Intelligent closed-loop control method and system for PEM water electrolysis hydrogen production equipment

Abstract

The application discloses a kind of PEM water electrolysis hydrogen production equipment intelligent closed loop control method and system, it is related to intelligent control technical field, including: identifying the running stage of PEM water electrolysis hydrogen production equipment, calculating equipment state vector, generates PEM coupling constraint envelope;Based on equipment state vector, PEM coupling constraint envelope, running rule and historical similar working condition generation candidate strategy bag;Safety check is carried out to candidate strategy bag, only when all check through, form check strategy bag;The check strategy bag is written into candidate instruction data area, collate local safety interlocking state;The equipment response after executing acquisition check strategy bag is evaluated;When meeting preset condition, corresponding working condition data, check strategy bag and equipment response are associated and written into verified case library.The application can generate adaptive operation strategy, and also can block unsafe strategy, so that the generation basis, verification process, acceptance state and execution effect of multivariable strategy are traceable.

Description

Technical Field

[0001] This invention relates to the field of intelligent control technology, and in particular to an intelligent closed-loop control method and system for PEM water electrolysis hydrogen production equipment. Background Technology

[0002] Proton exchange membrane (PEM) water electrolysis hydrogen production equipment typically uses a programmable logic controller (PLC) to perform sequential control, PID regulation, and safety interlocks, with data monitoring by a host computer. Operating parameters are mainly adjusted based on fixed thresholds set during the design phase or the engineer's experience. However, under conditions of fluctuations in renewable energy input, frequent start-ups and shutdowns, changes in ambient temperature, and degradation of electrolyzer performance, fixed strategies struggle to promptly absorb historical operating patterns and coordinate across variables.

[0003] Existing technologies employ machine learning or model predictive control to regulate electrolyzer temperature, load, or water flow rate, but these primarily rely on dedicated predictive models for single or a few variables. While large models can explain complex operating conditions by incorporating operational rules, maintenance records, and historical cases, their outputs are probabilistic and may contain missing fields, incorrect units, or out-of-bounds values. Directly writing natural language results or values ​​generated by large models into the PLC output area introduces nondeterministic reasoning into the real-time control chain, potentially leading to risks such as temperature exceeding limits, insufficient water supply, abnormal pressure, excessive differential pressure across the membrane, or gas cross-permeation. Summary of the Invention

[0004] To address the shortcomings of existing technologies, the purpose of this invention is to provide an intelligent closed-loop control method and system for PEM water electrolysis hydrogen production equipment. This method can extract historical operating patterns using a local large model and generate adaptive operating strategies, and can also block unsafe strategies through deterministic mechanism constraints and PLC local safety interlocks. Furthermore, it makes the generation basis, verification process, acceptance status, and execution effect of multivariable strategies traceable.

[0005] To achieve the above objectives, the present invention is implemented through the following technical solution: In a first aspect, embodiments of the present invention provide an intelligent closed-loop control method for a PEM water electrolysis hydrogen production equipment, comprising: Identify the operating phases of the PEM water electrolysis hydrogen production equipment, calculate the equipment state vector, and generate the PEM coupling constraint envelope that changes with the operating phases. Based on the device state vector, PEM coupling constraint envelope, operating rules, and historical similar operating conditions, a candidate strategy package is generated. The candidate policy package is subjected to security verification, and a verification policy package is formed only when all verifications pass. The verification strategy package is written into the candidate instruction data area and the local security interlock status is checked. When the check is consistent and the local security interlock is permitted, the multiple set values ​​in the verification strategy package are atomically copied as a whole to the valid set value data area at the scan cycle boundary, and the adjustable actuator is driven through the basic control loop. The device response after the verification strategy package is executed is collected and evaluated; only when preset conditions are met, the corresponding operating condition data, verification strategy package and device response are associated and written into the verified case library for retrieval when generating subsequent candidate strategies.

[0006] As a further implementation, the timestamped operating data of the PEM water electrolysis hydrogen production equipment is acquired in real time, and the operating data is processed. The operating data includes at least the electrolytic cell electrical data, temperature data, anode-side pressure data, cathode-side pressure data, water supply data, gas quality data, alarm status, and feedback data from at least one adjustable actuator.

[0007] As a further implementation, the operation phase includes shutdown, startup preparation, load increase, steady state, load decrease, safe shutdown, and anomaly recovery; The device state vector includes at least the temperature change rate, pressure change rate, differential pressure margin across the membrane, voltage dispersion, water supply margin, and gas quality margin.

[0008] As a further implementation, the PEM coupling constraint envelope includes at least the allowable range of tank temperature, the upper limit of the rate of temperature rise or fall, the allowable range of anode-side pressure, the allowable range of cathode-side pressure, the upper limit of the absolute value of the differential pressure across the membrane, the lower limit of the water supply flow rate, and the upper limit of the gas quality, all related to the operating phase and the current load, and the allowable rate of change of at least one set value based on the sensor quality code or component health.

