An electrolysis system, a method for operating an electrolysis system, a computer program, a computer-readable storage medium, a controller and an electrical power system

Abstract

The present invention relates to an electrolysis system (1) comprising an electrolyzer (3) and an electrolyzer power supply system (2) that is adapted to receive an electrical power input (6, 8) for the electrolyzer (3) from an electrical network (7) and a controller that is adapted to detect a fault event of the electrical network (7) when an network voltage (9) of the electrical network (7) leaves a tolerance band (10) around a reference network voltage (11) of the electrical network (7), wherein the controller is further adapted to allow or tolerate a violation of an operational threshold by an operating parameter of the electrolysis system (1) for a predetermined duration when the network voltage (9) is outside the tolerance band (10) and within a stability range20 (12) from the reference network voltage (11).

Description

[0001] 2024PF00296 Subsequent Filing Version

[0002] 1

[0003] Description

[0004] An electrolysis system, a method for operating an electrolysis system, a computer program, a computer-readable storage medium, a controller and an electrical power system

[0005] Technical Field

[0006] The present invention relates to an electrolysis system, a method for operating an electrolysis system, a computer program, a computer-readable storage medium, a controller and an electrical power system comprising said electrolysis system and / or said controller .

[0007] Technological Background

[0008] Current electrolysis systems consist mainly of a trans former unit , recti fier units operating in parallel , and the electrolysis module rows connected to the direct current side of the recti fiers . Connecting large electrolysis systems to the public electrical network requires compliance with local network code requirements . Part of these requirements , especially for large electrolysis systems , is fault ride through capability . The typical core requirement is to remain fully connected to the electrical network in the event of a temporary voltage dip in the electrical network . Longer or deeper voltage dips allow the electrolysis system to be disconnected . Similar requirements apply to transient voltage spikes . Meeting this requirement is a challenge for the electrolysis system and its converter systems .

[0009] Important for the grid operator is the availability of an electrical load after the fault has been cleared, the so- called post- fault recovery behavior . I f a large electrolysis system were to shut down in the event of a short-term disturbance in the electrical network, the network operator would have di f ficulty balancing the power inside his network after the disturbance has been cleared . Therefore , only a certain amount of the electrical load consuming electrical 2024PF00296 Subsequent Filing Version power from the electrical network is allowed to be disconnected from the electrical grid and it is furthermore essential for network stability that large electrical loads remain connected i f the allowed operational voltage band from a reference voltage is violated .

[0010] Saha et al . , "Enabling LVRT Compliance of Electrolyzer Systems Using Energy Storage Technologies" , Batteries vol . 9 , no . 11 , Basel , October 2023 , discloses an enabling of LVRT compliance of electrolyzer systems using energy storage technologies .

[0011] US 2021 / 0363651 Al discloses a multi-stage DC power distribution system . CN 116 683 751 A discloses an AC / DC power supply and a low voltage ride-through control method thereof . US 5 572 138 A discloses a method and device for determining the direction to a fault on a power transmission line .

[0012] Boemer et al . , "Response of wind power park modules in distribution systems to transmission network faults during reverse power flows" , IET Renewable Power Generation, vol . 9 , no . 8 , The Institution of Engineering and Technology, November 2015 , discloses a response of wind power park modules in distribution systems to transmission network faults during reverse power flows .

[0013] CN 118 028 900 A discloses a multi-electrolytic cell seriesparallel hydrogen production control method and power generation system .

[0014] Summary of the invention

[0015] It is thus an obj ect of the present invention to provide an improved electrolysis system and an improved method for operating the electrolysis system that particularly improves the network stability .

[0016] A solution is provided by the subj ect matter according to the independent claims . Advantageous additional embodiments of 2024PF00296 Subsequent Filing Version the invention are described by the dependent claims , the following description and the figures .

[0017] The invention relates to an electrolysis system comprising an electrolyzer power supply system and an electrolyzer, wherein the electrolyzer power supply system comprises at least one trans former unit and a converter and is adapted to receive an alternating current electrical power input from an electrical network and to convert the alternating current electrical power input into a direct current electrical power input for the electrolyzer, which is adapted to convert the direct current electrical power input into an energy carrier, further comprising a controller, particularly an electrolyzer power supply system controller and / or an electrolyzer controller, that is adapted to detect a fault event of the electrical network when a network voltage of the electrical network leaves a tolerance band around a reference network voltage of the electrical network .

[0018] The controller is adapted to allow a violation of an operational threshold by an operating parameter, particularly of the electrolyzer power supply system and / or of the electrolyzer, for a predetermined duration when the network voltage is outside the tolerance band and within a stability range from the reference network voltage .

[0019] According to the invention, the allowing comprises blocking and / or delaying an action that is triggered by the violation of the operating parameter .

[0020] In other words , the converter may be adapted to tolerate or ignore a violation of the operational threshold by the operating parameter . Tolerating and / or allowing may comprise detecting or ignoring the violation of the operational threshold by the operating parameter . . The delay of the action may be at least partly for the predetermined duration . For example , a time constant of a control loop may be delayed . The predetermined duration may correspond to a maximum duration 2024PF00296 Subsequent Filing Version of the violation by the operating parameter, when the network voltage has got a value of reference value plus or minus the stability range such that a component of the electrolysis system may not be damaged .

[0021] The operating parameter may be of the electrolysis system or any component thereof , particularly of the electrolyzer power supply system and / or of the electrolyzer and / or of an auxiliary system .

[0022] The tolerance band around the reference network voltage may be an interval of the operating parameter, wherein no action of the electrolysis system may take place . For example , the tolerance band may have an interval between 85% to 115% or 90% to 110% of the reference network voltage , wherein optionally the edge values of the respective interval may be included . The stability range from the reference network voltage may be larger than the tolerance band . When the network voltage leaves the stability range , the electrolysis system may shut down . The stability range may be limited by a low voltage fault ride through and / or a high voltage fault ride through voltage characteristic .

[0023] The electrolyzer power supply system may be adapted to receive the alternating current electrical power input from an electrical network, particularly via a point of connection, and to convert the alternating current electrical power input into the direct current electrical power input for the electrolyzer and additionally be adapted to provide the electrical power input to the electrolyzer . Here , the converter may be adapted to convert the alternating current electrical power input into the direct current electrical power input for the electrolyzer and optionally to drop and / or boost a direct voltage of the direct current electrical power input . The electrolyzer may be adapted to produce an energy carrier, such as hydrogen, using the electrical power input . The electrical network may be adapted to electrically connect a plu- 2024PF00296 Subsequent Filing Version rality of electrical power sources to a plurality of electrical loads such as the electrolysis system in a network operation mode . Alternatively, the electrical network may comprise an electrical connection between an electrical power source and the electrolysis system in an island operation mode .

[0024] This provides the technical ef fect that the electrolysis system can continue to operate as an electrical load when the network voltage fluctuates and leaves the tolerance band . Those violations of the operational threshold by the operating parameter are allowable as they remain in a predictable range . By this , the electrolysis system may contribute to a stability of the electrical network .

[0025] The electrolyzer power supply system also includes embodiments by which additional advantages are obtained .

[0026] In one embodiment , the controller is adapted to detect the fault event of the electrical network when a rate of change of the network voltage and a rate of change of a network current received by the electrolyzer power supply system from the electrical network via a point of connection of the electrolyzer power supply system to the electrical network both have a same direction and / or when a rate of change of the network voltage and a rate of change of the network current transmitted to the electrical network via the point of connection both have a di f ferent direction, particularly in at least two current carrying phases of the point of connection, and / or the controller is adapted to detect an internal fault when the rate of change of the network voltage and the rate of change of the network current received by the electrolyzer power supply system from the electrical network both have a di f ferent direction, particularly in the at least two current carrying phases of the point of connection .

[0027] In other words , the controller may be adapted to measure , particularly at the point of connection, and compare the sign 2024PF00296 Subsequent Filing Version

[0028] ( direction) of the respective rate of change — and — and determine the fault event of the electrical grid i f — < 0 and dt

[0029] — < 0 or — > 0 and — > 0, particularly when the electrolysis dt dt dt system may operate as an electrical load . Here , the respective sign may indicate the direction of the respective rate of change .

[0030] Here , U may denote the network voltage and I may denote the network current which may be received by the electrolysis system from the electrical network .

[0031] Additionally, or alternatively, the controller may be adapted to determine an internal fault of the electrolysis system i f — < 0 and — > 0, particularly when the electrolysis system may operate as an electrical load .

[0032] Additionally, or alternatively, the controller of an electrical power source may be adapted to determine the fault event of the electrical grid i f ^ < 0 and > 0, particularly when the electrolysis system may operate as an electrical power source due to a surplus of a plant-internal power generation .

[0033] Additionally, the controller may be adapted to determine the sign of and in at least two current carrying phases of a multi-phase system such as a three-phase system, wherein the current carrying phases electrically connect the electrolysis system to the electrical network . Thus , when the fault event of the electrical network 7 or the internal fault event of the electrolysis system 1 is respectively determined in at least two current carrying phases , the fault event of the electrical network 7 or the internal fault event of the electrolysis system 1 may be determined for the multi-phase system as a whole .

[0034] This provides the advantage that the fault event of the electrical network may be detected quickly and reliably and may further be distinguished from an internal fault . 2024PF00296 Subsequent Filing Version

[0035] 7

[0036] In one embodiment , the trans former unit optionally comprises an on-load tap changer and the controller is adapted to change a switching state of the on-load tap changer and / or the controller is adapted to alter a conversion rate of the converter for adj usting the direct current electrical power input of the electrolyzer corresponding to the network voltage of the electrical network when the network voltage is outside the tolerance band and within the stability range from the reference network voltage , particularly longer than the predetermined duration .

