, protection levels, unlocking conditions, and fallback strategies. Based on these multiple risk channels, optimized control quantities and protection control quantities are generated in parallel. Arbitration and safety domain projection are then performed on these optimized and protection control quantities according to the extreme safety package to obtain the execution control quantity. This execution control quantity is executed, and after execution, the protection level update strategy for the wind turbine is determined based on the projection conflict index, reliable residual, and the time-to-limit. The protection strategy includes: maintaining current control, escalating protection, downgrading protection, shutdown protection, and fallback. Through multi-channel collaborative optimization and dynamic protection level adjustment, the safety and stability of wind turbines under extreme operating conditions can be effectively improved.

[0084] Regarding the system in the above embodiments, the specific ways in which each module performs operations have been described in detail in the embodiments related to the method, and will not be elaborated here.

[0085] Figure 5 This is a block diagram illustrating an electronic device 500 according to an exemplary embodiment. For example... Figure 5 As shown, the electronic device 500 may include a processor 501 and a memory 502. The electronic device 500 may also include one or more of a multimedia component 503, an input / output (I / O) interface 504, and a communication component 505.

[0086] The processor 501 controls the overall operation of the electronic device 500 to complete all or part of the steps in the aforementioned safety optimization control method for wind turbines under extreme operating conditions. The memory 502 stores various types of data to support the operation of the electronic device 500. This data may include, for example, instructions for any application or method operating on the electronic device 500, and application-related data such as contact data, sent and received messages, pictures, audio, video, etc. The memory 502 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read-Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. Multimedia component 503 may include a screen and an audio component. The screen may be, for example, a touchscreen, and the audio component is used to output and / or input audio signals. For example, the audio component may include a microphone for receiving external audio signals. The received audio signals may be further stored in memory 502 or transmitted via communication component 505. The audio component also includes at least one speaker for outputting audio signals. I / O interface 504 provides an interface between processor 501 and other interface modules, such as a keyboard, mouse, buttons, etc. These buttons may be virtual or physical buttons. Communication component 505 is used for wired or wireless communication between the electronic device 500 and other devices. Wireless communication, such as Wi-Fi, Bluetooth, Near Field Communication (NFC), 2G, 3G, 4G, NB-IoT, eMTC, or other 5G technologies, or combinations thereof, is not limited here. Therefore, the corresponding communication component 505 may include: a Wi-Fi module, a Bluetooth module, an NFC module, etc.

[0087] In an exemplary embodiment, the electronic device 500 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to execute the aforementioned safety optimization control method for wind turbines under extreme operating conditions.

[0088] In another exemplary embodiment, a computer-readable storage medium including program instructions is also provided, which, when executed by a processor, implement the steps of the above-described safety optimization control method for wind turbines under extreme operating conditions. For example, the computer-readable storage medium may be the memory 502 including program instructions, which may be executed by the processor 501 of the electronic device 500 to complete the above-described safety optimization control method for wind turbines under extreme operating conditions.

[0089] In another exemplary embodiment, a computer program product is also provided, which includes a computer program executable by a programmable device, the computer program having a code portion for performing the above-described safety optimization control method for wind turbine generators under extreme operating conditions when executed by the programmable device.

[0090] The preferred embodiments of the present disclosure have been described in detail above with reference to the accompanying drawings. However, the present disclosure is not limited to the specific details of the above embodiments. Within the scope of the technical concept of the present disclosure, various simple modifications can be made to the technical solutions of the present disclosure, and these simple modifications all fall within the protection scope of the present disclosure.

[0091] It should also be noted that the various specific technical features described in the above specific embodiments can be combined in any suitable manner without contradiction. In order to avoid unnecessary repetition, this disclosure will not describe the various possible combinations separately.

[0092] Furthermore, various different embodiments of this disclosure can be combined in any way, as long as they do not violate the spirit of this disclosure, they should also be regarded as the content disclosed in this disclosure.

Claims

1. A safety optimization control method for wind turbine units under extreme operating conditions, characterized in that, include: The state vector of the wind turbine during operation is obtained, and the state vector includes at least one of the following: wind speed, turbulence intensity, wind direction change rate, rotational speed, pitch angle, generator torque, blade root bending moment, tower bending moment, nacelle acceleration, grid connection voltage and grid connection frequency. Based on the state vector, a reliable margin trajectory and time to limit are generated for each of the multiple risk channels; wherein, the risk channel is used to characterize the risk sources that may trigger protection when the wind turbine is in extreme operating conditions; An extreme security package is generated based on the trusted margin trajectory, the time to limit, and the sensor trustworthiness; the extreme security package includes: extreme state label, dynamic security domain, protection level, unlocking conditions, and fallback strategy; Based on the multiple risk channels, optimized control quantities and protection control quantities are generated in parallel. Based on the optimized control quantities and protection control quantities, arbitration and security domain projection are performed according to the extreme security package to obtain the execution control quantity. The execution control variable is executed, and after execution, the protection level update strategy of the wind turbine is determined based on the projection conflict index, the reliable residual, and the time limit. The protection strategy includes: maintaining the current control, upgrading protection, downgrading protection, shutdown protection, and rollback.

