Green electricity direct connection continuous load power supply switching front safety permission control method and system

Abstract

The embodiment of the application relates to the technical field of new energy power supply, user side power control, industrial continuous load control, electrical safety interlocking and power supply switching protection, and provides a green electricity direct connection continuous load power supply switching safety permission control method and system. Including: obtaining the operation state of each device and candidate control action; when the candidate control action contains a power supply mode switching action, determining the matching parameter corresponding to the power supply mode switching action according to the operation state; judging whether there is a transient power gap according to the matching parameter, and generating a corresponding adjustment instruction; configuring the power supply mode switching action and the adjustment instruction as the same transaction and associating the same identifier; obtaining the continuous power adjustment confirmation feedback and executable state feedback corresponding to the transaction from the load driving unit and the power supply switching unit; when all feedbacks meet the corresponding permission conditions, a power supply switching execution permission signal is generated; when the permission signal is valid, the power supply switching unit is allowed to complete electrical switching.

Description

Technical Field

[0001] This application relates to the fields of new energy supply, user-side power control, industrial continuous load control, electrical safety interlocking and power supply switching protection, and specifically to a safety permission control method and system for green electricity direct connection to continuous load power supply switching. Background Technology

[0002] Against the backdrop of green and low-carbon industrial transformation, utilizing new energy sources such as photovoltaics and wind power to provide local energy supply for continuous loads on the industrial user side has become an important way to improve the local consumption level of new energy, reduce industrial energy costs, and reduce carbon emissions.

[0003] In traditional renewable energy grid-connected power supply methods, renewable energy sources are typically connected to the public power grid, and fluctuations in renewable energy output are mainly absorbed and regulated by the public power grid, dispatching system, or upstream power system. User-side continuous loads usually face a large-capacity public power grid with strong power supply rigidity, so fluctuations in renewable energy output do not directly pose a transient risk during user-side power supply switching.

[0004] In the user-side direct green power supply method, the renewable energy source supplies power to the continuous load through the user-side direct connection line. The renewable energy source and the continuous load are directly coupled on the user side. When the green power output suddenly drops, the green power voltage is abnormal, the auxiliary power supply is connected, the buffer unit intervenes, or the system switches from one power supply mode to another, the user-side control system needs to automatically complete the power supply mode switching, continuous load power adjustment, buffer unit support, and power supply switching safety judgment. If the short-term carrying capacity of the target switching power source, the short-term support capacity of the buffer unit, and the continuous load power before the switch cannot match at the moment of switching, a transient power gap will be formed, causing the target switching power source to overload, bus voltage drop, load current surge, contactor malfunction, protection false tripping, or continuous load process interruption.

[0005] Existing automatic transfer switch technology can select the power supply path between mains power, backup power, photovoltaic inverters, or energy storage inverters, and can be configured with load management, priority load shedding, or interlock protection functions. Existing microgrid energy management technology can coordinate distributed power sources, dispatch energy storage, perform frequency threshold load shedding, and restore power supply. Existing photovoltaic energy storage control technology can perform energy storage compensation or power balance control based on parameters such as power deficit, bus voltage change rate, and load current change rate. Existing industrial safety interlocking systems may also employ permission logic, switch status confirmation, communication handshake, or fault confirmation to prevent equipment from operating when preset conditions are not met.

[0006] However, the aforementioned existing technologies mainly focus on "which power source provides the power," "when to cut off the load," "how to restore power supply," "how to maintain the energy balance of the microgrid," "how to perform energy storage compensation," or "how to confirm that the switching side has the conditions for operation." They typically do not establish a safety permission closed loop that must be completed before electrical switching for the moment of power supply switching of continuous loads directly connected to green electricity on the user side. This means: 1) calculating the transient load gap before switching; 2) generating a continuous load reduction command when there is a transient power gap; 3) generating an explicit power maintenance command even when there is no transient power gap; 4) binding the power supply switching action and the continuous load power adjustment action to the same safety execution transaction; 5) requiring the generation, issuance, and feedback confirmation of the continuous load power adjustment command to precede the completion of electrical switching by the power supply switching unit; 6) generating a power supply switching execution permission signal independent of the power supply switching command itself based on the continuous power adjustment confirmation feedback from the load driving side and the executable status feedback from the power supply switching side; 7) allowing the power supply switching unit to complete electrical switching only when the execution permission signal is valid.

[0007] While existing ATS interlocks, industrial safety interlocks, and communication handshake mechanisms possess switch-side confirmation, permission logic, or communication confirmation functions, they typically do not treat "continuous load power regulation confirmation feedback" as a necessary condition for "power supply switching electrical switching permission." Furthermore, they do not generate an explicit power hold command carrying the current power setpoint, hold flag, feedback request flag, and command number when there is no transient power gap, and do not incorporate this explicit power hold command into the same safety execution process as the power supply switching action. Therefore, the power supply switching problem in a user-side green electricity direct-connected continuous load system is not a typical automatic transfer switch problem, nor is it simply a photovoltaic energy storage management problem. Rather, it is a user-side safety execution control problem encompassing "source-side fluctuations—power supply mode switching—continuous load power regulation—buffer unit support—safety permission before electrical switching."

[0008] The existing technology has the following problems: 1. Traditional grid-connected control is difficult to directly apply to continuous loads directly connected to green electricity on the user side. In traditional grid-connected modes, renewable energy sources typically achieve power aggregation and fluctuation balancing through the public grid. Continuous loads on the user side primarily receive power from the public grid, and fluctuations in renewable energy do not directly pose transient risks during power supply switching on the user side. However, in the direct green electricity connection mode, renewable energy sources are directly coupled to continuous loads, and fluctuations in green electricity directly affect the user side's power supply status. When green electricity is insufficient, experiences a sudden drop in green electricity, or is connected by auxiliary power, the user-side system must automatically handle power supply mode switching, continuous load power adjustment, buffer unit support, and safety clearance determination. Existing traditional grid-connected control methods struggle to address the transient load matching and execution timing safety issues during power supply switching in this scenario.

[0009] 2. The target switching power supply's carrying capacity may be mismatched with the continuous load power at the moment of power supply switching. Existing microgrid energy management methods typically treat power supply mode switching and load power regulation as two relatively independent control issues. The former focuses on power supply availability, while the latter focuses on load power limiting. For continuous loads, these two are strongly coupled at the moment of power supply switching. If the instantaneous support capacity of the target switching power supply and the buffer unit is less than the load power before switching, and the continuous load power regulation is not synchronously prepared, a transient power gap will be formed, causing current surges, auxiliary power supply overloads, bus undervoltage, load driver out-of-synchronization, or protection malfunctions.

[0010] 3. Separate execution of power supply switching commands and continuous load power adjustment commands can easily lead to timing misalignment. Existing power supply switching controls typically allow power supply switching commands and load power adjustment commands to be generated, issued, and executed separately. If the switching command is executed first, but the load reduction command has not yet been generated, issued, confirmed by the load drive unit, or has failed to execute, the load power at the moment of power supply switching may exceed the combined support capacity of the target switching power supply and the buffer unit. Existing technology lacks a mechanism to configure power supply switching actions and flexible continuous load reduction actions or explicit holding actions as a bound execution relationship within the same safe execution transaction, especially lacking a safe execution mechanism that ensures the generation, issuance, and feedback confirmation of continuous power adjustment commands precede the completion of electrical switching by the power supply switching unit.

[0011] 4. Lack of explicit load-side confirmation in scenarios without transient power gaps. Existing power switching logic typically executes the switch directly or assumes the load-side state is normal when it determines that no load reduction is needed. However, in actual industrial systems, even if the calculated transient power gap is zero, it is still necessary to confirm whether the load drive channel is controllable, whether the current power setting is valid, whether the load driver is fault-free, and whether the communication link can return matching feedback for the current switching transaction. Without explicit confirmation, power switching may still be performed under conditions where the load side is uncontrollable, the setting is invalid, the driver is faulty, or the feedback link is abnormal, resulting in switching risks. Existing technology lacks an explicit power maintenance command mechanism that incorporates scenarios without power gaps into the load-side confirmation and switching permission closed loop.

[0012] 5. Lack of cross-side clearance decision mechanism before switching. In existing technologies, power supply switching actions are mostly directly determined by power supply side conditions, switching device status, or control strategies, lacking a cross-side confirmation mechanism that simultaneously relates to feedback from the load power regulation side and the power supply switching side. In other words, existing technologies typically do not generate an execution clearance signal independent of the power supply switching command itself, making it difficult to ensure that the power supply switching action only enters the electrical switching phase when the load side regulation preparation is complete, the power supply switching side has the execution conditions, the transaction number matches, and no feedback anomaly occurs.

[0013] 6. Unclear boundaries between the control strategy layer and the safety execution layer. Existing intelligent control, predictive control, or optimization control methods typically convert model output actions directly into execution commands, or only restrict them through simple thresholds. For discrete and high-risk actions like power supply switching, if the strategy layer output can directly drive the power supply switching unit to complete the electrical switching, erroneous switching can easily occur under conditions of prediction uncertainty, communication anomalies, lack of load feedback, or uncontrollable drivers. Existing technologies lack a mechanism to clearly distinguish between the switching intention of the strategy layer and the switching permission of the safety execution layer. The strategy layer can output candidate actions for "desired switching," but these actions should not directly drive electrical switching; they must be executed only after the safety execution layer completes the safety permission determination.

[0014] 7. Lack of a stability confirmation and freeze-back mechanism based on continuous satisfaction of multi-dimensional electrical quantities after switching. In green power direct-connection systems, short-term transients exist in voltage, current, load power, and buffer unit status after power supply mode switching. Existing methods mostly use simple delays or single thresholds to prevent back-back, failing to continuously and stably confirm multi-dimensional conditions such as voltage fluctuations, current fluctuations, power change rate, buffer unit voltage recovery, fault indicators, and communication status. Furthermore, they fail to freeze restorative power supply back-back before stability confirmation is complete, making it difficult to suppress repeated back-back oscillations under complex transient conditions.

[0015] Therefore, there is an urgent need for a method to solve the problems of transient load gap, current surge, target switching power supply overload, switching malfunction, and erroneous switching under uncontrollable load conditions caused by the separate execution of power supply switching and continuous load power regulation. Summary of the Invention

[0016] The purpose of this application is to provide a safety permission control method, safety permission controller and system for green electricity direct connection to continuous load power supply switching, so as to solve the technical defects in the prior art caused by the separation of power supply switching and continuous load power regulation, such as transient load gap, current surge, target switching power supply overload, switching malfunction and erroneous switching under uncontrollable load conditions.

[0017] To achieve the above objectives, the first aspect of this application provides a safety clearance control method before switching green electricity to a continuous load, the method comprising: The system acquires the operating status of the new energy direct-connected power supply, auxiliary power supply, buffer unit, continuous load, load drive unit and power supply switching unit, as well as candidate control actions including power supply mode switching actions. Among them, the new energy direct-connected power supply supplies power to the continuous load through the user-side direct connection line. The power supply mode switching action is only used as a switching intention input to the safety execution controller and cannot directly drive the power supply switching unit to complete electrical switching. When the candidate control action includes a power supply mode switching action, the matching parameters corresponding to the power supply mode switching action are determined according to the operating status. The matching parameters include at least the conservative support power of the target switching power supply and the conservative release support power of the buffer unit, the total power of the continuous load before switching, and the safety margin. The system determines whether there is a transient power gap based on the matching parameters and generates a corresponding flexible continuous load adjustment command based on the determination result. When there is a transient power gap, a flexible continuous load reduction command is generated; when there is no transient power gap, a flexible continuous load power maintenance command is generated. The power maintenance command is an explicit continuous power adjustment confirmation command. Configure the power supply mode switching action and the flexible continuous load adjustment command as the same safe execution transaction and associate them with the same safe execution transaction identifier. The generation, issuance and feedback confirmation of the flexible continuous load adjustment command are completed before the power supply switching unit completes the electrical switching. Obtain continuous power regulation confirmation feedback from the load drive unit corresponding to the safe execution transaction, and obtain executable status feedback from the power supply switching unit corresponding to the safe execution transaction; When both the continuous power regulation confirmation feedback and the executable status feedback meet the corresponding preset permission conditions, and the safety execution transaction identifier in the continuous power regulation confirmation feedback matches the current safety execution transaction identifier, and no overcurrent, undervoltage, overtemperature, communication abnormality or manual prohibition of switching flag is detected, a power supply switching execution permission signal independent of the power supply switching command itself is generated. When the power supply switching execution permission signal is valid, the power supply switching unit is allowed to complete the electrical switching corresponding to the power supply mode switching action.

[0018] In the embodiments of this application, determining whether there is a transient power gap based on the matching parameters includes: summing the total power of the continuous load before switching with the safety margin to obtain a first value, and summing the conservatively supportable power of the target switching power supply with the conservatively releaseable support power of the buffer unit to obtain a second value; when the first value is greater than the second value, it is determined that there is a transient power gap; when the first value is less than or equal to the second value, it is determined that there is no transient power gap.

[0019] In the embodiments of this application, when the candidate control action includes a power supply mode switching action, determining the matching parameters corresponding to the power supply mode switching action based on the operating state includes: when the candidate control action includes a power supply mode switching action, calculating the allowable support power of the target switching power supply in the current switching window based on the rated support power of the target switching power supply, the short-term overload support power of the target switching power supply within the preset switching window, and the allowable power corresponding to the protection limit of the target switching power supply; and calculating the conservatively supported power of the target switching power supply based on the temperature derating factor, the response delay derating factor, the communication status derating factor, the allowable support power of the target switching power supply in the current switching window, and the power already undertaken.

[0020] In the embodiments of this application, the power supply mode switching action and the flexible continuous load adjustment command are confirmed to be configured as the same safe execution transaction when all of the following conditions are met: the power supply mode switching action and the flexible continuous load adjustment command are assigned the same safe execution transaction identifier; both the power supply switching command and the flexible continuous load adjustment command carry a safe execution transaction identifier, wherein the power supply switching command is generated based on the power supply mode switching action and is used to send to the power supply switching unit to control the power supply switching unit to perform electrical switching corresponding to the power supply mode switching action; the feedback frame returned by the load drive unit contains a safe execution transaction identifier; the feedback frame returned by the power supply switching unit contains a safe execution transaction identifier or a pending execution status flag associated with the safe execution transaction identifier; the safe execution transaction identifier includes a control cycle number, a switching action number, a target power supply mode number, a load adjustment command number, and a check code.

[0021] In the embodiments of this application, the power supply switching execution permission signal includes a hardware permission output signal and / or a communication permission frame. When the power supply switching execution permission signal is valid, allowing the power supply switching unit to complete the electrical switching corresponding to the power supply mode switching action includes: when the power supply switching execution permission signal is a hardware permission output signal, receiving the hardware permission output signal through the permission input terminal set by the power supply switching unit; when the hardware permission output signal is valid and the power supply switching unit's own state meets the switching conditions, allowing the power supply switching unit to complete the electrical switching corresponding to the power supply mode switching action; when the power supply switching execution permission signal is a communication permission frame, verifying the communication permission frame through the power supply switching unit; when the communication permission frame verification passes, allowing the power supply switching unit to complete the electrical switching corresponding to the power supply mode switching action, wherein the communication permission frame includes at least a secure execution transaction identifier, a target power supply mode number, a permission validity flag, a timestamp, and a checksum; when the power supply switching execution permission signal is a combination signal of the hardware permission output signal and the communication permission frame, when the hardware permission signal is valid and the permission validity flag indicated by the communication permission frame is valid at the same time, allowing the power supply switching unit to complete the electrical switching corresponding to the power supply mode switching action.

[0022] In the embodiments of this application, when the power supply switching execution permission signal is invalid, the execution drive of the power supply switching unit is kept in a prohibited state, and the power supply switching unit is not allowed to complete the electrical switching. The power supply switching execution permission signal is confirmed to be invalid when any of the following conditions are met: when the power supply switching execution permission signal is a hardware permission output signal and the hardware permission output signal is invalid; when the power supply switching execution permission signal is a communication permission frame and the permission validity flag of the communication permission frame is invalid or the communication permission frame verification fails; when the power supply switching execution permission signal is a combination of the hardware permission output signal and the communication permission frame and the hardware permission output signal is invalid or the communication permission frame verification fails.