[0037] In other words , the controller may be adapted to increase or decrease an alternating voltage on an alternating current side of the converter by changing the switching state of the on-load tap changer corresponding to the network voltage , particularly when the network voltage is inside the tolerance band or inside the stability range and outside of the tolerance band . For example , i f the network voltage drops , the controller may be adapted to increase the alternating voltage and vice versa .

[0038] Additionally, or alternatively, the controller may be adapted to increase or decrease a boost factor or a reduction factor of the converter corresponding to the network voltage , particularly when the network voltage is inside the tolerance band or inside the stability range and outside of the tolerance band . For example , i f the network voltage drops , the controller may be adapted to increase the boost factor of the converter and vice versa .

[0039] Additionally, the controller may be adapted to change the switching stage of the on-load tap changer and / or the conversion rate of the converter in at least a millisecond range .

[0040] This provides the advantage that a direct voltage of the direct current electrical power input for the electrolyzer may 2024PF00296 Subsequent Filing Version

[0041] 8 be kept constant when the network voltage changes , particularly within the tolerance band or outside the tolerance band and inside the stability range .

[0042] In one embodiment , the trans former unit or any other upstream trans former unit between the electrolysis system and the electrical network comprises the on-load tap changer and the controller is adapted to temporarily prevent a switching of the on-load tap changer for the duration of the fault event . In other words , the trans former unit may comprise one or more tap changers wherein the controller may be adapted to block a change of a switching state of any or all of the one or more on-load tap changers , particularly for the duration of the fault event . The electrolysis system may comprise the upstream trans former unit and / or the point of connection of the electrolysis system may be electrically connected to the upstream trans former unit .

[0043] In one embodiment , the controller is adapted to maintain and / or store a setting of an operating point of the electrolyzer power supply system and / or of the electrolyzer and / or of an auxiliary system, particularly from a point of time before of when the fault event is detected . In other words , the controller may be adapted to freeze and / or store the setting, particularly the pre- fault setting, of the operating point of the electrolyzer power supply system and / or of the electrolyzer and / or of an auxiliary system . The auxiliary system may be a cooling system of the electrolyzer or a management system of the electrolysis input and output material . The auxiliary system may comprise a compressor system for managing the gas output from the electrolyzer and / or the gas input into a storage system . For example , the setting of the operating point may comprise a valve position and / or a temperature .

[0044] This provides the advantage that the start-up and / or ramp-up after a shutdown of the electrolysis system due to the fault event may be faster . 2024PF00296 Subsequent Filing Version

[0045] 9

[0046] In one embodiment , the controller is adapted to adj ust the operating point of the electrolyzer power supply system and / or of the electrolyzer and / or of the auxiliary system corresponding to the network voltage of the electrical network upon detection of the fault event , particularly when the network voltage is outside the tolerance band and within the stability range from the reference network voltage . In other words , the controller may be adapted to ramp the electrolyzer and / or the electrolyzer power supply system up or ramp the electrolyzer and / or the electrolyzer power supply system down corresponding to the network voltage , particularly when the network voltage is inside the stability range from the reference network voltage .

[0047] Additionally, or alternatively, the controller may be adapted to increase or decrease the operating point of the auxiliary system corresponding to the network voltage , particularly when the network voltage is inside the stability range from the reference network voltage . For example , the controller may be adapted to adj ust a gas pressure of fset of a compressor system corresponding to the network voltage .

[0048] This provides the advantage , that a stability of the electrical network may be improved, particularly during a fault event .

[0049] In one embodiment , the controller is adapted to maintain the electrolyzer and / or the auxiliary system in a stand-by mode when the network voltage leaves the stability range , wherein the stand-by mode optionally comprises the controller being adapted to control the electrolyzer power supply system to provide a polari zation voltage for the electrolyzer and / or the controller being adapted to set the auxiliary system in an auxiliary operating mode which particularly allows an increased cooling of the electrolyzer or a stable temperature , particularly of the electrolyzer . In other words , when the network voltage leaves the stability range from the reference network voltage , the controller may be adapted to set the 2024PF00296 Subsequent Filing Version

[0050] 10 electrolysis system, particularly the electrolyzer and / or the auxiliary system, into a stand-by mode , which particularly allows a faster start-up or ramp-up when the fault event is over . The stand-by mode may be suitable for slowing down an aging of the electrolyzer, wherein a polari zation voltage is provided to the electrolyzer, particularly by the electrolyzer power supply system and / or an energy storage unit . Additionally, or alternatively, the auxiliary system may be adapted to provide an increased cooling of the electrolyzer during the fault event . This provides the advantage that the electrolysis system may start up or ramp up faster after the fault event is over and that additionally an aging of the electrolyzer is slowed down . In an alternative embodiment , it is also possible to instead keep the electrolyzer at a given or stable temperature i f this enables a faster start-up of the electrolysis system .

[0051] In one embodiment , the controller is adapted to allow the violation of the stability range by the network voltage during an initial start-up and / or a ramp-up of the electrolyzer, particularly from the stand-by mode of the electrolyzer . In other words , the converter may be adapted to tolerate or ignore the violation of the stability range by the network voltage and additionally the violation of the operational threshold by the operating parameter during a start-up or ramp-up of the electrolyzer . For example , the controller may be adapted to ignore a drop of the network voltage beyond the stability range during the start-up and / or ramp-up of the electrolyzer . Further, the controller may be adapted to ramp up the electrolyzer when the network voltage is within the tolerance band . This provides the advantage that an inrush current causing the network voltage to drop beyond the stability range may abort the start-up or ramp-up of the electrolyzer . Thus , the electrolyzer may safely ramp up after the fault event has ended .

[0052] In one embodiment , the electrolysis system further comprises an electrical load which is adapted to receive at least 2024PF00296 Subsequent Filing Version

[0053] 11 partly the alternating current electrical power input and / or the direct current electrical power input from the electrolyzer power supply system instead of the electrolyzer, wherein the controller optionally is adapted to redirect the alternating current electrical power input and / or the direct current electrical power input from the electrolyzer to the electrical load when the network voltage leaves the tolerance band and / or the stability range and / or wherein the controller optionally is adapted to redirect the alternating current electrical power input and / or the direct current electrical power input from the electrical load to the electrolyzer when the network voltage is within the tolerance band and / or the stability range from the reference network voltage , particularly corresponding to a ramp-up rate of the electrolyzer .

[0054] In other words , the electrical load may be electrically connected to the electrolyzer power supply system, particularly to the trans former unit and / or the converter, and may be any kind of electrical load which at least may be adapted to consume and / or absorb and / or store the electrical power input for the electrolyzer . The electrolyzer power supply system and / or the controller by means of the electrolyzer power supply system may be adapted to provide the alternating current electrical power input and / or the direct current electrical power input to the electrical load and / or the electrolyzer .

[0055] Additionally, or alternatively, the controller may be adapted to switch the alternating current electrical power input and / or the direct current electrical power input from the electrolyzer to the electrical load when the network voltage has left the tolerance band and / or stability range .

[0056] Additionally, or alternatively, the controller may be adapted to distribute or redirect the alternating current electrical power input and / or the direct current electrical power input from the electrolyzer to the electrical load corresponding to a ramp-down rate of the electrolyzer when the network voltage 2024PF00296 Subsequent Filing Version

[0057] 12 is outside the tolerance band and inside the stability range from the reference parameter .

[0058] Additionally, or alternatively, the controller may be adapted to distribute or redirect the alternating current electrical power input and / or the direct current electrical power input between the electrical load and the electrolyzer corresponding to a ramp-up rate of the electrolyzer, particularly when the network voltage is within the stability range from the reference network voltage .

[0059] The electrical load may be adapted to consume the electrical power of the electrolysis system instead of the electrolysis system, particularly at a level before the fault event has occurred, or at a level defined by the grid operator .

[0060] This provides the advantage that an electrical load corresponding to the electrical load of the electrolysis system can be provided to the electrical network even during a fault , when the electrolysis process may have stopped, or in case the electrolysis systems trips and disconnects from the electrical network . This measure can also be applied in case the network voltage has left the stability range and the electrolysis has shut down .

[0061] In one embodiment , the electrolysis system comprises a plurality of electrolyzers , wherein the controller is adapted to connect or disconnect , particularly to shut down or ramp up, the respective electrolyzer of the plurality of electrolyzers in a sequence , wherein an order of the sequence is particularly based on an aging parameter of the respective electrolyzer and / or an available power consumption of the respective electrolyzer . In other words , the controller may be adapted to start-up or shut-down or trip the respective electrolyzer of a plurality of electrolyzers in a sequence . Additionally, the sequence for connecting or disconnecting, particularly for ramping up or tripping or shutting down or starting up, the respective electrolyzer may be based on the power demand, 2024PF00296 Subsequent Filing Version

[0062] 13 which may be linked to an aging parameter of the respective electrolyzer . The aging parameter may be derived from or correspond to a current-voltage characteristic of the respective electrolyzer, particularly over a time of operation of the respective electrolyzer . For example , the sequence may comprise that the electrolyzer with the highest power demand ( for example due to ageing) may be started up first and / or the electrolyzer with the lowest power demand ( for example due to little ageing) may be shut down first . Additionally or alternatively, the sequence may comprise that the electrolyzer with the highest power demand ( for example due to ageing) may be allowed to trip last or be shut down last and / or the electrolyzer with the lowest power demand ( for example due to little ageing) may be allowed to trip first or be shut down first . This provides the advantage that a stability of the electrical network can be improved when an electrolyzer or its power supply components need to be re-energi zed or when it has to be disconnected during the fault and be connected again after the fault .

