An integrated verification platform and verification method

Abstract

This application relates to an integrated verification platform and verification method. The integrated verification platform includes: an ammonia fuel supply system, an ammonia fuel medium-speed generator system, a decision-making system, and a testing and verification system. The ammonia fuel supply system and the ammonia fuel medium-speed generator system each have independently set up corresponding security control units and execute corresponding safety strategies. The decision-making system is used to collect real-time status data of all systems and trigger alarms based on alarm signals, and feeds back the safety decision level determined according to safety interlock logic to the corresponding security control unit to execute the corresponding safety strategy. The testing and verification system is used to analyze the coordinated response status of each system based on the injection of simulated fault signals to verify the response performance of the security control unit. A dedicated safety subsystem for the high-risk characteristics of ammonia fuel is provided, and the entire system can reliably and collaboratively execute safety commands.

Description

Technical Field

[0001] This application mainly relates to the field of engine testing technology, and in particular to an integrated verification platform and verification method. Background Technology

[0002] The shipping industry accounts for approximately 3% of global anthropogenic greenhouse gas (GHG) emissions annually, and is facing increasingly stringent decarbonization challenges. Ammonia fuel, being a carbon-free fuel that does not produce CO2 during combustion, can fundamentally solve the carbon emission problem during its use. Furthermore, it is easy to store and transport, has high energy efficiency in its manufacturing process, and low manufacturing costs. Ammonia fuel has received significant international attention as a solution for achieving zero carbon emissions in future internal combustion engines, and relevant organizations consider it one of the main solutions for achieving zero carbon emissions in future shipping.

[0003] However, its inherent high toxicity, strong corrosiveness, high ignition energy, and narrow flammability limit pose unprecedented challenges to engine fuel supply, combustion organization, material compatibility, and operational safety.

[0004] Existing universal engine validation platforms primarily address multi-fuel compatibility and the reuse of common components, with a design focus on versatility and cost control. However, these platforms lack dedicated safety subsystems (such as comprehensive leak monitoring, emergency purging, and waste ammonia recovery) specifically for the high-risk characteristics of ammonia fuel. They also fail to establish a system-level safety validation process that spans all modules, including the supply system, the ammonia engine, the laboratory, and waste ammonia recovery, covering both static and dynamic operating conditions. This results in the critical safety risks of ammonia-fueled engines not being fully exposed and validated during the bench testing phase, creating significant hidden dangers for subsequent shipboard applications. Summary of the Invention

[0005] One objective of this application is to provide an integrated verification platform and verification method to address the lack of a dedicated safety subsystem and safety verification process for the high-risk characteristics of ammonia fuel in the prior art.

[0006] According to one aspect of this application, an integrated verification platform is provided, comprising: an ammonia fuel supply system, an ammonia fuel medium-speed engine system, a security control unit, a decision-making system, and a testing and verification system; The security control unit includes a first security control unit and a second security control unit; The ammonia fuel supply system has a built-in first security control unit, which is used to monitor and adjust fuel parameters and process fault information, and execute the first safety strategy based on the received trigger signal; The ammonia fuel medium-speed engine system has a built-in second security control unit for monitoring risk parameters of ammonia fuel operation and executing a second safety strategy when an anomaly occurs; The decision-making system is used to collect the status data of all systems in real time and trigger alarms based on alarm signals, and to feed back the security decision level determined according to the security interlock logic to the security control unit to execute the corresponding security strategy. The test and verification system is used to analyze the coordinated response status of each system based on the injection of simulated fault signals, so as to verify the response performance of the security control unit.

[0007] Optionally, the test and verification system is also used for fuel mode switching safety verification under different load conditions, as well as engine safety verification simulating switching failure scenarios.

[0008] Optionally, the integrated verification platform includes an ammonia fuel purging and waste liquid recovery system that integrates purging branch pipes and waste liquid recovery units; The purging branch pipes are laid to designated areas to form independent zoned purging circuits, which are used to purge the zoned purging circuits based on the zoned nitrogen purging procedure in the event of shutdown or ammonia leakage, and to purge the remaining ammonia to the waste liquid recovery unit for treatment.

[0009] Optionally, the integrated verification platform includes monitoring sensors distributed in the target risk area to monitor the presence of ammonia in the target risk area, wherein the target risk area includes the ammonia fuel supply system, ammonia fuel injectors, and pipeline interfaces.

[0010] Optionally, the decision-making system includes a safety instrument layer for receiving alarm signals from the monitoring sensors, the first security control unit, and the second security control unit, prioritizing the received alarm signals, and performing audible and visual alarms based on the prioritized signals and predefined alarm methods.

[0011] Optionally, the integrated verification platform includes a ventilation system for ventilating the leak area where the ammonia gas detected by the monitoring sensor is located.

[0012] Optionally, the decision system includes a security logic solver and an interactive interface; The security logic solver is used to receive security-related information, determine the security decision level based on the security-related information and security interlocking logic, and feed it back to the first security control unit and the second security control unit to execute the corresponding security strategy; The interactive interface is used to visually display the system status, real-time alarm list, safety interlock logic, and verification data.