[0023] In embodiments of this application, the method further includes: after allowing the power supply switching unit to complete the electrical switching corresponding to the power supply mode switching action, continuously monitoring the load bus voltage fluctuation, load bus current fluctuation, load power change rate, buffer unit voltage, fault flag, and communication status; when it is detected that all stability confirmation conditions are met within the continuous stability confirmation time, the restorative power supply cut-off freeze is lifted, wherein the stability confirmation conditions include at least the load bus voltage fluctuation being less than the voltage fluctuation threshold, the load bus current fluctuation being less than the current fluctuation threshold, the load power change rate being lower than the power change rate threshold, the buffer unit voltage recovering to the preset safe range, no new overcurrent, undervoltage, overtemperature, or communication abnormality flags being detected, the power supply switching unit status being consistent with the target power supply mode, and the load drive unit being in a controllable and fault-free state; when it is detected that any stability confirmation condition is not met within the continuous stability confirmation time, the restorative power supply cut-off is kept frozen, and the continuous power adjustment command is limited to the safe contraction range.

[0024] In embodiments of this application, the method further includes a parameter calibration step, which includes: calibrating the target switching power supply's allowable supported power, the target switching power supply's protection limit power, the buffer unit's protection limit power, the temperature derating factor, the response delay derating factor, the communication status derating factor, the safety factor, the minimum safety margin, and the stability confirmation time; wherein, the target switching power supply's allowable supported power is determined based on the minimum value among the target switching power supply's rated supported power, the short-time overload supported power within a preset switching window, and the allowable power corresponding to the protection limit; the target switching power supply's protection limit power is determined based on at least two of the target switching power supply's overcurrent protection limit, undervoltage protection limit, temperature protection limit, and the rated limit of the power supply switching device; the buffer unit's protection limit power is determined based on... The following parameters are considered: buffer unit voltage, protection allowable discharge current, state of charge constraint, temperature constraint, current allowable discharge power output by the battery management system or energy storage management system, and DC bus protection constraint; temperature derating factor is determined based on the target switching power supply temperature-power derating curve or piecewise linear derating relationship; response delay derating factor is determined based on the target switching power supply step power support test; communication status derating factor is determined based on communication delay, packet loss rate, and verification error rate; safety factor and minimum safety margin are determined based on bus voltage drop, current peak, and target switching power supply overload ratio under different load power change rates and different power supply switching delay conditions; stability confirmation time is determined based on no-load switching, rated load switching, and most unfavorable continuous load change condition tests.

[0025] The second aspect of this application provides a safety execution controller configured to execute the above-described safety permission control method before switching green electricity to continuous load power supply.

[0026] A third aspect of this application provides a safety clearance control system for green electricity direct-connection continuous load power supply switching, comprising: The aforementioned safety execution controller; New energy direct-connect power supply, auxiliary power supply, buffer unit, continuous load, load drive unit and power supply switching unit.

[0027] The above technical solution acquires the operating status of the new energy direct-connected power supply, auxiliary power supply, buffer unit, continuous load, load drive unit, and power supply switching unit, as well as candidate control actions including power supply mode switching. The new energy direct-connected power supply supplies power to the continuous load through a direct connection line on the user side. The power supply mode switching action only serves as a switching intention input to the safety execution controller and cannot directly drive the power supply switching unit to complete electrical switching. When a candidate control action includes a power supply mode switching action, matching parameters corresponding to the power supply mode switching action are determined based on the operating status. These matching parameters include at least the conservatively supported power of the target switching power supply, the conservatively releaseable supported power of the buffer unit, the total power of the continuous load before switching, and the safety margin. The system determines whether a transient power gap exists based on the matching parameters and generates a corresponding flexible continuous load adjustment command based on the determination result. Specifically, when a transient power gap exists, a flexible continuous load load reduction command is generated; when no transient power gap exists, a flexible continuous load power maintenance command is generated. The power maintenance command is an explicit continuous power adjustment confirmation command. The power supply mode switching action and the flexible continuous load adjustment command are configured as the same safe execution transaction and associated with the same safe execution transaction identifier. The generation, issuance, and feedback confirmation of the flexible continuous load adjustment command are completed before the power supply switching unit completes the electrical switching. The continuous power adjustment confirmation feedback corresponding to the safe execution transaction is obtained from the load drive unit, and the executable status feedback corresponding to the safe execution transaction is obtained from the power supply switching unit. When both the continuous power adjustment confirmation feedback and the executable status feedback meet the corresponding preset permission conditions, and the safe execution transaction identifier in the continuous power adjustment confirmation feedback matches the current safe execution transaction identifier, and no overcurrent, undervoltage, overtemperature, communication abnormality, or manual prohibition of switching flag is detected, a power supply switching execution permission signal independent of the power supply switching command itself is generated. When the power supply switching execution permission signal is valid, the power supply switching unit is allowed to complete the electrical switching corresponding to the power supply mode switching action. This application obtains the system's operating status and candidate control actions. When the candidate actions include power supply mode switching actions, it determines the matching parameters based on the operating status and judges whether there is a transient power gap, thereby generating a corresponding flexible continuous load adjustment command. By configuring the power supply mode switching action and the flexible continuous load adjustment command as the same safe execution transaction, and requiring the generation, issuance, and feedback confirmation of the adjustment command to be completed before electrical switching, and then generating a power supply switching execution permission signal independent of the power supply switching command itself when the feedback from both sides meets the preset permission conditions, the transaction identifier matches, and no abnormality is detected, electrical switching is only allowed to be completed when the permission signal is valid. This ensures that electrical switching is performed on the premise that the load-side adjustment has been confirmed, the switching-side status is available, and the transaction is accurately matched, reducing the risk of erroneous switching caused by source-load mismatch and timing misalignment at the moment of switching.

[0028] Other features and advantages of the embodiments of this application will be described in detail in the following detailed description section. Attached Figure Description

[0029] The accompanying drawings are provided to further illustrate the embodiments of this application and form part of the specification. They are used together with the following detailed description to explain the embodiments of this application, but do not constitute a limitation on the embodiments of this application. In the drawings: Figure 1 This illustration schematically shows an application environment diagram of a safety permission control method for switching green electricity direct-connection to continuous load power supply according to an embodiment of this application; Figure 2 The illustration shows a flowchart of a method for safety permission control before switching to green electricity direct-connection continuous load power supply according to an embodiment of this application; Figure 3 This schematically illustrates a structural block diagram of a safety clearance control system for green electricity direct-connection continuous load power supply switching according to an embodiment of this application; Figure 4 The diagram illustrates the internal structure of a computer device according to an embodiment of this application. Detailed Implementation

[0030] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are only for illustration and explanation of the embodiments of this application and are not intended to limit the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0031] Furthermore, if the embodiments of this application involve descriptions such as "first" or "second," these descriptions are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, features defined with "first" or "second" may explicitly or implicitly include at least one of those features. Additionally, the technical solutions of various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. If the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed in this application.

[0032] The safety permission control method for switching green electricity directly connected to a continuous load provided in this application can be applied to, for example... Figure 1 The application environment shown. For example, Figure 1As shown, a schematic diagram of a user-side green electricity direct-connection continuous load system is provided. The system includes: The target power source side (green electricity direct connection side) includes the green electricity generation unit, the generation-side converter, the target power source, and the buffer unit; Power supply switching unit; The continuous load side (user load side) includes load 1, load 2, ... and load N; Grid-connected side (mains power grid), including PG, QG, grid-connected transformer / filter and grid-connected switch; The control and communication system includes a measurement and status sensing unit, a safety execution controller, a control strategy generation module, a human-machine interface, and a communication network.

[0033] It should be noted that the green power generation unit may include photovoltaic modules and wind turbines; the target power source includes renewable energy AC power sources PT and QT; the buffer unit is the energy storage system PB and EB; the power supply switching unit includes static switching devices ST and SM; loads 1 to N are sorted in descending order of priority, with load 1 having the highest priority and load N having the lowest priority; the measurement and status sensing unit includes voltage, current, and power measurement, frequency and phase angle measurement, buffer unit SOC measurement, and load power feedback; the safety execution controller is used for permission decision and execution, including transient power gap calculation, cross-side permission decision, execution transaction binding and gating, and stability confirmation and back-off control; the control strategy and generation module is used for optimization and parameter management, including parameter calibration and online correction, derating factor and safety margin management, stability confirmation time management, and priority and load derating allocation strategy; the human-machine interface includes status display, alarm management, parameter setting, and time recording.

[0034] Figure 2 This illustration schematically shows a flowchart of a safety clearance control method for switching green electricity directly connected to a continuous load power supply according to an embodiment of this application. Figure 2 As shown in the figure, this application provides a safety permission control method before switching green electricity to continuous load power supply, which is applied to a safety execution controller. The method may include the following steps: Step 201: Obtain the operating status of the new energy direct-connected power supply, auxiliary power supply, buffer unit, continuous load, load drive unit and power supply switching unit, as well as candidate control actions including power supply mode switching actions. Among them, the new energy direct-connected power supply supplies power to the continuous load through the user-side direct connection line. The power supply mode switching action is only used as a switching intention input to the safety execution controller and cannot directly drive the power supply switching unit to complete the electrical switching.

[0035] In the embodiments of this application, it should be noted that in the user-side green electricity direct-connection continuous load system, the new energy direct-connection power supply directly supplies power to the continuous load through the user-side direct connection line. The source and load are directly coupled. The transient risks during the switching process cannot be absorbed by the public power grid as in the traditional grid connection method. Therefore, before the safety execution controller determines whether to allow the power supply mode switching, it needs to understand the current operating status of each link of the system and whether there is a switching intention.

[0036] Specifically, the safety execution controller can grasp the current operating status of each component of the system by acquiring the operating status of the new energy direct-connected power supply, auxiliary power supply, buffer unit, continuous load, load drive unit, and power supply switching unit, and determine whether the system has a switching intention by acquiring candidate control actions including power supply mode switching actions. Among them, the new energy direct-connected power supply supplies power to the continuous load through the user-side direct connection line. The power supply mode switching action is only used as a switching intention input to the safety execution controller and cannot directly drive the power supply switching unit to complete the electrical switching.

[0037] Furthermore, the safety execution controller can collect the input voltage, input current, and input power of the new energy direct-connected power supply to characterize its operating status; it can collect the availability status and current output power of the auxiliary power supply to characterize its operating status; it can collect the voltage, current, state of charge, and voltage change rate of the buffer unit to characterize its operating status; it can collect the load bus voltage, load bus current, and current power of each continuous load to characterize its operating status; it can collect the contactor or switch status of the power supply switching unit to characterize its operating status; and it can collect the driver status, fault flags, and communication status of the load drive unit to characterize its operating status. Among these, the state of charge and voltage change rate of the buffer unit reflect its short-term support potential; the continuous power adjustment command values ​​corresponding to each load collected from the load side are directly related to the adjustment capability of subsequent flexible continuous loads; and the status of the power supply switching unit and the load drive unit are used to determine whether the execution process is in a controllable and fault-free state.

[0038] Furthermore, candidate control actions can include discrete and continuous candidate actions. Discrete candidate actions can be used to characterize intentions at the power supply mode level, such as maintaining the current power supply mode, power supply mode switching actions (including switching from direct-connected renewable energy power supply to auxiliary power supply, and switching from auxiliary power supply to direct-connected renewable energy power supply), entering a buffer support state, cutting off non-critical loads, entering a fault protection state, or entering a manual takeover state. Continuous candidate actions can be used to characterize power regulation intentions for flexible continuous loads, such as PWM duty cycle, target power, inverter frequency, current limit value, load reduction ratio, target speed, target current, or recovery slope. It is understood that the specific forms of these candidate actions can vary depending on the actual control strategy, but the power supply mode switching action, after entering the safety execution controller, only exists as a switching intention and does not itself have the ability to directly drive the power supply switching unit to complete electrical switching. Whether subsequent electrical switching is allowed requires a series of safety judgments to achieve gating. In this way, a clear authority boundary is formed between the control strategy layer and the safety execution layer, which can effectively reduce the risk of erroneous switching caused by misjudgment of the control strategy, communication anomalies, or lack of load feedback.

[0039] Step 202: When the candidate control action includes a power supply mode switching action, determine the matching parameters corresponding to the power supply mode switching action based on the operating status. The matching parameters include at least the conservative support power of the target switching power supply and the conservative release support power of the buffer unit, the total power of the continuous load before switching, and the safety margin.

[0040] In this embodiment, it should be noted that when the candidate control action includes a power supply mode switching action, the safety execution controller needs to determine a set of parameters for evaluating whether the source-load bearing is matched before the switching, for the target switching power supply to which the switching action is directed. This set of matching parameters can be extracted or calculated from the acquired operating status, rather than directly calling preset values ​​without considering the current operating status. When the power supply mode switching action is a switch from power supply directly connected to the renewable energy source to power supply from the auxiliary power source, the target switching power supply is the auxiliary power source; conversely, when the power supply mode switching action is a switch from power supply directly connected to the renewable energy source to power supply from the auxiliary power source, the target switching power supply is the renewable energy source directly connected to the renewable energy source.

[0041] The matching parameters can include the conservatively supported power of the target switching power supply, the conservatively releaseable power of the buffer unit, the total continuous load power before switching, and the safety margin. The conservatively supported power of the target switching power supply reflects the additional power it can handle under the current operating conditions after switching. The conservatively releaseable power of the buffer unit reflects the short-term support capacity that the buffer unit can release at the moment of switching. The total continuous load power before switching reflects the load demand that needs to be handled before switching. The safety margin provides a margin for uncertainties such as delays, sampling errors, and load fluctuations during the switching process. It can be understood that the above matching parameters describe the key factors involved in transient power matching before switching from the source side, buffer side, and load side, respectively. This allows the safety execution controller to determine whether a transient power gap exists not based solely on the availability of a single power supply or the current power of the load, but on a quantitatively comparable matching basis based on the current operating state. In this context, the matching parameters corresponding to the power supply mode switching action can be understood as not referring to all parameters of the entire system in general, but rather to the specific switching direction and target pointed to by the current candidate action. For example, when the candidate switching action is switching from power supply directly connected to the new energy source to power supply to the auxiliary power source, the target switching power source is the auxiliary power source, and the corresponding matching parameters are also developed around the auxiliary power source and the current load conditions, so as to ensure that the subsequent gap judgment is consistent with the current switching intention.

[0042] In this embodiment of the application, when the candidate control action includes a power supply mode switching action, determining the matching parameters corresponding to the power supply mode switching action based on the operating status includes: when the candidate control action includes a power supply mode switching action, calculating the allowable support power of the target switching power supply in the current switching window based on the rated support power of the target switching power supply, the allowable short-time overload support power of the target switching power supply within the preset switching window, and the allowable power corresponding to the protection limit of the target switching power supply; and calculating the conservatively supported power of the target switching power supply based on the temperature derating factor, the response delay derating factor, the communication status derating factor, the allowable support power of the target switching power supply in the current switching window, and the power already undertaken.

[0043] In this embodiment, it should be noted that the conservative support power of the target switching power supply is not a direct reference to its nameplate rating. Instead, it is a short-term available support capacity index obtained after a series of conservative processing based on the rated capacity, combined with the actual limitations and protection constraints of the current switching window. Specifically, the allowable support power of the target switching power supply in the current switching window can be determined first based on its rated support power, the short-term overload support power allowed within the preset switching window, and the allowable power corresponding to the protection limit of the target switching power supply. The rated support power reflects the continuous output capacity of the target switching power supply under normal operating conditions; the short-term overload support power reflects the ability of the target switching power supply to operate beyond its rated value within the short-term timeframe of the switching window; and the allowable power corresponding to the protection limit reflects the maximum output level allowed by the target switching power supply under protection constraints such as no current leakage, no undervoltage, and no overheating. Combining these three factors, it can be understood as taking a relatively conservative upper limit among the rated capacity, short-term overload capacity, and protection boundary as the actual usable allowable support power of the target switching power supply in the current switching window. Specifically, the allowable support power can be calculated using the following formula: , in, The actual allowable supporting power available to the target switching power supply within the current switching window. The target switching power supply rated support power, The short-term overload support power allowed by the target switching power supply within a preset switching window. The allowable power corresponding to the target switching power supply protection limit. To obtain the minimum value.