[0063] In one embodiment , the electrolysis system further comprises an energy storage unit for storing an electrical energy received from the electrical network, wherein the controller optionally is adapted for a fault ride through event to fill up the energy storage unit at least partly with the electrical energy, and / or wherein the controller is adapted to provide the electrical energy, particularly an active and / or a reactive energy, from the storage unit at least partly to the electrolyzer power supply system and / or to the electrolyzer and / or to the electrical network, particularly after detecting the fault event , and / or wherein the controller is adapted to adj ust or maintain a power factor of the electrolyzer power supply system and / or of the electrolyzer, particularly by altering the conversion rate of the converter and / or changing the switching state of the on-load tap changer .

[0064] In other words , the controller may be adapted to store the electrical power input , particularly the alternating current 2024PF00296 Subsequent Filing Version

[0065] 14 electrical power input and / or the direct current electrical power input , at least partly in the energy storage unit . The energy storage unit may be any kind of energy storage , such as a battery and / or a capacitor .

[0066] Additionally or alternatively, the controller may be adapted to withdraw the stored electrical energy from the energy storage unit and provide the electrical energy, particularly an active and / or reactive power, at least partly to the electrical network and / or to the electrolysis system and / or to the electrolyzer, particularly when the network voltage is outside the first tolerance band and within the stability range from the reference network voltage or outside the stability range .

[0067] Additionally, or alternatively, the controller may be adapted to maintain a constant power factor of the electrolysis system, particularly of the electrolyzer power supply system and / or of the electrolyzer, particularly when the network voltage is outside the tolerance band and within the stability range from the reference network voltage . Additionally, the controller may be adapted to maintain the power factor constant by altering the conversion rate or a boost factor of the converter and / or by changing the switching state of the on-load tap changer .

[0068] Additionally or alternatively, the controller may be adapted to adj ust or tune the power factor of the electrolysis system, particularly of the electrolyzer power supply system and / or of the electrolyzer, of the electrolysis system, particularly of the electrolyzer power supply system and / or of the electrolyzer, corresponding to the network voltage , particularly when the network voltage is outside the tolerance band and within the stability range from the reference network voltage . Additionally, the controller may be adapted to adj ust or tune the power factor by altering the conversion rate or a boost factor of the converter and / or by changing the switching state of the on-load tap changer . 2024PF00296 Subsequent Filing Version

[0069] 15

[0070] This provides the advantage that a stability of the electrical network may be improved, particularly when the network voltage is between the tolerance band and the stability range .

[0071] In one embodiment , the converter is adapted to regulate the direct current electrical power input for the electrolyzer, particularly within an operating current limit of the electrolyzer and / or in a millisecond domain . In other words , the converter supplying the electrolyzer with direct current may regulate the direct current in order to prevent a rapid increase of the direct current flowing through the electrolysis cells . The corresponding controller may be adapted to operate at least in the millisecond domain or range and to detect a fault event as a high voltage ride through event and to resume operation . This provides the advantage that further damage to the electrolysis cells of the electrolyzer due to a fault event can be avoided .

[0072] The invention further relates to a method for operating an electrolysis system comprising an electrolyzer power supply system and an electrolyzer, wherein the electrolyzer power supply system comprises at least one trans former unit and a converter and receives an alternating current electrical power input from an electrical network and converts the alternating current electrical power input into a direct current electrical power input for the electrolyzer, which converts the direct current electrical power input into an energy carrier, comprising the steps of :

[0073] Detecting a fault event of the electrical network when a network voltage of the electrical network leaves a tolerance band around a reference network voltage of the electrical network;

[0074] Allowing a violation of an operational threshold of the electrolyzer by an operating parameter, particularly of the electrolyzer power supply system and / or of the electrolyzer, for a predetermined duration when the network 2024PF00296 Subsequent Filing Version

[0075] 16 voltage is outside the tolerance band and within a stability range from the reference network voltage .

[0076] According to the invention, the allowing comprises blocking and / or delaying an action that is triggered by the violation of the operating parameter .

[0077] In other words , a violation of the operational threshold by the operating parameter may be tolerated or ignored . Tolerating and / or allowing may comprise detecting or ignoring the violation of the operational threshold by the operating parameter . The delay of the action may be at least partly for the predetermined duration . For example , a time constant of a control loop may be delayed .

[0078] The operating parameter may be of the electrolysis system or any component thereof , particularly of the electrolyzer power supply system and / or of the electrolyzer and / or of an auxiliary system .

[0079] The tolerance band around the reference network voltage may be an interval of the operating parameter, wherein no action of the electrolysis system may take place . For example , the tolerance band can feature an interval between 85% to 115% or 90% to 110% of the reference network voltage , wherein optionally the edge values of the respective interval may be included . The stability range from the reference network voltage may be larger than the tolerance band . When the network voltage leaves the stability range , the electrolysis system may shut down . The stability range may be limited by a low voltage fault ride through and / or a high voltage fault ride through voltage characteristic .

[0080] This provides the technical ef fect that the electrolysis system can continue to operate as an electrical load when the network voltage fluctuates and leaves the tolerance band . Those violations of the operational threshold by the operating parameter are allowable as they remain in a predictable 2024PF00296 Subsequent Filing Version

[0081] 17 range . By this , the electrolysis system may contribute to a stability of the electrical network .

[0082] The method may also include the features of the corresponding electrolysis system and any combination of the corresponding embodiments thereof , particularly with the necessary modi fications . Therefore , for the sake of brevity, the embodiments of the electrolysis system are not repeated for said method .

[0083] The invention further relates to a computer program comprising instructions which, when the program is executed by a controller, particularly an electrolysis system controller and / or an electrolyzer power supply system controller and / or an electrolyzer controller, cause the controller to carry out the steps of said method . Alternatively, the controller may also be a personal computer .

[0084] The controller may comprise means to execute said method, particularly means to control the electrolyzer power supply system, particularly the trans former and / or the converter and / or the on-load tap changer, and / or means to control the electrolyzer and / or an auxiliary system of the electrolyzer . Alternatively, the controller may comprise means for indicating a switching state to be selected for a manual operation of the on-load tap changer .

[0085] Additionally or alternatively, the converter may comprise means to drop and / or boost the direct current electrical power input corresponding to an operating point of the electrolyzer, particularly of the converter . This may be done by providing a di f ferent setpoint or an of fset to an existing setpoint . The controller may further comprise means to activate and / or deactivate a switching element , particularly a thyristor or IGBT , of the respective converter .

[0086] Additionally or alternatively, the controller may comprise means to control an operating point of the electrolyzer and / or of an auxiliary system of the electrolyzer, such as a 2024PF00296 Subsequent Filing Version

[0087] 18 compressor . Additionally or alternatively, the controller may comprise means to redirect the alternating current electrical power input and / or the direct current electrical power input between the electrolyzer and an additional electrical load and / or vice versa . Additionally or alternatively, the controller may comprise means to redirect the alternating current electrical power input and / or the direct current electrical power input between the electrolysis system and / or the electrical network and an electrical storage unit . The controller may further comprise means to control the electrical storage unit .

[0088] The invention also relates to a computer-readable storage medium having stored thereon said computer program . In other words , the computer-readable storage medium may be a punched card, a ( floppy) disk storage medium, a hard disk, a CD, a DVD, an USB (Universal Serial Bus ) storage device , a RAM (Random Access Memory) , a ROM (Read Only Memory) and / or an EPROM (Erasable Programmable Read Only Memory) . Preferably, the computer-readable storage medium may be a RAM or a ROM, wherein particularly a flash memory is used . The computer readable-storage medium may also be a data communication network which allows downloading a program code , such as the Internet or a server for example .

[0089] The invention further relates to a controller, particularly an electrolysis system controller and / or an electrolyzer power supply system controller and / or an electrolyzer controller, comprising said computer-readable storage medium having stored thereon said computer program . The controller may be programmable logic controller ( PLC ) . The controller may comprise at least one processor and said computer-readable storage medium, wherein the computer-readable storage medium comprises said computer program which, when executed by the at least one processor, cause the controller to perform the method as described above . Alternatively, the controller may be a personal computer . 2024PF00296 Subsequent Filing Version

[0090] 19

[0091] In other words , the at least one processor may be a microprocessor and / or a microcontroller and / or a FPGA ( Field Programmable Gate Array) and / or a DSP ( Digital Signal Processor ) .

[0092] The controller may comprise means to execute said method, particularly means to control the electrolyzer power supply system, particularly the trans former and / or the converter and / or the on-load tap changer, and / or means to control the electrolyzer and / or an auxiliary system of the electrolyzer . Alternatively, the controller may comprise means for indicating a switching state to be selected for a manual operation of the on-load tap changer .

[0093] Additionally or alternatively, the controller may comprise means to control an operating point of the electrolyzer and / or of an auxiliary system of the electrolyzer, such as a compressor .

[0094] Additionally or alternatively, the controller may comprise means to redirect the alternating current electrical power input and / or the direct current electrical power input between the electrolyzer and an additional electrical load and / or vice versa . Additionally or alternatively, the controller may comprise means to redirect the alternating current electrical power input and / or the direct current electrical power input between the electrolysis system and / or the electrical network and an electrical storage unit . The controller may further comprise means to control the electrical storage unit .

[0095] Additionally or alternatively, the controller may comprise means to change a switching state of the on-load tap changer and / or means to display when a tap selection of the on-load tap changer is to be changed and / or which tap is to be selected for a manual operation of the on-load tap changer .

[0096] Additionally or alternatively, the converter may comprise means to drop and / or boost the direct current electrical 2024PF00296 Subsequent Filing Version

[0097] 20 power input corresponding to an operating point of the electrolyzer, particularly of the converter . The controller may further comprise means to activate and / or deactivate a switching element , particularly a thyristor or IGBT , of the respective converter .