[0009] As a further implementation, the candidate strategy package is generated according to a preset machine-readable mode. The machine-readable mode defines the target variable identifier, value, engineering unit, allowable rate of change, retention time, applicable operating stage, preconditions and failure conditions for each candidate setting value, and defines the strategy sequence number, effective time window, data snapshot identifier and confidence information for the candidate strategy package.

[0010] As a further implementation, the security verification includes, in sequence, mode integrity verification, runtime permission verification, absolute boundary verification, rate of change verification, coupling interlocking verification, and communication health verification. In the absolute boundary verification and rate of change verification, slight out-of-bounds errors of individual candidate setpoints are pruned by projecting them into the PEM coupling constraint envelope; if there are pressure, temperature, flow, or power coupling conflicts among candidate setpoints, or if the overall consistency of the candidate strategy package cannot be maintained after pruning, the entire candidate strategy package is rejected.

[0011] As a further implementation, the verification strategy package, along with the data snapshot identifier, running stage identifier, constraint version identifier, strategy sequence number, and effective time window on which the verification strategy package is generated, are written together into the candidate instruction data area, and a writing completion flag, a cyclic redundancy check code, and a host computer heartbeat are attached. If the policy sequence number is not processed, the cyclic redundancy check is correct, the host computer heartbeat is valid, the current running stage is consistent with the running stage identifier, and the current time is within the valid time window, return the acceptance flag; otherwise, return the rejection flag and reason code.

[0012] As a further implementation, the preset conditions include at least: The execution feedback window reaches the preset duration; the effectiveness of key sensor data is higher than the threshold; there are no hard interlocks or manual emergency shutdowns during execution; the differential pressure across the membrane and the tank temperature are always within the safety envelope; and at least one of the following—unit hydrogen production energy consumption, power tracking error, temperature fluctuation, pressure fluctuation, or gas quality—has improved to the threshold relative to the baseline before execution.

[0013] Secondly, embodiments of the present invention also provide an intelligent closed-loop control system for a PEM water electrolysis hydrogen production device, including an embedded host computer and a programmable logic controller, wherein the embedded host computer and the programmable logic controller are communicatively connected. The programmable logic controller is configured to: when the local security interlock state is consistent and permitted, atomically accept the verification strategy packet at the scan cycle boundary and drive the adjustable actuator through the basic control loop; and reject the verification strategy packet and maintain baseline control when the check is inconsistent or the local security interlock is not permitted. The embedded host computer includes a data acquisition and management module, a working condition identification and feature calculation module, a local large model strategy generation module, a deterministic security verification module, a strategy communication module, and a feedback evaluation and management module.

[0014] As a further implementation, the data acquisition and treatment module is configured to: acquire timestamped operating data of the PEM water electrolysis hydrogen production equipment in real time, and treat the operating data; The operating condition identification and feature calculation module is configured to: identify the operating stage based on the operating data of the PEM water electrolysis hydrogen production equipment, calculate the equipment state vector, and generate the PEM coupling constraint envelope; The local large model strategy generation module is configured to generate candidate strategy packages based on the device state vector, PEM coupling constraint envelope, operating rules, and historical similar operating conditions. The deterministic security verification module is configured to: perform security verification on the candidate policy package in a verification process independent of the large model, and generate a verification policy package when all verifications pass; The policy communication module is configured to write the verification policy package into the candidate instruction data area; The feedback evaluation and management module is configured to write the execution fragment into the verified case library when preset conditions are met.

[0015] The beneficial effects of this invention are as follows: This invention constructs a fast-slow dual-timescale collaborative control architecture to deeply isolate the generation of nondeterministic large-scale model strategies from the deterministic PLC safety execution. On the embedded host computer side, data governance, operating condition identification, candidate strategy generation, and multi-dimensional deterministic safety verification are completed in seconds to minutes. On the PLC side, basic control and safety interlocks are executed in milliseconds to seconds. Through physical isolation between the candidate instruction data area and the effective setpoint data area, and a group atomic acceptance mechanism at the scanning cycle boundary, it ensures that multi-variable setpoints take effect synchronously and avoids cross-cycle transient conflicts. Simultaneously, a closed-loop feedback system based on a proven case library with preset admission conditions is established. Only strategies and operating condition data that have been executed and verified are used for subsequent large-scale model retrieval, forming accumulative and auditable operational knowledge. This technical solution can both extract historical operating patterns from the local large-scale model and generate adaptive operating strategies, and block unsafe strategies through deterministic mechanism constraints and PLC local safety interlocks. Furthermore, it makes the generation basis, verification process, acceptance status, and execution effect of multi-variable strategies traceable. Attached Figure Description

