LNG / Methanol Dual Fuel Tank Pressure Safety Threshold Interlock Control System

Abstract

The present invention relates to the technical field of ship fuel tank safety control, and discloses an LNG / methanol dual-fuel tank pressure safety threshold interlock control system. The system comprises: a dual-source data acquisition module, a dynamic threshold calculation module, an interlock arbitration module, and a core control unit. The dual-source data acquisition module divides the LNG and methanol pressure data streams based on preset medium separation rules; the dynamic threshold calculation module generates a safety threshold set through partial pressure gradient analysis and phase compensation calculation; the interlock arbitration module jointly verifies the threshold and maps the valve group instructions according to the priority matrix; and the core control unit verifies the execution parameters and generates the final interlock instruction. The system integrates the bus communication interface, the actuator module, and the safety log module to realize dynamic monitoring of the dual-fuel pressure, adaptive adjustment of the threshold, and optimization of the interlock action, thereby improving safety and response efficiency.

Description

Technical Field

[0001] The present invention relates to the technical field of ship fuel tank safety control, and in particular to a pressure safety threshold interlock control system for an LNG / methanol dual fuel tank. Background Art

[0002] As marine propulsion systems transition towards green and low-carbon development, LNG (liquefied natural gas) and methanol are widely used as clean fuels in dual-fuel vessels. However, the complexity of storing multiple media within dual-fuel tanks poses significant challenges to pressure safety control. Traditional single-tank pressure control systems struggle to meet the requirements of multi-channel data fusion, dynamic threshold calculation, and interlocking control in a dual-fuel environment. The main technical bottlenecks are:

[0003] The physical and chemical properties of LNG and methanol differ significantly. LNG is a cryogenic liquefied gas, and its pressure characteristics are closely related to temperature and phase change processes. Methanol, on the other hand, is volatile, and the pressure distribution of its gas and liquid phases is significantly affected by ambient temperature and the liquid level in the tank. Traditional control systems use a single data acquisition and processing mode, which is unable to effectively separate the pressure data streams of different media, resulting in data confusion and misjudgment. For example, if the gas and liquid phase pressures of methanol are not distinguished, the safety threshold may be mistakenly triggered due to uncorrected changes in the saturated vapor pressure, or the pressure control may be delayed due to failure to consider the partial pressure gradient characteristics of LNG.

[0004] In existing technologies, safety thresholds are mostly based on fixed parameter presets and lack the ability to dynamically respond to real-time operating conditions. For methanol fuel tanks, phase changes (such as gas-liquid two-phase conversion) will cause drastic fluctuations in pressure characteristics. Traditional static thresholds cannot be dynamically adjusted with temperature coupling data and phase change critical points, which may cause insufficient threshold coverage or excessive sensitivity. For example, when the temperature changes suddenly, if the change in the saturated vapor pressure of methanol is not corrected by the state equation, it may cause the safety threshold to not match the actual risk, increasing the risk of leakage or overpressure. For LNG fuel tanks, if the real-time changes in the partial pressure gradient (such as the pressure difference between different compartments) are not dynamically analyzed, the threshold may not accurately reflect the pressure safety boundary of each area.

[0005] Traditional interlock control systems use fixed priority logic, making it difficult to cope with the complex conflicts encountered during multi-threshold cross-validation in dual-fuel tanks. When the pressure thresholds of LNG and methanol simultaneously trigger control commands of different levels, the static priority matrix may not achieve optimal arbitration of the commands, resulting in delayed or malfunctioning valves. Furthermore, the actuator's valve control lacks optimization of pipeline topology and timing constraints. For example, if the action sequence is not generated based on the valve's physical node coordinates and the shortest switching path, this can lead to excessive interlock response time or an unreasonable valve operation sequence, compromising system safety and response efficiency.

[0006] Existing systems typically utilize independent architectures for modules such as data acquisition, threshold calculation, and interlock arbitration. Inconsistent communication protocols lead to data transmission delays and compatibility issues. Furthermore, the lack of redundant verification mechanisms and security logging makes it difficult to ensure data validity and trace incidents. For example, a single sensor failure could cause the entire control system to malfunction, and the lack of security logging makes it impossible to fully analyze the trajectory of abnormal pressure events. Summary of the Invention

[0007] The object of the present invention is to provide a pressure safety threshold interlock control system for an LNG / methanol dual fuel tank to solve the problems raised in the above background technology.

[0008] To achieve the above objectives, the present invention provides the following technical solution: an LNG / methanol dual fuel tank pressure safety threshold interlock control system, the system comprising:

[0009] A dual-source data acquisition module is used to obtain multi-channel pressure sensing data of the LNG storage unit and the methanol storage unit in the fuel tank, and divide the multi-channel pressure sensing data into an LNG pressure data stream and a methanol pressure data stream based on a preset medium separation rule;

[0010] a dynamic threshold calculation module, configured to perform a partial pressure gradient analysis on the LNG pressure data stream to generate a first safety threshold set, and perform a phase compensation calculation on the methanol pressure data stream to generate a second safety threshold set;

[0011] an interlock arbitration module, configured to perform a joint check on the first safety threshold set and the second safety threshold set according to a preset interlock priority matrix, and then map the resultant to corresponding valve group control instructions, and use the valve group control instructions as execution parameters for the current working condition;

[0012] A core control unit is used to send the multi-channel pressure sensing data to the dynamic threshold calculation module, send the first safety threshold set and the second safety threshold set to the interlock arbitration module, and perform logical verification on the execution parameters to generate a final interlock instruction.