[0098] The invention further relates to an electrical power system comprising said electrolysis system and / or said controller . The electrical power system may be a network of electrical components deployed to supply, trans fer, and use electric power . The electrical power system may comprise an electrical power source and an electrical load that are connected via an electrical network, wherein particularly the electrical power source and / or the electrical load may comprise the electrolysis system from above . In other words , the electrical power system may comprise an entirety of all technical equipment required for generation, transmission and distribution of electrical energy within a control zone of a distribution area where electrical energy is provided from a producer to a consumer . For example , the electrical power system may comprise a switchyard, which optionally may comprise said controller, wherein the controller particularly may be a switchyard controller .

[0099] The invention also relates to reali zations comprising a combination of the features of several of the described embodiments .

[0100] Brief description of the drawings

[0101] The present disclosure will be more readily appreciated by reference to the following detailed description when being considered in connection with the accompanying drawings in which :

[0102] Figure 1 shows a schematic view of an electrolysis system comprising an electrolyzer power supply system and one or more electrolyzers ; 2024PF00296 Subsequent Filing Version

[0103] 21

[0104] Figure 2 schematically shows a current-voltage characteristic of an electrolyzer at the beginning of li fe compared to a current-voltage characteristic of the electrolyzer at the end of li fe ;

[0105] Figure 3 schematically shows a high-voltage fault ride through event as an example fault event ;

[0106] Figure 4 schematically shows a low-voltage fault ride through event as another example fault event ; and

[0107] Figure 5 shows a schematic flow diagram of the method for operating an electrolysis system during a fault event .

[0108] In the following, the invention will be explained in more detail with reference to the accompanying figure . In the Figures , like elements are denoted by identical reference numerals and repeated description thereof may be omitted in order to avoid redundancies .

[0109] Figure 1 schematically shows an example electrolysis system 1 in a 24-pulse operation . The schematic electrolysis system 1 comprises an electrolyzer power supply system 2 and one or more electrolyzers 3 . The electrolyzer power supply system 2 comprises a trans former unit 4 and a converter 5 , wherein the trans former unit 4 comprises one or more trans formers 16 and optionally an on-load tap changer 16 . The trans formers 16 may be adapted to provide a phase shi ft between at least two three-winding trans formers 16 , particularly with a phase shi ft of 15 ° , hence +7 . 5 ° and -7 . 5 ° .

[0110] The converter 5 is adapted to convert an alternating current into a direct current and optionally to drop and / or boost a direct voltage . The electrolyzer power supply system 2 is connected to an electrical grid 7 via a point of connection 13 . Optionally, the electrolysis system 1 and / or the electrolyzer power supply system 2 comprises a filter element 17 , 2024PF00296 Subsequent Filing Version

[0111] 22 wherein the filter element may be an active and / or passive filter .

[0112] The electrolyzer power supply system 2 is adapted to receive an alternating current electrical power input 6 from the electrical grid 7 and to convert the alternating current electrical power input 6 into a direct current electrical power input 8 for the electrolyzer 3 . For this , the electrical power supply system 3 , particularly the converter 5 , is electrically connected to the electrolyzer 3 via a switching element 15 for connecting and disconnecting the electrolyzer 3 .

[0113] The electrolyzer 3 is adapted to convert the direct current electrical power input 8 into an energy carrier, such as hydrogen . Auxiliary systems for providing an electrolysis ingredient , such as water, or for providing cooling and / or a compression and / or storage of the energy carrier gases are not shown .

[0114] The electrical network 7 may electrically connect a plurality of electrical power sources with a plurality of electrical loads in a network operation mode . Alternatively, the electrical network 7 may also be a line that electrically connects the electrical power source with the point of connection 13 of the electrolyzer power supply system 2 in an island operation mode .

[0115] Connecting the electrolysis system 1 to the electrical grid 7 requires compliance with local network code requirements .

[0116] Part of these requirements , especially for large electrolysis systems 1 , is fault ride through capability . The typical core requirement is to remain fully connected to the electrical network 7 during a fault event in which a deviation of a network voltage from a reference network voltage , such as dip or a spike of a network voltage , may occur at the point of connection 13 . Here , an operator of the electrical network 7 speci fies a curve as shown in Figures 3 and 4 as a stability 2024PF00296 Subsequent Filing Version

[0117] 23 range for the deviation of the network voltage from the reference network voltage , particularly for the dip or spike of the network voltage and / or network frequency, during which the electrolysis system 1 must remain connected to the electrical network 7 and / or remain operational for functioning as an electrical load . A deviation of the network voltage from the network reference parameter that is longer than a predetermined duration and / or larger than the stability range allows the electrolysis system 1 to disconnect from the electrical grid 7 , particularly to disconnect the electrolyzer 3 by means of the switching element 15 or within the converter systems 5 .

[0118] Meeting this requirement is a challenge for the electrolysis plant and its converter system . Important for the network operator is the availability of the electrolysis system as electrical load after the fault has been removed, the so- called post- fault recovery behavior of the electrolysis system 1 . I f the electrolysis system 1 shuts down or trips in the event of a short-term deviation of the network voltage from the network voltage in the electrical grid 7 , the operator of the electrical network 7 would have di f ficulty balancing the power inside the electrical network 7 after the disturbance causing the deviation has been cleared .

[0119] Therefore , only a certain amount of the electrical load may be disconnected or tripped and it is essential , particularly for large electrical loads , such as the electrolysis system 1 to remain connected or to continue operating as an electrical load i f the allowed tolerance band for the network voltage is violated . The allowed lower limit of the tolerance band for the network voltage may be from including 85 % to including 90 % of the reference network voltage . The network voltage may be a network voltage . The fault event may start when the network voltage leaves the tolerance band about the reference network voltage and end when the network voltage returns into the tolerance band . 2024PF00296 Subsequent Filing Version

[0120] 24

[0121] Since a current-voltage characteristic of the electrolyzer 3 is highly dependent on the input voltage of the alternating current input 6 and / or the direct current electrical power input 8 , even a small deviation of the network voltage from the reference network voltage , such as voltage drop, will signi ficantly change the electrical power that is absorbed by the electrolyzer 3 as shown in Figure 2 . This can lead to a massive imbalance between production and consumption of electrical power, particularly in the range of several Gigawatt of electrical power that the electrolysis system 1 may cease to absorb, either during the fault , when power consumption drops stronger than power production, or after fault clearance , when power consumption and generation do not match each other ' s power adj ustments .

[0122] A maj or challenge is thus to balance the operation of the electrical network 7 during the fault event . The electrical power source (not shown ! ) meets similar requirements as above and will continue to supply electrical power, especially i f the deviation of the network voltage from the reference network voltage is not too large , such as outside a stability range larger than the tolerance band from the reference network voltage . At all times , the generation and consumption of electrical power, particularly of active power, must be balanced in order to keep the frequency of the electrical network 7 stable , even during the time of the fault .

[0123] Numerous measures within the electrolysis system 1 are thus required to enable stability for such a fault event . A key enabler is the timely detection of a fault event and the application of the correct countermeasures . Here , the critical network voltage to measure is the network voltage corresponding to the allowable tolerance band about the respective reference network voltage , particularly the reference network voltage , as defined by the operator of the electrical network 7 . The network voltage may be measured at the point of connection 13 between the electrolyzer power supply system 2 and the electrical grid 7 and / or within the electrical grid . 7 , 2024PF00296 Subsequent Filing Version

[0124] 25 wherein measuring the network voltage within the electrical grid 7 may require a correction factor . Additionally, a rate of change of the network voltage , such as — may also be con- dt sidered .

[0125] For example , a distinction between an internal fault of the electrolysis system 1 and a fault event of the electrical network 7 may be made by comparing the rate of change of voltage and the rate of change of current particularly of respective current carrying phases of the connection point 13 which electrically connect the electrolysis system 1 to the electrical grid 7 . This may include an evaluation over discrete time steps , particularly in at least a millisecond time range as well as an evaluation over said rates of change — and — . The measurement may be made within any of the dt dt trans formers 16 of the trans former unit 4 and / or the converter 5 and / or the filter element 17 and / or a compensation unit , switchyard or the trans former connecting the entire plant to an electrical network . This measurement may be reali zed by means of capacitive and inductive voltage and current sensors , such as a capacitive divider and / or a Rogowski coil , which are easy to implement .

[0126] In case of an internal fault of the electrolysis system 1 , such as a short circuit or an internal fault of a component , the current received from the electrical network 7 by the electrolysis system 1 increases while the network voltage decreases , whereas in case of a fault event of the electrical network 7 such as a low voltage ride through event ( LVRT ) both decrease . Additionally or alternatively, in case the fault event of the electrical network 7 is a high voltage ride through event (HVRT ) , the voltage and the current both may increase .

[0127] Therefore , by comparing the sign of gives : 2024PF00296 Subsequent Filing Version

[0128] 26 o determines a fault event of the electrical grid 7 i f the plant operates as an electric load; and o I f — < 0 and — > 0 or — > 0 and — < 0 determines a fault dt cZt cZt dt event of the electrical grid 7 i f the plant operates as an electric source ; and o I f — < 0 and — > 0 determines an internal fault of the electrolysis system 1 .

[0129] Here , the plant and the electrolysis system 1 may share or may be electrically connected to the same point of connection 13 .

[0130] The corresponding algorithm may be parameteri zed by means of a simulation . Additionally, a FPGA-based detection software may be used for a fast response .

[0131] Additionally or alternatively, i f the electrolysis system 1 is operating as an electrical power source for the electrical network 7 , particularly in a combined plant , the fault event of the electrical network 7 may be determined i f the current being transmitted to the electrical network 7 increases .