[0016] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0017] Figure 1 This is a block diagram of the control system according to one or more embodiments of the present invention; Figure 2 This is a flowchart of the control method of the present invention according to one or more embodiments; Figure 3 This is a flowchart of the deterministic security verification of candidate strategies according to one or more embodiments of the present invention; Figure 4 This is a diagram of PLC bidirectional handshake and atomic acceptance with identification verification according to one or more embodiments of the present invention; Figure 5This is a diagram illustrating the operating conditions of a PEM water electrolysis device according to one or more embodiments of the present invention. Figure 6 This is a flowchart of the execution feedback evaluation and case library update process according to one or more embodiments of the present invention. Detailed Implementation

[0018] It should be noted that the following detailed description is illustrative and intended to provide further explanation of the invention. Unless otherwise specified, all technical and scientific terms used in this invention have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0019] Example 1: The PEM water electrolysis hydrogen production equipment includes a rectifier power supply, a PEM electrolyzer, a circulating water supply unit, a gas-liquid separation unit, a thermal management unit, a pressure regulation unit, a hydrogen processing unit, and a safety interlock unit. A programmable logic controller (PLC) connects to these units via a sensor interface and to each adjustable actuator via an actuator interface. An embedded host computer communicates with the PLC via an industrial Ethernet network. This computer can be an industrial computer integrated with the equipment, running Windows or Linux systems, and operating in a completely isolated local environment from the public network.

[0020] The PLC internally sets up a real-time data area (DB_R), a candidate instruction data area (DB_C), a valid setpoint data area (DB_E), a handshake status area (DB_H), and an audit summary area (DB_A). DB_R stores measured values, quality codes, timestamps, operating stages, and interlocking states; DB_C allows writing from the host computer but is not directly connected to the physical output; DB_E can only be updated by the PLC's internal program when acceptance conditions are met and serves as the setting source for PID and sequential control; DB_H is used for bidirectional handshakes and status feedback; and DB_A records summary information of policy acceptance or rejection.

[0021] The embedded host computer includes a data acquisition adapter, timing buffer, deterministic analysis engine, local large model service, rule and constraint service, policy validator, PLC policy communication service, case library, and audit logs. The system can run completely offline; the model, rules, data, and logs are all stored on-site.

[0022] Based on the aforementioned PEM water electrolysis hydrogen production equipment, this embodiment provides an intelligent closed-loop control method for the PEM water electrolysis hydrogen production equipment, such as... Figure 2 As shown, it includes the following steps: S101. Acquire and manage operational data in real time.

[0023] In this embodiment, the PLC collects the operating data of the PEM water electrolysis hydrogen production equipment with a basic sampling period of 100 milliseconds and transmits it to the host computer via industrial Ethernet.

[0024] The embedded host computer's data acquisition adapter reads PLC data via PLC communication, OPC UA, or Modbus TCP, and forms aligned samples at 1-second intervals. Each sample point includes a value, engineering units, source timestamp, receive timestamp, and quality code. The quality code at least distinguishes between valid, out-of-range, communication hold, manual substitution, estimation, and unknown.

[0025] The operating data includes at least: electrolytic cell electrical data, such as the current, voltage, and power of the rectifier power supply, as well as the total voltage of the electrolytic cell and the voltage of a single cell; temperature data, such as the cell temperature; anode-side pressure data and cathode-side pressure data; water supply data, such as circulating water flow rate, makeup water flow rate, conductivity, and liquid level; gas quality data, such as oxygen content in hydrogen, hydrogen content in oxygen, hydrogen dew point, and hydrogen purity; alarm status; and feedback data from adjustable actuators such as circulating water pumps, makeup water valves, back pressure valves, cooling valves, cooling fans, gas-liquid separation control valves, and purge valves.

[0026] The embedded host computer performs time alignment and data quality marking on the operating data. For critical sensors, such as tank temperature, differential pressure across the membrane, and gas quality sensors, if their quality codes are invalid, model estimates are not used as replacements; instead, they are marked as missing and subsequent strategies are prohibited from accepting them. For non-critical variables used only for trend judgment, short-term hold or interpolation can be used if explicitly marked.

[0027] In this embodiment, an S7-1200 series programmable logic controller is used.

[0028] S102, Operating condition identification and equipment state vector calculation.

[0029] A working condition dataset is generated based on a sliding time window (e.g., the most recent 30 seconds). Working condition identification uses deterministic determination of PLC sequential status, contactor and valve status, power change rate, pressure build-up status, and duration.

[0030] Prioritize using status codes already confirmed by the PLC; when the PLC only provides basic statuses, the host computer supplements the identification through a rule-based state machine, identifying operating phases such as shutdown, start-up preparation, load increase, steady state, load decrease, safe shutdown, and abnormal recovery. State transitions must meet minimum dwell time and preconditions to avoid frequent state switching caused by measurement jitter.