[0013] Preferably, the dynamic threshold calculation module performs phase compensation calculation on the methanol pressure data flow, including:

[0014] dividing a continuous sampling sequence in the methanol pressure data stream into a gas phase component set and a liquid phase component set, and performing saturated vapor pressure correction on the gas phase component set based on a preset state equation to generate a compensated pressure set;

[0015] Performing thermodynamic equilibrium processing on the temperature coupling data in the methanol pressure data stream, extracting the critical phase change characteristics of each equilibrium node and constructing a phase transition map;

[0016] The compensation pressure set is correlated and calibrated with the phase transfer map to generate the second safety threshold set.

[0017] Preferably, the preset medium separation rules include a basic sensor set and a redundant sensor set; the basic sensor set includes a main pressure transmitter identifier and a differential pressure sensor identifier; the redundant sensor set includes a safety valve feedback identifier and an emergency shut-off valve status identifier, and each identifier corresponds to an independent data verification channel.

[0018] Preferably, the bus communication interface is used to implement protocol adaptation of the dual-source data acquisition module, the dynamic threshold calculation module, and the interlock arbitration module to the fuel tank control network respectively;

[0019] The dual-source data acquisition module divides the multi-channel pressure sensing data based on the preset medium separation rule, including:

[0020] Periodically receiving raw data frames from the fuel tank control network via the bus communication interface, and matching the message headers of the raw data frames according to the identifiers in the basic sensor set to separate the basic sensor segments;

[0021] Traversing the extended field of the original data frame according to the identifier in the redundant sensing set to extract a redundant check segment;

[0022] The basic sensing segment and the redundant check segment are aligned according to the timestamp and then written into the LNG data buffer area and the methanol data buffer area respectively.

[0023] Preferably, when the preset interlock priority matrix adopts a static decision model, the valve group control instruction is a discrete mapping result of the joint verification value of the first safety threshold set and the second safety threshold set;

[0024] When the preset interlocking priority matrix adopts a dynamic arbitration model, the valve group control instruction is a set of operation sequences that are calibrated in real time on the cross comparison results of the first safety threshold set and the second safety threshold set through a conflict resolution algorithm.

[0025] Preferably, the system further comprises an actuator module connected to the core control unit, and the actuator module is connected to the fuel tank valve database via the bus communication interface;

[0026] The actuator module is used to screen the target valve list from the fuel tank valve database according to the valve operation requirements in the final interlock instruction, and generate a valve action sequence to optimize the interlock response logic.

[0027] Preferably, the system actuator module generates a valve action sequence comprising:

[0028] Loading a fuel tank pipeline topology model, and locating the physical node coordinates of each valve in the target valve list in the pipeline model;

[0029] Calculating the shortest switching path from the initial state of each valve to the target control state based on a timing constraint algorithm, and sorting the target valve list according to action priority;

[0030] The shortest switching path and the execution sequence are integrated into the pipeline model to generate a visual valve action sequence.

[0031] Preferably, when the core control unit performs logical verification on the execution parameters, a dual audit mode of a fault-tolerant verification mechanism and a conflict detection mechanism is adopted, wherein the fault-tolerant verification mechanism is used to confirm the validity of the data, and the conflict detection mechanism is used to resolve the mutual exclusion relationship between instructions.

[0032] Preferably, the system further comprises an instruction encoding module connected to the core control unit, the instruction encoding module being used to convert the final interlocking instruction into a valve drive code, and to send the valve drive code to a designated actuator through the bus communication interface to trigger an interlocking action.

[0033] Preferably, the system also includes a security log module connected to the core control unit, and the security log module is used to archive the multi-channel pressure sensing data, the first safety threshold set, the second safety threshold set, the valve group control instructions and the final interlocking instructions, and generate pressure safety event records in a time series.

[0034] Compared with the prior art, the present invention has the following beneficial effects:

[0035] The dual-source data acquisition module uses preset media separation rules to divide multi-channel pressure sensor data into independent data streams for LNG and methanol. The basic sensor set (primary pressure transmitter, differential pressure sensor) and the redundant sensor set (safety valve feedback, emergency shut-off valve status) form dual verification channels. This design not only accurately isolates pressure data from different media, preventing misjudgments caused by data confusion, but also improves data reliability through independent verification channels. For example, if the primary pressure transmitter experiences an anomaly, the safety valve feedback data from the redundant sensor set serves as a backup, ensuring the system continues to obtain valid pressure information and minimizing the impact of a single sensor failure.

[0036] The dynamic threshold calculation module employs algorithms tailored to the distinct physical properties of LNG and methanol: It performs partial pressure gradient analysis on the LNG pressure data stream to generate a first set of safety thresholds that dynamically change with the spatial pressure distribution, accurately reflecting the pressure safety boundaries of each compartment. It also performs phase compensation calculations on the methanol pressure data stream, generating a second set of safety thresholds that adjust in real time with temperature and phase transition state through saturated vapor pressure correction and phase transition map construction. This differentiated approach allows threshold settings to better align with actual operating conditions. For example, when the methanol temperature changes, the saturated vapor pressure can be corrected through the equation of state and combined with the phase transition map to adjust the safety threshold in real time, avoiding threshold hysteresis or false triggering due to phase changes and improving the system's adaptability to complex operating conditions.