[0132] Additionally or alternatively, the fault event of the electrical network 7 and / or the internal fault of the electrolysis system 12 may be determined based on a table-based decision matrix .

[0133] By definition, a fault ride through event of the electrical network 7 is triggered by a violation of the tolerance band 10 as an allowed tolerance range for the network voltage at the point of connection 13 . The electrolysis system 1 may shut down when the network voltage is outside the stability range about the reference network voltage . For example , the stability range may correspond to a low voltage fault ride through and / or a high voltage fault-ride through tolerance range for the network voltage . 2024PF00296 Subsequent Filing Version

[0134] 27

[0135] Therefore , the network voltage and / or the current between the electrical network 7 and the electrolysis system 1 may be measured at the point of connection and / or within the electrical network 7 , particularly corrected by means of a correction and / or of fset value or formula . The measurement equipment for measuring the network voltage and the current between the electrical network 7 and the electrolysis system 1 may have a sampling rate and / or a measurement resolution which may be suitable for at least a millisecond range in order to detect the fault event of the electrical network 7 and / or the internal fault of the electrolysis system . Additionally, a trace of the detected fault event may be stored at the respective measurement resolution .

[0136] Figure 2 shows a schematic current-voltage characteristic of an electrolyzer at the begin of li fe and at the end of li fe .

[0137] I f the cell voltage drops below the Nernst voltage ( about 1 . 23 V for water electrolysis ) , a gas production and thus the electrolysis process stops completely . In the example below, the nominal voltage of the electrolyzer system at the beginning of its li fe is about 980 V, while the threshold for hydrogen production is in the range of 720 V . I f the input voltage of the electrolyzer 3 drops quickly to 73 % of the reference network voltage , no signi ficant power can be consumed by the electrolyzer system .

[0138] For example , i f the electrolysis system 1 is initially operating at 60% part load ( 6000 A, 900 V DC ) , reducing the input voltage by 100 V will reduce the DC current by 4 , 200 A and the power consumption by approximately 75% at the begin of li fe BOL . I f the voltage drops by about 180 V in the example , gas production stops because the electrolysis system voltage is in the Nernst range . By definition, the fault event is cleared when the voltage returns to the defined voltage band, which could be in the range of 110% to 90% or 85% . I f the network voltage only recovers to the lower threshold of the 2024PF00296 Subsequent Filing Version

[0139] 28 voltage band ( 85% ) , the input voltage at the converter or recti fier input may be too low to enable pre- fault power consumption of the electrolyzer 3 , since the possible power consumption is determined by said current-voltage characteristic . This ef fect may weaken over the li fe of the electrolyzer 3 , particularly at the end of li fe EOL .

[0140] This leads to a massive imbalance between production and consumption when several Gigawatt of electrolysis capacity are af fected at the same time , while the production units continue to operate at only slightly reduced power compared to the pre- fault values . Numerous measures within the electrolysis system 1 are required to enable a fault ride through capability, as the electrolysis system 1 as a whole must meet these requirements .

[0141] A key enabler is the timely detection of such events and the application of the correct countermeasures . A maj or challenge is to balance the operation of the electrical network 7 during the disturbance . Electrical power sources also must meet similar requirements as mentioned above and will continue to provide electrical power, especially i f the network voltage drop is not too large ( for example , in the case of a grid fault several 100 km away, which could result in a voltage drop down to 90 % of the reference voltage ) . At all times , the generation and consumption of active power must be balanced in order to keep the network frequency stable , even during the time of the fault . In addition, the on-load tapchanger units 14 of the electrolyzers 3 are generally designed to compensate for a voltage drop of up to 90% from the reference network voltage so that the electrolyzer 3 can reach 100% load .

[0142] Numerous measures within the electrolysis system 1 are required to enable fault ride through capability, particularly when the network voltage is between the tolerance band and the stability range , as the plant as a whole must meet these 2024PF00296 Subsequent Filing Version 29 requirements as shown in the example cases of Figures 3 and 4 .

[0143] The measures as shown in Figures 3 and 4 may be applied to some or all electrical loads within the electrolysis system 1 , depending on the respective design and / or characteristic of the electrical load and the respective local network code requirement . Therefore , any combination of the measures as listed in the context of Figures 3 and 4 below may be used to achieve compliance with the respective local network code requirement .

[0144] Figure 3 shows a schematic high voltage fault ride through event as an example fault event . The network voltage is denoted by Unet. The network voltage Unetfluctuates around the reference voltage Uref of the electrical network 7 within the tolerance band 10 from the point of time t until it leaves the tolerance band 10 at t2, which may correspond to the point of time 0 in Figure 3 . The network voltage Unetfluctuates outside the tolerance band 10 and within the stability range 12 which corresponds to a high voltage fault ride through characteristic UHVRTbetween t2and t5. Thus , the fault event lasts between t2and t5. Here , the following controller of the electrolysis system 1 is adapted to tolerate a violation of an operational threshold by an operating parameter for a predetermined time in order to maintain the electrolysis system 1 operating as an electrical load . When the network voltage Unetleaves the stability range 12 as limited by the UHVRTcurve , the electrolysis system 1 may shut down . The electrolysis system 1 may start up or ramp up after the network voltage Unethas returned into the tolerance band 10 at t5.

[0145] Starting from the point of time t2when the fault event is detected, the voltage values and time stamps are recorded and the time-dependent voltage characteristic is compared with the high voltage ride through curve requirement . For example , 2024PF00296 Subsequent Filing Version

[0146] 30 at t2, the network voltage Unetand the network current / flowing between the electrolysis system 1 and the electrical network 7 are measured, particularly at the point of connection . I f - - < 0 and — < 0 or i f - - > 0 and — > 0, a fault event of dt dt dt dt the electrical grid is determined, particularly when the electrolysis system 1 operates as an electrical load .

[0147] Additionally or alternatively, i fdUnet< 0 and — > 0, an inter- dt dt nal fault of the electrolysis system 1 is determined, particularly when the electrolysis system 1 operates as an electrical load .

[0148] Additionally or alternatively, i f > 0, particu larly at the point of connection, a fault event of the electrical grid is determined, particularly when the electrolysis system 1 is part of a combined power plant comprising combined generation and storage units for electric power . The plant as a whole may be an electrical power source . Here , the electrolysis system 1 may be electrically connected to the point of connection 13 of the plant to the electrical network 7 .

[0149] Additionally,dUnetand — are determined in at least two cur- dt dt rent carrying phases of a multi-phase system such as a three phase system, wherein the current carrying phases electrically connect the electrolysis system 1 to the electrical network 7 . When the fault event of the electrical network 7 or the internal fault event of the electrolysis system 1 is respectively determined in the at least two current carrying phases , the fault event of the electrical network 7 or the internal fault event of the electrolysis system 1 is determined for the multi-phase system as a whole .

[0150] Additionally or alternatively, the controller may be adapted to an internal fault of the electrolysis system i f — < 0 and dt

[0151] — > 0, particularly when the electrolysis system may operate dt as an electrical load . 2024PF00296 Subsequent Filing Version

[0152] 31

[0153] Additionally or alternatively, the controller of an electrical power source may be adapted to determine the fault event of the electrical grid i f ^ < 0 and > 0, particularly when the electrolysis system may be operated in an electrical power source due to the production of excess power by power generating units within the plant . Here , the power plant and the electrolysis system 1 may share the same network connection, particularly the same point of connection 13 .

[0154] During the fault event , a network voltage Unetthat is higher than the maximum voltage Umaxof the tolerance band 10 may cause a violation of an operational threshold by an operating parameter of the electrolyzer power supply system 2 and / or of the electrolyzer 3 and / or of an auxiliary system of the electrolyzer 3 . Here , allowing or tolerating the violation by the operational parameter may comprise at least one of or any combination of the following measures , particularly as long as the network voltage Unetis outside the tolerance band 10 and inside or within the stability range 12 , for example at t4:

[0155] First , the associated on-load tap changer 14 of the transformer unit 4 or that of any trans former upstream from the electrolysis may be blocked for a predetermined duration, particularly corresponding to the required high voltage fault ride through curve . This avoids an unnecessary switching of the on-load tap changer 14 i f the on-load tap changer 14 is unable to perform multiple steps within at least a reasonable part of the predetermined duration to avoid unwanted or unnecessary disturbances to the operation of the electrolysis system 1 , such as multiple switching in less than 1 second . The blocking may be released i f the network voltage Unetexceeds the stability range 12 as defined by the high voltage fault ride through curve or i f the voltage returns to the tolerance band 10 . 2024PF00296 Subsequent Filing Version

[0156] 32

[0157] Additionally or alternatively, a switching state of the onload tap changer 14 , particularly of a trans former 16 that is directly electrically connected to the electrical network 7 and / or of a trans former 16 that is directly electrically connected to the converter 5 and / or the on-load tap changer 14 of any intermediate trans former, may be actively changed, particularly to at least one lower tap position in order to cope with a conversion rate of the converter 5 , particularly with a boost mode operation of the converter 5 which may be a recti fier .

[0158] Additionally or alternatively, the converter system 5 supplying the electrolysis system 3 with power may regulate the DC current feeding the electrolysis to prevent a rapid increase in DC current flowing through the electrolysis cells . The corresponding controller is required to operate at least in the ms domain and detect the event as a high voltage ride through event and resume operation, in contrast to an electrolysis fault event which would also cause an increase of DC current flow but would not be caused by a strong drop of input voltage .

[0159] I f the voltage leaves the stability range as defined by the high voltage fault ride through curve , the electrolysis system is allowed to shut down or trip . Optionally, a shut-down and / or trip signal is sent , particularly by a controller of the electrolysis system 1 .