[0031] like Figure 5 As shown, the shutdown state only allows for diagnosis and startup preparation; the startup preparation state requires the completion of self-checks for water supply, liquid level, gas circuit, and interlocks; the load increase and load decrease states use stricter constraints on power change rate, temperature rise rate, and differential pressure; the steady state allows for efficiency optimization; the abnormal recovery state only allows adjustments in the direction of risk reduction; and the system directly enters safe shutdown after a serious interlock is triggered.

[0032] Calculate the device state vector x(k), which includes at least the temperature change rate, pressure change rate, differential pressure margin across the membrane, voltage dispersion, water supply margin, and gas quality margin.

[0033] In this embodiment, let x(k) = [I,U,P,T,p_a,p_c,Δp,q_w,L,c_g,σ_U,r_T,r_p,m]^T, where I is the current, U is the voltage, P is the power, T is the tank temperature, p_a is the anode-side pressure, p_c is the cathode-side pressure, Δp = p_c - p_a is the differential pressure across the membrane; q_w is the water supply flow rate, L is the liquid level, c_g is the gas quality index, σ_U is the single-cell voltage dispersion, r_T is the temperature change rate, r_p is the pressure change rate, and m is the operating stage.

[0034] S103. Generate the PEM coupling constraint envelope and candidate policy package.

[0035] The rules and constraints service generates a PEM coupled constraint envelope C(m,b,h) that varies with the operating phase, load interval b, and device health or sensor reliability h. The constraint envelope contains a set of hard constraints and a set of soft optimizations.

[0036] Hard constraints include at least the allowable range of tank temperature, the upper limit of the rate of temperature rise or fall, the allowable range of anode-side pressure, the allowable range of cathode-side pressure, the upper limit of the absolute value of the differential pressure across the membrane, the lower limit of the water supply flow rate, and the upper limit of gas quality. Soft constraints include the recommended efficiency range, temperature and pressure fluctuation targets, and component lifespan costs. The constraint envelope is not a fixed rectangular boundary across all operating conditions. For example, during the start-up preparation phase when the pressure has not yet been established, a rapid increase in current is prohibited; during the load ramp-up phase, the allowable power increase is determined by the current tank temperature, water supply margin, and pressure build-up rate; when voltage dispersion increases or sensor quality deteriorates, the allowable operating space is reduced and the upper limit of the power change rate is lowered. The constraint version is determined by the equipment model, software version, engineer approval status, and effective date.

[0037] The local large model strategy generation module runs locally on the embedded host computer. Its input includes only numerical features obtained through deterministic calculation, fragments of operating rules, and historical similar operating conditions retrieved from a validated case library. Historical similar operating conditions are filtered and sorted according to equipment model, operating stage, load range, ambient temperature range, equipment state vector distance, constraint version, and maintenance status. The large model is prohibited from automatically generating sensor measurements or statistics for use as factual data.

[0038] The large model generates candidate strategy packages according to a preset machine-readable mode. The machine-readable mode specifies the target variable identifier, value, engineering units, allowable rate of change, hold time, applicable operating phase, preconditions, and failure conditions for each candidate setpoint. It also specifies the strategy sequence number, effective time window, data snapshot identifier, and confidence information for each candidate strategy package. A candidate strategy package can simultaneously contain multiple interrelated candidate setpoints, such as the rectifier power supply target power, target load ramp rate, circulating pump target frequency, cooling valve target opening, and back pressure valve target value. Natural language interpretation is only used as bypass audit information and is not entered into the PLC control fields.

[0039] This embodiment utilizes the PEM coupling constraint envelope relevant to the operational phase to simultaneously constrain temperature, pressure, differential pressure across the membrane, water supply, gas quality, and power, reducing the cross-variable risks caused by univariate optimization. A two-layer gating system is formed through machine-readable candidate strategies, independent deterministic verification, and PLC local interlocking, isolating the nondeterministic large model from real-time execution.

[0040] S104, Deterministic security check.

[0041] like Figure 3 As shown, the deterministic security verification module, independent of the large model, performs the following verifications in sequence: Schema integrity check: Checks field integrity, data type correctness, and engineering unit matching; rejects directly if schema parsing fails or engineering unit mismatch occurs.

[0042] Runtime Permission Verification: Based on the state permission matrix, determine whether the current runtime phase allows adjustment of the corresponding variables in the candidate policy package.

[0043] Absolute boundary verification: Each candidate setting value is compared with the hard boundary of the PEM coupling constraint envelope. For slight out-of-bounds errors of a single candidate setting value, it is clipped by projecting it into the constraint envelope.

[0044] Change rate verification: Verify whether the change rate of each candidate setting value meets the allowable change rate under the current operating stage and health status.