[0013] Optionally, the systems in the integrated verification platform are linked through a three-layer coupling method, wherein the three-layer coupling method includes pipeline mechanical connection, electrical connection and control communication network connection; The pipeline mechanical connection is used to connect the ammonia fuel supply system, the ammonia fuel medium-speed engine system, and the test and verification system; The electrical connection is used to transmit the highest priority emergency stop command; The control communication network connection is used to synchronize the status and verification data of each system.

[0014] Optionally, the first safety strategy includes an emergency shut-off operation, and the second safety strategy includes a forced fuel mode switch or a safe engine shutdown.

[0015] According to another aspect of this application, a verification method is also provided, using the integrated verification platform as described above, the method comprising: Start each system in the integrated verification platform and perform a security self-check to determine the security readiness status; Based on the aforementioned safety-ready state, start the engine and run it in pure diesel mode to establish a performance baseline; The pure diesel mode is switched to the ammonia-diesel dual-fuel mode at different ammonia substitution rates. The safety parameters for operation in the ammonia-diesel dual-fuel mode at each ammonia substitution rate are determined, and a comparison benchmark is obtained based on the performance baseline and the safety parameters. When the engine is operating at the target ammonia substitution rate, a simulated fault signal is injected through the safety logic solver to analyze the coordinated response status of each system in the integrated verification platform. The security strategy is assessed based on the coordinated response status of each system, and the assessment results are compared with the benchmark to verify the response performance of the security control unit. The security control unit includes a first security control unit and a second security control unit.

[0016] Optionally, the step of injecting simulated fault signals through a security logic solver and analyzing the collaborative response status of each system in the integrated verification platform includes: Through the test interface of the safety logic solver, a simulated fault signal is injected into the second security control unit built into the ammonia fuel medium-speed engine system, wherein the simulated fault signal includes a simulated signal of ammonia injection valve drive failure; When the second security control unit detects the simulated fault signal, it sends an alarm signal to the decision-making system and automatically performs a forced switch of fuel mode; Record the entire timing sequence after the simulated signal is injected to analyze the collaborative response status of each system in the integrated verification platform.

[0017] Optionally, the method includes: Perform bidirectional switching of fuel modes under multiple load conditions, and collect dynamic parameters during ammonia fuel combustion to detect abnormal fluctuations in real time; Simulate a scenario where the fuel mode switching fails to switch, and verify whether the engine can successfully switch back to the pure diesel mode without the risk of ammonia leakage.

[0018] Optionally, the dynamic parameters include the in-cylinder combustion pressure at the moment of switching, the concentration of unburned ammonia in the exhaust, and the fluctuation of ammonia fuel pressure.

[0019] Optionally, the method further includes: By using global monitoring sensors to detect or simulate engine compartment leaks in real time, a tiered emergency response process can be implemented.

[0020] Optionally, the tiered emergency response process includes: When a ppm-level ammonia leak is detected and the concentration continues to rise, the sensor signal triggers an audible and visual alarm on the safety instrument panel, and displays the leak area and leak concentration on the interactive interface. The ventilation system is activated via a safety logic solver interlock to ventilate the leaked area. If the leakage concentration exceeds a preset threshold, the safety logic solver sends a highest priority emergency stop command to the first security control unit and the second security control unit in the ammonia fuel supply system. The nitrogen purging procedure for the leaked area is initiated simultaneously to purge the remaining ammonia to the waste liquid recovery unit for recycling.

[0021] Compared with existing technologies, this application provides an integrated verification platform, which includes: an ammonia fuel supply system, an ammonia fuel medium-speed engine system, a security control unit, a decision-making system, and a testing and verification system. The security control unit includes a first security control unit and a second security control unit. The ammonia fuel supply system integrates the first security control unit, which monitors and adjusts fuel parameters and processes fault information, and executes a first safety strategy based on received trigger signals. The ammonia fuel medium-speed engine system integrates the second security control unit, which monitors risk parameters of ammonia fuel operation and executes a second safety strategy when an anomaly occurs. The decision-making system collects real-time status data from all systems and triggers alarms based on alarm signals, feeding back the safety decision level determined according to safety interlock logic to the security control unit to execute the corresponding safety strategy. The testing and verification system analyzes the coordinated response status of each system based on the injection of simulated fault signals to verify the response performance of the security control unit. This platform integrates multiple safety barrier subsystems and their interaction logic for ammonia safety, and provides corresponding verification methods. The entire system can reliably and collaboratively execute safety commands. Attached Figure Description

[0022] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the specific embodiments of this application will be described in detail below with reference to the accompanying drawings, wherein: Figure 1 A schematic diagram of the structure of an integrated verification platform provided according to one aspect of this application is shown. Figure 2 This illustration shows a schematic diagram of a medium-speed engine verification platform framework for ammonia fuel safety system verification in one embodiment of this application; Figure 3 A flowchart illustrating a verification method provided according to another aspect of this application is shown.

[0023] The same or similar reference numerals in the accompanying drawings represent the same or similar parts. Detailed Implementation

[0024] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the specific embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0025] Many specific details are set forth in the following description in order to provide a full understanding of this application. However, this application may also be implemented in other ways different from those described herein, and therefore this application is not limited to the specific embodiments disclosed below.