[0044] After obtaining the permissible support power, it is necessary to further consider the impact of temperature, response delay, and communication status on the actual carrying capacity of the target switching power supply. The temperature derating factor reflects the degree to which the output capacity of the target switching power supply needs to be reduced under the current temperature conditions; the response delay derating factor reflects the response lag between receiving the power support request and actually reaching the target output power, thus requiring a reduction in its short-term available capacity; the communication status derating factor reflects the impact of communication quality factors such as current communication delay, packet loss, or checksum errors on the reliability of power regulation. After derating the permissible support power using the temperature derating factor, response delay derating factor, and communication status derating factor, and then subtracting the power already carried by the target switching power supply, we can obtain the conservatively permissible additional support power that the target switching power supply can actually provide within the current switching window. This conservatively permissible support power provides a more reliable basis for subsequently comparing whether the sum of the total continuous load power before switching and the safety margin exceeds the source-side support capacity, avoiding overestimation of the target switching power supply's carrying capacity at the moment of switching. Specifically, the conservatively permissible support power can be calculated using the following formula: , in, This is the temperature derating factor. In response to the delay derating factor, This is the derating factor for communication status. The target switching power supply is set to the allowable supported power within the current switching window. The power supply currently being used to switch to the target power source is handling the current power. To obtain the maximum value. Secondly, the calculation method for conservatively supported power is not limited to the above formula, and can also be determined based on at least two of the following: the target switching power supply rated capacity, short-time overload capacity, current temperature, response delay, communication status, currently handled power, voltage drop limit, and protection limit.

[0045] Furthermore, when the candidate control action includes a power supply mode switching action, the conservative releasable support power of the buffer unit is calculated based on the buffer unit voltage, the maximum allowable discharge current of the buffer unit, the buffer unit temperature derating factor, the available energy of the buffer unit, the rated power of the buffer unit, the allowable power corresponding to the protection limit of the buffer unit, and the state-of-charge derating factor.

[0046] Specifically, the conservative releasable support power of the buffer unit and the conservative releasable support power of the target switching power supply are determined using similar approaches, both aiming to obtain a relatively conservative short-term support capability that can be realistically delivered at the moment of switching. The difference lies in that the support capability of the buffer unit is not only limited by its electrical output capability but also constrained by factors such as energy reserves and state of charge (SBC). Therefore, the determination process requires a comprehensive consideration of multiple constraints. The voltage and maximum allowable discharge current of the buffer unit together reflect the upper limit of power that the buffer unit can provide within a short-term window, reflecting the constraint on the buffer unit's power output capability. The SBC derating factor can be determined based on the current SBC of the buffer unit. When the SBC is low, this factor will decrease accordingly, thereby reducing the calculated conservative releasable support power and avoiding over-reliance on the buffer unit when energy reserves are insufficient. The temperature derating factor reflects whether the output capability of the buffer unit needs to be reduced under the current temperature conditions. Under over-temperature conditions, this factor will limit its releasable capability. By combining the voltage, maximum allowable discharge current, SBC derating factor, and temperature derating factor, the short-term support power considering the electrical output capability can be obtained. The buffer unit can also obtain the releaseable power under another constraint based on available energy and allowable support time, which reflects the energy reserve constraint. Even if the instantaneous power capability of the buffer unit is sufficient, if the available energy is insufficient to continuously support the system within the switching window, the actual releaseable support power should also be limited according to the energy constraint. Furthermore, the rated power of the buffer unit and the allowable power corresponding to the protection limit need to be considered. The allowable power corresponding to the protection limit can come from the allowable discharge power output in real time by the battery management system, supercapacitor management unit, or energy storage converter, or from the allowable carrying power under the DC bus or bus protection constraints. In actual implementation, the minimum value among the above constraints can be taken as the conservative releaseable support power of the buffer unit. This ensures that the buffer unit will not fail to support the system due to any breach in voltage, current, state of charge, temperature, energy, or protection limit at the moment of switching. It is understandable that this method of taking the minimum value is consistent with the approach to determining the conservative support power, both aiming to make the source-side and buffer-side capabilities on which the subsequent transient power gap judgment depends closer to the actual achievable level. Specifically, the conservative releaseable support power can be calculated using the following formula: , in, To conserve power, the support power can be released. This refers to the buffer unit voltage, measured in volts (V). This represents the maximum allowable discharge current of the buffer unit, expressed in amperes (A). This is the derating factor for the state of charge. This refers to the temperature derating factor of the buffer unit. The available energy for the buffer unit is expressed in kWh. Allowable support time in hours; The rated power of the buffer unit is expressed in kW. The allowable power corresponding to the protection limit of the buffer unit. To minimize the value. Secondly, the calculation method for conservatively releasable support power is not limited to the above formula, and can also be determined based on at least two of the following: buffer unit voltage, state of charge, allowable discharge current, available energy, short-term support time, temperature status, protection threshold, and health status.

[0047] Furthermore, the safety margin is calculated based on the load power change rate, power supply switching action delay, continuous power regulation command communication delay, power sampling error, and a preset safety factor; the total power of continuous loads before switching is obtained by summing the current power of each continuous load before switching. Specifically, in determining the matching parameters, in addition to the conservatively supported power of the target switching power supply and the conservatively releaseable supported power of the buffer unit, the total power of continuous loads before switching and the safety margin are also necessary bases for judging transient power gaps. The total power of continuous loads before switching represents the sum of the actual power demand on the load side at the moment of switching, while the safety margin is used to cover the uncertainties caused by load fluctuations, action delays, communication delays, and sampling errors during the switching process. Together, they determine whether the source side and the buffer side have sufficient short-term carrying capacity before switching. For the safety margin, its calculation process needs to comprehensively consider factors such as the load power change rate, power supply switching action delay, continuous power regulation command communication delay, and power sampling error. The load power change rate reflects the degree of drastic change in load demand before and after switching. The larger the change rate, the higher the possibility that the load power will continue to rise or fluctuate within the switching window, so a larger margin needs to be reserved. The power supply switching delay and the continuous power regulation command communication delay represent the time windows between issuing the switching intention and actually completing the electrical switching, and between issuing the load regulation command and the load drive unit response, respectively. The longer the delay, the more uncertainties the system needs to withstand within that time window, and the greater the safety margin should be. Power sampling error reflects the deviation between the collected load power and the actual power. To avoid overestimating the source-side support capacity due to underestimation, compensation through a safety margin is also necessary. In practice, corresponding preset safety factors can be set for each of the above factors, and then the safety margin can be calculated by combining each factor with its corresponding coefficient. It is understandable that after calculating the safety margin, it can be compared with a preset minimum safety margin, and the larger one can be used as the final safety margin. This ensures that even with smooth load changes, short delays, and small sampling errors, the system always retains a basic safety margin and will not lose its protective function due to an excessively small calculated value. Specifically, the safety margin can be calculated using the following formula: , in, For safety margin, This represents the absolute value of the load power change rate. Due to the delay in power supply switching action, For continuous power regulation command communication delay, For power sampling error, , , For safety reasons, To preset the minimum safety margin, To obtain the maximum value.

[0048] The total power of continuous loads before the switchover can be obtained by summing the current power of each continuous load before the switchover. Each continuous load can include critical continuous loads and flexible continuous loads, and the current power can be obtained from real-time data fed back by the load drive unit. If there are many continuous loads in the system or some loads have fluctuating power, the collected power of each load can be filtered or its short-time average value can be taken before summing to improve the stability of the total power calculation. The reason for calculating the total power of continuous loads before the switchover, rather than using the target value after the switchover, is that the transient power gap at the moment of switchover is determined by the difference between the load demand before the switchover and the actual support capacity of the source and buffer sides. Only by comparing with the actual total load power before the switchover can the potential load-bearing risks at the moment of switchover be truly reflected. Specifically, the total power of continuous loads before the switchover can be calculated using the following formula: , in, This represents the total power of the continuous load before the switchover. For the first The current power of a continuous load. This refers to the number of continuous loads. After obtaining the safety margin and the total power of the continuous loads before switching using the above method, the basic quantities required in the matching parameters from multiple dimensions such as the load side, source side, buffer side, and system safety margin are basically complete. Subsequently, transient power gap judgment can be performed relatively completely, and quantitative basis can be provided for determining whether to generate flexible continuous load reduction command or power maintenance command.

[0049] Step 203: Determine whether there is a transient power gap based on the matching parameters, and generate a corresponding flexible continuous load adjustment command based on the determination result; wherein, when there is a transient power gap, a flexible continuous load reduction command is generated, and when there is no transient power gap, a flexible continuous load power maintenance command is generated, and the power maintenance command is an explicit continuous power adjustment confirmation command.

[0050] In this embodiment, it should be noted that after determining the matching parameters, the safety execution controller can use these parameters to judge the transient matching between the source side and the load side before the switch. The purpose of the judgment is to identify in advance whether a short-term power shortage may occur when directly switching the power supply mode under the current operating conditions, that is, to confirm whether there is a transient power gap. The matching parameters used here have quantified the load-bearing conditions before the switch from different dimensions such as the source side, the buffer side, the load side, and the system safety margin. Therefore, the judgment process does not simply rely on a single parameter, but needs to combine the transient load-bearing relationship before the switch reflected by these parameters to draw a conclusion. It can be understood that when the short-term support capacity that the source side and the buffer side can actually provide within the current switching window is insufficient to meet the continuous load demand and safety margin requirements before the switch, a transient power gap is considered to exist; otherwise, a transient power gap is considered not to exist.

[0051] Furthermore, when the judgment result indicates the existence of a transient power gap, it means that under the current operating conditions, if the power supply mode switch is directly executed, the target switching power supply and buffer unit may not be able to safely handle the total power of the continuous load before the switch, and problems such as overload, bus voltage drop, or load current surge may easily occur at the moment of switching. Therefore, the safety execution controller needs to first reduce the power of the flexible continuous load, that is, generate a flexible continuous load load reduction command. The purpose of this load reduction command is to reduce the power demand on the load side to a range that the source side and buffer side can safely support before electrical switching, thereby avoiding a power gap at the moment of switching. It can be understood that the load reduction here mainly targets flexible continuous loads with continuous adjustment capabilities, rather than all continuous loads, so as to minimize the switching risk while ensuring the continuous operation of critical loads.

[0052] Furthermore, when the judgment result indicates that there is no transient power gap, it does not mean that the load-side confirmation can be skipped and the power supply switch can be executed directly. At this time, the safety execution controller will generate a flexible continuous load power maintenance command, and this power maintenance command is an explicit continuous power adjustment confirmation command. That is to say, even if the calculation result indicates that the source side and the buffer side can meet the load demand before the switch, the safety execution controller still needs to actively send a confirmation request to the load drive unit through this command, requiring the load drive unit to clearly return information such as whether the current power adjustment channel is controllable, whether the current set value remains valid, and whether there is a fault. The purpose of this processing is to ensure that the load side is not assumed to be completely normal even when there is no transient power gap, but is still included in the pre-switching safety clearance closed loop, so as to avoid being ignored due to load drive channel abnormality or feedback link failure, which would affect the accuracy of subsequent clearance judgment. In the above way, after the safety execution controller completes the transient power gap judgment according to the matching parameters, it will generate the corresponding flexible continuous load adjustment command regardless of whether there is a gap. When a gap exists, a load reduction command is generated to bring the load demand back to within the support range of the source and buffer sides before the switchover. When no gap exists, an explicit power preservation command is generated to confirm the controllability of the load side and the validity of the current power setting. Subsequent binding of the same safety execution transaction and cross-side permission decisions will be based on these generated adjustment commands and corresponding load-side feedback, thus providing a complete safety criterion for whether to allow the power supply switching unit to complete the electrical switching.

[0053] In this embodiment of the application, determining whether there is a transient power gap based on the matching parameters includes: summing the total power of the continuous load before switching with the safety margin to obtain a first value, and summing the conservatively supportable power of the target switching power supply with the conservatively releaseable support power of the buffer unit to obtain a second value; when the first value is greater than the second value, it is determined that there is a transient power gap; when the first value is less than or equal to the second value, it is determined that there is no transient power gap.

[0054] In this embodiment, it should be noted that when determining whether a transient power gap exists based on matching parameters, the safety execution controller can consider the total demand and safety margin of the load side before switching, and simultaneously consider the support capabilities that the target switching power supply and the buffer unit can provide at the moment of switching. Then, the existence of a gap is determined by comparing the magnitudes of these two values. Specifically, the total continuous load power before switching and the safety margin can be summed to obtain a first value. This first value represents the total power demand that the load side actually needs to bear at the moment of switching, after considering uncertainties such as load fluctuations, action delays, communication delays, and sampling errors. Simultaneously, the conservatively supported power of the target switching power supply and the conservatively releaseable support power of the buffer unit are summed to obtain a second value. This second value represents the short-term support capability that the source side and the buffer side can provide together at the moment of switching. By comparing the first and second values, it is possible to intuitively determine whether the source and load are matched under the current operating conditions. When the first value is greater than the second value, it indicates that even if the target switching power supply and the buffer unit work together, it is insufficient to cover the sum of the total power of the continuous load before the switching and the safety margin. At this time, there is a risk of insufficient power during the switching moment, so it is determined that there is a transient power gap; that is, when the following conditions are met: If so, a transient power gap exists. According to the formula: The calculation shows that when the first value is less than or equal to the second value, it indicates that the combined short-term support capacity of the target switching power supply and buffer unit can cover the load requirements and safety margin before switching. In this case, the risk of a power shortfall during switching is relatively small, therefore it is determined that there is no transient power shortfall. In this application, "no transient power shortfall" can mean that the transient shortfall is zero, i.e., when the following conditions are met: When the transient power gap is zero, a flexible continuous load power maintenance command is generated. It is understandable that this comparison method quantifies and compares load-side demand, safety margin, and available capacity on the source and buffer sides on the same scale. This allows the transient power gap assessment result to directly reflect the matching of load conditions before switching, providing a clear basis for whether subsequent load reduction or power maintenance of the flexible continuous load is necessary.

[0055] Furthermore, the flexible continuous load power maintenance command carries at least the current power setpoint, a maintenance flag, a feedback request flag, and a command number. After receiving the flexible continuous load power maintenance command, the load drive unit returns continuous power adjustment confirmation feedback corresponding to the command number. Specifically, when the transient power gap is zero, the safety execution controller generates a flexible continuous load power maintenance command. This command is not a no-op, but requires explicit command content to trigger the load drive unit to confirm the current power status. This power maintenance command may carry at least the current power setpoint, a maintenance flag, a feedback request flag, and a command number. Among them, the current power setpoint is used to indicate the power level that the safety execution controller recognizes the load should maintain before the switchover, and the load drive unit can compare it with the actual operating status; the maintenance flag is used to indicate that the purpose of this command is to maintain the current power, rather than to perform a new load reduction or increase action; the feedback request flag is used to require the load drive unit to return confirmation information after receiving the command to prove that the command has been correctly received and executed; the command number is used to associate this power maintenance command with the current safety execution transaction, so that the returned feedback can correspond to the specific command. After receiving the power hold command, the load drive unit can return continuous power adjustment confirmation feedback corresponding to the command number. This feedback can include information such as command number matching, power adjustment channel controllability, validity of the current power setting, and no fault in the load drive unit. Through the above command content and feedback mechanism, even in the absence of transient power shortages, the controllable state of the load side can be explicitly confirmed, avoiding the switching risks caused by directly assuming the load side is normal.