[0045] Coupling and Interlock Verification: Jointly calculate the impact of candidate setpoints on the safety margins of temperature, pressure, differential pressure, water supply, and gas quality. If there are coupling conflicts between candidate setpoints in terms of pressure, temperature, flow rate, or power, or if the overall consistency of the candidate strategy package cannot be maintained after trimming, then the entire candidate strategy package is rejected, rather than being forcibly executed after individual trimming.

[0046] Communication health check: Verifies the communication heartbeat, key data quality, and constraint version validity between the host computer and the PLC.

[0047] A verification strategy package is formed only when all verifications pass; if any verification fails, the current setting is maintained or the baseline control strategy in the PLC is switched. The strategy verifier outputs an accepted, projected, or rejected status and a reason code. Only the accepted status or the projected status after secondary verification can proceed to the subsequent PLC communication stage.

[0048] S105, PLC identification verification and atomic acceptance.

[0049] like Figure 4 As shown, the strategy communication module writes the verification strategy package, along with the data snapshot identifier, running phase identifier, constraint version identifier, strategy sequence number, and effective time window, into the candidate instruction data area DB_C of the PLC, and adds a write completion flag, a cyclic redundancy check code, and a host computer heartbeat.

[0050] After the PLC detects the new strategy sequence number, it copies DB_C to the internal temporary area within a scan cycle and checks the following in sequence: whether the cyclic redundancy check is correct; whether the strategy sequence number has not been processed; whether the host computer heartbeat is valid; whether the current running stage is consistent with the running stage identifier; whether the current time is within the valid time window; and whether the local safety interlock is permitted.

[0051] If all checks pass, the PLC atomically copies multiple setpoints from the temporary area to the valid setpoint data area DB_E at the boundary of the next scan cycle, records the accepted_sequence, and returns the ACCEPT flag. This prevents power, flow, temperature, and pressure-related setpoints from taking effect separately in different scan cycles, avoiding transient conflicts caused by multiple setpoints taking effect step-by-step across cycles. If the check fails, the REJECT flag and reason code are returned, but DB_E is not modified. If the host computer does not receive ACCEPT within a timeout period, it is not assumed that the strategy has been executed.

[0052] The PLC basic control loop drives at least one of the following components—rectifier power supply, circulating water pump, water supply valve, back pressure valve, cooling valve, cooling fan, gas-liquid separation control valve, and purge valve—at millisecond to second-level cycles based on the target value in DB_E. The basic control loop continues to execute PID control, sequential control, limiting, and hard interlocks; any hard interlock can override the target value in DB_E and trigger load reduction, holding, or safe shutdown. The slow-timescale strategy loop updates the target current, target power, target temperature, target pressure, load increase / decrease rate, or actuator target opening degree at second to minute-level cycles, without directly rewriting the safety interlock logic of the basic control loop.

[0053] S106, Feedback and Evaluation and Case Library Updates.

[0054] like Figure 6As shown, the system begins collecting data on the device response after execution once the PLC confirms ACCEPT and reports that the setpoints have taken effect. The evaluation module saves the baseline before execution, the trajectory during execution, and the stable window after execution, excluding incomparable segments caused by external power surges, manual operation, or sensor malfunctions.

[0055] The evaluation should assess at least one of the following before and after execution: unit hydrogen production energy consumption, hydrogen production, temperature stability, pressure stability, membrane differential pressure margin, and gas quality. Preset entry conditions should include at least: the execution feedback window reaches a preset duration; the effectiveness rate of key sensor data exceeds a threshold; there are no hard interlocks or manual emergency shutdowns during execution; the membrane differential pressure and tank temperature remain within the safety envelope; and at least one of the following—unit hydrogen production energy consumption, power point tracking error, temperature fluctuation, pressure fluctuation, or gas quality—has improved by a threshold relative to the pre-execution baseline.

[0056] Only when data quality meets requirements, no safety interlocks are triggered during execution, and the evaluation results meet preset admission criteria, will the corresponding operating condition data, verification strategy package, and equipment response be associated and written into the verified case library for retrieval during subsequent candidate strategy generation. Execution segments that do not meet the admission criteria will only be written into the isolated audit library and will not participate in subsequent candidate strategy retrieval, thus preventing unverified model outputs from being continuously amplified through the feedback chain.

[0057] Validated cases are stored as immutable records, including data snapshot hashes, policy packages, PLC acceptance sequences, constraint versions, device responses, admission decisions, and approval status. After model upgrades, rule upgrades, or major device maintenance, old cases can be isolated by version or their sorting weight can be reduced.

[0058] When the local large model is unavailable, communication between the embedded host computer and the PLC times out, the quality code of a key sensor is invalid, the policy is continuously rejected to the threshold, the current state enters a safe shutdown, or the operator gains control, the system prohibits the acceptance of new candidate policy packages and switches to the most recently verified setpoint, the PLC baseline control policy, or the safe shutdown policy without disturbance. The rollback state machine includes at least the AI_ENABLED, AI_HOLD, BASELINE, and SAFE_SHUTDOWN states. During the switch, the effective setpoint is smoothly transferred to the baseline value through the PLC's internal ramp or tracking function to avoid abrupt changes.