[0026] As indicated in this application and claims, unless the context clearly indicates otherwise, the words "a," "an," "an," and / or "the" are not specifically singular and may include plural forms. Generally speaking, the terms "comprising" and "including" only indicate the inclusion of explicitly identified steps and elements, which do not constitute an exclusive list, and the method or apparatus may also include other steps or elements.

[0027] To address the shortcomings of existing general-purpose verification platforms, this application provides an integrated verification platform and method applicable to ammonia-fueled medium-speed engines. It solves the problem of constructing a test environment capable of realistically simulating, monitoring, and verifying the effectiveness of the entire safety system of an ammonia-fueled engine under operating, fault, and emergency conditions, thus systematically overcoming the challenge of integrated safety verification for ammonia fuel. The specific solution is as follows: Figure 1 The diagram shows a structural schematic of an integrated verification platform provided according to one aspect of this application. The integrated verification platform includes: an ammonia fuel supply system 10, an ammonia fuel medium-speed engine system 20, a security control unit (not shown), a decision system 40, and a test and verification system 50.

[0028] The security control unit includes a first security control unit 301 and a second security control unit 302; the ammonia fuel supply system 10 has the first security control unit 301 built in, which is used to monitor and adjust fuel parameters and process fault information, and execute a first safety strategy based on the received trigger signal; the ammonia fuel medium-speed engine system 20 has the second security control unit 302 built in, which is used to monitor the risk parameters of ammonia fuel operation and execute a second safety strategy when an abnormality occurs; the decision system 40 is used to collect the status data of all systems in real time and trigger alarms based on alarm signals, and feed back the safety decision level determined according to the safety interlock logic to the security control unit to execute the corresponding safety strategy; the test and verification system 50 is used to analyze the coordinated response status of each system based on the injection of simulated fault signals to verify the response performance of the security control unit.

[0029] To achieve system-level safety policy verification, the key modules of the integrated verification platform incorporate dedicated security control units. These key modules include an ammonia fuel supply system 10 and an ammonia fuel medium-speed engine system 20. Compared to traditional verification platforms, the integrated verification platform described in this application features intelligent modules with independent security units. Each security control unit executes different safety policies, wherein the first safety policy includes an emergency shut-off operation, and the second safety policy includes a forced fuel mode switch or a safe engine shutdown.

[0030] The ammonia fuel supply system 10 has a built-in first safety control unit 301, which includes sensors and control units for monitoring and regulating fuel pressure, flow rate and temperature. It integrates a safety instrument system and has an emergency shut-off function. It can independently handle faults such as abnormally high / low pressure, excessive temperature, and sudden flow changes in the supply pipeline. Based on the received trigger signal, it executes a first safety strategy, such as performing an emergency shut-off operation to quickly isolate the fuel source. The trigger signal includes a signal from the decision system, a signal from the ammonia fuel medium-speed engine, or a local trigger signal.

[0031] The second safety control unit 302, built into the ammonia fuel medium-speed engine system 20, is integrated into the ammonia fuel engine controller and is specifically responsible for monitoring risk parameters directly related to ammonia fuel operation, such as: in-cylinder combustion misfire, sudden increase in unburned ammonia concentration, abnormal crankcase ammonia concentration, injection valve actuation, and supply system failure. Once an abnormality is detected, this unit can immediately execute a second safety strategy, such as forced fuel mode switching (ammonia to diesel) or safe shutdown.

[0032] The decision system 40 is used to collect status data of all systems in real time. The status data of all systems includes, for example, the status data of the second security control unit 302 integrated in the engine and the ESD status of the ammonia fuel supply system 10. The system prioritizes the received alarm signals according to the built-in alarm management system and triggers predefined audible and visual alarms. The alarm signals can come from the security control units of each system in the integrated verification platform or from the ammonia leak monitoring sensors in the entire area.

[0033] The decision system 40 determines different levels of security decisions based on pre-programmed security interlock logic and feeds them back to the security control unit, specifically the first security control unit 301 and / or the second security control unit 302, thereby enabling corresponding security strategies to be implemented for different levels of security decisions. For example, a security decision might be: when leaks are detected simultaneously in areas A and B, it is determined to be a major leak, automatically triggering a system-wide emergency shutdown and initiating a full-area purging.

[0034] The test and verification system 50 can achieve dynamic verification of system-level safety strategies based on fault injection. When the engine is running stably in ammonia mode, the safety system is actively triggered through simulated signal injection or actual physical operation. Simulated signal injection includes, for example, simulating a leak sensor signal or simulating injection valve jamming; actual physical operation includes, for example, suddenly cutting off part of the fuel supply. This accurately verifies whether the system can respond correctly according to the preset safety logic, which includes: immediately switching to pure diesel mode, initiating purging of the corresponding area, issuing audible and visual alarms, and executing a shutdown. The system records the entire response time from fault triggering to complete system safety and the sequence of actions of each subsystem.

[0035] This allows the system to expose logical flaws and timing conflicts in the security strategy of the security control unit, ensuring that the entire system can reliably and collaboratively execute security commands when a real danger occurs, rather than just verifying the function of individual components.

