A multi-dimensional fusion full-dimension security protection linkage system and fault isolation method

Abstract

This invention provides a multi-dimensional integrated, all-dimensional safety protection linkage system and fault isolation method. The system includes an Energy Management System (EMS), which is configured to perform the following fault isolation steps: acquiring a multi-dimensional safety status parameter set; performing linkage criterion discrimination processing on the multi-dimensional safety status parameter set to determine the linkage isolation actions to be performed; the types of linkage isolation actions include: insulation linkage isolation action, communication fault fallback linkage action, over-temperature cascade linkage action, and precise electrical fault isolation action; arranging the linkage isolation actions to generate an isolation action sequence; and driving the power distribution switching unit and / or the equipment local control unit to implement fault isolation according to the isolation action sequence. This multi-dimensional integrated, all-dimensional safety protection linkage system and fault isolation method of the present invention precisely confines faults to a single hardware area, improving the safety of power supply operations for mobile energy storage equipment.

Description

Technical Field

[0001] This invention relates to the field of new energy storage and new power system technology, and in particular to a multi-dimensional integrated all-dimensional safety protection linkage system and fault isolation method. Background Technology

[0002] In low-voltage uninterrupted maintenance and emergency power supply operations, the on-site environment often presents an extremely complex AC / DC hybrid network environment. As the core equipment for emergency power supply, mobile energy storage equipment needs to handle the hybrid network topology of 1500V DC high voltage and 400V AC simultaneously, and maintain continuous power supply to the outside world under live-line working conditions.

[0003] In the aforementioned high-risk operating environments, traditional safety protection mechanisms rely excessively on single-point physical circuit breakers for fault isolation. Single-point physical circuit breakers determine thermal or magnetic tripping solely based on the current flowing through them, resulting in a limited range of judgments and making them highly susceptible to failure or malfunction in the complex operating conditions of AC / DC hybrid power grids. Once a single-point physical circuit breaker fails, it can easily trigger secondary disasters, causing localized faults to rapidly spread into global system collapse, and even leading to serious cascading accidents such as fires or electric shocks.

[0004] In view of this, there is an urgent need for a multi-dimensional integrated, all-dimensional security protection linkage system and fault isolation method to at least address the above-mentioned shortcomings. Summary of the Invention

[0005] One of the objectives of this invention is to provide a multi-dimensional integrated, all-dimensional security protection linkage system and fault isolation method to solve the problems mentioned in the background art.

[0006] This invention provides a multi-dimensional integrated, all-dimensional security protection linkage system, comprising: A multi-dimensional integrated, all-dimensional safety protection and linkage system includes an energy storage unit, a power conversion unit, a power distribution switching unit, a sensing and acquisition unit, and an energy management system (EMS). The power distribution switching unit includes at least one controllable DC switching element and at least one controllable AC switching element. The power conversion unit and / or the power distribution switching unit are equipped with local control units. The energy management system (EMS) is configured to perform the following steps: The sensing and acquisition unit collects a multi-dimensional safety status parameter set; the multi-dimensional safety status parameter set includes at least: insulation status parameters of AC and DC circuits, control and communication status parameters, temperature status parameters, and electrical status parameters; The multi-dimensional safety status parameter set is processed by linkage criteria to determine the linkage isolation actions to be performed. The types of linkage isolation actions include: insulation linkage isolation action, communication failure fallback linkage action, over-temperature cascade linkage action, and electrical fault precise isolation action. Perform motion orchestration on the linked isolation actions to generate an isolation action sequence; According to the isolation action sequence, drive the power distribution switching unit and / or the local control unit of the equipment to implement fault isolation.

[0007] Preferably, the steps for determining the insulation linkage isolation action include: When the insulation status parameter of the AC / DC circuit indicates that the insulation level of the AC / DC circuit is lower than the preset insulation safety threshold, the controllable DC switching element is controlled to disconnect the high-voltage DC output circuit. At the same time, if the preset unlocking condition is not met, the high-voltage output enable permission is locked.