[0056] Furthermore, the flexible continuous load reduction command is generated based on the transient power gap and the power adjustment mapping relationship of the flexible continuous load. The power adjustment mapping relationship includes at least one of the following: PWM duty cycle, target power, inverter frequency, current limit value, load reduction ratio, target speed, target current, or recovery slope. Continuous loads include critical continuous loads and flexible continuous loads. When multiple flexible continuous loads exist, the load reduction amount is allocated according to priority from low to high. Specifically, when the judgment result indicates the existence of a transient power gap, the safety execution controller needs to generate a corresponding flexible continuous load reduction command based on the size of the gap and the power adjustment mapping relationship of the flexible continuous load. The transient power gap reflects the amount of power missing between the combined short-term support capacity of the source side and the buffer side before switching and the demand of the load side. The larger the gap, the greater the load reduction task that the flexible continuous load needs to undertake. The power adjustment mapping relationship is used to convert this overall power reduction demand into specific adjustment amounts that each flexible continuous load can execute, so that the load reduction command can be truly implemented on the control parameters that the load drive unit can recognize. The power regulation mapping relationship can include at least one of the following: PWM duty cycle, target power, inverter frequency, current limit value, load reduction ratio, target speed, target current, or recovery slope. It is understood that different load types may require different regulation methods. For example, variable frequency drive loads can achieve power reduction by adjusting the inverter frequency or target speed; adjustable power heating loads can achieve power reduction by changing the PWM duty cycle, target power, or current limit value; and adjustable speed pump loads and fan loads can achieve power reduction by adjusting the target speed or load reduction ratio. The mapping relationship can be obtained in advance through offline calibration and appropriately corrected during operation based on the deviation between the actual load power and the command response, thereby ensuring that the expected regulation effect is achieved relatively accurately after the load reduction command is issued. Through this mapping relationship, the safety execution controller can reasonably decompose the overall load reduction demand—the transient power gap—into specific adjustment amounts corresponding to each flexible continuous load, avoiding situations where some loads are over-loaded while others are under-loaded. In terms of load classification, continuous loads can include critical continuous loads and flexible continuous loads. Critical continuous loads typically have high requirements for power supply continuity and operational stability, making them unsuitable for short-term load reduction before switching. Flexible continuous loads, on the other hand, can continuously adjust their power within permissible limits, making them more suitable for undertaking short-term power reduction tasks before switching. Therefore, when generating load reduction instructions, the load reduction task is preferentially assigned to flexible continuous loads, rather than adjusting critical continuous loads. When multiple flexible continuous loads exist in the system, the load reduction amount can be allocated sequentially from low to high priority. That is, the lower-priority flexible continuous loads first undertake the load reduction task, and when their adjustment capacity is insufficient to cover the transient power gap, the higher-priority flexible continuous loads continue to undertake the remaining load reduction.The priority of each flexible continuous load can be preset according to process importance, allowable adjustment range, or actual operating strategy, and can also be appropriately adjusted according to changes in operating conditions. This arrangement can minimize the impact on important loads and overall process continuity while meeting the gap elimination requirements. Through the above method, the flexible continuous load descent commands generated when there is a transient power gap can be reasonably allocated according to the actual adjustability and priority relationship of the load, providing a valid basis for subsequently binding the descent commands and power supply mode switching actions into the same safe execution transaction.

[0057] Step 204: Configure the power supply mode switching action and the flexible continuous load adjustment command as the same safe execution transaction and associate them with the same safe execution transaction identifier. The generation, issuance and feedback confirmation of the flexible continuous load adjustment command are completed before the power supply switching unit completes the electrical switching.

[0058] In this embodiment, it should be noted that after the flexible continuous load adjustment command is generated, the safety execution controller needs to treat the power supply mode switching action and the adjustment command as a whole for subsequent safety control, rather than processing and issuing them independently. This integrated control is achieved by configuring the power supply mode switching action and the flexible continuous load adjustment command as the same safety execution transaction and associating them with the same safety execution transaction identifier. It is understood that the role of the safety execution transaction here is to establish a binding relationship between power supply switching and load adjustment, ensuring that during a power supply mode switching process, the load-side adjustment action and the power supply-side switching action are not treated as two unrelated independent behaviors, but must be coordinated and advanced within the same transaction framework. By configuring the same safety execution transaction, the power supply mode switching action and the flexible continuous load adjustment command can share the same transaction identifier during execution. Subsequent adjustment confirmation feedback from the load drive unit or executable status feedback from the power supply switching unit can be traced back to the same switching process through this transaction identifier. This avoids the situation where, due to the large number of commands and feedback in a continuous control cycle, feedback from one cycle is incorrectly matched to the switching intent of another cycle. Especially in situations where green power direct-connection systems experience frequent output fluctuations and rapid updates to candidate control actions, the correspondence established through transaction identifiers can prevent expired or misaligned feedback from affecting the current switching permission judgment. Under the constraint of this safe execution transaction, the generation, issuance, and feedback confirmation of flexible continuous load adjustment commands must be completed before the power supply switching unit completes electrical switching. That is, the load side must first issue the adjustment command and confirm that the load drive unit has executed the command correctly and returned the corresponding confirmation feedback before the power supply switching unit can proceed to the electrical switching stage. This avoids situations where power switching is completed but flexible continuous load adjustment has not yet been confirmed, thus preventing the load power from still exceeding the level that the target switching power supply and buffer unit can safely handle at the moment of switching. It is understandable that this timing requirement does not merely indicate the order in which commands are issued, but rather requires that the adjustment result on the load side be confirmed before the electrical switching can be considered to have a basis for continued execution. By incorporating power supply mode switching actions and flexible continuous load regulation commands into the same safety execution transaction, and by mandating that load-side regulation confirmation precede electrical switching, the safety execution controller can effectively reduce the timing misalignment risk caused by the separate execution of switching and regulation. Subsequently, whether it's cross-side permission decisions or the generation and gating of power supply switching execution permission signals, this transaction framework can be used to uniformly verify feedback from both sides, thereby improving the reliability of safety permission control before power supply switching.

[0059] In this embodiment, the power supply mode switching action and the flexible continuous load adjustment command are confirmed to be configured as the same safe execution transaction when all of the following conditions are met: the power supply mode switching action and the flexible continuous load adjustment command are assigned the same safe execution transaction identifier; both the power supply switching command and the flexible continuous load adjustment command carry a safe execution transaction identifier, wherein the power supply switching command is generated based on the power supply mode switching action and is used to send to the power supply switching unit to control the power supply switching unit to perform electrical switching corresponding to the power supply mode switching action; the feedback frame returned by the load drive unit contains a safe execution transaction identifier; the feedback frame returned by the power supply switching unit contains a safe execution transaction identifier or a pending execution status flag associated with the safe execution transaction identifier; the safe execution transaction identifier includes a control cycle number, a switching action number, a target power supply mode number, a load adjustment command number, and a check code.

[0060] In this embodiment, it should be noted that configuring the power supply mode switching action and the flexible continuous load adjustment command as the same safe execution transaction requires multiple conditions to be met simultaneously for confirmation. These conditions, from different levels such as identifier allocation, instruction carrying, feedback return, and identifier composition, ensure the integrity and traceability of the transaction binding. Only when all these conditions are met can the safe execution controller consider that the power supply switching and load adjustment are within the same transaction framework, and subsequent cross-side permission decisions and electrical switching gating can be based on a unified transaction identifier.

[0061] Furthermore, the power supply mode switching action and the flexible continuous load adjustment command need to be assigned the same secure execution transaction identifier. This identifier points to both the power supply mode switching action and the corresponding load adjustment action during the current switching process, making them no longer independent operations but two components of the same transaction. In practice, the secure execution controller can write the transaction identifier corresponding to the current switching action when generating the flexible continuous load adjustment command, allowing the adjustment command received by the load side to be directly associated with the specific switching intent. Through this identifier allocation, subsequent adjustment confirmation feedback from the load driving unit and status feedback from the power supply switching unit can be identified and matched within the same transaction framework, avoiding misalignment caused by the coexistence of multiple cycle commands.

[0062] Furthermore, both power supply switching commands and flexible continuous load adjustment commands need to carry this safety execution transaction identifier. The power supply switching command involved here can be understood as the actual execution command generated by the safety execution controller based on the power supply mode switching action and sent to the power supply switching unit. The power supply mode switching action itself only represents the switching intent at the policy layer, while the power supply switching command is the specific execution command for the power supply switching unit after being processed by the safety execution controller. When this power supply switching command is issued, it carries the same safety execution transaction identifier as the flexible continuous load adjustment command, enabling the power supply switching unit to clearly identify the specific transaction corresponding to the command upon receipt. The flexible continuous load adjustment command also carries this identifier, allowing the load drive unit to provide feedback within the same transaction when performing adjustment.

[0063] Furthermore, the feedback frame returned by the load drive unit needs to include a safety execution transaction identifier. This way, when the safety execution controller receives continuous power regulation confirmation feedback from the load drive unit, it can determine whether the feedback corresponds to the currently processed switching transaction by using the transaction identifier in the feedback frame. Similarly, the feedback frame returned by the power supply switching unit also needs to include this safety execution transaction identifier, or a pending execution status flag associated with that transaction identifier. When the power supply switching unit returns a pending execution status flag associated with the transaction identifier, it indicates that the switching unit has identified the corresponding transaction and is in a waiting-to-execute state, not yet having completed the electrical switching. By carrying transaction identifiers in the feedback frames from both sides, the safety execution controller can perform matching verification of the feedback from the load side and the power supply switching side under the same transaction during subsequent permission determination, thereby avoiding interference from expired, misaligned, or irrelevant feedback in the switching permission determination.

[0064] The specific composition of the secure execution transaction identifier can include a control cycle number, a switching action number, a target power supply mode number, a load adjustment instruction number, and a checksum. The control cycle number distinguishes different control cycles, the switching action number distinguishes different switching actions that may exist within the same cycle, the target power supply mode number identifies the power supply mode to which this switch is directed, the load adjustment instruction number associates the corresponding flexible continuous load adjustment instruction, and the checksum verifies the integrity of the identifier itself to prevent errors during transmission or storage. Through the combination of these fields, the secure execution transaction identifier can relatively completely reflect the temporal location, action object, and associated instructions of the current transaction, thus making the transaction binding relationship clearly identifiable even under complex operating conditions. It is understood that the above identifier composition does not constitute a limitation on the specific encoding format; in actual implementation, it can be adjusted accordingly based on the system communication protocol and data frame structure. Furthermore, the secure execution cycle can be set to 10ms to 200ms, and is less than the sum of the continuous load power adjustment response time and the power supply switching execution delay.

[0065] Step 205: Obtain continuous power regulation confirmation feedback from the load drive unit corresponding to the safe execution transaction, and obtain executable status feedback from the power supply switching unit corresponding to the safe execution transaction.

[0066] In this embodiment, it should be noted that after the power supply mode switching action and the flexible continuous load adjustment command have been configured as the same safe execution transaction, and the adjustment command has been issued and executed, the safe execution controller needs to obtain feedback information corresponding to the safe execution transaction from both the load drive unit and the power supply switching unit. This feedback information is not an isolated status report, but is directly related to the currently processed safe execution transaction, reflecting whether the load-side adjustment result and the power supply switching side execution conditions have reached the expected state. It is understood that the purpose of obtaining feedback from both sides is to provide necessary basis for subsequent judgment on whether to generate a power supply switching execution permission signal. Therefore, the feedback content itself needs to match the transaction identifier to ensure that it corresponds to the current switching process, rather than a historical cycle or other irrelevant transaction. For the continuous power adjustment confirmation feedback from the load drive unit, it is mainly used to confirm that the flexible continuous load adjustment command has been correctly received and executed by the load drive unit, and that the load side is currently in a controllable state. This feedback may include a safe execution transaction identifier to indicate that it belongs to the current transaction. After receiving an adjustment command, the load drive unit can return corresponding confirmation information based on the feedback request flag in the command, such as whether the command number matches, whether the power adjustment channel is controllable, whether the current setpoint remains valid, and whether the load drive unit is faulty. This information helps the safety execution controller confirm whether the load side is truly ready for the switchover, avoiding further electrical switching if the load side has not completed adjustment or if there are abnormalities. For the executable status feedback from the power supply switching unit corresponding to the safety execution transaction, it mainly reflects whether the power supply switching unit has entered the executable state and whether it has the conditions to complete the electrical switchover. This feedback may include a safety execution transaction identifier or a pending execution status flag associated with the transaction identifier. After receiving the power supply switching command, the power supply switching unit does not immediately complete the electrical switchover but first enters the pending execution state and returns executable status feedback to the safety execution controller. This feedback may include information such as whether the power supply switching unit is in the pending execution state, whether it is operable, and whether there is a fault. By obtaining this feedback, the safety execution controller can understand whether the power supply switching unit is ready to receive subsequent permission signals, thus providing a status basis for the switching side for cross-side permission decisions. Understandably, feedback from both the load drive unit and the power supply switching unit must correspond to the current safety execution transaction. This ensures that the load-side and switching-side feedback used for subsequent permission decisions originate from the same switching process. If the transaction identifiers in the feedback from both sides are inconsistent, or if feedback from one side is missing, the safety execution controller cannot confirm whether load regulation and power supply switching are truly under the coordinated control of the same transaction.Therefore, the feedback information obtained in this step actually provides an indispensable input condition for subsequent judgment on whether both sides meet the preset permission conditions and whether an independent power supply switching execution permission signal can be generated.

[0067] Furthermore, the continuous power regulation confirmation feedback includes at least instruction number matching feedback, power regulation channel controllability feedback, and load drive unit fault-free feedback. The executable status feedback includes at least power supply switching unit pending execution status feedback, power supply switching unit operable status feedback, and power supply switching unit fault-free status feedback. Specifically, after obtaining feedback from the load drive unit and the power supply switching unit, to ensure that this feedback can be truly used for subsequent permission judgment, the feedback from both sides also needs to meet the corresponding basic requirements. For the continuous power regulation confirmation feedback from the load drive unit, it must at least include instruction number matching feedback, power regulation channel controllability feedback, and load drive unit fault-free feedback. Instruction number matching feedback can be used to indicate that the load drive unit returns confirmation information corresponding to the regulation instruction in the current safe execution transaction, rather than feedback from historical instructions or other transactions; power regulation channel controllability feedback can be used to indicate that the load drive unit can currently receive and execute power regulation instructions normally, and its regulation channel is not in a state of being out of control or inoperable; load drive unit fault-free feedback can be used to indicate that the load drive unit itself has not experienced a fault affecting regulation execution. Through these three basic feedbacks, the safety execution controller can confirm that the load side, after executing the flexible continuous load adjustment command, is in a state corresponding to the current transaction, with controllable channels and no faults, thus providing a basis for including the load side in the permission decision. For the executable status feedback from the power supply switching unit, it must at least include the power supply switching unit pending execution status feedback, the power supply switching unit operable status feedback, and the power supply switching unit fault-free status feedback. The power supply switching unit pending execution status feedback can be used to indicate that the power supply switching unit has identified the current switching transaction and is in a pending execution state awaiting further permission, and has not yet completed the electrical switching; the power supply switching unit operable status feedback can be used to indicate that the power supply switching unit currently possesses the basic conditions for executing the electrical switching action, and its execution drive has not been prohibited; the power supply switching unit fault-free status feedback can be used to indicate that the power supply switching unit itself does not have any faults affecting the switching action. Through these three basic feedbacks, the safety execution controller can confirm that the power supply switching unit is currently in a pending, operable, and fault-free state, providing a status basis for the switching side to subsequently determine whether to generate a power supply switching execution permission signal. It is understandable that the feedback on both sides corresponds to the load adjustment side and the power supply switching side, respectively, and is related to the current safe execution transaction. Only when both sides of the feedback contain the above basic content can the safe execution controller reliably determine whether the load side and the switching side simultaneously meet the switching conditions in the subsequent cross-side permission decision.

[0068] Step 206: When both the continuous power regulation confirmation feedback and the executable status feedback meet the corresponding preset permission conditions, and the safety execution transaction identifier in the continuous power regulation confirmation feedback matches the current safety execution transaction identifier, and no overcurrent, undervoltage, overtemperature, communication abnormality, or manual prohibition of switching flag is detected, a power supply switching execution permission signal independent of the power supply switching command itself is generated.

[0069] In this embodiment, it should be noted that after obtaining continuous power regulation confirmation feedback from the load drive unit and executable status feedback from the power supply switching unit, the safety execution controller needs to determine whether these feedbacks meet the permission conditions. Only when both feedbacks meet their respective preset permission conditions, and the safety execution transaction identifier in the continuous power regulation confirmation feedback is consistent with the current safety execution transaction identifier, and no overcurrent, undervoltage, overtemperature, communication anomaly, or manual prohibition of switching flag is detected, will the safety execution controller generate a power supply switching execution permission signal. These three conditions, from the perspectives of feedback validity, transaction correspondence, and system abnormal state, constitute the prerequisites for generating the permission signal. Specifically, the continuous power regulation confirmation feedback meeting the corresponding preset permission conditions means that the feedback information returned by the load drive unit can prove that the load side has completed regulation confirmation and is in a controllable state; the executable status feedback meeting the corresponding preset permission conditions means that the power supply switching unit has entered a state of readiness for execution, operability, and fault-free operation. Both feedbacks must be met simultaneously, not just one, because the power supply switching safety permission depends on both whether the load side is ready and whether the switching side has the necessary execution conditions. Feedback from both sides is indispensable; otherwise, even if one side is in a normal state, the entire switching transaction cannot be considered ready for the switchover.