[0059] The embedded host computer runs in a local environment isolated from the public network, storing large model files, operating rules, a verified case library, data snapshots, candidate strategy packages, verification results, PLC acceptance or rejection results, and device responses; it records the model version, rule version, constraint version, operator, and timestamp for each strategy execution to form a traceable audit chain.

[0060] This embodiment constructs a fast and slow dual-timescale collaborative control architecture to deeply isolate the generation of nondeterministic large-scale model strategies from the deterministic PLC safe execution: on the embedded host computer side, data governance, operating condition identification, candidate strategy generation, and multi-dimensional deterministic safety verification are completed in seconds to minutes; on the PLC side, basic control and safety interlocks are executed in milliseconds to seconds. Through physical isolation between the candidate instruction data area and the valid setpoint data area, and a whole-group atomic acceptance mechanism at the scanning cycle boundary, it ensures that multi-variable setpoints take effect synchronously and avoids cross-cycle transient conflicts. Simultaneously, a closed-loop feedback system based on a proven case library with preset admission conditions is established, using only executed and verified strategies and operating condition data for subsequent large-scale model retrieval, forming accumulative and auditable operational knowledge.

[0061] Therefore, this approach fully leverages the local large-scale model's ability to extract historical operating patterns to generate adaptive operating strategies. Furthermore, it employs multi-layered safety protection through PEM coupling constraint envelopes, independent deterministic verification, and PLC local hard interlocking, effectively isolating non-deterministic reasoning from the real-time execution link. This not only solves the technical problem of fixed control strategies being unable to adapt to renewable energy fluctuations, frequent start-ups and shutdowns, and equipment degradation, but also effectively avoids transient conflicts and the risk of expired strategies being misexecuted due to step-by-step writing of multiple setpoints. It ensures the safe and stable operation of the PEM electrolyzer under multi-variable coupling conditions of temperature, pressure, differential pressure across the membrane, water supply, and gas quality, achieving continuous accumulation of auditable and reversible operating patterns and optimization of system energy efficiency.

[0062] Example 2: This embodiment provides an intelligent closed-loop control system for a PEM water electrolysis hydrogen production equipment, such as... Figure 1 As shown, it includes a programmable logic controller, an embedded host computer, a sensor interface, and an actuator interface. The embedded host computer includes a data acquisition and management module, a working condition identification and feature calculation module, a local large model strategy generation module, a deterministic safety verification module, a strategy communication module, and a feedback evaluation and management module.

[0063] Furthermore, the data acquisition and management module is configured to: acquire timestamped operating data from the PLC via the acquisition adapter, and perform time alignment, quality marking, and sliding time window organization. The operating condition identification and feature calculation module is configured to: identify the operating stage based on electrical, temperature, anode-side pressure, cathode-side pressure, water supply, and gas quality data; calculate the equipment state vector including temperature change rate, pressure change rate, differential pressure margin across the membrane, voltage dispersion, water supply margin, and gas quality margin; and generate a PEM coupling constraint envelope that varies with the operating stage.

[0064] The local large-scale model strategy generation module is configured to generate candidate strategy packages containing multiple interrelated setpoints based on the device state vector, PEM coupling constraint envelope, operating rules, and historical similar operating conditions, in a preset machine-readable mode. Each candidate strategy package includes at least two of the following: target current or target power, load ramp rate, target temperature, target pressure, and corresponding actuator setpoints. It also includes the permissible rate of change for each candidate setpoint, the strategy's effective time window, and strategy confidence information.

[0065] The deterministic security verification module is configured to perform pattern integrity verification, runtime permission verification, absolute boundary verification, rate of change verification, coupling interlocking verification, and communication health verification on candidate policy packages in a verification process independent of the large model; and generate a verification policy package only when all verifications pass.

[0066] The strategy communication module is configured to write the verification strategy package, along with the data snapshot identifier, running phase identifier, constraint version identifier, strategy sequence number, and effective time window, into the candidate instruction data area DB_C of the PLC, and to attach a write completion flag, a cyclic redundancy check code, and a host computer heartbeat.

[0067] The programmable logic controller (PLC) is configured to: when the identifier verification is consistent and the local safety interlock is permitted, atomically copy multiple setpoints from the verification strategy package as a whole to the valid setpoint data area DB_E at the scan cycle boundary, and drive at least one of the following via the basic control loop: rectifier power supply, circulating water pump, water supply valve, back pressure valve, cooling valve, cooling fan, gas-liquid separation control valve, and purge valve. When the verification is inconsistent or the local safety interlock is not permitted, reject the verification strategy package and maintain baseline control.