2. The method according to claim 1, characterized in that, The multiple risk channels include at least one of the following: speed risk channel, blade root load risk channel, tower load risk channel, transmission chain vibration risk channel, grid voltage risk channel, grid frequency risk channel, and actuator degradation risk channel.

3. The method according to claim 1, characterized in that, Each risk channel includes a continuous operation boundary and a protection exit boundary. Based on the state vector, the generation of a reliable margin trajectory and timeout for each risk channel among multiple risk channels includes: The reliability margin trajectory of the first risk channel is determined based on the protection exit boundary, the continuous operation boundary, the risk channel observation, the sensor reliability, and the data degradation penalty amount; the first risk channel is any one of the plurality of risk channels. The time to reach the limit of the first risk channel is determined based on the protection exit boundary of the first risk channel, the risk channel observation, and the rate of change of the risk channel observation.

4. The method according to claim 3, characterized in that, The risk channel observations are the observations of the corresponding risk channels after being aligned with the danger direction.

5. The method according to claim 1, characterized in that, The extreme state label is used to indicate that the current state of the wind turbine is a sudden wind overspeed, load approach, grid connection crossing, actuator degradation, transmission chain vibration amplification, or a combination of extreme states. The dynamic safety domain is used to limit the allowable range of the pitch rate, torque change rate, yaw rate, active power change rate, and reactive power change rate of the wind turbine. The protection level is used to indicate the protection status of the wind turbine, which includes: continuous operation, derating operation, protection off or shutdown; The unlocking conditions are used to define the switching conditions for different protection levels among the protection levels; The rollback strategy is used to roll back to the security strategy of the previous cycle when the optimized control quantity and the protection control quantity in the current cycle meet the conflict condition.

6. The method according to claim 5, characterized in that, Each of the risk channels includes: a protected exit boundary; The dynamic security domain is determined based on the protection exit boundary, the trusted margin trajectory, the time to limit, the trusted margin contraction coefficient, and the time to limit contraction coefficient.

7. The method according to claim 1, characterized in that, The optimized control quantities include at least two of the following: collective pitch increment, individual pitch increment, generator torque increment, yaw increment, active power command increment, and reactive power command increment. The protection control quantity is determined based on the risk channel with the shortest time to reach its limit among the plurality of risk channels.

8. The method according to claim 1, characterized in that, The projection conflict index is determined based on the deviation relationship between the execution control quantity, the optimization control quantity, and the protection control quantity.

9. The method according to claim 1, characterized in that, The reliable residual is determined based on the sensing reliability, the measured response vector, and the predicted response vector; wherein, the measured response vector is the actual response data of the wind turbine after the execution of the control quantity, and the predicted response vector is the predicted response data of the wind turbine after the execution of the control quantity.

10. A safety optimization control system for wind turbine generators under extreme operating conditions, characterized in that, include: The system includes a status acquisition module, a trusted margin generation module, a limit safety package generation module, a dual-channel control module, a security arbitration and projection module, an execution interface module, and a protection upgrade and downgrade module. The state acquisition module is used to acquire the state vector during the operation of the wind turbine. The state vector includes at least one of the following: wind speed, turbulence intensity, wind direction change rate, rotational speed, blade pitch angle, generator torque, blade root bending moment, tower bending moment, nacelle acceleration, grid connection voltage, and grid connection frequency. The reliable margin generation module is used to generate a reliable margin trajectory and time to limit for each of the multiple risk channels based on the state vector; wherein, the risk channel is used to characterize the risk source that may trigger protection of the wind turbine under extreme operating conditions; The extreme security package generation module is used to generate an extreme security package based on the trusted margin trajectory, the time to limit, and the sensor trustworthiness; the extreme security package includes: extreme state label, dynamic security domain, protection level, unlocking conditions, and fallback strategy; The dual-channel control module is used to generate optimized control quantities and protection control quantities in parallel based on the multiple risk channels; The security arbitration and projection module is used to arbitrate and project the security domain based on the optimized control quantity and the protection control quantity according to the limit security package to obtain the execution control quantity; The execution interface module is used to execute the execution control quantity; The protection upgrade / downgrade module is used to determine the protection level update strategy of the wind turbine based on the projection conflict index, reliable residual and the time limit after the execution of the control quantity. The protection strategy includes: maintaining the current control, upgrading protection, downgrading protection, shutdown protection and rollback.

Images