[0037] The interlock arbitration module realizes the joint verification of the dual threshold sets through a preset interlock priority matrix. The combination of the static decision model and the dynamic arbitration model can flexibly respond to different scenarios. The static model is suitable for fast discrete mapping control under normal working conditions, while the dynamic model uses a conflict resolution algorithm to handle threshold cross-conflicts in real time to ensure the dynamic optimization of instruction priority. The actuator module generates a valve action sequence based on the pipeline topology model and the timing constraint algorithm. By locating the valve physical nodes, calculating the shortest switching path and action sorting, it significantly shortens the interlock response time and optimizes the operation sequence. For example, in a multi-valve linkage scenario, the system can automatically plan the optimal action sequence according to the pipeline topology, avoid valve operation conflicts, and improve emergency response efficiency.

[0038] The core control unit employs a dual audit mode, employing both fault-tolerant verification and conflict detection mechanisms, to ensure the validity of execution parameters and instruction compatibility. The instruction encoding module accurately converts digital instructions into physical actuators. The safety log module archives full-process data and generates time-series event records, providing a complete data chain for accident tracing and system optimization. The protocol adaptation function of the bus communication interface ensures seamless integration between each module and the fuel tank control network, enhancing system integration and real-time data transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 This is a working principle diagram of the LNG / methanol dual-fuel tank pressure safety threshold interlock control system according to the present invention;

[0040] Figure 2 This is the design diagram for methanol pressure phase compensation calculation;

[0041] Figure 3 Design diagram for bus communication interface data acquisition;

[0042] Figure 4 This is the design drawing of the actuator module;

[0043] Figure 5This is a design diagram for the double-audit model for logic verification. DETAILED DESCRIPTION

[0044] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0045] See also Figure 1-Figure 5 The present invention relates to an LNG / methanol dual fuel tank pressure safety threshold interlock control system, which includes: a dual-source data acquisition module, a dynamic threshold calculation module, an interlock arbitration module, and a core control unit. The specific implementation steps are as follows:

[0046] The dual-source data acquisition module acquires multi-channel pressure sensor data from the LNG and methanol storage units within the fuel tank and, based on preset media separation rules, divides the multi-channel pressure sensor data into LNG and methanol pressure data streams. The dynamic threshold calculation module performs partial pressure gradient analysis on the LNG pressure data stream to generate a first safety threshold set, and performs phase compensation calculation on the methanol pressure data stream to generate a second safety threshold set. The interlock arbitration module, based on a preset interlock priority matrix, jointly verifies the first and second safety threshold sets and maps them to the corresponding valve group control instructions, which serve as execution parameters for the current operating condition. The core control unit sends the multi-channel pressure sensor data to the dynamic threshold calculation module and the first and second safety threshold sets to the interlock arbitration module. It also performs logical verification on the execution parameters to generate the final interlock instruction.

[0047] Example 1: When the dynamic threshold calculation module in the system performs phase compensation calculation on the methanol pressure data stream, the specific implementation method is as follows: It is necessary to process the continuous sampling sequence in the methanol pressure data stream. During the actual operation of the fuel tank, the state of methanol is not a single gas phase or liquid phase, but is in a complex gas-liquid mixed state. Therefore, its pressure data stream contains a large amount of phase-related information. The dynamic threshold calculation module will analyze these continuous sampling sequences and divide them into gas phase component sets and liquid phase component sets according to the preset division rules. The division rules here are formulated based on the phase characteristics of methanol under different pressure and temperature conditions. For example, within a specific pressure range, methanol is more inclined to exist in the gas phase or liquid phase. The division of the gas phase component set and the liquid phase component set is achieved by judging the pressure value, temperature value and other parameters of the sampling data.

[0048] After obtaining the gas phase component set, the saturated vapor pressure is corrected based on the preset state equation. The preset state equation is a mathematical model established based on the physical and chemical properties of methanol, which can accurately describe the state changes of methanol at different temperatures and pressures. Through this state equation, each data point in the gas phase component set is calculated, and the influence of temperature on the saturated vapor pressure is taken into account. The pressure data of the gas phase component set is corrected to generate a compensated pressure set. The purpose of this step is to more accurately reflect the actual pressure of the gas phase of methanol, because in actual working conditions, the saturated vapor pressure of methanol will change with changes in temperature. Only by correcting it can we obtain pressure data that is more in line with the actual situation.

[0049] Thermodynamic equilibrium processing is performed on the temperature-coupled data in the methanol pressure data stream. Temperature is a key factor influencing methanol's phase state. The methanol pressure data stream contains a large amount of temperature-related data, which, coupled with the pressure data, jointly influences the methanol's phase state. The dynamic threshold calculation module analyzes this temperature-coupled data and processes it using the principles and methods of thermodynamic equilibrium to determine the thermodynamic equilibrium state of methanol at different times.

[0050] After completing the thermodynamic equilibrium process, it is necessary to extract the critical phase transition characteristics of each equilibrium node and construct a phase transition map. Each equilibrium node corresponds to the thermodynamic equilibrium state of methanol at a specific moment, in which the methanol may undergo a phase transition. The dynamic threshold calculation module extracts critical features related to phase transitions from these equilibrium nodes, such as the critical pressure and temperature values ​​at which phase transitions occur. By analyzing and integrating these critical features, a phase transition map is constructed, which intuitively displays the phase change process and trends of methanol under different pressure and temperature conditions.

[0051] The compensation pressure set is calibrated with the phase transition map to generate a second safety threshold set. The compensation pressure set reflects the corrected methanol vapor pressure, while the phase transition map illustrates the patterns of methanol phase changes. The dynamic threshold calculation module correlates the data from the compensation pressure set with the phase change characteristics in the phase transition map. Based on the critical conditions and patterns of phase transition, the compensation pressure set is calibrated to determine the safe pressure thresholds for the methanol storage unit under different operating conditions, generating the second safety threshold set.