[0036] In one embodiment of this application, the test and verification system 50 is also used for fuel mode switching safety verification under different load conditions, as well as engine safety verification simulating switching failure scenarios.

[0037] The test and verification system 50 can not only dynamically verify safety strategies, but also perform safety verification under seamless fuel mode switching. For the high-risk transient process of mode switching in ammonia / diesel dual-fuel engines, frequent switching between "ammonia-diesel" and "diesel-ammonia" modes is performed at different load points. During this process, the following are key monitoring points: combustion stability (pressure fluctuations) at the moment of switching, unburned ammonia escape, and whether transient fluctuations in fuel supply system pressure exceed limits. The system verifies whether, in the event of switching failure or anomalies, the system can seamlessly return to a safe pure diesel mode, ensuring no ammonia leakage risk.

[0038] By specifically verifying the engine's safety redundancy under the most critical and complex transient operating conditions, the operational safety of the ship during actual navigation when changing speed and load is ensured.

[0039] In one embodiment of this application, the integrated verification platform includes an ammonia fuel purging and waste liquid recovery system 60 that integrates a purging branch pipe (not shown) and a waste liquid recovery unit (not shown).

[0040] The purging branch pipes are laid to designated areas to form independent zoned purging circuits, which are used to purge the zoned purging circuits based on the zoned nitrogen purging procedure in the event of shutdown or ammonia leakage, and to purge the remaining ammonia to the waste liquid recovery unit for treatment.

[0041] The integrated verification platform is equipped with a system-level ammonia leak monitoring and emergency response system. This system includes an ammonia fuel purging and waste liquid recovery system 60. Purge branch pipes are laid to designated areas, creating independent zoned nitrogen purging loops. These designated areas contain critical components such as the ammonia fuel supply system piping, the ammonia medium-speed engine belt piping, and the ammonia fuel injectors. In the event of a leak or shutdown, nitrogen purging can be performed on the designated areas. The system can quickly and accurately initiate the purging procedure for the corresponding zone based on the location of the risk. For example, if the risk location is in the engine's ammonia inlet system, and the ammonia injection valve leaks, the engine will shut down, simultaneously triggering nitrogen purging from the engine-side supply unit to the engine, without needing to purge all piping from the ammonia fuel storage tank to the engine. Residual ammonia is directed to the waste liquid recovery unit for harmless treatment, completely preventing direct emission of ammonia into the atmosphere.

[0042] It enables multi-level, refined monitoring and rapid emergency response, from overall environmental safety to the status of key components. It can expose and systematically verify the potential leakage risks and safety strategies of ammonia fuel engines in the early stages of R&D, significantly improving the safety, environmental friendliness and reliability of bench testing. It provides crucial data support and verification assurance for the safety design and market access certification of ammonia fuel engines.

[0043] In one embodiment of this application, the integrated verification platform includes monitoring sensors 70, which are distributed in the target risk area to monitor the presence of ammonia in the target risk area. The target risk area includes the ammonia fuel supply system, ammonia fuel injectors, and pipeline interfaces.

[0044] The ammonia leak monitoring and emergency response system also includes a distributed ammonia leak monitoring sensor 70. In high-risk areas such as the engine compartment (laboratory), fuel supply system, and pipeline interfaces, an ammonia leak sensor array is deployed. For example, nine sensors are arranged in high-risk areas such as the intake side, exhaust side, and top of the engine in the laboratory; thereby achieving real-time location and concentration tracking of ppm-level ammonia leaks.

[0045] In one embodiment of this application, the integrated verification platform includes a ventilation system 80 for ventilating the leak area where the ammonia gas detected by the monitoring sensor is located.

[0046] The ammonia leak monitoring and emergency response system is linked to the intelligent ventilation system of the engine compartment (laboratory). Once an alarm is triggered, targeted forced ventilation is immediately activated, and the system is connected to the decision-making system 40 to coordinate relevant safety response strategies.

[0047] Leakage monitoring is implemented for critical ammonia-related components, with a focus on installing online ammonia leak monitoring systems at key locations such as fuel injectors, seals, and sensor probes. This allows for long-term monitoring of ammonia leakage at these component locations under actual engine operating conditions, providing direct data for verifying component material corrosion and performance degradation, as well as predicting component lifespan.

[0048] The decision system 40 includes a data acquisition and monitoring control layer, which is responsible for collecting, displaying and recording data from all systems (engine, supply system, purging system, dynamometer, etc.) in real time, and providing global operational situation awareness.

[0049] Continue to refer to Figure 1 In one embodiment of this application, the decision system 40 includes a safety instrument layer 401, which is used to receive alarm signals fed back by the monitoring sensor 70, the first security control unit 301 and the second security control unit 302, prioritize the received alarm signals, and perform audible and visual alarms based on the prioritized priorities and predefined alarm methods.