[0160] Additionally or alternatively, the shut-down and / or trip limit of the electrolysis system 1 may be defined by the operator of the electrical network 7 , particularly depending on a pre-defined limit of violation of an operational threshold by an operating parameter of the electrolysis system 1 .

[0161] Additionally or alternatively, the electrolyzer 3 enters in a stand-by mode in the event of a shut-down of the electrolyzer 3 due to overvoltage . Said stand-by mode allows a quick restart of the electrolyzer 3 after the fault event has been 2024PF00296 Subsequent Filing Version

[0162] 33 cleared at t5. The stand-by mode may also comprise measures to reduce an aging of the electrolyzer 3 , such as maintaining to provide a polari zation voltage by the converter 5 . Additionally or alternatively, an auxiliary systems required for the stand-by mode may be restarted fast enough or their power supply buf fered .

[0163] Additionally or alternatively, the auxiliary system may be set into an auxiliary operating mode which allows an increased cooling of the electrolyzer 3 or provision of a stable temperature . For instance , the auxiliary system may comprise a compressor system that enters in a " recycle / zero mass flow" mode , which allows a quick restart of the electrolyzer 3 after the fault event has been cleared at t5.

[0164] Additionally or alternatively, an additional electrical load such as a chopper resistor may be activated to match the prefault power consumption at the point of time t2of the electrolysis system 1 , particularly with an accuracy of ±10 / % in order to prevent a loss of electrical input power in the event of a disconnection or trip of the electrolysis system or parts of it . Upon a restart of the electrolysis system 1 after the network voltage Unethas returned into the stability range 12 , said additional electrical load would be shut down to match a ramp-up rate of the electrolyzer 3 and optionally additional auxiliary systems . The power adj ustment between these systems may be continuous , optionally with a support of smoothing power storage systems , or in discrete steps , e . g . i f the additional electrical load can only be switched on / of f without the possibility to control the power input . Here , a converter system may not be used for economic reasons .

[0165] To balance the power exchange of a combined plant comprising the electrolysis system 1 as an electrical load and at least one electrical power source , a controller of the plant may adj ust the power generation / consumption within the schedule to keep the power exchange with the electrical network 7 2024PF00296 Subsequent Filing Version

[0166] 34 within the tolerance allowed by the network operator or to prevent a reversal of the flow of electrical power between the plant and the electrical network 7 . For example , i f part of an electrical power generation by the plant is shut down, it may be necessary to shut down an electrical load with a capacity of equivalent electrical power, or vice versa . It may also be necessary to completely shut down the production and / or consumption units of electrical power plant at least partly or completely i f the electrical power plant is consuming electrical power from the electrical network 7 . I f the electrical power plant ' s internal consumption of electrical power exceeds its internal generation of electrical power, a complete shutdown may be necessary to prevent a power reversal at the point of connection 13 . In such a case , the units of the electrical power plant that are shut down shall enter a stand-by mode which allows a quick restart of the units after the fault event . After the fault has been cleared and the unit of the electrical power plant has been shut down, it can be restarted as soon as the operator of the electrical network 7 agrees . The ramp-up rate of the respective electrolyzer 3 unit may be determined by the respective limit defined by the stand-by state .

[0167] Figure 4 shows a schematic low-voltage fault ride through event as another example fault event . The network voltage is denoted by Unet, which fluctuates around the reference voltage Uref of the electrical network 7 within the tolerance band 10 from the point of time t until it leaves the tolerance band 10 at t2. At t2, the fault event of the electrical grid 7 or an internal fault of the electrolysis system 1 may be determined as in Figure 3 above , wherein t2may correspond to the point of time 0 in Figure 4 .

[0168] The network voltage Unetfluctuates outside the tolerance band 10 and within the stability range 12 which corresponds to a low voltage fault ride through characteristic ULVRTbetween t2and t6. Between t2and t6and i f the network voltage [ / netremains within the stability range 12 , a violation of an 2024PF00296 Subsequent Filing Version operational threshold by an operating parameter is allowed or tolerated for a predetermined time in order to maintain the electrolysis system 1 operating as an electrical load . When the network voltage Unetleaves the stability range 12 as limited by the ULVRTcurve such as at t3or t4, the electrolysis system 1 may shut down . After the network voltage Unethas returned into the tolerance band 10 , the electrolysis system 1 may start up again .

[0169] When the tolerance band 10 around the reference voltage Uref and / or a defined lower voltage limit Uminof the tolerance band 10 is exceeded by an undervoltage event , low voltage ride through ( LVRT ) settings are activated . I f necessary, this event can be distinguished from a short voltage dip caused by the (planned) start-up of the electrolysis system 1 . Particularly, when the available short-circuit electrical power is low compared to the electrical power requirement of the electrolysis system 1 , starting up the electrolysis system 1 , particularly the trans former 16 and / or the converter 5 and / or the electrolyzer 3 , may cause a voltage dip of the network voltage Unetoutside the tolerance band 10 and / or even below the stability range 12 which may be limited by ULVRTdue to a high inrush current from the electrical network 7 . An example is shown at t5, where the network voltage Unetis close to the lower limit of the stability range 12 which corresponds to ULVRTand the start-up of the electrolyzer 3 causes the network voltage Unetto shortly drop below ULVRT • Said inrush current may as well cause the network voltage Unetto drop outside the tolerance band 10 . When the start-up and / or the ramp / up of the electrolysis system 1 could cause a violation of the tolerance band 10 and / or even of the stability range 12 , particularly at the point of connection 13 , the violation of an operational threshold by the operating parameter is allowed or tolerated for the start-up period . Additionally, no settings are used or ig nored to trigger the detection of the fault event and / or an activation of low voltage fault ride through settings is blocked and / or a time threshold is adj usted for activating 2024PF00296 Subsequent Filing Version

[0170] 36 the low voltage fault ride through settings . Thus , the controller may be adapted to allow a violation of an operational threshold by an operating parameter of the electrolyzer power supply system 4 and / or of the electrolyzer 3 for a predetermined duration when the network voltage Unetis outside the tolerance band 10 and / or outside the stability range 12 from the reference network voltage 9 during a start-up or ramp-up of the electrolyzer 3 .

[0171] Additionally, at least one of or any combination of the following measures is made in order to maintain the electrolysis system 1 operating as an electrical load between t2and t6:

[0172] The voltage values of the network voltage Unetand corresponding time stamps are recorded and the time-dependent voltage characteristic of Unetis compared with the low voltage fault ride through curve requirement .

[0173] Additionally or alternatively, i f the voltage-time characteristic of Unetexceeds the low voltage fault ride through curve limit ULVRT, the electrolysis system 1 is allowed to shut down and, i f desired, a shut-down and / or a trip signal is sent .

[0174] Additionally or alternatively, the operator of the electrical network can define the shut down or trip limits of the electrolysis system 1 depending on the pre-defined limits of the electrolysis system 1 .

[0175] Additionally or alternatively, the low voltage fault ride through event may directly af fect the direct current feeding of the electrolyzer 3 and thus the gas production . In order to ride through the fault event , an operating point of the electrolysis system 1 , particularly of the trans former 16 and / or of the converter 5 and / or of the electrolyzer 3 and / or of the auxiliary system is maintained or stored, such as a valve position or the like to support a fast ramp-up of the electrolysis system 1 after the fault event has been cleared 2024PF00296 Subsequent Filing Version

[0176] 37 by providing the former operating points to the relevant control systems , for example as updated operating points .

[0177] Additionally or alternatively, the operating point of an auxiliary system, such as a production mass flow control element setting or an actuator setting may be maintained and / or stored . Additionally or alternatively, a time constant of a control loop may be reduced, particularly in a manner to activate a fast control mode which allows a timely reaction to the adj usted mass flows .

[0178] Additionally or alternatively, the operating point of the auxiliary system may comprise a cooling mass flow . During the stand-by mode of the electrolyzer 3 , the cooling mass flow of the auxiliary system may be increased to protect the electrolyzer 3 or regulated in order to provide a constant temperature to the electrolysis system required for faster ramp-up after the fault is cleared .

[0179] Additionally or alternatively, the auxiliary system may comprise a compressor, wherein a setpoint of the compressor may be shi fted during the stand-by mode of the electrolyzer 3 according to a change of production of the energy carrier . Alternatively, i f a buf fer tank or volume between the electrolyzer 3 and the compressor is suf ficiently si zed, the setpoint may remain unchanged .

[0180] Additionally or alternatively, the auxiliary system, particularly the compressor system, enters an auxiliary operating mode in the event of a system shutdown due to undervoltage , wherein the auxiliary operating mode particularly allows a quick restart after the fault has been cleared . The auxiliary operating mode may be a " recycle / zero mass flow mode" of the compressor system .

[0181] Additionally or alternatively, a time delay for operational shutdown due to threshold violations of the electrolyzer 3 is 2024PF00296 Subsequent Filing Version

[0182] 38 increased, whereas a time delay for safety relevant measurements is not adj usted . Depending on the reaction time of the electrochemical process of the electrolyzer 3 and / or the required reaction time of the electrolyzer 3 to prevent a critical condition, certain safety-related measurements may be modi fied by adj usting the respective threshold value , the integral of the threshold value or the delay time . The reason for these modi fications is that during such a fault event , the violation of the operating thresholds can be tolerated since it is known that the cause is due to a disturbance in the power supply by the electrical network 7 and not to the electrolysis system 1 itsel f .

[0183] Additionally or alternatively, the voltage of the electrolysis system 1 may be adj usted in order to allow a quick start of the electrolysis system 1 after the fault event has been cleared . This is due to the high voltage dependence of the absorption of direct current and gas production by the electrolysis system 1 as shown in Figure 2 . Therefore , the controller is adapted to operate the on-load tap changer 14 for changing a switching state for compensating the voltage dip of the network voltage Unetparticularly when a low voltage fault ride through event is detected to ensure suf ficient power supply of the electrolyzer 3 after the fault event is cleared . Additionally or alternatively, the voltage control of the converter system 5 may be adj usted to boost the voltage suf ficiently to allow further operation of the electrolysis after fault clearance .