[0052] Throughout the phase compensation calculation process, the dynamic threshold calculation module continuously processes and analyzes data to ensure accuracy and reliability at every step. For example, when dividing the gas and liquid phase components, the phase properties of each sampled data set must be accurately determined; when applying the preset equation of state for correction, the applicability of the equation and the accuracy of the calculation must be ensured; and when processing temperature-coupled data and constructing phase transition maps, the influence of various thermodynamic factors must be fully considered. This series of processing steps allows for a more comprehensive and accurate consideration of the impact of methanol's phase changes on the pressure safety threshold, thereby providing a more reliable second safety threshold set and improving the safety and stability of the entire LNG / methanol dual-fuel tank pressure safety threshold interlock control system. In practical applications, the dynamic threshold calculation module can perform phase compensation calculations on the methanol pressure data stream in real time based on the actual operating conditions of the fuel tank, promptly adjusting the second safety threshold set to adapt to varying operating conditions.

[0053] Example 2: The system's pre-set media separation rules include a basic sensor set and a redundant sensor set. The basic sensor set includes the main pressure transmitter identifier and the differential pressure sensor identifier, while the redundant sensor set includes the safety valve feedback identifier and the emergency shut-off valve status identifier. Each identifier corresponds to an independent data verification channel. The system also provides a bus communication interface, which is used to implement protocol adaptation between the dual-source data acquisition module, dynamic threshold calculation module, and interlock arbitration module and the fuel tank control network, ensuring normal and stable data transmission and interaction between each module and the control network.

[0054] The dual-source data acquisition module divides multi-channel pressure sensor data based on pre-set media separation rules. The specific implementation process is as follows: It periodically receives raw data frames from the fuel tank control network via the bus communication interface. These raw data frames transmitted from the fuel tank control network contain a large amount of data collected by various sensors within the fuel tank. This data is encapsulated in a specific frame format for easy transmission and identification within the network.

[0055] The basic sensing segment is isolated by matching the raw data frame's header with the identifiers in the basic sensing set. The raw data frame's header contains identification information such as the data type and source. The dual-source data acquisition module identifies the primary pressure transmitter and differential pressure sensor identifiers in the basic sensing set, finds the corresponding identification information in the header, and then determines the location of the basic sensing data in the raw data frame. This data is extracted to form the basic sensing segment. The primary pressure transmitter measures the primary pressure within the fuel tank, while the differential pressure sensor measures the pressure difference between different locations.

[0056] The extended field of the original data frame is traversed based on the identifiers in the redundant sensor set to extract the redundant check segment. The extended field of the original data frame stores additional auxiliary data, including the data corresponding to the safety valve feedback identifier and the emergency shut-off valve status identifier in the redundant sensor set. The dual-source data acquisition module traverses the extended field and, based on the safety valve feedback identifier and the emergency shut-off valve status identifier, finds the corresponding feedback data and status data, extracting them to form the redundant check segment. The safety valve feedback data reflects the operating status of the safety valve, while the emergency shut-off valve status data indicates whether the emergency shut-off valve is operating normally.

[0057] After separating the basic sensing segment and the redundant check segment, these two data segments need to be aligned based on their timestamps. Because the data collection times for the basic sensing segment and the redundant check segment may differ slightly, to ensure data consistency and accuracy, the two segments need to be aligned on the timeline based on the timestamp information contained in the data, so that they correspond to the operating conditions at the same moment.

[0058] After timestamp alignment is complete, the basic sensing segment and redundant check segment are written to the LNG data buffer and methanol data buffer, respectively. Based on pre-set media separation rules, pressure sensing data for different media (LNG and methanol) must be stored separately for subsequent processing and analysis. The dual-source data acquisition module writes the basic sensing segment and redundant check segment to the corresponding LNG data buffer or methanol data buffer, depending on the media type.

[0059] Throughout the data collection and classification process, the bus communication interface must maintain stable communication with the fuel tank control network to ensure accurate and timely reception of raw data frames. Furthermore, the dual-source data acquisition module must accurately match identifiers and extract data to avoid data errors caused by incorrect identifier recognition or incomplete data extraction.

[0060] By establishing a primary sensor set and a redundant sensor set, along with corresponding independent data verification channels, the system achieves dual collection and verification of pressure sensor data. The primary sensor set provides primary pressure data, while the redundant sensor set verifies and supplements this data. When anomalies in the primary sensor data occur, the redundant sensor data serves as a reference, ensuring the system's timely detection and improving system reliability and safety. The protocol adaptation function of the bus communication interface ensures smooth data exchange between each module and the fuel tank control network, enabling the dual-source data acquisition module to accurately obtain the required raw data. This data collection and partitioning method provides a reliable data foundation for subsequent dynamic threshold calculation and interlock arbitration, ensuring that the entire system can accurately calculate pressure safety thresholds and interlock control, thereby ensuring the safe operation of the LNG / methanol dual-fuel tank. In actual operation, the dual-source data acquisition module continuously and periodically acquires data from the fuel tank control network and processes it according to the aforementioned process, providing the system with the latest pressure sensor data in real time, enabling the system to respond promptly to the actual operating status of the fuel tank.