[0070] Building upon this foundation, the necessary feedback combination on the load drive side, in addition to command number matching feedback, power regulation channel controllability feedback, and load drive unit fault-free feedback, can also include one or more of the following: current setpoint validity feedback, target power attainable feedback, load reduction not exceeding limits feedback, or drive operating mode permitted feedback. Current setpoint validity feedback can further confirm that the power setpoint currently held by the load drive unit has not been accidentally modified or invalidated and remains valid. Target power attainable feedback can indicate that the load drive unit has the capability to achieve the target power required by the regulation command under the current operating conditions, preventing situations where the command is issued but the load cannot actually be adjusted to the required level. Load reduction not exceeding limits feedback can confirm that the load reduction involved in this adjustment does not exceed the allowable adjustment range of the load drive unit, preventing abnormal load operation due to excessive load reduction. Drive operating mode permitted feedback can indicate that the current operating mode of the load drive unit supports the execution of the continuous power regulation command, for example, the drive is in remote control mode or automatic mode, rather than in local manual mode or a mode where adjustment is prohibited. These feedback items can be selected according to the actual capabilities of the load drive unit and the system control requirements, further enhancing the reliability of load-side status confirmation. Similarly, the necessary feedback combination on the power supply switching side, in addition to the power supply switching unit's pending execution status feedback, power supply switching unit's operable status feedback, and power supply switching unit's fault-free status feedback, may also include one or more of the following: contactor or switching device position feedback, interlock status normal feedback, drive power supply normal feedback, or target switching power supply access condition satisfaction feedback. Contactor or switching device position feedback can be used to confirm whether the current position of the contactor or switching device actually performing electrical switching in the power supply switching unit meets expectations, such as whether it is in an intermediate state between opening and closing; interlock status normal feedback can be used to indicate that the safety interlock relationship between the power supply switching unit and other equipment has not been broken, avoiding accidental switching when the interlock is abnormal; drive power supply normal feedback can be used to confirm that the power supply required for the power supply switching unit to perform the drive is normal, avoiding the inability to complete the switching action due to a lack of drive power; target switching power supply access condition satisfaction feedback can be used to confirm that the target switching power supply has met the access conditions, such as normal voltage, correct polarity, or being ready. Through these additional feedback items, the safety execution controller can gain a more comprehensive understanding of the actual status of the power supply switching unit, thereby further reducing the switching risk caused by actuator malfunction or the target power supply not being ready when generating the power supply switching execution permission signal. It is understood that the feedback items in the above preferred embodiment do not necessarily all need to be present simultaneously; rather, one or more can be selected and combined according to the actual configuration of the user-side system and the requirements for the safety level.

[0071] The purpose of matching the safe execution transaction identifier is to prevent feedback misalignment. Since the system may generate multiple adjustment commands and feedbacks in different control cycles, it is difficult to distinguish whether the feedback is relevant to the currently processed switching transaction based solely on the feedback content. By comparing the safe execution transaction identifier in the continuous power adjustment confirmation feedback with the current safe execution transaction identifier, it can be confirmed that the feedback returned by the load side does indeed correspond to the current switching action and the current adjustment command, thus preventing expired or irrelevant feedback from being misused for permission judgment. This transaction identifier matching relationship ensures that permission judgment is based on accurate transaction correspondence, rather than merely on the superficial conformity of the feedback content. The absence of detected overcurrent, undervoltage, overtemperature, communication anomalies, or manual prohibition of switching imposes constraints on permission generation from the perspectives of system safety and human intervention. Even if both the load-side and switching-side feedback meet the conditions and the transaction identifiers match, a permission signal cannot be generated if an abnormal state such as overcurrent, undervoltage, or overtemperature has occurred in the system, or if a communication anomaly or manual prohibition of switching exists. These prohibition signs indicate that the current system may have risks that are not fully reflected in the feedback information, or that the operator has explicitly requested that switching be prohibited. Continuing to generate permission signals in this situation could lead to electrical switching being performed under unsafe conditions. Therefore, they need to be excluded from permission generation. It is understandable that the power supply switching execution permission signal is not the power supply switching command itself. The power supply switching command is the actual execution command generated by the safety execution controller based on the power supply mode switching action and issued to the power supply switching unit; it represents the specific switching content to be performed. The power supply switching execution permission signal, on the other hand, is a safety decision result generated independently of the power supply switching command by the safety execution controller after completing the above condition judgment, used to allow the power supply switching unit to enter the execution queue or complete the electrical switching. Separating the permission signal from the switching command avoids the switching intention or switching command at the policy layer directly driving the switching. Instead, the safety execution controller only gates the switching action through the permission signal after confirming that there are no problems with feedback from both sides, transaction identifiers, and system abnormal states. This further improves the reliability of safety permission control before power supply switching.

[0072] Step 207: When the power supply switching execution permission signal is valid, the power supply switching unit is allowed to complete the electrical switching corresponding to the power supply mode switching action.

[0073] In this embodiment, it should be noted that after confirming that the load-side feedback, switching-side feedback, safety execution transaction identifier, and system abnormal state all meet the permission generation conditions, the safety execution controller generates a power supply switching execution permission signal. This permission signal is independent of the power supply switching command itself; its function is not to reissue the switching command, but rather to serve as the final release condition for the current power supply mode switching action by the safety execution layer. When the permission signal is valid, it indicates that the safety execution controller has confirmed that all safety conditions involved in the current switching transaction have been met, and at this time, the power supply switching unit can be allowed to complete the electrical switching corresponding to the power supply mode switching action. The permission to complete the electrical switching described here can be understood as releasing the execution prohibition held by the power supply switching unit in the waiting state, enabling it to enter the electrical switching completed state from the waiting state. That is, before the permission signal is valid, even if the power supply switching unit has received the power supply switching command, it is still in a waiting state and cannot actually complete the switching action; only after the permission signal is valid is the power supply switching unit allowed to complete the electrical switching according to the target power supply mode corresponding to the switching action. This arrangement ensures that the final execution of electrical switching depends not only on whether the strategy layer issues a switching intention, nor solely on whether the power supply switching unit itself meets the operational conditions, but also on the permission gating of the safety execution controller. It is understandable that a valid power supply switching execution permission signal does not mean that the safety execution controller directly drives the contactor to close or the switch to open; rather, it indicates that the electrical switching action has passed the pre-switching safety permission determination. When the permission signal is valid and its own state meets the switching conditions, the power supply switching unit completes the electrical switching corresponding to the power supply mode switching action, thereby realizing the power supply mode switch. This method of allowing switching only after permission is valid prevents erroneous switching when the load side is not properly adjusted, the switching side is not ready, or there are system anomalies, ensuring that the power supply switching action is always executed under safety permission control.

[0074] In this embodiment, the power supply switching execution permission signal includes a hardware permission output signal and / or a communication permission frame. When the power supply switching execution permission signal is valid, allowing the power supply switching unit to complete the electrical switching corresponding to the power supply mode switching action includes: when the power supply switching execution permission signal is a hardware permission output signal, receiving the hardware permission output signal through the permission input terminal set by the power supply switching unit; when the hardware permission output signal is valid and the power supply switching unit's own state meets the switching conditions, allowing the power supply switching unit to complete the electrical switching corresponding to the power supply mode switching action; when the power supply switching execution permission signal is a communication permission frame, verifying the communication permission frame through the power supply switching unit; when the communication permission frame verification passes, allowing the power supply switching unit to complete the electrical switching corresponding to the power supply mode switching action, wherein the communication permission frame includes at least a secure execution transaction identifier, a target power supply mode number, a permission validity flag, a timestamp, and a checksum; when the power supply switching execution permission signal is a combination signal of the hardware permission output signal and the communication permission frame, when the hardware permission signal is valid and the permission validity flag indicated by the communication permission frame is valid at the same time, allowing the power supply switching unit to complete the electrical switching corresponding to the power supply mode switching action.

[0075] In this embodiment, it should be noted that the power supply switching execution permission signal, in its specific implementation, can take the form of a hardware permission output signal, a communication permission frame, or a combination of both, depending on the execution drive method and safety control architecture adopted by the power supply switching unit. Different permission signal forms correspond to different gating paths, but regardless of the form used, the purpose is to form a permission checkpoint controlled by the safety execution controller before the power supply switching unit completes the electrical switching, ensuring that the electrical switching action is only allowed after the permission conditions are met. The power supply switching unit, as the final device for executing the electrical switching, can be composed of contactors, circuit breakers, static switches, solid-state relays, power electronic switches, or transfer switches, either individually or in combination. After receiving the power supply switching command, these devices can first enter a waiting state, but their execution drive remains in a prohibited state until the permission signal is valid, and they cannot complete the electrical switching. In this way, the final completion of the electrical switching action is not directly triggered by the power supply switching command itself, but requires waiting for the permission signal from the safety execution controller to arrive and become valid before the switching can be completed. When the power supply switching execution permission signal is a hardware permission output signal, the power supply switching unit can be equipped with a permission input terminal to receive the hardware permission output signal from the safety execution controller. This hardware permission output signal can physically manifest as an internal permission bit of the controller, a relay permission contact signal, a logic gate signal, etc. The power supply switching unit is only allowed to complete the electrical switching corresponding to the power supply mode switching action when the hardware permission output signal is valid and its own state also meets the switching conditions. It is understandable that both the validity of the permission signal and the satisfaction of the switching conditions by the switching unit are required because the permission capability not only comes from the release by the safety execution controller, but also requires that the power supply unit's own drive power supply, switching device positions, and interlocking states are all within the normal operating range. If the power supply switching unit's own state does not meet the switching conditions, even if the hardware permission output signal is valid, the electrical switching cannot be completed. When the power supply switching execution permission signal is a communication permission frame, the safety execution controller can send the permission frame to the power supply switching unit through the communication bus. The power supply switching unit needs to verify the permission frame upon receipt. A communication license frame may include at least a secure execution transaction identifier, a target power supply mode number, a license validity flag, a timestamp, and a checksum. The secure execution transaction identifier identifies the license frame as the currently processed secure execution transaction, preventing it from being mistakenly used for other switching transactions. The target power supply mode number indicates the target power supply mode for which the license frame is applied. The license validity flag indicates whether the license frame itself is valid. The timestamp prevents expired license frames from being used. The checksum verifies the integrity of the license frame during transmission. The power supply switching unit only allows the electrical switching corresponding to the power supply mode switching action to complete if the license frame verification passes.Specifically, a successful verification means that the security execution transaction identifier in the permission frame matches the current pending transaction identifier of the power supply switching unit, the permission validity flag is valid, the timestamp has not exceeded the validity period, and the checksum is correct. This way, even if the communication channel is interfered with or if there are erroneous or expired frames, invalid permissions can be excluded through the verification mechanism. For the case where the power supply switching execution permission signal is a combination of a hardware permission output signal and a communication permission frame, it can be understood that the power supply switching unit is simultaneously subject to two gating controls: hardware permission input and communication permission verification. In this case, the hardware permission output signal must be valid, and the permission validity flag indicated by the communication permission frame must also be valid before the power supply switching unit is allowed to complete the electrical switching corresponding to the power supply mode switching action. This combination method combines hardware-level permissions with information-level permissions, further improving permission reliability. Even if the communication link malfunctions, the hardware permission can still serve as the final security checkpoint; conversely, if the hardware permission signal is normal, but the permission validity flag indicated by the communication permission frame is invalid, the switching will not be performed. It is understandable that the three methods described above are suitable for different engineering implementation conditions. The specific form to be adopted can be selected based on the communication architecture of the user-side system, the type of power supply switching unit, and the safety level requirements. Regardless of the form used, the power supply switching execution permission signal is independent of the power supply switching command itself. The power supply switching command expresses the specific switching content to be executed, while the power supply switching execution permission signal expresses that the safety execution controller has confirmed that both the load side and the power supply switching side meet the safety conditions before switching, thus allowing the electrical switching to be executed.

[0076] In this embodiment, when the power supply switching execution permission signal is invalid, the execution drive of the power supply switching unit is kept in a prohibited state, and the power supply switching unit is not allowed to complete the electrical switching. The power supply switching execution permission signal is confirmed to be invalid when any of the following conditions are met: when the power supply switching execution permission signal is a hardware permission output signal and the hardware permission output signal is invalid; when the power supply switching execution permission signal is a communication permission frame and the permission validity flag of the communication permission frame is invalid or the communication permission frame verification fails; when the power supply switching execution permission signal is a combination of the hardware permission output signal and the communication permission frame and the hardware permission output signal is invalid or the communication permission frame verification fails.

[0077] In this embodiment, it should be noted that the validity of the power supply switching execution permission signal directly determines whether the power supply switching unit can transition from the pending execution state to the electrical switching completion state. When the permission signal is invalid, it indicates that the safety execution controller has not yet confirmed that the switching transaction meets the switching conditions, or has detected a situation requiring termination of the switching. In this case, the power supply switching unit must remain in a prohibited state and cannot complete the electrical switching. This prohibited state can be reflected at the execution drive level of the power supply switching unit. For example, contactor coil drive, switching device drive, static switch trigger signal, or power electronic switch gate drive are all prohibited, preventing the power supply switching unit from actually closing or conducting. By directly associating the invalid permission signal with the prohibition of execution drive, it can be ensured that even if the power supply switching command has been issued, the power supply switching unit will not complete the electrical switching if the permission conditions are not met. The specific confirmation of the invalid permission signal can be determined according to the different forms of the permission signal. When the power supply switching execution permission signal is a hardware permission output signal, if the hardware permission output signal is in an invalid state, such as the level signal not reaching a valid level, the contact not closing, or the logic gate signal not being enabled, then the power supply switching execution permission signal is confirmed to be invalid. At this point, even if the power supply switching unit has received the power supply switching command, it cannot complete the electrical switching because the release condition transmitted by the safety execution controller through the hardware permission output signal has not yet been met. The contactor coil drive, switching device drive, static switch trigger signal, or power electronic switch gate drive of the power supply switching unit must all remain in a disabled state. When the power supply switching execution permission signal is a communication permission frame, if the permission validity flag in the communication permission frame is invalid, or the communication permission frame verification fails, the power supply switching execution permission signal is confirmed to be invalid. An invalid permission validity flag indicates that the safety execution controller has not given a valid release instruction in the permission frame; a failed communication permission frame verification indicates that the permission frame may have encountered errors, been tampered with, or expired during transmission, making its authenticity and validity unverifiable. Verification failure can manifest as inconsistencies between the safety execution transaction identifier in the permission frame and the currently pending transaction identifier, timestamp timeout, or incorrect checksum. Regardless of the situation, the power supply switching unit cannot complete the electrical switching based on the communication permission frame; its execution drive must remain in a disabled state. This verification mechanism prevents invalid permissions from being mistakenly executed due to communication interference, frame errors, or timestamp expiration. The situation is more stringent when the power supply switching execution permission signal is a combination of a hardware permission output signal and a communication permission frame. In this case, if either the hardware permission output signal is invalid or the communication permission frame fails verification, the power supply switching execution permission signal is considered invalid. In other words, under the combined signal method, both hardware and communication permission gating must pass. If either gating fails, the entire permission signal cannot be considered valid, and the power supply switching unit must remain in an execution drive disabled state, preventing electrical switching.This approach ensures that the power supply switching unit will not malfunction even when the communication link is abnormal or the hardware permission fails, thus improving the reliability of permission gating. Understandably, in the combined signal mode, if the hardware permission output signal is valid but the communication permission frame verification fails, or if the communication permission frame verification passes but the hardware permission output signal is invalid, the power supply switching unit should remain in a pending state or return to a prohibited state, rather than completing the electrical switching based solely on a single successful gating. Through the aforementioned invalidation confirmation method and prohibition processing, the power supply switching unit cannot complete the electrical switching during the period when the permission signal is invalid. Only after the permission signal regains its validity can it proceed to the subsequent switching execution stage. This complements the gating logic when the permission signal is valid, ensuring that the final execution of the electrical switching is entirely under the permission control of the safety execution controller.

[0078] This application obtains the system's operating status and candidate control actions. When the candidate actions include power supply mode switching actions, it determines the matching parameters based on the operating status and judges whether there is a transient power gap, thereby generating a corresponding flexible continuous load adjustment command. By configuring the power supply mode switching action and the flexible continuous load adjustment command as the same safe execution transaction, and requiring the generation, issuance, and feedback confirmation of the adjustment command to be completed before electrical switching, and then generating a power supply switching execution permission signal independent of the power supply switching command itself when the feedback from both sides meets the preset permission conditions, the transaction identifier matches, and no abnormality is detected, electrical switching is only allowed to be completed when the permission signal is valid. This ensures that electrical switching is performed on the premise that the load-side adjustment has been confirmed, the switching-side status is available, and the transaction is accurately matched, reducing the risk of erroneous switching caused by source-load mismatch and timing misalignment at the moment of switching.