[0184] Additionally or alternatively, other measures may be taken to increase the voltage input such as a capacitive current inj ection and / or a switching operation or setpoint adj ustment of the converter 5 and / or of the trans former 16 . All these operations can be performed after the voltage has left the tolerance band 10 at t2(possibly with a delay or depending on the actual voltage dip of the network voltage Unet) . It is possible to operate the on-load tap changer 14 of the line 2024PF00296 Subsequent Filing Version 39 trans former 16 or the on-load tap changer 14 of any downstream trans former or to operate more than one downstream onload tap changer or to apply additional measures instead of / in addition to ensuring a suf ficient voltage increase at the electrolyzer 3 .

[0185] Additionally or alternatively, the setpoints or control schemes of the converter 5 which optionally is capable of reactive power adj ustment may be adj usted to provide a stable power factor cos(4>) at the point of connection 14 , and / or to provide a capacitive current to the electrical network 7 , e . g . , based on a Q(l ) control scheme or a voltage limiting function, and / or to provide a predefined reactive power or current , and / or to provide the maximum capacitive power / cur- rent currently available .

[0186] Additionally or alternatively, after the fault has been cleared, measures to reduce the inrush current may be applied, especially in cases where the network voltage Unetis recovering quickly . These additional measures may be activated when a defined — and / or time dependent voltage recov- dt ery value or other equation is exceeded and may modi fy the ramp-up rate of the electrolyzer 3 or adj ust the connec- tion / restart of parallel electrolyzers 3 . In particular, these measures take into account the restarting or charging of a trans former 16 , the electrolyzer 3 and / or the auxiliary system, particularly downstream . In order to reduce the total inrush current , it is possible to switch on or ramp-up the various trans formers 16 and / or electrolyzers 3 and / or auxiliary systems of the electrolysis system 1 one after the other .

[0187] Additionally or alternatively, the electrolyzer 3 and / or the auxiliary system and / or the electrolyzer power supply system 4 goes into a stand-by mode i f the electrolysis system 1 , particularly the electrolyzer 3 and / or the electrolyzer power supply system 4 and / or the auxiliary system, shuts down or trips due to undervoltage . Said stand-by mode allows a quick 2024PF00296 Subsequent Filing Version

[0188] 40 restart after the fault event has been cleared . Measures to reduce an aging of the electrolyzer 3 such as applying a polari zation voltage to the electrolyzer 3 by the converter may be applied during the stand-by mode . Additionally or alternatively, an auxiliary system required for the stand-by mode can either be restarted i f fast enough or be buf fered .

[0189] The stand-by mode may include the activation of a polari zation unit to prevent the voltage of the electrolyzer 3 from dropping below the Nernst voltage , optionally with a defined safety margin . This measure is used to prevent the electrolyzer 3 from entering a harmful fuel cell mode .

[0190] Additionally or alternatively, in order to avoid loss of electrical power input 6 , 8 when the electrolysis system 1 shuts down or trips , additional electrical loads ( such as chopper resistors ) may be activated to match the pre- fault consumption of electrical power by the electrolysis system 1 , particularly with an accuracy of plus / minus 10% . Preferably, these electrical loads provide a stable current consumption, which is preferably equal to the pre- fault current consumption of the electrolysis system 1 . When the electrolysis system 1 is restarted, these additional electrical loads may be shut down in a manner that matches the ramp-up rate of the electrolysis system 1 and optionally of additional auxiliary systems . The power adj ustment between these systems may be continuous , possibly with the support of smoothing power storage systems , or in discrete steps , e . g . i f the additional electrical load can only be switched on / of f without the possibility to control the electrical power input 6 , 8 ( for economic reasons a converter system may not be used) .

[0191] Additionally or alternatively, additional electrical loads may be activated to match the required power consumption characteristic i f power is required during the fault , for example to enable a linear power drop in relation to the voltage drop (voltage drop of 20% equals power input drop of 20% ) . An additional control loop can be enabled to monitor 2024PF00296 Subsequent Filing Version

[0192] 41 and control the power consumption during the fault event . This auxiliary control loop and the additional electrical load may be deactivated after the fault event has cleared or the rest of the electrolysis system 1 has returned to prefault power consumption .

[0193] Additionally or alternatively, after the fault has been cleared and the electrolysis system 1 has been shut down or has tripped, the electrolysis system 1 can be restarted . The ramp-up rate of the electrolysis system 1 may be determined by the respective limit defined by the stand-by mode of the electrolyzer 3 or operational limits , which may be provided by the grid operator or the downstream process .

[0194] The measures as listed in Figure 3 and Figure 4 may also be combined .

[0195] Figure 5 shows a schematic flow diagram of the method for operating the electrolysis system 1 .

[0196] In a first step S I , a fault event of the electrical network 7 is detected when a network voltage 9 of the electrical network 7 leaves tolerance band 10 around a reference network voltage 11 of the electrical network 7 .

[0197] Additionally, the fault event of the electrical network 7 is detected when a rate of change of the network voltage 9 and a rate of change of a network current received by the electrolyzer power supply system 2 from the electrical network 7 via a point of connection 13 of the electrolyzer power supply system 2 to the electrical network 7 both have a same direction, particularly in at least two current carrying phases of the point of connection 13 . This may be applied when the electrolysis system 1 operates an electrical load .

[0198] Additionally or alternatively, the fault event of the electrical network 7 is detected when a rate of change of the network voltage 9 and a rate of change of the network current 2024PF00296 Subsequent Filing Version

[0199] 42 transmitted from a plant to the electrical network 7 via the point of connection 13 both have a di f ferent direction, particularly in at least two current carrying phases of the point of connection 13 . The plant may comprise the electrolysis system 1 and an electrical power source , which may be electrically connected to the point of connection 13 . The plant is electrically connected to the electrical network 7 via the point of connection . The fault event is determined at an operating point of the plant , where the electrical power source produces more electrical power than the electrolysis system 1 consumes or is adapted to consume . This may be applied when the electrolysis system 1 is part of the plant .

[0200] Additionally or alternatively, an internal fault is detected when the rate of change of the network voltage 9 and the rate of change of the network current received by the electrolyzer power supply system 2 from the electrical network 7 both have a di f ferent direction, particularly in the at least two current carrying phases of the point of connection 13 . This may be applied when the electrolysis system 1 operates an electrical load .

[0201] In a second step S2 , a violation of an operational threshold of the electrolyzer 3 by an operating parameter, particularly of the electrolyzer power supply system ( 2 ) and / or of the electrolyzer ( 3 ) , is allowed for a predetermined duration when the network voltage 9 is outside the tolerance band 10 and within a stability range 12 from the reference network voltage 11 .

[0202] Additionally, a switching state of an on-load tap changer 14 is changed and / or a conversion rate of the converter 5 is altered for adj usting the direct current electrical power input

[0203] 8 of the electrolyzer 3 corresponding to the network voltage

[0204] 9 of the electrical network 7 when the network voltage 9 is outside the tolerance band 10 and within the stability range 12 from the reference network voltage 11 . Alternatively, the 2024PF00296 Subsequent Filing Version

[0205] 43 on-load tap changer 14 is temporarily prevented from switching for a duration of the fault event .

[0206] Additionally or alternatively, a setting of an operating point of the electrolyzer power supply system 2 and / or of the electrolyzer 3 and / or of an auxiliary system is maintained and / or stored, particularly from a point of time t before of when the fault event is detected .

[0207] Additionally or alternatively, the operating point of the electrolyzer power supply system 2 and / or of the electrolyzer 3 and / or of the auxiliary system is adj usted corresponding to the network voltage 9 of the electrical network 7 upon detection of the fault event , particularly when the network voltage 9 is outside tolerance band 10 and within the stability range 12 from the reference network voltage 11 .

[0208] Additionally or alternatively, the electrolyzer 3 and / or the auxiliary system is maintained in a stand-by mode when the network voltage 9 leaves the stability range 12 , wherein the stand-by mode optionally comprises controlling the electrolyzer power supply system 2 or an auxiliary system to provide a polari zation voltage for the electrolyzer 3 and / or setting the auxiliary system in an auxiliary operating mode which particularly allows an increased cooling of the electrolyzer 3 or enables a stable temperature .

[0209] Additionally or alternatively, a violation of the stability range 12 by the network voltage 9 is allowed or tolerated during an initial start-up and / or a ramp-up of the electrolyzer 3 , particularly from the stand-by mode of the electrolyzer 3 .

[0210] Additionally or alternatively, the alternating current electrical power input 6 and / or the direct current electrical power input 8 is redirected from the electrolyzer 3 to an electrical load, which is adapted to receive at least partly the alternating current electrical power input 6 and / or the 2024PF00296 Subsequent Filing Version 44 direct current electrical power input 8 from the electrolyzer power supply system 2 instead of the electrolyzer 3 , when the network voltage 9 leaves the stability range 12 .

[0211] Additionally or alternatively, the alternating current electrical power input 6 and / or the direct current electrical power input 8 is redirected from the electrical load to the electrolyzer 3 when the network voltage 9 is within the stability range 12 or within the tolerance band 10 from the reference network voltage 11 , particularly corresponding to a ramp-up rate of the electrolyzer 3 .

[0212] Additionally or alternatively, the respective electrolyzer 3 of a plurality of electrolyzers 3 is connected or disconnected, particularly shut down or ramped up, in a sequence , wherein an order of the sequence is particularly based on an aging parameter of the respective electrolyzer 3 and / or the available power consumption .