[0061] Example 3: There are two application scenarios for the preset interlocking priority matrix in the system, corresponding to the static decision model and the dynamic arbitration model respectively. The generation mechanism of the valve group control instruction under the two models is different. The specific implementation methods are as follows:

[0062] When the preset interlock priority matrix adopts a static decision model, the model pre-sets the priority logic based on the typical operating conditions and historical operating data of the fuel tank, and generates valve group control instructions for the joint verification value of the first safety threshold set and the second safety threshold set through discrete mapping rules. Specifically, the static decision model will first perform a joint verification on the first safety threshold set generated by the LNG pressure data stream and the second safety threshold set generated by the methanol pressure data stream. The joint verification process is to cross-compare the two sets of threshold data, for example, to determine whether the current pressure data exceeds the safety boundary of any threshold set, or whether the overlapping area of ​​the two sets of thresholds triggers a specific risk condition. After the verification is completed, the system will map the results of the joint verification to the corresponding valve group control instructions according to the preset discrete mapping table.

[0063] The discrete mapping table predefines the correspondence between different verification results and control instructions. For example, if the LNG pressure exceeds the upper limit of the first safety threshold set, while the methanol pressure is within the normal range of the second safety threshold set, the mapping table corresponds to the instruction to "open the LNG tank pressure relief valve." If both threshold sets trigger the mid-limit warning, the mapping is mapped to the instruction to "activate the bidirectional pressure balancing valve group." This mapping relationship is fixed and configured during system deployment based on safety regulations and engineering experience. It is not adjusted in real time during operation. Therefore, it is suitable for scenarios with relatively stable operating conditions and predictable pressure changes, such as routine pressure control during normal fuel tank operation.

[0064] When the preset interlock priority matrix adopts a dynamic arbitration model, the model introduces a real-time conflict resolution algorithm. By performing real-time calibration on the cross-comparison results of the first and second safety threshold sets, a set of operation sequences is generated as valve group control instructions. The implementation of the dynamic arbitration model first requires a real-time cross-comparison of the two threshold sets. The comparison includes dynamic parameters such as the threshold overlap area, pressure change rate, and phase transition trend. For example, when the LNG pressure approaches the lower limit of the first safety threshold set, while the methanol pressure is rapidly approaching the upper limit of the second safety threshold set, the system needs to comprehensively determine the risk priority of the two.

[0065] After cross-comparison, the system initiates a conflict resolution algorithm. This algorithm, based on dynamic decision-making mechanisms such as fuzzy logic or neural networks, evaluates conflicts between the two sets of thresholds. For example, if changes in LNG and methanol pressure simultaneously trigger thresholds of different priorities, the algorithm calculates the combined priority of each risk factor based on preset dynamic weighting factors (such as the hazard level of the medium and the impact of the pressure change rate on safety), and then determines the sequence and combination of valve actions. For example, if a sudden increase in methanol pressure poses a risk of flooding, while a slow increase in LNG pressure is a less significant risk, the algorithm will prioritize the sequence of closing the methanol feed valve and activating the LNG tank air supply valve.

[0066] The valve control instructions generated by the dynamic arbitration model are a set of operation sequences. Each sequence includes the valve action type (open, close, adjust), action timing, and parameter configuration. For example, an instruction might require "first open the methanol tank emergency pressure relief valve 1, and then close the LNG tank main inlet valve after a 5-second interval." This sequenced instruction can dynamically adjust the interlocking logic based on real-time operating conditions, adapting to complex operating conditions such as sudden pressure changes or multi-parameter coupling, such as during fuel tank refueling or in the event of a leak.

[0067] In actual applications, the switching between the static decision-making model and the dynamic arbitration model is automatically determined by the core control unit based on the operating mode of the fuel tank. When the system detects stable operating conditions (such as pressure fluctuations less than the preset threshold and gentle temperature changes), it automatically switches to the static decision-making model to improve response efficiency. When abnormal operating conditions are detected (such as sudden pressure changes or simultaneous over-limit of multiple media parameters), it switches to the dynamic arbitration model to enhance decision-making flexibility. The collaborative operation of the two models ensures the safety and adaptability of the system in different scenarios: the static model ensures control stability under normal operating conditions, while the dynamic model responds to sudden risks in complex operating conditions, avoiding false operations or delayed responses due to the limitations of a single decision-making logic.

[0068] Furthermore, both models of the preset interlock priority matrix must be calculated based on the first and second safety threshold sets transmitted by the core control unit. Before sending threshold data, the core control unit verifies the data's validity to ensure that the threshold sets have not deviated due to sensor failure or calculation errors. Whether using static mapping or dynamic arbitration, the generated valve group control instructions must be returned to the core control unit for logical verification. A dual audit mode (fault-tolerant verification mechanism and conflict detection mechanism) confirms the feasibility of the instructions, avoiding valve action conflicts or the execution of invalid instructions, thus forming a complete interlock control closed loop.

[0069] Example 4: The actuator module connected to the core control unit in the system is connected to the fuel tank valve database via a bus communication interface. The implementation method of generating a valve action sequence according to the valve operation requirements in the final interlocking instruction is as follows:

[0070] The actuator module first receives the final interlock command from the core control unit. This command specifies key information such as the valve type to be operated and the target state. Based on this information, the actuator module selects a list of target valves that meet the requirements from the fuel tank valve database. The fuel tank valve database stores detailed information on all valves, including valve model, installation location, control method, and operating parameters.

[0071] The actuator module needs to load the fuel tank piping topology model and locate the physical node coordinates of each valve in the target valve list within this model. The fuel tank piping topology model is a digital representation of the physical connections and spatial positions of all pipes and valves within the fuel tank. It graphically displays the pipeline routes, valve installation locations, and the connections between components. By loading this model, the actuator module can accurately determine the specific location of each target valve within the fuel tank.