[0079] In this embodiment, the method further includes: after the power supply switching unit is allowed to complete the electrical switching corresponding to the power supply mode switching action, continuously monitoring the load bus voltage fluctuation, load bus current fluctuation, load power change rate, buffer unit voltage, fault flag, and communication status; when it is detected that all stability confirmation conditions are met within the continuous stability confirmation time, the restorative power supply cut-off freeze is lifted, wherein the stability confirmation conditions include at least the load bus voltage fluctuation being less than the voltage fluctuation threshold, the load bus current fluctuation being less than the current fluctuation threshold, the load power change rate being lower than the power change rate threshold, the buffer unit voltage recovering to the preset safe range, no new overcurrent, undervoltage, overtemperature, or communication abnormality flags being detected, the power supply switching unit status being consistent with the target power supply mode, and the load drive unit being in a controllable and fault-free state; when it is detected that any stability confirmation condition is not met within the continuous stability confirmation time, the restorative power supply cut-off is kept frozen, and the continuous power adjustment command is limited to the safe contraction range.

[0080] In this embodiment, it should be noted that after the power supply switching unit completes the electrical switching corresponding to the power supply mode switching action, the system does not immediately enter a free recovery state, but needs to undergo a stability confirmation phase first. The main function of this phase is to determine whether the switched system has truly entered a stable operating state, thereby deciding whether to allow subsequent restorative power supply switching back. Because the load bus voltage, current, and load power may experience transient fluctuations in the short period after the electrical switching is completed, judging stability solely based on a single moment's sampled value or a simple delay can easily lead to misjudgments due to instantaneous fluctuations, thus causing repeated oscillations during restorative power supply switching back. Therefore, it is necessary to continuously monitor multiple dimensions of electrical quantities and state quantities after the electrical switching is completed.

[0081] Furthermore, during the stabilization confirmation phase, the safety actuator controller can continuously monitor load bus voltage fluctuations. Load bus current fluctuation Load power change rate The system includes buffer unit voltage, fault flags, and communication status. Load bus voltage and current fluctuations reflect whether a persistent transient exists on the bus side after switching; the load power change rate reflects whether the load power is still changing rapidly; the buffer unit voltage reflects whether the buffer unit has returned to the preset safe range after switching; fault flags and communication status are used to determine whether new abnormalities have occurred after switching. These status variables provide the basis for judging whether the system is stable after switching from the bus side, load side, buffer side, and system status side, respectively. When a continuous stability confirmation time is detected... When all stability confirmation conditions are met, the system after the switchover can be considered stable, and the restorative power supply cut-off freeze can be lifted. Stability confirmation conditions may include at least the following: load bus voltage fluctuation less than the voltage fluctuation threshold; load bus current fluctuation less than the current fluctuation threshold; load power change rate lower than the power change rate threshold; buffer unit voltage restored to the preset safe range; no new overcurrent, undervoltage, overtemperature, or communication anomaly flags detected; power supply switching unit status consistent with the target power supply mode; and load drive unit in a controllable and fault-free state. These conditions cover the main factors that may affect stable operation after the switchover. Only when all conditions are met within the continuous stability confirmation period can it be concluded that the system has not temporarily and accidentally met a certain condition, but has the basis to lift the cut-off freeze. Understandably, the stability confirmation time can be preset based on factors such as the transient attenuation characteristics, filter window time, and control cycle of the actual system to ensure the effectiveness of continuous confirmation. If any stability confirmation condition is not met within the continuous stability confirmation period, it indicates that unstable factors still exist in the system after the switchover. In this case, the restorative power supply cut-off freeze must be maintained, and the restorative power supply cut-off action is not allowed. Meanwhile, to reduce the possibility of the system continuing to be impacted by unnecessary load changes, continuous power regulation commands can be restricted to a safe shrinkage range. The safe shrinkage range can be understood as a temporary limitation on the power regulation range of flexible continuous loads while the transient situation after the switchover has not completely disappeared. This prevents a significant rebound or further fluctuation in load power, thus buying time for system stabilization. It is understood that this restriction is not permanent, but rather a temporary protective measure taken during the period before stability confirmation is achieved. Once all stability confirmation conditions are met, the freeze is lifted and the normal continuous power regulation range is restored. Through the above-mentioned post-switchover stability confirmation and freeze-back mechanism, the risk of repeated switchovers and oscillations under complex transient conditions can be effectively reduced, ensuring the operational stability of continuous loads after power supply mode switching.

[0082] Furthermore, restorative power supply switching refers to the switch from auxiliary power supply or buffer support state back to renewable energy direct power supply state. During the freeze period of restorative power supply switching, the system is allowed to enter protection state, buffer support state, or manual takeover state, but restorative power supply switching actions are not permitted. Specifically, restorative power supply switching can be understood as the process of the system switching back from auxiliary power supply or buffer support state to renewable energy direct power supply state after the power supply mode switch is completed and stabilized. Since the green energy direct connection system may experience short-term transients in voltage, current, and power after switching, if restorative switching is allowed before these transients have disappeared, it is easy for the system to switch back and forth between renewable energy direct power supply and auxiliary power supply, resulting in oscillations. Therefore, when stabilized confirmation is not completed or unstable factors exist, it is necessary to freeze the restorative power supply switching and temporarily prohibit the action of returning from auxiliary power supply or buffer support state to renewable energy direct power supply. During the freeze period of restorative power supply switching, the system does not completely stop all control behaviors, but restricts the allowed states to protection state, buffer support state, or manual takeover state. The protection state can be understood as the safety controller actively controlling the load and power supply unit to enter a safety protection state when it detects a system anomaly or the inability to meet stability conditions, preventing the anomaly from escalating further. The buffer support state can be understood as using the buffer unit to provide short-term support for the continuous load to maintain uninterrupted power supply. The manual takeover state can be understood as handing over system control to operators for judgment and handling. Allowing entry into these states is to ensure necessary safety management and load maintenance of the system even when the cut-off is frozen. Simultaneously, during the freeze period for restorative power cut-off, restorative power cut-off actions are not allowed. That is, even if the system is currently supported by an auxiliary power supply or buffer unit, it cannot be directly switched back to the new energy direct-connected power supply during this period. This restriction aims to prevent the reintroduction of source-load mismatch or power surges due to restorative cut-off before the transient has completely disappeared and the stability conditions are met. By freezing the cut-off and restricting the allowed states, the system can be kept within a relatively controllable range after the switch. Once the multi-dimensional stability conditions are continuously met, the freeze can be lifted and restorative power cut-off can be allowed, thereby reducing the risk of repeated cut-off oscillations and ensuring the stability of continuous load power supply.

[0083] In this embodiment, the method further includes a parameter calibration step, which includes: calibrating the target switching power supply's allowable supported power, the target switching power supply's protection limit power, the buffer unit's protection limit power, the temperature derating factor, the response delay derating factor, the communication status derating factor, the safety factor, the minimum safety margin, and the stability confirmation time; wherein, the target switching power supply's allowable supported power is determined based on the minimum value among the target switching power supply's rated supported power, the short-time overload supported power within the preset switching window, and the allowable power corresponding to the protection limit; the target switching power supply's protection limit power is determined based on at least two of the target switching power supply's overcurrent protection limit, undervoltage protection limit, temperature protection limit, and the rated limit of the power supply switching device; the buffer unit's protection limit power is determined based on... The following parameters are considered: buffer unit voltage, protection allowable discharge current, state of charge constraint, temperature constraint, current allowable discharge power output by the battery management system or energy storage management system, and DC bus protection constraint; temperature derating factor is determined based on the target switching power supply temperature-power derating curve or piecewise linear derating relationship; response delay derating factor is determined based on the target switching power supply step power support test; communication status derating factor is determined based on communication delay, packet loss rate, and verification error rate; safety factor and minimum safety margin are determined based on bus voltage drop, current peak, and target switching power supply overload ratio under different load power change rates and different power supply switching delay conditions; stability confirmation time is determined based on no-load switching, rated load switching, and most unfavorable continuous load change condition tests.

[0084] In this embodiment, it should be noted that, in order to ensure reliable implementation of this application under different engineering sites, equipment configurations, and operating conditions, it is necessary to calibrate the key parameters involved in the method before system commissioning, during periodic maintenance, or after significant changes in operating status. The purpose of the parameter calibration step is to provide reproducible and traceable parameter sources for the aforementioned matching parameter calculation, transient power gap judgment, permit signal generation, and post-switching stability confirmation, avoiding deviations from reality in safety judgment results due to improper parameter values ​​or direct use of empirical values. Parameter calibration can be performed separately for the target switching power supply's allowable supporting power, target switching power supply protection limit power, buffer unit protection limit power, temperature derating factor, response delay derating factor, communication status derating factor, safety factor, minimum safety margin, and stability confirmation time, so as to match them with the actual operating characteristics and switching window requirements of the current system.

[0085] The calibration process for the target switching power supply's allowable supported power can be determined by combining the target switching power supply's rated supported power, the short-time overload supported power within the preset switching window, and the allowable power corresponding to the protection limit. It can be understood that these three power types describe the support level that the target switching power supply may possess within the switching window from the perspectives of normal continuous output capability, short-time overload capability, and protection boundary, respectively. During calibration, a relatively conservative allowable supported power can be obtained by taking the minimum value among these three types. This approach ensures that the base value is not overly optimistic when subsequently calculating the conservatively supported power of the target switching power supply. Specifically, calibration can be performed according to the following formula: , in, The power supply is allowed to support the target switching power. The target switching power supply rated support power, The short-term support power allowed by the target switching power supply within a preset switching window. The allowable power corresponding to the target switching power supply protection limit. To obtain the minimum value. Determined based on the target switching power supply nameplate parameters, rated capacity parameters, or the rated power limit output by the target switching power supply controller. The short-time overload curve and short-time load capacity curve provided by the target switching power supply manufacturer, or the short-time support test conducted on-site, are determined accordingly. The on-site short-time support test includes: applying step loads of different durations and power levels to the target switching power supply without triggering overcurrent, undervoltage, overtemperature, or protection shutdown conditions; recording the target switching power supply's sustainable output power, minimum bus voltage, peak output current, and protection operation status; and selecting the maximum output power that meets safety conditions within the preset switching window as the [specific value / value]. . The value is determined by conversion based on at least two of the following: target switching power supply overcurrent protection limit, undervoltage protection limit, temperature protection limit, inverter current limit, and circuit breaker or contactor rated limit.

[0086] The calibration of the target switching power supply protection limit power can be determined based on at least two of the target switching power supply's overcurrent protection limit, undervoltage protection limit, temperature protection limit, and rated limits of the power supply switching devices. These limits describe the output boundaries that the target switching power supply can withstand before protection operation from different dimensions such as current, voltage, temperature, and the carrying capacity of switching devices. During calibration, the actual output voltage of the target switching power supply, overcurrent protection threshold, undervoltage protection threshold, temperature protection threshold, and the rated carrying capacity of the contactors, circuit breakers, or power electronic switches in the power supply switching unit can be combined to obtain the allowable power value that simultaneously meets multiple protection constraints. Specifically, calibration can be performed according to the following formula: , in, The allowable power corresponding to the target switching power supply protection limit. To switch the current output voltage or the expected input voltage of the power supply to the target location, Switch the power supply overcurrent protection limit to the target. To target the desired power supply output efficiency or power conversion factor, switch the power supply output efficiency or power conversion factor. This refers to the allowable output power under undervoltage protection constraints. The permissible output power under thermal protection constraints. The power carrying capacity of power switching devices, contactors, circuit breakers or power electronic switches is permitted. To obtain the minimum value. The target switching power supply output voltage drop test is used to determine this. During the test, the target switching power supply output voltage is recorded under different load power conditions. When the output voltage drops to the undervoltage protection threshold or the preset safe voltage lower limit, the corresponding power is taken as the undervoltage constraint power, and then reduced according to a safety factor to obtain the final value. . The derating is determined based on the target switching power supply temperature-power derating curve. When the target switching power supply temperature is in different temperature ranges, the corresponding allowable power is read from the temperature-power derating curve; when a complete curve is not obtained, it is determined by piecewise linear interpolation or a conservative derating table. The rated current, permissible short-time current, heat dissipation conditions, and breaking capacity of the contactors, circuit breakers, static switches, solid-state relays, or power electronic switches in the power supply switching unit are determined.

[0087] The calibration of the buffer unit's protection limit power can be determined based on at least two of the following: buffer unit voltage, allowable discharge current, state of charge constraint, temperature constraint, current allowable discharge power output by the battery management system or energy storage management system, and DC bus protection constraint. Specifically, the buffer unit voltage and allowable discharge current reflect the electrical boundaries of the buffer unit's short-term discharge capability; the state of charge constraint reflects the limitation of current remaining energy on discharge capability; the temperature constraint reflects the impact of temperature on the buffer unit's output capability; the current allowable discharge power output by the battery management system or energy storage management system can be directly used as a real-time constraint in the calibration; and the DC bus protection constraint considers the limitation of discharge power by the bus-side capacitor bank or protection devices. By combining these multiple constraint sources, the buffer unit's protection limit power can be made more consistent with actual usable levels. Specifically, it can be calibrated according to the following formula: , in, The allowable power corresponding to the protection limit of the buffer unit. For the buffer unit voltage, To protect the allowable discharge current of the buffer unit, To allow power release under state-of-charge constraints, To allow power release under temperature constraints, The current allowable discharge power output by the battery management system or energy storage management system. The allowable power carrying capacity under the constraints of DC bus, capacitor bank, or bus protection. To obtain the minimum value. Determined based on the maximum allowable discharge current output by the buffer unit protection device, battery management system, supercapacitor management unit, or flywheel energy storage controller. The value is determined based on the state of charge (SBC) of the buffer unit versus the allowable discharge power curve. When the SBC is below the preset lower limit... Set to zero or the minimum support power allowed in protection mode; when the state of charge is in the normal range, obtain the allowable release power according to the lookup table function. The allowable discharge power is determined based on the temperature-permissible discharge power curve of the buffer unit. When the temperature of the buffer unit exceeds the preset temperature threshold, the allowable discharge power is reduced according to the temperature derating curve; when the temperature exceeds the protection temperature threshold, the buffer unit is prohibited from being included in the releasable support power. The limit is output in real time by the BMS, supercapacitor management unit, energy storage converter, or buffer unit controller. If the safety execution controller does not receive the real-time limit within a preset time, it will use the preset conservative default value or set the releaseable support power of the buffer unit to zero.

[0088] The temperature derating factor can be calibrated based on the temperature-power derating curve or piecewise linear derating relationship of the target switching power supply. It's understood that the allowable output power of the target switching power supply varies at different temperatures; generally, the higher the temperature, the lower the allowable output power. During calibration, the temperature-power derating curve of the target switching power supply can be stored as a lookup table function, or a piecewise linear method can be used to determine the corresponding derating factor when the temperature falls within different ranges, thus ensuring that the temperature derating factor follows the actual temperature state of the target switching power supply. Specifically, calibration can be performed using the following formula: , in, This is the temperature derating factor. Switch the current temperature of the power supply to the target. The symbol is a function symbol, representing the temperature derating factor. The current temperature of the target power supply The function. When a complete temperature-power derating curve is not obtained, the safety actuator uses a piecewise linear derating method to determine the value. When the target switching power supply temperature is below the first temperature threshold. hour, Take the first preset value; when the target switching power supply temperature is higher than the second temperature threshold. hour, Take the second preset value; when the target switching power supply temperature is at... and In between, Linear interpolation is used to determine the value. The first preset value is greater than the second preset value.

[0089] The derating factor for response delay can be determined based on the target switching power supply's step power support test. During the test, a preset power support command can be issued to the target switching power supply without triggering protection. The time required for its output power to reach the preset proportion of the target value is recorded, and the maximum or percentile value among multiple test times is used as the response time basis. Based on this response time, combined with the power supply switching action delay and the buffer unit's allowable support time window, the derating factor that the target switching power supply needs to reduce due to response lag within the short-time switching window can be determined. Specifically, it can be calibrated according to the following formula: , in, In response to the delay derating factor, In response to the lower limit of the delay reduction factor, To address the response delay safety factor, Due to the delay in power supply switching action, To allow the buffer unit to support the time window, The response time required for a target power supply to switch from receiving a power support request to reaching the target output power. To obtain the maximum value, the controller was tested during the commissioning phase using a step power support test. Specifically, without triggering protection, a preset power support command is issued to the target switching power supply. The time required for the target switching power supply output power to reach 90% of the target value or a preset percentage is recorded, and the maximum value or percentile value from multiple tests is used as the reference value. The derating factor for communication status can be determined based on communication latency, packet loss rate, and checksum error rate. It's understandable that communication quality directly affects the real-time performance and accuracy of commands and feedback between the safety execution controller and the load drive unit and power supply switching unit. Higher communication latency, packet loss rate, or checksum error rate indicate less reliable communication conditions, requiring a corresponding increase in derating. During calibration, the communication latency, number of packet losses, and number of checksum errors within a certain control period can be statistically analyzed and combined with preset weights to form the communication status derating factor.