[0050] The safety instrument layer 401 has a built-in alarm management system that prioritizes and records alarm signals from the monitoring sensors 70 for ammonia leaks across the entire system, as well as from the built-in safety control units of each system, triggering predefined audible and visual alarms and logging. Priority can be ranked according to risk analysis and the degree of impact. For example, an ammonia leak has a higher priority than engine safety parameters such as crankcase pressure. Predefined audible and visual alarms include: a yellow light when the ammonia concentration is 0-25 ppm, and a red light when the ammonia concentration is 25-110 ppm.

[0051] refer to Figure 1In one embodiment of this application, the decision system 40 includes a security logic solver 402 and an interactive interface 403. The security logic solver 402 is used to receive security-related information, determine the security decision level based on the security-related information and security interlocking logic, and feed it back to the first security control unit 301 and the second security control unit 302 to execute the corresponding security strategy. The interactive interface 403 is used to visualize the system status, real-time alarm list, security interlocking logic, and verification data.

[0052] The safety logic solver 402 receives all safety-related inputs and determines different levels of safety decisions based on safety interlock logic. Safety-related inputs include, for example, coordinated signals from multiple monitoring sensors, the status of the second security control unit 302, and the ESD status of the supply system. The safety interlock logic includes triggering local ventilation and alarms when a single high-risk area leaks, and triggering a system-wide emergency shutdown and purging when at least two unrelated areas simultaneously alarm. As shown in Table 1, the leak detection in test chambers A and B serves as an example.

[0053] Table 1

[0054] The interactive interface 403 provides operators with a dedicated safety view that graphically highlights the status of all safety devices, real-time alarm lists, safety interlock logic diagrams, verification data, and historical safety event traceability.

[0055] The safety interlock logic diagram can display the interlock logic in real time through colors, shapes, and animations. For example, the safety interlock logic is: when both high pressure and low temperature trigger at the ammonia inlet pipeline, the ammonia fuel inlet valve is closed, and an emergency venting operation is initiated in the designated section. In this scenario: the pressure indicator icon turns red, and the temperature indicator icon turns red; the ammonia fuel inlet valve icon immediately changes from green to red (command to close), and the designated section pipeline changes from green to flashing red (purge execution). The operator can see from the safety interlock logic diagram that the simultaneous fulfillment of two conditions leads to valve closure and venting.

[0056] In one embodiment of this application, the systems in the integrated verification platform are linked through a three-layer coupling method, wherein the three-layer coupling method includes pipeline mechanical connection, electrical connection and control communication network connection; the pipeline mechanical connection is used to connect the ammonia fuel supply system, the ammonia fuel medium-speed engine system and the test verification system; the electrical connection is used to transmit the highest priority emergency stop command; the control communication network connection is used to synchronize the status of each system and the verification data.

[0057] The various systems are tightly coupled through a three-layer network consisting of mechanical connections, electrical connections, and a control communication network, ensuring high-speed and reliable transmission of safety commands and status information. The mechanical connections, via pipes, valves, etc., link the fuel supply, engine, purging system, and waste liquid recovery system, forming channels for the flow of matter and energy.

[0058] Electrical connections: Sensors, actuators and safety modules of each subsystem are connected via a high-reliability safety bus or hard-wiring. This "hard-wiring" is used to transmit the highest priority emergency stop signal to ensure that critical safety commands (such as emergency stop) can be reliably executed even if the communication bus is interrupted.

[0059] Control and communication network: Based on industrial Ethernet, the information backbone of the entire platform is constructed. All non-safety-related operational data (such as performance parameters and setpoints) and safety system status information are exchanged at high speed with the centralized control display and storage system through this network to achieve data synchronization and centralized monitoring.

[0060] The integrated verification platform elevates safety from a single device function to a system-level interaction and decision-making capability, a core capability specifically built to overcome systemic safety challenges in ammonia fuel.

[0061] Based on the aforementioned integrated verification platform, a verification platform can be constructed, such as... Figure 2 The medium-speed engine verification platform for ammonia fuel safety system verification shown includes an ammonia fuel supply system, an ammonia fuel medium-speed engine, a load and dynamometer system, an exhaust gas after-treatment system, a laboratory, a comprehensive safety monitoring and emergency response system, and a centralized control display and storage system. The platform is built upon this verification platform, and the construction process includes hardware integration and software and control system integration.

[0062] The hardware integration construction steps are as follows: The ammonia fuel medium-speed engine, ammonia fuel supply system (including safety control unit), load and dynamometer system, auxiliary system, and exhaust gas aftertreatment system are physically connected via mechanical pipelines and valves. Simultaneously, a monitoring sensor array is installed in the comprehensive safety monitoring and emergency response system, with key monitoring sensors positioned at critical components (such as injectors and sealing interfaces). The purging branch pipes of the nitrogen zone purging system are pre-laid to designated areas (such as supply pipelines, motor belt pipelines, and areas near injectors) and connected to the waste ammonia recovery system, i.e., the waste liquid recovery unit.

[0063] The construction steps for software and control system integration are as follows: A centralized control, display, and storage system is deployed. Within this system, a data acquisition and monitoring control layer is configured, integrating signals from all subsystems through a graphical interface. In the safety logic solver, safety interlocking logic is written and downloaded according to preset safety policies. For example, a leak alarm in a single high-risk area triggers local ventilation and an alarm; simultaneous alarms in two or more unrelated areas indicate a major leak, triggering an emergency shutdown of the entire system and initiating a full-area purging. A main control network is constructed via industrial Ethernet, and all safety control units (supply system, engine safety control unit) are connected to the safety logic solver via a high-reliability safety bus and highest-priority hardwiring, forming a reliable communication network.