[0072] After locating the physical node coordinates of each valve, the actuator module calculates the shortest switching path from each valve's initial state to the target control state based on a timing constraint algorithm. This algorithm is used to solve time-constrained path planning problems. It considers the time factor during valve operation and various constraints, such as valve opening and closing speeds and restrictions on the operating sequence of different valves.

[0073] Assume that there are multiple operation steps in the process of switching the valve from the initial state to the target control state, and the operation time of each step is , the time interval between steps is , then the total time of the entire switching path is It can be expressed as:

[0074]

[0075] in, is the number of operation steps in the switching process, Indicates the The time for each operation step, Indicates the The first step and The time interval between the operation steps. This formula is used to calculate the total time of different switching paths and thus find the shortest switching path.

[0076] When calculating the shortest switching path, the actuator module takes into account a variety of factors. The first is the operation type of the valve. Different types of valves (such as stop valves, control valves, safety valves, etc.) may have different switching speeds and operation methods, which will directly affect the time of the operation step. Secondly, the spatial relationship between valves. Valves that are closer may be able to complete continuous operations in a shorter time, while valves that are farther away need to consider factors such as the flow time of the fluid in the pipeline, which affects the time interval between steps. In addition, it is also necessary to consider the operating parameters such as pressure and temperature in the fuel tank, which will affect the properties and flow state of the fluid, and thus affect the operation process of the valve.

[0077] After determining the shortest switching path for each valve, the actuator module sorts the target valve list by action priority. This priority is determined based on multiple factors, including the impact of valve operation on system safety, the hazardous nature of the media involved, and the urgency of the operation. For example, valves handling flammable or explosive media typically receive a higher priority than valves handling standard media. Valves that can directly mitigate system overpressure risks also receive a higher priority.

[0078] The actuator module assigns a priority coefficient to each target valve This coefficient takes into account all of the above factors. A higher priority coefficient indicates a higher priority for the valve operation and should be executed first. When sorting the target valve list, the valves are arranged in descending order of priority coefficient to determine the execution order of each valve.

[0079] Finally, the actuator module integrates the shortest switching paths and execution order into the pipeline model to generate a visual valve motion sequence. During this integration process, the actuator module displays the shortest switching path for each valve in the pipeline model as an animation or graphic. It also adds time stamps to each valve's movement according to the execution order, creating a dynamic, visual motion sequence.

[0080] This visual action sequence intuitively displays each valve's action time and path, as well as the coordinated operation of each valve throughout the interlock response process. This visual action sequence allows operators to clearly understand the system's interlock response logic, facilitating monitoring and troubleshooting. Furthermore, this visual display facilitates optimization and verification of the interlock response logic during system design and commissioning.

[0081] Throughout the valve action sequence generation process, the actuator module maintains close interaction with the core control unit, the bus communication interface, and the fuel tank valve database. The actuator module receives the final interlocking instructions from the core control unit, exchanges data with the fuel tank valve database via the bus communication interface to obtain valve-related information, and feeds the generated valve action sequence back to the core control unit for further logical verification of the execution parameters.

[0082] Furthermore, the actuator module must possess a certain level of fault tolerance and adaptability. During actual operation, unexpected situations may arise, such as valve failures or abnormal sensor data. In these situations, the actuator module must be able to adjust the valve action sequence accordingly to ensure safe system operation. For example, if a valve fails to operate normally, the actuator module can automatically bypass that valve and adjust the action sequence of other valves to maximize interlocking control.

[0083] The actuator module generates optimized valve action sequences, improving the efficiency and accuracy of interlock response logic, thereby better ensuring pressure safety in LNG / methanol dual-fuel tanks. This method of generating valve action sequences fully considers multiple factors such as valve spatial location, operation time, and priority, ensuring rapid and accurate interlock response under various operating conditions.

[0084] Example 5: The core control unit in the system uses a dual audit mode of fault-tolerant verification mechanism and conflict detection mechanism when performing logic verification on execution parameters, and connects the instruction encoding module and the security log module at the same time. The specific implementation method is as follows:

[0085] After the interlock arbitration module generates a valve group control instruction and transmits it as an execution parameter to the core control unit, the fault-tolerant verification mechanism first confirms the validity of the data. For example, if the execution parameter includes the LNG tank pressure threshold data of -0.5MPa, the fault-tolerant verification mechanism will determine that the data exceeds the reasonable range based on the preset physical threshold range (for example, the normal range of LNG tank pressure is 0.1MPa to 1.2MPa), triggering a data anomaly flag and refusing to include the parameter in subsequent logic verification. This verification covers dimensions such as the data's numerical range, signal integrity, and checksum correctness. For example, a CRC check is performed on the 16-bit data frame transmitted by the pressure sensor. If the checksum is incorrect, the data is deemed invalid, preventing incorrect parameters from entering the control process due to sensor failure or communication interference.

[0086] The conflict detection mechanism resolves mutually exclusive relationships between commands. For example, if the execution parameters include both the "Open LNG tank intake valve" and "Close all LNG tank valves" commands, the conflict detection mechanism identifies a logical conflict based on a pre-set valve mutual exclusion table (e.g., the intake valve and the main shut-off valve belong to a mutually exclusive valve group). The system then suspends command execution and initiates the conflict resolution process, prioritizing the command with the higher safety level (e.g., closing the main shut-off valve has a higher safety level than opening the intake valve). A conflict report is generated, recording the timestamps, parameter contents, and resolution strategies of the conflicting commands to ensure logical consistency in valve operation.