[0090] The derating factor for communication status can be determined based on communication latency, packet loss rate, verification error rate, and feedback timeout within a statistical window. Communication latency refers to the time elapsed for instruction or feedback transmission between the safety execution controller and the load drive unit or power supply switching unit; a higher latency indicates a less timely communication link. Packet loss rate refers to the proportion of data packets lost within a certain statistical period out of the total transmitted data packets; a higher packet loss rate indicates a less reliable communication link. Verification error rate refers to the proportion of received data that fails verification; a higher verification error rate indicates a greater possibility of data transmission interference or errors. Feedback timeout reflects the cumulative number of times feedback has not been received within a preset time. It is understandable that these communication quality indicators affect the timely acquisition and accurate judgment of load adjustment confirmation feedback and power supply switching side status feedback by the safety execution controller. Therefore, when calibrating the communication status derating factor, the above indicators can be comprehensively statistically analyzed and their respective weights combined to form the communication status derating factor. The worse the communication status, the lower the communication status derating factor. When calculating the conservatively supported power of the target switching power supply, its available capacity can be reduced accordingly to avoid overestimating the system's control over the switching process in unreliable communication situations. When the number of consecutive communication timeouts reaches a preset threshold, it indicates a serious anomaly in the current communication link, making it unsuitable to continue relying on communication feedback to advance the power switching process. The safety execution controller can set the communication status derating factor to the default value for communication anomalies and prohibit the generation of power switching execution permission signals. This avoids continuing to generate permission signals and execute electrical switching in cases of severe communication anomalies, untimely or potentially lost feedback, thereby reducing the risk of erroneous switching due to communication failures. Understandably, this default communication status value is usually more conservative than the coefficient obtained from normal calibration, and can even reduce the communication status derating factor to the lower limit, significantly reducing the conservatively supported power of the target switching power supply. This creates stronger constraints on source-side capability assessment and provides additional safety protection for the system. By determining the derating factor and handling anomalies in the communication state described above, the calibration process not only reflects the impact of communication quality on power support capability, but also triggers a permission prohibition mechanism when communication is severely abnormal, ensuring that the system will not abruptly switch power supply modes under unreliable communication conditions. Specifically, calibration can be performed according to the following formula: , in, This is the derating factor for communication status. This represents the lower limit of the derating factor for communication status. To calculate communication latency within the statistical window, To allow for maximum communication latency, For packet loss rate, To verify the error rate, , , These are the weighting coefficients. To take the maximum value. When the number of consecutive communication timeouts reaches a preset threshold, the safety execution controller will... Set to the default value for communication anomalies and disable the generation of power supply switching execution permission signals.

[0091] The calibration of safety factors and minimum safety margins can be determined based on bus voltage dips, peak currents, and the overload ratio of the target switching power supply under different load power change rates and power supply switching delays. It is understandable that these operating condition tests can cover adverse conditions such as rapid load changes and large switching delays. By recording transient response results under different operating conditions, a combination of safety factors can be selected that still covers the most unfavorable operating conditions without triggering overcurrent, undervoltage, overtemperature, and communication anomaly protections. For example, using safety factors... , , For example, safety factor , , The calibration process is determined through offline simulation, semi-physical testing, or on-site step condition testing. The calibration process includes: setting multiple sets of load power change rate, power supply switching delay, communication delay, and power sampling error conditions; recording the load bus voltage drop, peak current, target switching power supply overload ratio, and buffer unit voltage drop at the moment of switching; selecting a safety factor combination that can cover the most unfavorable conditions without triggering overcurrent, undervoltage, overload, and communication anomaly protection; writing the safety factor combination into the non-volatile memory of the safety actuator; and performing limited online correction of the safety factor during operation based on the actual peak current, minimum bus voltage, and power error after switching; the safety factor satisfies the following: .

[0092] The minimum safety margin can be determined based on power sampling error, the proportion of rated total power of continuous load, and on-site commissioning experience. This ensures that the system always retains a basic safety margin even when load changes are gradual or delays are short. Specifically, it can be calibrated according to the following formulas: , in, For minimum safety margin, , To preset a safety factor, Rated total power for continuous load, This is a safety margin for the project, set based on on-site commissioning experience. This refers to the power deviation that may be introduced during the power sampling process. To obtain the maximum value.

[0093] The stability confirmation time can be calibrated based on tests conducted under no-load switching, rated load switching, and the most unfavorable continuous load change conditions. In these tests, the transient decay process of the load bus voltage, current, and power after switching can be observed, and the time required to meet the stability conditions can be recorded. This time, combined with the control cycle, filter window time, and the number of cycles required to continuously meet the stability conditions, is used to comprehensively determine the stability confirmation time. The resulting stability confirmation time is adapted to the actual transient characteristics of the system, avoiding misjudgment of stability due to an excessively short setting, or affecting the timeliness of restorative power supply switching due to an excessively long setting. Specifically, it can be calibrated using the following formula: , in, To ensure stable confirmation time, To control the cycle, The number of cycles required to continuously satisfy the stability condition. The electrical transient decay time after power supply switching. For the state variable filtering window time, To obtain the maximum value. , and Before commissioning, the conditions are determined through no-load switching, rated load switching, and the most unfavorable continuous load change test.

[0094] Through the above parameter calibration process, the safety execution controller can perform operations such as matching parameter calculation, transient power gap judgment and stability confirmation according to the calibrated parameters in actual operation. After the accumulation of operating data, the relevant parameters are corrected online under limited conditions, thereby improving the system's adaptability to different operating conditions while maintaining the stability of the safety boundary.

[0095] In this embodiment, when it is detected that a flexible continuous load adjustment command has not been generated or that the flexible continuous load adjustment command has failed the continuous action constraint verification, the generation of a power supply switching execution permission signal is prohibited. When it is detected that a flexible continuous load adjustment command has been generated, and no continuous power adjustment confirmation feedback or executable status feedback is received within a preset waiting time, the generation of a power supply switching execution permission signal is delayed or prohibited. When it is detected that any of the following are abnormal: continuous power adjustment confirmation feedback is abnormal, executable status feedback is abnormal, transaction identifier mismatch is detected, load drive unit is faulty, power supply switching unit is faulty, or communication is abnormal, the incomplete command is revoked and the system enters a protection state. When it is detected that a flexible continuous load reduction command has been executed, and no power supply switching execution permission signal has been generated within a preset waiting time and the system has not entered a protection state, the flexible continuous load reduction command is revoked according to a preset recovery slope, so that the flexible continuous load gradually recovers to the power before reduction or the target power. The preset recovery slope is the minimum value among the maximum allowable recovery slope of the load, the process allowable recovery slope, and the current power supply allowable load recovery slope.

[0096] Specifically, during the safety authorization control process before power supply switching, the power supply switching execution authorization signal cannot be generated smoothly in all cases. When abnormalities occur in the generation, verification, issuance, or feedback confirmation of flexible continuous load regulation commands, the safety execution controller needs to take different handling methods, such as prohibition, delay, or cancellation, depending on the stage of the abnormality, to avoid continuing to advance electrical switching without meeting safety conditions. When it is detected that no flexible continuous load regulation command has been generated, or the flexible continuous load regulation command has not passed the continuous action constraint verification, it means that the load side has not yet formed a valid regulation command that can be bound to the power supply switching action. If the power supply switching execution authorization signal continues to be generated at this time, the subsequent binding of the same safety execution transaction and cross-side authorization decision will lose the load side basis. Therefore, the safety execution controller needs to prohibit the generation of the power supply switching execution authorization signal, so that the entire switching process stops before the authorization is generated, waiting for the next control cycle to re-perform the matching parameter judgment and regulation command generation. Failing the continuous action constraint verification can be understood as the target power, load reduction ratio, frequency, or current limit value in the regulation command exceeding the constraint range allowed by the load drive unit, or the regulation slope exceeding the maximum allowable rate of change of the load. Even if the command is issued, it cannot be reliably executed.

[0097] When a flexible continuous load adjustment command is detected to have been generated, but no continuous power adjustment confirmation feedback or executable status feedback is received within a preset waiting time, it indicates that the load side or power supply switching side has not yet returned feedback information proving its readiness. In this case, the safety execution controller cannot confirm whether the load drive unit has executed the adjustment command, nor can it confirm whether the power supply switching unit has entered the executable state. If a permission signal is generated immediately in this situation, electrical switching may be allowed without a clear understanding of the status on both sides. Therefore, the safety execution controller needs to delay generating the power supply switching execution permission signal, waiting for feedback to arrive in subsequent control cycles. If the required feedback is still not received within a longer period, the generation of the power supply switching execution permission signal is prohibited, preventing the current switching transaction from entering the electrical switching execution phase. When any of the following is detected: abnormal continuous power adjustment confirmation feedback, abnormal executable status feedback, mismatched transaction identifier, faulty load drive unit, faulty power supply switching unit, or communication anomaly, it indicates that the basic conditions on the load side or switching side upon which the current switching transaction depends are no longer reliable. Feedback anomalies can manifest as incomplete feedback content, incorrect feedback frame verification, or a mismatch between the instruction number in the feedback and the current transaction. A mismatched transaction identifier indicates that the returned feedback does not belong to the currently being processed safe execution transaction. A fault in the load drive unit or power supply switching unit means that the corresponding execution stage no longer possesses the capability for safe action. Communication anomalies may prevent the reliable transmission of subsequent instructions and feedback. In any of these situations, the safe execution controller must cancel the incomplete instruction and enter a protection state. Once in the protection state, the system will no longer attempt to complete the current switch but will instead transition to a safe state such as buffer support, fault protection, or manual takeover, depending on the actual operating conditions, to avoid damage to continuous loads and power supply equipment caused by electrical switching under abnormal circumstances. In addition to the above anomaly handling, a special recovery scenario needs to be considered: when a flexible continuous load reduction instruction has been executed, but the power supply switching execution permission signal fails to be generated within a preset waiting time, the system faces the situation where the load side has already completed the power reduction, but the power supply switching has not actually occurred. If the load remains at the low power level after load reduction for an extended period, it may affect the normal operation of the continuous load process. Therefore, provided that the system has not entered a protection state, the executed flexible continuous load load reduction command should be revoked according to the preset recovery slope, allowing the flexible continuous load to gradually recover to its pre-load reduction power or target power. Specifically, the recovery slope is calculated using the following formula: , in, To restore the slope, The maximum allowable recovery slope for the load. To allow for slope recovery in the process, The current allowable load recovery slope of the power supply. To minimize this value, when overcurrent, undervoltage, overtemperature, communication failure, load drive unit failure, power supply switching unit failure, or transaction number mismatch is detected, the safety execution controller cancels incomplete switching transactions, prohibits the generation of new power supply switching execution permission signals, and enters protection state, buffer support state, or manual takeover state. The setting of the recovery slope needs to consider the load's own allowable recovery capability, the process's tolerance for power recovery speed, and the load recovery rate that the current power supply can withstand. Therefore, the preset recovery slope can be the minimum value among the maximum allowable recovery slope of the load, the process-allowed recovery slope, and the current power supply's allowable load recovery slope. The maximum allowable recovery slope of the load is determined by the characteristics of the load drive unit and the load equipment itself. Excessive power recovery may cause current surges or mechanical stress on the load side. The process-permitted recovery slope is determined by the production process served by the continuous load; for example, heating, conveying, or pumping processes have their own control requirements for power recovery speed. The current power supply's allowable load recovery slope depends on whether the power supply currently bearing the load has sufficient capacity to follow the gradual recovery of the load power, avoiding overload or bus voltage drop on the power supply side due to excessive recovery. By taking the minimum of these three factors, it can be ensured that the load power recovery process will neither impact the load itself nor exceed the current power supply's capacity. Canceling the load reduction command does not instantly pull the load power back to the pre-load reduction level, but rather restores it gradually according to the preset recovery slope, keeping the load power change stable. This allows for timely removal of unnecessary load reduction on the load side before a permit signal is generated, and avoids introducing new transient disturbances during the recovery process. If the system has entered a protection state while waiting for a permit signal, the above recovery action will not be performed; instead, the control strategy under protection will be prioritized for safe handling.

[0098] Furthermore, the safety execution controller converts the verified final action into power supply switching commands, continuous power adjustment commands, load reduction commands, explicit power maintenance commands, permission gating signals, freeze-back signals, or protection shutdown commands, and sends them to the power supply switching unit, load drive unit, buffer unit controller, or upper-level monitoring system. The safety execution controller collects status feedback for the next cycle after execution, updates the status sequence, control permissions, switching timers, action constraint domains, load power adjustment mapping relationships, and safety execution transaction status, and enters the next control cycle.

[0099] In one specific embodiment, taking the switching power supply as the auxiliary power supply (i.e., switching from direct photovoltaic (PV) continuous load to auxiliary power supply) as an example, the system includes a 15kW programmable DC PV simulation source, a 15kW auxiliary power interface, a 2kW short-time buffer unit, a 4kW critical continuous load, a 6kW flexible continuous load, a power supply switching unit, a load drive unit, and a safety execution controller. The control cycle is 100ms, the electrical switching completion time of the power supply switching unit is 80ms, and the average time for command reception and feedback of the load drive unit is 35ms. An experimental setup is implemented to simulate a sudden drop in PV output, causing the system to switch from direct PV power supply to auxiliary power supply. After detecting a candidate switching action as "switching from direct PV power supply to auxiliary power supply," the safety execution controller calculates the conservatively supported power of the auxiliary power supply, the conservatively releaseable power of the buffer unit, the total power of the continuous load before the switch, and the safety margin. If a transient power shortfall exists, a load reduction command is generated based on the flexible continuous load power adjustment mapping relationship, and the same safety execution transaction number is assigned to the power supply switching action. After receiving the load reduction command, the load drive unit returns feedback indicating command number matching, controllable power regulation channel, valid current setpoint, and no fault. The power supply switching unit returns feedback indicating pending execution, operable, and no fault. When all the above feedbacks are satisfied, the safety execution controller generates a power supply switching execution permission signal, and the power supply switching unit completes the electrical switching.

[0100] In a specific embodiment, taking explicit power hold confirmation without transient power gap as an example, when the sum of the conservatively supportable power of the target switching power supply and the conservatively releaseable support power of the buffer unit is greater than the sum of the total power of the continuous load before the switch and the safety margin, the safety execution controller determines that the transient power gap is zero. At this time, the safety execution controller does not directly allow the power supply switch, but generates an explicit power hold command. The explicit power hold command carries the current power setting value, hold flag, feedback request flag, and command number. After receiving the explicit power hold command, the load drive unit returns a status indicating that the power adjustment channel is controllable, the current setting value is valid, there is no fault, and the corresponding command number. The safety execution controller then combines the feedback from the power supply switch side to generate a power supply switch execution permission signal. If the load drive unit does not return feedback, returns fault feedback, or the returned command number does not match the current safety execution transaction number, the safety execution controller prohibits the generation of the power supply switch execution permission signal and cancels the current switch transaction or enters a protection state.

[0101] In a specific embodiment, parameter calibration is taken as an example. Before the system is put into operation, the following calibration process is adopted: a step power support test is performed on the target switching power supply to obtain the response time. And calculate the response delay derating factor. Establish a temperature derating lookup table function based on the target switching power supply temperature-power curve. Under different communication loads, statistical analysis was conducted on communication latency, packet loss rate, and checksum error rate to establish a communication state derating function. Test the bus voltage drop, peak current, and target switching power supply overload ratio under different load power change rates and different power supply switching delays to determine the safety factor. , , The stability confirmation time was determined through rated load switching and worst-case load change tests. Write the above parameters into the non-volatile memory of the safety execution controller, and set the upper and lower limits for online correction.