[0064] Figure 3 The diagram illustrates a verification method according to another aspect of this application, which uses an integrated verification platform for verification. The method includes steps S11 to S15.

[0065] Step S11: Start each system in the integrated verification platform and perform a security self-check to determine the security ready state.

[0066] Connect the power and gas supply (such as nitrogen) to the integrated verification platform. After powering on, the platform first performs a full system safety self-test, checking the status of all security control units, sensor communication, and verifying the operational flexibility of key valves (such as emergency shut-off valves). Once the self-test passes, the system enters a safety-ready state; if any step fails, the system is locked on the interactive interface, and the specific fault point is displayed.

[0067] Step S12: Based on the safety-ready state, start the engine and run it in pure diesel mode to establish a performance baseline.

[0068] Once the system enters a safe-ready state, system-level verification of the verification platform is performed. The engine is started and initially operated in pure diesel mode to establish a performance baseline.

[0069] Step S13: Switch the pure diesel mode to the ammonia-diesel dual-fuel mode at different ammonia substitution rates, determine the safety parameters for operation in the ammonia-diesel dual-fuel mode at each ammonia substitution rate, and obtain a comparison benchmark based on the performance baseline and safety parameters.

[0070] Switch to ammonia-diesel dual-fuel mode and gradually increase the ammonia fuel substitution rate. During this period, monitoring sensors in all areas and key locations continue to operate, and the centralized safety monitoring system monitors and records all operating parameters and safety status at each ammonia substitution rate in real time. By adjusting the safety parameters related to ammonia fuel in the performance baseline, a comparison benchmark under dual-fuel conditions is generated.

[0071] Step S14: When the engine is operating at the target ammonia substitution rate, a simulated fault signal is injected through the safety logic solver to analyze the coordinated response status of each system in the integrated verification platform.

[0072] Based on the dynamic verification of the system-level security strategy using fault injection, when the transmitter is operating stably at the target ammonia substitution rate (such as a specified high ammonia substitution rate), a simulated fault signal is injected through the safety logic solver. The millisecond time sequence chain from fault injection to mode switching and purging start is recorded, and the coordinated response status of each system in the platform is analyzed.

[0073] Step S15: Assess the security strategy based on the coordinated response status of each system, and compare the assessment results with the comparison benchmark to verify the response performance of the security control unit, wherein the security control unit includes a first security control unit and a second security control unit.

[0074] The coordinated response status of each system includes the correctness and timeliness of the response. The response time and error rate are compared with the benchmark to quantify the effectiveness of the security control unit's security strategy, verify the response performance of the security control unit, and locate any potential logical conflicts or response delays.

[0075] In one embodiment of this application, in step S14, a simulated fault signal is injected into the second security control unit built into the ammonia fuel medium-speed engine system through the test interface of the safety logic solver. The simulated fault signal includes a simulated signal of ammonia injection valve drive failure. When the second security control unit recognizes the simulated fault signal, it sends an alarm signal to the decision system and automatically performs a forced switch of fuel mode. The entire process timing after the simulated signal is injected is recorded to analyze the coordinated response status of each system in the integrated verification platform.

[0076] When the engine is operating stably at a high ammonia substitution rate, a fault injection test is initiated. For example, a simulated injection valve sticking fault is performed. The user injects a simulated "ammonia injection valve drive fault" signal into the safety control unit of the ammonia-fueled medium-speed engine through the test interface of the safety logic solver. After the simulated signal is injected, the system response and verification are performed. The safety control unit immediately identifies the fault, sends a high-level alarm to the decision system, and automatically executes a forced fuel mode switch according to the preset safety interlock logic, such as stopping ammonia injection and switching to pure diesel operation.

[0077] It accurately records the entire timeline (in milliseconds) from fault injection to alarm triggering, mode switching, and purge initiation. By analyzing this timeline chain, users can verify the correctness and timeliness of the coordinated responses of various systems and expose any potential logical conflicts or response delays.

[0078] In one embodiment of this application, seamless fuel mode switching safety verification can also be achieved by performing bidirectional fuel mode switching operations under multiple load conditions, collecting dynamic parameters during ammonia fuel combustion to detect abnormal fluctuations in real time, simulating the fuel mode switching failure scenario, and verifying whether the engine can successfully switch back to the pure diesel mode without the risk of ammonia leakage.

[0079] The dynamic parameters include the in-cylinder combustion pressure at the moment of switching, the concentration of unburned ammonia in the exhaust, and the fluctuation of ammonia fuel pressure.

[0080] At different load points, due to variations in ammonia supply pressure and flow rate, different problems will arise during mode switching. These problems can be verified at different load points. Multiple load conditions can be selected, with load points at 25%, 50%, 75%, and 100% load. The overall machine control system frequently executes "ammonia-diesel" and "diesel-ammonia" mode switching.