[0068] The candidate instruction data area DB_C and the valid setpoint data area DB_E are isolated from each other. DB_E can only be updated by the PLC's internal program when the acceptance condition is met, and is not directly written to by the embedded host computer. The PLC includes hard-locking logic, a policy watchdog, and a rollback state machine independent of the embedded host computer. When the embedded host computer loses power, experiences a process abnormality, or communication is interrupted, the PEM water electrolysis hydrogen production equipment still maintains baseline control or executes a safety shutdown by the PLC to ensure system fault safety.

[0069] The control system in this embodiment employs a two-level control system—fast and slow—that operates in isolation but collaboratively. The basic control loop in the PLC executes PID regulation, sequential control, and safety interlocks at millisecond to second-level cycles. The local large-scale model strategy generation module and the deterministic safety verification module run in the embedded host computer at second to minute-level cycles. The slow-timescale strategy loop updates the target current, target power, target temperature, target pressure, load increase / decrease rate, or actuator target opening, but does not directly rewrite the safety interlock logic of the basic control loop. The large model does not modify the PLC program, nor does it directly write data into the valid setpoint data area DB_E.

[0070] The feedback evaluation and management module is configured to: collect equipment responses after the execution of the verification strategy package, and evaluate at least one of the following before and after execution: unit hydrogen production energy consumption, hydrogen production, temperature stability, pressure stability, differential pressure margin across the membrane, and gas quality. Only execution segments that meet the data quality, safety interlock, and performance improvement admission criteria are written to the verified case library; execution segments that do not meet the admission criteria are written to the isolated audit library and do not participate in subsequent candidate strategy retrieval.

[0071] In load escalation control scenarios under fluctuating power supplies, the PLC maintains a 100-millisecond base cycle, while the host computer formulates a strategy every 30 seconds. When available power increases, the state machine enters the load escalation phase; the local large model searches for empirical cases under similar loads, ambient temperatures, and health conditions, suggesting target power, power change rate, circulating pump frequency, and cooling valve opening. The deterministic safety verification module narrows down the action space based on the current temperature rise rate, water supply margin, and differential pressure margin. The entire PLC is activated upon acceptance; if pressure build-up lag causes a decrease in differential pressure margin, the PLC local interlock immediately suspends the load escalation without waiting for the next model inference.

[0072] In steady-state energy consumption optimization scenarios, after the equipment enters steady state and maintains it for a preset time, the large model proposes minor adjustments to the circulating water and cooling settings based on the nearest window and similar cases to reduce the energy consumption per unit of hydrogen production within temperature and gas quality constraints. The deterministic safety verification module limits the amplitude of single-cycle actions and the minimum holding time to avoid back-and-forth oscillations. After execution, the normalized energy consumption, temperature standard deviation, and pressure standard deviation are compared under the same load; only when improvements are sustained across multiple evaluation windows without interlocking events are the results written into the validated case library.

[0073] In equipment degradation adaptation scenarios, if the single-cell voltage dispersion or the same-load tank voltage increases over a long period, the deterministic analysis engine reduces health. The constraint service then tightens the load ramp rate and maximum recommended load, and requires a higher water supply margin. Large models can retrieve validated cases before and after maintenance to propose conservative strategies and inspection recommendations, but must not deactivate hard interlocks or increase engineer-approved rating boundaries.

[0074] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A smart closed-loop control method for a PEM water electrolysis hydrogen production equipment, characterized in that, include: Identify the operating phases of the PEM water electrolysis hydrogen production equipment, calculate the equipment state vector, and generate the PEM coupling constraint envelope that changes with the operating phases. Based on the device state vector, PEM coupling constraint envelope, operating rules, and historical similar operating conditions, a candidate strategy package is generated. The candidate policy package is subjected to security verification, and a verification policy package is formed only when all verifications pass. The verification strategy package is written into the candidate instruction data area and the local security interlock status is checked. When the check is consistent and the local security interlock is permitted, the multiple set values ​​in the verification strategy package are atomically copied as a whole to the valid set value data area at the scan cycle boundary, and the adjustable actuator is driven through the basic control loop. The device response after the verification strategy package is executed is collected and evaluated; only when preset conditions are met, the corresponding operating condition data, verification strategy package and device response are associated and written into the verified case library for retrieval when generating subsequent candidate strategies.

2. The intelligent closed-loop control method for a PEM water electrolysis hydrogen production equipment according to claim 1, characterized in that, Real-time acquisition of timestamped operating data of the PEM water electrolysis hydrogen production equipment, and processing of the operating data; The operating data includes at least the electrolytic cell electrical data, temperature data, anode-side pressure data, cathode-side pressure data, water supply data, gas quality data, alarm status, and feedback data from at least one adjustable actuator.