[0213] Additionally or alternatively, an energy storage unit for storing an electrical energy received from the electrical network 7 , is filled up at least partly with the electrical energy, particularly with the active and / or the reactive energy .

[0214] Additionally or alternatively, the electrical energy, from the storage unit is provided as active and / or reactive power at least partly to the electrolyzer power supply system 2 and / or to the electrolyzer 3 and / or to the electrical network 7 , particularly after detecting the fault event .

[0215] Additionally or alternatively, a power factor of the electrolyzer power supply system 2 and / or of the electrolyzer 3 is adj usted or maintained, particularly by altering the conversion rate of the converter 5 and / or changing the switching state of the on-load tap changer 14 . 2024PF00296 Subsequent Filing Version

[0216] 45

[0217] Additionally or alternatively, the direct current electrical power input 8 for the electrolyzer 3 is regulated, particularly within an operating current limit of the electrolyzer 3 and / or in a milli-second domain .

[0218] It will be obvious for a person skilled in the art that these embodiments and items only depict examples of a plurality of possibilities . Hence , the embodiments shown here should not be understood to form a limitation of these features and con- figurations . Any possible combination and configuration of the described features can be chosen according to the scope of the invention .

Claims

2024PF00296 Subsequent Filing Version46Patent claims1. Electrolysis system (1) comprising an electrolyzer power supply system (2) and an electrolyzer (3) , wherein the electrolyzer power supply system (2) comprises at least one transformer unit (4) and a converter (5) and is adapted to receive an alternating current electrical power input (6) from an electrical network (7) and to convert the alternating current electrical power input (6) into a direct current electrical power input (8) for the electrolyzer (3) , which is adapted to convert the direct current electrical power input (8) into an energy carrier, further comprising a controller, particularly an electrolyzer power supply system controller and / or an electrolyzer controller that is adapted to detect a fault event of the electrical network (7) when a network voltage (9) of the electrical network (7) leaves a tolerance band (10) around a reference network voltage (11) of the electrical network (7) , wherein the controller is adapted to allow a violation of an operational threshold by an operating parameter, particularly of the electrolyzer power supply system (2) and / or of the electrolyzer (3) , for a predetermined duration when the network voltage (9) is outside the tolerance band (10) and within a stability range (12) from the reference network voltage (11) , characterized in that the allowing comprises blocking and / or delaying an action that is triggered by the violation of the operating parameter .

2. Electrolysis system (1) according to claim 1, characterized in that the controller is adapted to detect the fault event of the electrical network (7) when a rate of change of the network voltage (9) and a rate of change of a network current received by the electrolyzer power supply system (2) from the electrical network (7) via a point of connection (13) of the electrolyzer power supply system (2) to the electrical network (7) both have a same direction and / or when a rate of change of the network voltage (9) and a rate of2024PF00296 Subsequent Filing Version47 change of the network current transmitted to the electrical network (7) via the point of connection (13) both have a different direction, particularly in at least two current carrying phases of the point of connection (13) , and / or the controller is adapted to detect an internal fault when the rate of change of the network voltage (9) and the rate of change of the network current received by the electrolyzer power supply system (2) from the electrical network (7) both have a different direction, particularly in the at least two current carrying phases of the point of connection (13) .

3. Electrolysis system (1) according to one of the preceding claims, characterized in that the transformer unit (4) optionally comprises an on-load tap changer (14) and the controller is adapted to change a switching state of the on-load tap changer (14) and / or the controller is adapted to alter a conversion rate of the converter (5) for adjusting the direct current electrical power input (8) of the electrolyzer (3) corresponding to the network voltage (9) of the electrical network (7) when the network voltage (9) is outside the tolerance band (10) and within the stability range (12) from the reference network voltage (11) .

4. Electrolysis system (1) according to claim 1 or 2, characterized in that the transformer unit (4) or any other upstream transformer unit between the electrolysis system (1) and the electrical network (7) comprises the on-load tap changer (14) and the controller is adapted to temporarily prevent a switching of the on-load tap changer for a duration of the fault event.

5. Electrolysis system (1) according to one of the preceding claims, characterized in that the controller is adapted to maintain and / or store a setting of an operating point of the electrolyzer power supply system (2) and / or of the electrolyzer (3) and / or of an auxiliary system, particularly from a point of time (t- before of when the fault event is detected .2024PF00296 Subsequent Filing Version486. Electrolysis system (1) according to one of the preceding claims, characterized in that the controller is adapted to adjust the operating point of the electrolyzer power supply system (2) and / or of the electrolyzer (3) and / or of the auxiliary system corresponding to the network voltage (9) of the electrical network (7) upon detection of the fault event, particularly when the network voltage (9) is outside the tolerance band (10) and within the stability range (12) from the reference network voltage (11) .

7. Electrolysis system (1) according to one of the preceding claims, characterized in that the controller is adapted to maintain the electrolyzer (3) and / or the auxiliary system in a stand-by mode when the network voltage (9) leaves the stability range (12) , wherein the stand-by mode optionally comprises the controller being adapted to control the electrolyzer power supply system (2) to provide a polarization voltage for the electrolyzer (3) and / or the controller being adapted to set the auxiliary system in an auxiliary operating mode which particularly allows an increased cooling of the electrolyzer (3) or a stable temperature, particularly of the electrolyzer (3) .

8. Electrolysis system (1) according to one of the preceding claims, characterized in that the controller is adapted to allow the violation of the stability range (12) by the network voltage (9) during an initial start-up and / or a ramp- up of the electrolyzer (3) , particularly from the stand-by mode of the electrolyzer (3) .

9. Electrolysis system (1) according to one of the preceding claims, characterized in that further comprising an electrical load which is adapted to receive at least partly the alternating current electrical power input (6) and / or the direct current electrical power input (8) from the electrolyzer power supply system (2) instead of the electrolyzer (3) , wherein the controller optionally is adapted to redirect the2024PF00296 Subsequent Filing Version49 alternating current electrical power input (6) and / or the direct current electrical power input (8) from the electrolyzer (3) to the electrical load when the network voltage (9) leaves the tolerance band (10) and / or the stability range (12) and / or wherein the controller optionally is adapted to redirect the alternating current electrical power input (6) and / or the direct current electrical power input (8) from the electrical load to the electrolyzer (3) when the network voltage (9) is within the tolerance band (10) and / or the stability range (12) from the reference network voltage (11) , particularly corresponding to a ramp-up rate of the electrolyzer ( 3 ) .

10. Electrolysis system (1) according to one of the preceding claims, characterized in that comprising a plurality of electrolyzers (3) , wherein the controller is adapted to connect or disconnect, particularly to shut down or ramp up, the respective electrolyzer (3) of the plurality of electrolyzers (3) in a sequence, wherein an order of the sequence is particularly based on an aging parameter of the respective electrolyzer (3) and / or an available power consumption of the respective electrolyzer (3) .

11. Electrolysis system (1) according to one of the preceding claims, characterized in that further comprising an energy storage unit for storing an electrical energy received from the electrical network (7) , wherein the controller optionally is adapted for a fault ride through event to fill up the energy storage unit at least partly with the electrical energy, and / or wherein the controller is adapted to provide the electrical energy, particularly an active and / or a reactive energy, from the storage unit at least partly to the electrolyzer power supply system (2) and / or to the electrolyzer (3) and / or to the electrical network (7) , particularly after detecting the fault event, and / or wherein the controller is adapted to adjust or maintain a power factor of the electrolyzer power supply system (2) and / or of the electrolyzer (3) , particularly by altering the conversion rate of2024PF00296 Subsequent Filing Version50 the converter (5) and / or changing the switching state of the on-load tap changer (14) .

12. Electrolysis system (1) according to one of the preceding claims, characterized in that the converter (5) is adapted to regulate the direct current electrical power input (8) for the electrolyzer (3) , particularly within an operating current limit of the electrolyzer (3) and / or in a millisecond domain.

13. Method for operating an electrolysis system (1) comprising an electrolyzer power supply system (2) and an electrolyzer (3) , wherein the electrolyzer power supply system (2) comprises at least one transformer unit (4) and a converter (5) and receives an alternating current electrical power input (6) from an electrical network (7) and converts the alternating current electrical power input (6) into a direct current electrical power input (8) for the electrolyzer (3) , which converts the direct current electrical power input (8) into an energy carrier, comprising the steps of:Detecting a fault event of the electrical network (7) when a network voltage (9) of the electrical network (7) leaves a tolerance band (10) around a reference network voltage (11) of the electrical network (7) ;Allowing a violation of an operational threshold of the electrolyzer (3) by an operating parameter, particularly of the electrolyzer power supply system (2) and / or of the electrolyzer (3) , for a predetermined duration when the network voltage (9) is outside the tolerance band (10) and within a stability range (12) from the reference network voltage (11) ; characterized in that the allowing comprises blocking and / or delaying an action that is triggered by the violation of the operating parameter .

14. Computer program comprising instructions which, when the program is executed by a controller, particularly by an elec-2024PF00296 Subsequent Filing Version51 trolysis system controller and / or an electrolyzer power supply system controller and / or an electrolyzer controller, cause the controller to carry out the steps of the method of claim 13 .15 . Computer-readable storage medium having stored thereon the computer program of claim 14 .16 . Controller, particularly an electrolysis system controller and / or an electrolyzer power supply system controller and / or an electrolyzer controller, comprising a computer- readable storage medium having stored thereon the computer program of claim 14 and optionally means to execute the method of claim 13 .17 . Electrical power system comprising the electrolysis system ( 1 ) of one of the claims 1 to 12 and / or the controller of claim 16 .

Images