[0087] After connecting to the core control unit, the instruction encoding module is responsible for converting the final interlock instruction into a valve actuation code. For example, for the instruction "Close methanol tank emergency shut-off valve V-007," the instruction output by the core control unit includes information such as the valve type (emergency shut-off valve), valve number (V-007), and action type (close). Based on preset encoding rules, the instruction encoding module converts this information into a binary actuation code: "101001100101007001." The first four digits ("1010") indicate the emergency shut-off valve type, the middle eight digits ("01100101") are the valve address code, and the last eight digits ("007001") indicate the closing action. When the actuation code is transmitted to the designated actuator via the bus communication interface, a check bit (such as a parity bit) is appended to ensure transmission accuracy. Upon receiving the actuation code, the actuator uses the decoding module to parse the specific action required and execute it.

[0088] After connecting to the core control unit, the safety log module archives multi-channel pressure sensor data, threshold sets, and control instructions. For example, when the LNG tank pressure sensor records a pressure value of 0.85 MPa at 14:30:25, this data is written to the log database in real time, along with metadata such as the sensor number (PTS-LNG-001) and sampling period (50ms). When the first safety threshold set is generated, the log module records the threshold calculation timestamp (e.g., 14:30:30), the calculation model version (V1.2), and the threshold boundary values ​​(e.g., lower limit 0.3 MPa, upper limit 1.0 MPa). When the interlock arbitration module generates a control instruction to "open the LNG tank pressure relief valve," the log records the instruction generation time, the associated threshold trigger condition (e.g., pressure exceeding the upper limit 1.0 MPa), and the instruction parameters (valve number V-LNG-015, action type open).

[0089] When generating pressure safety event records in a time series, the system integrates scattered log data into an event chain. For example, if pressure data rises abnormally at 14:30:25, the first safety threshold set triggers a high-limit warning at 14:30:30, the interlock arbitration module generates a pressure relief command at 14:30:35, the command encoding module sends an actuation code at 14:30:40, and the valve actuation feedback signal is returned at 14:30:45, the information at these time points is linked to form a complete event record of "pressure exceeding the limit - interlock triggering - valve actuation". Each event is accompanied by attributes such as the operator ID (if manual intervention was involved), the device number of the data source, and the event level (such as warning / emergency).

[0090] In dual-audit mode, the core control unit implements a hierarchical verification process for execution parameters. The fault-tolerant verification mechanism serves as the first level of audit, quickly filtering out obviously invalid data to prevent invalid parameters from entering subsequent processing. The conflict detection mechanism serves as the second level of audit, deeply analyzing the logical relationship between instructions to resolve potential conflicting actions. For example, when the execution parameters include the two instructions "adjust the methanol tank pressure to 0.6MPa" and "maintain the methanol tank pressure below 0.5MPa," the fault-tolerant verification mechanism will not determine that the data is invalid (the values ​​are all within a reasonable range), but the conflict detection mechanism will identify logical errors through the contradictions in the pressure control targets. Based on the preset control priority (e.g., emergency pressure relief takes precedence over pressure regulation), it will decide to retain the "maintain below 0.5MPa" instruction and issue a conflict prompt to the operator.

[0091] The conversion process of the instruction encoding module must adhere to strict protocol specifications. Different valve types correspond to different drive code formats. For example, the drive code for a control valve includes the opening parameter (e.g., "11000101008050" indicates a 50% opening), while the drive code for a safety valve only includes the switch status (e.g., "01010011001001" indicates open). The encoding module internally stores a complete valve drive protocol table, which is synchronized in real time based on updates to the fuel tank valve database to ensure compatibility between the drive code and the actual valve hardware. When a new valve model is connected to the system, the operator must first enter the relevant parameters into the valve database. The instruction encoding module then automatically updates the protocol table to prevent valve malfunctions due to incompatible drive codes.

[0092] The security log module's archiving strategy combines incremental storage with periodic backups. Real-time data is written to the database in batches of minutes, generating a log file every hour. The file name includes the date, hour, and system number (for example, "20250612-14.log-LNG"). A compressed backup of the previous 24 hours' worth of logs is performed at midnight each day. The backup files are stored on independent redundant hard drives and retained for 180 days. Expired logs are automatically deleted to free up storage space. This archiving method ensures data traceability while preventing storage resource exhaustion caused by unlimited log data growth.

[0093] In actual applications, the dual audit mode forms a closed-loop feedback loop with the log module. For example, when the fuel tank pressure does not drop as expected after a certain interlocking action, the operator can retrieve the full process record of the event through the security log to check whether the fault-tolerant check has missed abnormal data, whether the conflict detection has correctly handled the instruction contradictions, and whether the instruction code has been accurately converted into the driver code. If it is found that the physical threshold range of the fault-tolerant check is set unreasonably (such as not considering the pressure fluctuation under low-temperature conditions), the threshold range can be adjusted in time to optimize the verification mechanism; if there are loopholes in the priority setting of the conflict detection, the mutual exclusion table can be updated or the resolution strategy can be adjusted, so as to continuously improve the reliability of the system through historical log analysis.

[0094] When processing execution parameters, the core control unit also dynamically adjusts the audit strategy based on the current operating mode of the fuel tank (such as filling mode, navigation mode, and maintenance mode). For example, in filling mode, the system allows the methanol tank pressure to briefly exceed the normal upper limit (such as 1.2MPa). At this time, the fault-tolerant verification mechanism will temporarily expand the pressure threshold range to 1.5MPa to avoid triggering false interlocks due to pressure fluctuations during normal filling. In navigation mode, the pressure threshold returns to the normal range to ensure safe operation. This adaptive adjustment is achieved through the core control unit's built-in pattern recognition module, which determines the current operating mode based on parameters such as the fuel tank's valve status, medium flow, and temperature changes, and automatically loads the corresponding audit configuration file.