[0081] The testing system rapidly acquires transient parameters such as in-cylinder combustion pressure, unburned ammonia concentration in the exhaust, and ammonia fuel pressure fluctuations at the moment of switching. It verifies whether the engine smoothly transitions without violent knocking or misfire after the switching command is issued; simultaneously, it confirms whether the engine can seamlessly return to a safe pure diesel mode under a simulated "switching failure" scenario (e.g., by setting a switching obstacle via software), and whether the global ammonia leak monitoring sensor detects no abnormal leaks throughout the entire process.

[0082] In one embodiment of this application, an engine compartment leak event is detected or simulated in real time by a global monitoring sensor, and a tiered emergency response process is executed.

[0083] The platform undergoes long-term durability testing. During this period, the leakage monitoring sensors for key ammonia-related components continue to operate, tracking the trend of minute leaks in locations such as injectors and seals. When an ammonia leak is detected or a simulated engine compartment safety leak is detected, a graded emergency response procedure is executed.

[0084] The tiered emergency response process includes: when a ppm-level ammonia leak is detected and the concentration continues to rise, the sensor signal triggers an audible and visual alarm on the safety instrument layer, and displays the leak area and leak concentration on the interactive interface; the ventilation system is interlocked and activated through the safety logic solver to ventilate the leak area; if the leak concentration exceeds a preset threshold, the safety logic solver sends a highest-priority emergency stop command to the first and second security control units in the ammonia fuel supply system; and the zoned nitrogen purging procedure for the leak area is simultaneously activated to purge the remaining ammonia to the waste liquid recovery unit for recycling.

[0085] When the distributed monitoring sensors detect (or simulate) a ppm-level leak in a certain part of the engine compartment and the concentration continues to rise, the monitoring sensor signal is sent to the safety instrument layer, the system immediately triggers an audible and visual alarm, and highlights the leak location and concentration on the interactive interface.

[0086] Initiating a primary response, the safety logic solver automatically activates the ventilation system in the leak area based on preset safety interlock logic for targeted dilution.

[0087] If the leaked ammonia concentration continues to rise above a threshold, an escalation response is initiated. The safety logic resolver immediately sends the highest priority shutdown and disconnection commands to the first security control unit built into the ammonia fuel supply system and the second security control unit built into the ammonia fuel medium-speed engine. Furthermore, the safety logic resolver initiates a zoned nitrogen purging procedure for the leak area, purging residual ammonia to the waste liquid recovery unit for harmless treatment. The centralized control display and storage system records all data from the occurrence of the leak to the complete safety of the system, for post-incident event review and safety strategy optimization.

[0088] The basic concepts have been described above. Obviously, for those skilled in the art, the above disclosure is merely illustrative and does not constitute a limitation of this application. Although not explicitly stated herein, those skilled in the art may make various modifications, improvements, and corrections to this application. Such modifications, improvements, and corrections are suggested in this application, and therefore remain within the spirit and scope of the exemplary embodiments of this application.

[0089] Furthermore, this application uses specific terms to describe embodiments of the application. For example, "an embodiment," "one embodiment," and / or "some embodiments" refer to a particular feature, structure, or characteristic related to at least one embodiment of the application. Therefore, it should be emphasized and noted that "an embodiment," "one embodiment," or "an alternative embodiment" mentioned twice or more in different locations in this specification do not necessarily refer to the same embodiment. In addition, certain features, structures, or characteristics in one or more embodiments of the application can be appropriately combined.

[0090] In some embodiments, numbers describing the quantity of components and attributes are used. It should be understood that such numbers used in the description of embodiments are modified in some examples with the terms "approximately," "approximately," or "generally." Unless otherwise stated, "approximately," "approximately," or "generally" indicates that the numbers are allowed to vary by ±20%. Accordingly, in some embodiments, the numerical parameters used in the specification and claims are approximate values, which may be changed depending on the characteristics required by individual embodiments. In some embodiments, numerical parameters should take into account specified significant digits and employ a general method of digit reservation. Although the numerical ranges and parameters used to confirm their breadth of scope in some embodiments of this application are approximate values, in specific embodiments, such values ​​are set as precisely as feasible.

Claims

1. An integrated verification platform, characterized in that, The integrated verification platform includes: an ammonia fuel supply system, an ammonia fuel medium-speed engine system, a security control unit, a decision-making system, a testing and verification system, and an ammonia fuel purging and waste liquid recovery system integrating purging branch pipes and waste liquid recovery units; The security control unit includes a first security control unit and a second security control unit; The ammonia fuel supply system has a built-in first security control unit for monitoring and adjusting fuel parameters and processing fault information, and for executing a first safety strategy based on the received trigger signal. The first safety strategy includes an emergency cut-off operation. The ammonia fuel medium-speed engine system has a built-in second safety control unit for monitoring risk parameters of ammonia fuel operation and executing a second safety strategy when an abnormality occurs. The second safety strategy includes forced switching of fuel mode or safe engine shutdown. The decision-making system is used to collect the status data of all systems in real time and trigger alarms based on alarm signals, and to feed back the security decision level determined according to the security interlock logic to the security control unit to execute the corresponding security strategy. The test and verification system is used to analyze the coordinated response status of each system based on the injection of simulated fault signals, so as to verify the response performance of the security control unit. The purging branch pipes are laid to the designated area to form an independent zoned purging circuit, which is used to purge the zoned purging circuit based on the zoned nitrogen purging procedure in the event of shutdown or ammonia leakage, and purge the remaining ammonia to the waste liquid recovery unit for treatment. The integrated verification platform enables the interconnection of various systems through a three-layer coupling method, which includes pipeline mechanical connection, electrical connection and control communication network connection. The pipeline mechanical connection is used to connect the ammonia fuel supply system, the ammonia fuel medium-speed engine system, and the test and verification system; The electrical connection is used to transmit the highest priority emergency stop command; The control communication network connection is used to synchronize the status and verification data of each system.