[0102] In one specific embodiment, taking the post-switch freeze-back as an example, after the power supply mode switch is completed, the safety execution controller enters the stability confirmation phase. If the load bus voltage fluctuation, current fluctuation, load power change rate, buffer unit voltage recovery, and fault flag all meet the stability conditions within a continuous tstable time, the restorative power supply back-back freeze is lifted. If any condition is not met, the frozen restorative power supply back-back action is maintained, and the flexible continuous load power recovery is limited to the safe contraction range.

[0103] In one specific embodiment, the system includes a 15kW programmable DC green electricity simulation source, a 15kW auxiliary power interface, a 2kW short-time buffer unit, a 4kW critical continuous load, a 6kW flexible continuous load, a power supply switching unit, a load drive unit, and a safety execution controller. The control cycle is 100ms, the electrical switching completion time of the power supply switching unit is 80ms, and the average time for command reception and feedback of the load drive unit is 35ms. A sudden drop in green electricity output is set to switch the system from green electricity supply to auxiliary power supply. Under the experimental conditions of: DC bus nominal voltage 380V, system capacity 15kW, rated bus current 39.5A, critical continuous load 4kW, flexible continuous load 6kW, control cycle 100ms, and switching completion time 80ms, the experimental data obtained are shown in Table 1, including: Table 1 Comparison of Separate Execution Method and Bound License Execution Method

[0104] Table 1 shows that in the "switching first, then load reduction" method, the load power had not yet decreased at the moment of switching, the peak current reached 48.6A (approximately 1.23 times the rated bus current), the minimum bus voltage dropped to 342V, and overload protection was triggered 9 times in 50 tests. Although the "load reduction first, then switching" method issued the load reduction command first in the command sequence, it executed the switching without waiting for the load drive unit to return continuous power adjustment confirmation feedback. Therefore, the actual load reduction rate was only 62% in 50 tests, and overload protection was still triggered 2 times. This application binds the load reduction command and power supply switching action to the same safe execution transaction and requires feedback confirmation to be completed before electrical switching. The actual load reduction rate is 100%, the number of switching attempts without feedback confirmation is 0, the peak current drops to 28.5A at the moment of switching, the minimum bus voltage remains at 381V, and overload protection is not triggered. It is evident that the technical effect of this application does not solely come from adjusting the command sequence, but from the mandatory timing constraint between feedback confirmation and electrical switching.

[0105] Table 2 Experiments with explicit power preservation commands in gapless scenarios

[0106] The results in Table 2 show that when the transient power gap is zero, the explicit power hold command can include load drive channel abnormalities, invalid setpoints, or feedback loss in the permission decision, thus avoiding the mistaken assumption that the gap-free scenario is completely safe.

[0107] Table 3 Comparison between direct switching at the policy layer and permission switching at the security execution layer

[0108] The results in Table 3 show that the power supply mode switching action output by the control strategy generation module is only a switching intention and does not directly drive the power supply switching unit to complete the electrical switching. This can reduce the risk of erroneous switching under conditions of prediction uncertainty, communication abnormality, or load feedback abnormality.

[0109] In this embodiment, the control cycle Tctrl = 100ms, the number of cycles required to continuously meet the stability condition m = 6, the electrical transient decay time after power supply switching tsettle = 0.45s, the state variable filtering window time tfilter = 0.20s, and the stability confirmation time tstable = 0.60s is obtained by calibrating according to tstable = max{m·Tctrl,tsettle,tfilter}. The control group uses a fixed delay of 0.30s to determine stability and release the switchback freeze.

[0110] Table 4 Comparison of Simple Delayed Cutback and Multi-State Stable Confirmation Freeze Cutback

[0111] Table 4 shows that although the stable confirmation time tstable = 0.60s of this application is longer than the fixed delay of 0.30s in the control group, the number of secondary back-cuts in 30 tests decreased from 8 to 1 and the number of switching oscillations decreased from 6 to 0 because voltage fluctuation, current fluctuation, power change rate, and buffer unit voltage recovery are considered as continuous satisfaction conditions. The simple delayed back-cut, by prematurely unfreezing before the transient state has completely decayed, and the repeated back-cuts themselves prolong the overall recovery process, with an average stable recovery time of 1.42s, compared to 1.18s in this application. That is, although the continuous confirmation time required for a single determination increases, the overall stable recovery time of the system is shortened because repeated back-cuts are avoided.

[0112] This application provides a safety execution controller configured to execute the above-described safety permission control method before switching green electricity to continuous load power supply.

[0113] This application provides a safety clearance control system for green electricity direct-connection continuous load power supply switching, including: The aforementioned safety execution controller; New energy direct-connect power supply, auxiliary power supply, buffer unit, continuous load, load drive unit and power supply switching unit.

[0114] like Figure 3 As shown, a structural block diagram of a safety clearance control system for green electricity direct-connection continuous load power supply switching is provided. Figure 3 As shown, the safety clearance control system 300 for switching green electricity directly to continuous load power supply includes: Safety Controller 301; The system includes a new energy direct-connect power supply 302, an auxiliary power supply 303, a buffer unit 304, a continuous load 305, a load drive unit 306, and a power supply switching unit 307.

[0115] This technical solution, by clearly defining the direct coupling between renewable energy sources and continuous loads on the user side under green electricity direct connection, and by setting a safety permission control mechanism before power supply switching, transforms the problem from ordinary power source selection to source-load matching and electrical switching permission issues. By calculating the conservatively supportable power of the target power source, the conservatively releaseable support power of the buffer unit, the load power before switching, and the safety margin, it reduces the risks of transient power shortages, current surges, voltage drops, and target power source overload. Furthermore, by binding the power supply switching action with the load reduction command or explicit hold command to the same safety execution transaction, it reduces the time required for switching to occur before load reduction is confirmed. To mitigate the risk of misalignment, the system generates explicit power hold commands carrying setpoints, hold flags, feedback request flags, and command numbers, incorporating gapless scenarios into the load-side confirmation loop. By limiting strategy-level switching actions to switching intentions and having the safety execution controller generate independent execution permission signals, the system reduces the risk of erroneous switching due to model misjudgment, communication anomalies, or missing feedback. Stability confirmation is performed based on continuous satisfaction of multi-dimensional electrical quantities, with restorative back-switching frozen before stability is achieved, reducing the risk of switching oscillations and secondary back-switching. Finally, by setting parameter calibration and online correction processes, the system improves the repeatability and engineering adaptability of the solution.

[0116] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 4 As shown. The computer device includes a processor A01, a network interface A02, a memory (not shown), and a database (not shown) connected via a system bus. The processor A01 provides computing and control capabilities. The memory includes internal memory A03 and a non-volatile storage medium A04. The non-volatile storage medium A04 stores an operating system B01, a computer program B02, and a database (not shown). The internal memory A03 provides an environment for the operation of the operating system B01 and the computer program B02 stored in the non-volatile storage medium A04. The database stores data related to a safety clearance control method for green electricity direct connection to continuous load power supply switching. The network interface A02 communicates with external terminals via a network connection. When the computer program B02 is executed by the processor A01, it implements a safety clearance control method for green electricity direct connection to continuous load power supply switching.

[0117] Those skilled in the art will understand that Figure 4 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0118] This application provides a device including a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, it implements the steps of the safety permission control method before switching green electricity direct connection to continuous load power supply.

[0119] This application also provides a computer program product that, when executed on a data processing device, is suitable for performing the steps of the initialization method for safety clearance control before switching green electricity direct-connection continuous load power supply.

[0120] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0121] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0122] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0123] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0124] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0125] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, like read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0126] Computer-readable media include both permanent and non-permanent, removable and non-removable media that can store information by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0127] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0128] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A safety clearance control method for switching green electricity directly connected to a continuous load, applied to a safety execution controller, characterized in that, The method includes: The system acquires the operating status of the new energy direct-connected power supply, auxiliary power supply, buffer unit, continuous load, load drive unit and power supply switching unit, as well as candidate control actions including power supply mode switching actions. The new energy direct-connected power supply supplies power to the continuous load through the user-side direct connection line. The power supply mode switching action is only used as a switching intention input to the safety execution controller and cannot directly drive the power supply switching unit to complete electrical switching. When the candidate control action includes a power supply mode switching action, the matching parameters corresponding to the power supply mode switching action are determined according to the operating state. The matching parameters include at least the conservative support power of the target switching power supply, the conservative release support power of the buffer unit, the total power of the continuous load before switching, and the safety margin. The system determines whether a transient power gap exists based on the matching parameters and generates a corresponding flexible continuous load adjustment command based on the determination result. When a transient power gap exists, a flexible continuous load reduction command is generated; when there is no transient power gap, a flexible continuous load power maintenance command is generated. The power maintenance command is an explicit continuous power adjustment confirmation command. Configure the power supply mode switching action and the flexible continuous load adjustment command as the same safe execution transaction and associate them with the same safe execution transaction identifier, wherein the generation, issuance and feedback confirmation of the flexible continuous load adjustment command are completed before the power supply switching unit completes the electrical switching; Obtain continuous power adjustment confirmation feedback from the load driving unit corresponding to the safe execution transaction, and obtain executable status feedback from the power supply switching unit corresponding to the safe execution transaction; When both the continuous power adjustment confirmation feedback and the executable status feedback meet the corresponding preset permission conditions, and the safety execution transaction identifier in the continuous power adjustment confirmation feedback matches the current safety execution transaction identifier, and no overcurrent, undervoltage, overtemperature, communication abnormality or manual prohibition of switching flag is detected, a power supply switching execution permission signal independent of the power supply switching command itself is generated. When the power supply switching execution permission signal is valid, the power supply switching unit is allowed to complete the electrical switching corresponding to the power supply mode switching action.

2. The safety permission control method before switching green electricity direct-connection to continuous load power supply according to claim 1, characterized in that, Determining whether a transient power gap exists based on the matching parameters includes: The first value is obtained by summing the total power of the continuous load before the switch and the safety margin, and the second value is obtained by summing the conservatively supportable power of the target switching power supply and the conservatively releaseable support power of the buffer unit. When the first value is greater than the second value, it is determined that there is a transient power gap; When the first value is less than or equal to the second value, it is determined that there is no transient power gap.

3. The safety permission control method before switching green electricity direct-connection to continuous load power supply according to claim 1, characterized in that, When the candidate control action includes a power supply mode switching action, the matching parameters corresponding to the power supply mode switching action are determined based on the operating state, including: When the candidate control action includes a power supply mode switching action, the allowable support power of the target switching power supply in the current switching window is calculated based on the rated support power of the target switching power supply, the short-term overload support power of the target switching power supply within the preset switching window, and the allowable power corresponding to the protection limit of the target switching power supply. The conservatively supported power of the target switching power supply is calculated based on the temperature derating factor, response delay derating factor, communication status derating factor, and the allowable supported power and currently assumed power of the target switching power supply within the current switching window.

4. The safety permission control method before switching green electricity direct-connection to continuous load power supply according to claim 1, characterized in that, The power supply mode switching action and the flexible continuous load adjustment command are configured as the same secure execution transaction when all of the following conditions are met: The power supply mode switching action and the flexible continuous load adjustment command are assigned the same secure execution transaction identifier; Both the power supply switching command and the flexible continuous load adjustment command carry the safety execution transaction identifier. The power supply switching command is generated based on the power supply mode switching action and is used to send it to the power supply switching unit to control the power supply switching unit to perform electrical switching corresponding to the power supply mode switching action. The feedback frame returned by the load-driven unit contains the secure execution transaction identifier; The feedback frame returned by the power supply switching unit contains the secure execution transaction identifier or the pending execution status flag associated with the secure execution transaction identifier; The secure execution transaction identifier includes the control cycle number, switching action number, target power supply mode number, load adjustment instruction number, and check code.

5. The safety permission control method before switching green electricity direct-connection to continuous load power supply according to claim 1, characterized in that, The power supply switching execution permission signal includes a hardware permission output signal and / or a communication permission frame. When the power supply switching execution permission signal is valid, allowing the power supply switching unit to complete the electrical switching corresponding to the power supply mode switching action includes: When the power supply switching execution permission signal is a hardware permission output signal, the hardware permission output signal is received through the permission input terminal set by the power supply switching unit. When the hardware permission output signal is valid and the power supply switching unit itself meets the switching conditions, the power supply switching unit is allowed to complete the electrical switching corresponding to the power supply mode switching action. When the power supply switching execution permission signal is a communication permission frame, the power supply switching unit verifies the communication permission frame. If the communication permission frame passes the verification, the power supply switching unit is allowed to complete the electrical switching corresponding to the power supply mode switching action. The communication permission frame includes at least a security execution transaction identifier, a target power supply mode number, a permission validity flag, a timestamp, and a check code. When the power supply switching execution permission signal is a combination of a hardware permission output signal and a communication permission frame, and when the hardware permission signal is valid and the permission validity flag indicated by the communication permission frame is valid at the same time, the power supply switching unit is allowed to complete the electrical switching corresponding to the power supply mode switching action.

6. The safety permission control method before switching green electricity direct-connection to continuous load power supply according to claim 1, characterized in that, When the power supply switching execution permission signal is invalid, the execution drive of the power supply switching unit remains disabled, and the power supply switching unit is not allowed to complete electrical switching. The power supply switching execution permission signal is confirmed to be invalid if any of the following conditions are met: When the power supply switching execution permission signal is a hardware permission output signal and the hardware permission output signal is invalid; When the power supply switching execution permission signal is a communication permission frame, and the permission validity flag of the communication permission frame is invalid or the communication permission frame verification fails; When the power supply switching execution permission signal is a combination of a hardware permission output signal and a communication permission frame, and the hardware permission output signal is invalid or the communication permission frame fails verification.

7. The safety permission control method for switching green electricity directly connected to a continuous load power supply according to claim 1, characterized in that, The method further includes: After the power supply switching unit is allowed to complete the electrical switching corresponding to the power supply mode switching action, the load bus voltage fluctuation, load bus current fluctuation, load power change rate, buffer unit voltage, fault flag and communication status are continuously monitored. When it is detected that all stability confirmation conditions are met within the continuous stability confirmation time, the recovery power supply switch-back freeze is lifted. The stability confirmation conditions include at least the following: the load bus voltage fluctuation is less than the voltage fluctuation threshold, the load bus current fluctuation is less than the current fluctuation threshold, the load power change rate is lower than the power change rate threshold, the buffer unit voltage recovers to the preset safe range, no new overcurrent, undervoltage, overtemperature or communication abnormality flags are detected, the power supply switching unit status is consistent with the target power supply mode, and the load drive unit is in a controllable and fault-free state. If any stability confirmation condition is not met within the continuous stability confirmation time, the freeze recovery power supply is maintained and the continuous power regulation command is limited to the safe contraction range.

8. The safety permission control method before switching green electricity direct-connection to continuous load power supply according to claim 1, characterized in that, The method further includes a parameter calibration step, which includes: The allowable supporting power of the target switching power supply, the protection limit power of the target switching power supply, the protection limit power of the buffer unit, the temperature derating factor, the response delay derating factor, the communication status derating factor, the safety factor, the minimum safety margin, and the stability confirmation time are calibrated. The target switching power supply's allowable support power is determined based on the minimum value among the target switching power supply's rated support power, the short-time overload support power within the preset switching window, and the allowable power corresponding to the protection limit; the target switching power supply's protection limit power is determined based on at least two of the target switching power supply's overcurrent protection limit, undervoltage protection limit, temperature protection limit, and the rated limit of the power supply switching device; the buffer unit's protection limit power is determined based on at least two of the buffer unit voltage, protection allowable discharge current, state of charge constraint, temperature constraint, the current allowable discharge power output by the battery management system or energy storage management system, and the DC bus protection constraint. The temperature derating factor is determined based on the target switching power supply temperature-power derating curve or piecewise linear derating relationship; the response delay derating factor is determined based on the target switching power supply step power support test; the communication status derating factor is determined based on communication delay, packet loss rate, and verification error rate; the safety factor and minimum safety margin are determined based on bus voltage drop, current peak, and target switching power supply overload ratio under different load power change rates and different power supply switching delay conditions; the stability confirmation time is determined based on no-load switching, rated load switching, and most unfavorable continuous load change condition tests.

9. A safety execution controller, characterized in that, Configured to perform the safety permission control method for switching green electricity direct-connected continuous load power supply according to any one of claims 1 to 8.

10. A safety clearance control system for switching green electricity directly to a continuous load power supply, characterized in that, include: The safety execution controller according to claim 9; New energy direct-connect power supply, auxiliary power supply, buffer unit, continuous load, load drive unit and power supply switching unit.

Images