3. The intelligent closed-loop control method for a PEM water electrolysis hydrogen production equipment according to claim 1, characterized in that, The operation phase includes shutdown, startup preparation, load increase, steady state, load decrease, safe shutdown, and abnormal recovery; The device state vector includes at least the temperature change rate, pressure change rate, differential pressure margin across the membrane, voltage dispersion, water supply margin, and gas quality margin.

4. The intelligent closed-loop control method for a PEM water electrolysis hydrogen production equipment according to claim 1 or 3, characterized in that, The PEM coupling constraint envelope includes at least the allowable range of tank temperature, the upper limit of the rate of temperature rise or fall, the allowable range of anode side pressure, the allowable range of cathode side pressure, the upper limit of the absolute value of the differential pressure across the membrane, the lower limit of the water supply flow rate, and the upper limit of the gas quality, all related to the operating phase and the current load, and the allowable rate of change of at least one set value based on the sensor quality code or component health.

5. The intelligent closed-loop control method for a PEM water electrolysis hydrogen production equipment according to claim 1, characterized in that, The candidate strategy package is generated according to a preset machine-readable mode. The machine-readable mode defines the target variable identifier, value, engineering unit, allowable rate of change, retention time, applicable operating stage, preconditions and failure conditions for each candidate setting value, and defines the strategy sequence number, effective time window, data snapshot identifier and confidence information for the candidate strategy package.

6. The intelligent closed-loop control method for a PEM water electrolysis hydrogen production equipment according to claim 1, characterized in that, The security checks include, in sequence, mode integrity checks, operational phase permission checks, absolute boundary checks, rate of change checks, coupling interlock checks, and communication health checks. In the absolute boundary verification and rate of change verification, slight out-of-bounds errors of individual candidate setpoints are pruned by projecting them into the PEM coupling constraint envelope; if there are pressure, temperature, flow, or power coupling conflicts among candidate setpoints, or if the overall consistency of the candidate strategy package cannot be maintained after pruning, the entire candidate strategy package is rejected.

7. The intelligent closed-loop control method for a PEM water electrolysis hydrogen production equipment according to claim 1, characterized in that, The verification strategy package, along with the data snapshot identifier, running phase identifier, constraint version identifier, strategy sequence number, and effective time window on which the verification strategy package is generated, are written together into the candidate instruction data area, and a writing completion flag, a cyclic redundancy check code, and a host computer heartbeat are attached. If the policy sequence number is not processed, the cyclic redundancy check is correct, the host computer heartbeat is valid, the current running stage is consistent with the running stage identifier, and the current time is within the valid time window, return the acceptance flag; otherwise, return the rejection flag and reason code.

8. The intelligent closed-loop control method for a PEM water electrolysis hydrogen production equipment according to claim 1, characterized in that, The preset conditions include at least the following: The execution feedback window reaches the preset duration; the effectiveness of key sensor data is higher than the threshold; there are no hard interlocks or manual emergency shutdowns during execution; the differential pressure across the membrane and the tank temperature are always within the safety envelope; and at least one of the following—unit hydrogen production energy consumption, power tracking error, temperature fluctuation, pressure fluctuation, or gas quality—has improved to the threshold relative to the baseline before execution.

9. An intelligent closed-loop control system for a PEM water electrolysis hydrogen production equipment, characterized in that, It includes an embedded host computer and a programmable logic controller (PLC), wherein the embedded host computer and the PLC are communicatively connected; The programmable logic controller is configured to: when the local security interlock state is consistent and permitted, atomically accept the verification strategy packet at the scan cycle boundary and drive the adjustable actuator through the basic control loop; and reject the verification strategy packet and maintain baseline control when the check is inconsistent or the local security interlock is not permitted. The embedded host computer includes a data acquisition and management module, a working condition identification and feature calculation module, a local large model strategy generation module, a deterministic security verification module, a strategy communication module, and a feedback evaluation and management module.

10. The intelligent closed-loop control system for a PEM water electrolysis hydrogen production equipment according to claim 9, characterized in that, The data acquisition and processing module is configured to: acquire timestamped operating data of the PEM water electrolysis hydrogen production equipment in real time, and process the operating data; The operating condition identification and feature calculation module is configured to: identify the operating stage based on the operating data of the PEM water electrolysis hydrogen production equipment, calculate the equipment state vector, and generate the PEM coupling constraint envelope; The local large model strategy generation module is configured to generate candidate strategy packages based on the device state vector, PEM coupling constraint envelope, operating rules, and historical similar operating conditions. The deterministic security verification module is configured to: perform security verification on the candidate policy package in a verification process independent of the large model, and generate a verification policy package when all verifications pass; The policy communication module is configured to write the verification policy package into the candidate instruction data area; The feedback evaluation and management module is configured to write the execution fragment into the verified case library when preset conditions are met.

Images