2. The integrated verification platform according to claim 1, characterized in that, The test and verification system is also used for safety verification of fuel mode switching under different load conditions, as well as engine safety verification in simulated switching failure scenarios.

3. The integrated verification platform according to claim 1, characterized in that, The integrated verification platform includes monitoring sensors distributed in the target risk area to monitor the presence of ammonia in the target risk area, wherein the target risk area includes the ammonia fuel supply system, ammonia fuel injectors, and pipeline interfaces.

4. The integrated verification platform according to claim 3, characterized in that, The decision-making system includes a safety instrument layer, which is used to receive alarm signals fed back from the monitoring sensors, the first security control unit, and the second security control unit, prioritize the received alarm signals, and perform audible and visual alarms based on the prioritized priorities and predefined alarm methods.

5. The integrated verification platform according to claim 3, characterized in that, The integrated verification platform includes a ventilation system for ventilating the leak area where the monitoring sensor detected ammonia gas.

6. The integrated verification platform according to claim 1, characterized in that, The decision-making system includes a secure logic solver and an interactive interface; The security logic solver is used to receive security-related information, determine the security decision level based on the security-related information and security interlocking logic, and feed it back to the first security control unit and the second security control unit to execute the corresponding security strategy; The interactive interface is used to visually display the system status, real-time alarm list, safety interlock logic, and verification data.

7. A verification method, using the integrated verification platform as described in any one of claims 1 to 6, characterized in that, The method includes: Start each system in the integrated verification platform and perform a security self-check to determine the security readiness status; Based on the aforementioned safety-ready state, start the engine and run it in pure diesel mode to establish a performance baseline; The pure diesel mode is switched to the ammonia-diesel dual-fuel mode at different ammonia substitution rates. The safety parameters for operation in the ammonia-diesel dual-fuel mode at each ammonia substitution rate are determined, and a comparison benchmark is obtained based on the performance baseline and the safety parameters. When the engine is operating at the target ammonia substitution rate, a simulated fault signal is injected through the safety logic solver to analyze the coordinated response status of each system in the integrated verification platform. The security strategy is assessed based on the coordinated response status of each system, and the assessment results are compared with the benchmark to verify the response performance of the security control unit. The security control unit includes a first security control unit and a second security control unit.

8. The method according to claim 7, characterized in that, The step of injecting simulated fault signals through a security logic solver and analyzing the collaborative response status of each system in the integrated verification platform includes: Through the test interface of the safety logic solver, a simulated fault signal is injected into the second security control unit built into the ammonia fuel medium-speed engine system, wherein the simulated fault signal includes a simulated signal of ammonia injection valve drive failure; When the second security control unit detects the simulated fault signal, it sends an alarm signal to the decision-making system and automatically performs a forced switch of fuel mode; Record the entire timing sequence after the simulated signal is injected to analyze the collaborative response status of each system in the integrated verification platform.

9. The method according to claim 7, characterized in that, The method includes: Perform bidirectional switching of fuel modes under multiple load conditions, and collect dynamic parameters during ammonia fuel combustion to detect abnormal fluctuations in real time; Simulate a scenario where the fuel mode switching fails to switch, and verify whether the engine can successfully switch back to the pure diesel mode without the risk of ammonia leakage.

10. The method according to claim 9, characterized in that, The dynamic parameters include the in-cylinder combustion pressure at the moment of switching, the concentration of unburned ammonia in the exhaust, and the fluctuation of ammonia fuel pressure.

11. The method according to claim 7, characterized in that, The method further includes: By using global monitoring sensors to detect or simulate engine compartment leaks in real time, a tiered emergency response process can be implemented.

12. The method according to claim 11, characterized in that, The tiered emergency response process includes: When a ppm-level ammonia leak is detected and the concentration continues to rise, the sensor signal triggers an audible and visual alarm on the safety instrument panel, and displays the leak area and leak concentration on the interactive interface. The ventilation system is activated via a safety logic solver interlock to ventilate the leaked area. If the leakage concentration exceeds a preset threshold, the safety logic solver sends a highest priority emergency stop command to the first security control unit and the second security control unit in the ammonia fuel supply system. The nitrogen purging procedure for the leaked area is initiated simultaneously to purge the remaining ammonia to the waste liquid recovery unit for recycling.

Images