[0095] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "includes," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that includes a list of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus.

[0096] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

Claims

1. LNG / methanol dual fuel tank pressure safety threshold interlock control system, characterized by: include: A dual-source data acquisition module is used to obtain multi-channel pressure sensing data of the LNG storage unit and the methanol storage unit in the fuel tank, and divide the multi-channel pressure sensing data into an LNG pressure data stream and a methanol pressure data stream based on a preset medium separation rule; a dynamic threshold calculation module, configured to perform a partial pressure gradient analysis on the LNG pressure data stream to generate a first safety threshold set, and perform a phase compensation calculation on the methanol pressure data stream to generate a second safety threshold set; an interlock arbitration module, configured to perform a joint check on the first safety threshold set and the second safety threshold set according to a preset interlock priority matrix, and then map the resultant to corresponding valve group control instructions, and use the valve group control instructions as execution parameters for the current working condition; A core control unit is used to send the multi-channel pressure sensing data to the dynamic threshold calculation module, send the first safety threshold set and the second safety threshold set to the interlock arbitration module, and perform logical verification on the execution parameters to generate a final interlock instruction.

2. The LNG / methanol dual fuel tank pressure safety threshold interlock control system according to claim 1 is characterized in that: The dynamic threshold calculation module performs phase compensation calculation on the methanol pressure data flow, including: dividing a continuous sampling sequence in the methanol pressure data stream into a gas phase component set and a liquid phase component set, and performing saturated vapor pressure correction on the gas phase component set based on a preset state equation to generate a compensated pressure set; Performing thermodynamic equilibrium processing on the temperature coupling data in the methanol pressure data stream, extracting the critical phase change characteristics of each equilibrium node and constructing a phase transition map; The compensation pressure set is correlated and calibrated with the phase transfer map to generate the second safety threshold set.

3. The LNG / methanol dual fuel tank pressure safety threshold interlock control system according to claim 1 is characterized in that: The preset medium separation rules include a basic sensor set and a redundant sensor set; the basic sensor set includes a main pressure transmitter identifier and a differential pressure sensor identifier; the redundant sensor set includes a safety valve feedback identifier and an emergency shut-off valve status identifier, and each identifier corresponds to an independent data verification channel.

4. The LNG / methanol dual fuel tank pressure safety threshold interlock control system according to claim 3 is characterized in that: It also includes a bus communication interface, which is used to implement protocol adaptation of the dual-source data acquisition module, the dynamic threshold calculation module, and the interlock arbitration module to the fuel tank control network respectively; The dual-source data acquisition module divides the multi-channel pressure sensing data based on the preset medium separation rule, including: Periodically receiving raw data frames from the fuel tank control network via the bus communication interface, and matching the message headers of the raw data frames according to the identifiers in the basic sensor set to separate the basic sensor segments; Traversing the extended field of the original data frame according to the identifier in the redundant sensing set to extract a redundant check segment; The basic sensing segment and the redundant check segment are aligned according to the timestamp and then written into the LNG data buffer area and the methanol data buffer area respectively.

5. The LNG / methanol dual fuel tank pressure safety threshold interlock control system according to claim 1, characterized in that: When the preset interlock priority matrix adopts a static decision model, the valve group control instruction is a discrete mapping result of the joint verification value of the first safety threshold set and the second safety threshold set; When the preset interlocking priority matrix adopts a dynamic arbitration model, the valve group control instruction is a set of operation sequences that are calibrated in real time on the cross comparison results of the first safety threshold set and the second safety threshold set through a conflict resolution algorithm.

6. The LNG / methanol dual fuel tank pressure safety threshold interlock control system according to claim 4 is characterized in that: It also includes an actuator module connected to the core control unit, and the actuator module is connected to the fuel tank valve database through the bus communication interface; The actuator module is used to screen the target valve list from the fuel tank valve database according to the valve operation requirements in the final interlock instruction, and generate a valve action sequence to optimize the interlock response logic.

7. The LNG / methanol dual fuel tank pressure safety threshold interlock control system according to claim 6, characterized in that: The actuator module generates a valve action sequence including: Loading a fuel tank pipeline topology model, and locating the physical node coordinates of each valve in the target valve list in the pipeline topology model; Calculating the shortest switching path from the initial state of each valve to the target control state based on a timing constraint algorithm, and sorting the target valve list according to action priority; The shortest switching path and the execution sequence are integrated into the pipeline topology model to generate a visual valve action sequence.

8. The LNG / methanol dual fuel tank pressure safety threshold interlock control system according to claim 1, characterized in that: When the core control unit performs logic verification on the execution parameters, a dual audit mode of a fault-tolerant verification mechanism and a conflict detection mechanism is adopted. The fault-tolerant verification mechanism is used to confirm the validity of data, and the conflict detection mechanism is used to resolve the mutual exclusion relationship between instructions.

9. The LNG / methanol dual fuel tank pressure safety threshold interlock control system according to claim 4, characterized in that: It also includes an instruction encoding module connected to the core control unit, which is used to convert the final interlocking instruction into a valve drive code and send the valve drive code to a designated actuator through the bus communication interface to trigger an interlocking action.

10. The LNG / methanol dual fuel tank pressure safety threshold interlock control system according to claim 1, characterized in that: It also includes a security log module connected to the core control unit, which is used to archive the multi-channel pressure sensing data, the first safety threshold set, the second safety threshold set, the valve group control instructions and the final interlocking instructions, and generate pressure safety event records in time series.

Images