[0008] Preferably, locking the high-voltage output enable permission includes: Perform state machine transition processing on the current security state and operation request state to determine the target state of the hierarchical permission state machine and output the corresponding permission control instructions; The hierarchical permission state machine includes at least the following: Warning of restricted status is used to prohibit the connection of new loads and / or limit the maximum output power while maintaining the current power supply; Alarm lockout state is used to keep the controllable DC switching element in the open position and prevent automatic restart; Deadlock state is used to prevent unlocking via remote control and requires local unlocking confirmation conditions to be met before unlocking can be performed; and the preset unlocking conditions include at least receiving a maintenance reset signal indicating that the insulation fault has been eliminated and passing the preset unlocking authentication.

[0009] Preferably, the steps for determining the backup linkage action in case of communication failure include: When the control communication status parameters indicate a communication anomaly that meets the preset communication fault conditions, a control handover is triggered, causing the local control unit of the equipment to take over the control of the power conversion unit and / or the power distribution switching unit and enter fallback operation; when the control communication status parameters indicate that communication has recovered and meet the preset back-off conditions, a back-off command is generated and output to execute the control handover back to the energy management system (EMS).

[0010] Preferably, the steps for determining the backup action in case of communication failure also include: Analyze communication message statistics and message timestamp information to obtain link packet loss rate, communication latency, and latency jitter; The link packet loss rate, communication latency, and latency jitter are fused together to obtain a communication quality score; When the communication quality score is lower than the preset score threshold, the link is switched between at least two communication links according to the preset priority; wherein the communication links include at least one or more of wired industrial Ethernet links and fieldbus links. When at least two communication links fail to meet the preset switchback conditions, a fallback operation is triggered, which is then taken over by the device's local control unit.

[0011] Preferably, the steps for determining the super-temperature stepped linkage action include: When the temperature status parameter indicates that the temperature abnormality meets the preset over-temperature condition, at least the temperature control enhancement action and the power derating action shall be executed according to the preset tiered strategy. If the temperature status parameters still meet the preset shutdown conditions after the power derating operation is performed, a shutdown isolation command is output to cut off the energy conversion output. When the temperature status parameters further indicate the presence of a fire risk and meet the preset fire conditions, a fire warning command is output and the fire-fighting execution unit is activated to carry out fire suppression.

[0012] Preferably, the steps for determining the super-temperature cascade linkage action also include: The temperature state parameter and at least one auxiliary thermal risk parameter are fused and calculated to obtain a comprehensive thermal state index; wherein, the auxiliary thermal risk parameter includes at least one or more of the following: temperature rise rate, state of charge, individual cell temperature difference, and ambient temperature. The thermal state comprehensive index is compared with multiple graded thresholds to determine the tiered trigger level, and the corresponding temperature control enhancement command, derated command, shutdown command and / or fire linkage command are determined according to the tiered trigger level.

[0013] Preferably, the steps for determining the precise isolation action of electrical faults include: When the electrical status parameter characterization circuit abnormally meets the preset electrical fault conditions and / or when the power conversion unit's equipment self-protection status characterization self-protection is triggered, the fault area is determined according to the electrical status parameter and / or equipment self-protection status, and the upstream controllable DC switching element and / or controllable AC switching element electrically connected to the fault area is disconnected to achieve physical electrical isolation of the fault area.

[0014] Preferably, the linkage isolation actions are processed by motion orchestration to generate an isolation action sequence, including: The linkage isolation action is processed to generate action entries, resulting in a set of action entries; each action entry includes at least an action type identifier, a controlled object identifier, instruction parameters, and an execution timing marker. Dependency resolution is performed on the execution timing markers of each action item in the action item set to obtain an action dependency graph; among which, the dependencies include at least: the serial order constraints between the internal temperature control enhancement action of the over-temperature cascade linkage action, the power derating action, the shutdown isolation action and the fire linkage action, and the mutual exclusion constraints of control ownership between the communication failure fallback linkage action and other linkage actions. Perform mutual exclusion conflict detection on the action item set to obtain conflict detection results; when the conflict detection results indicate that there is a conflict of control ownership, prioritize the control ownership to the local control unit of the device, and replace the corresponding original item in the action item set with the updated action item. The set of action items after conflict resolution is topologically sorted according to the action dependency graph to obtain an ordered list of action items with execution order. The ordered list of action items is then output as an isolated action sequence.

[0015] This invention provides a multi-dimensional fusion-based fault isolation method, comprising: Obtain a multi-dimensional safety status parameter set; the multi-dimensional safety status parameter set includes at least: insulation status parameters of AC / DC circuits, control and communication status parameters, temperature status parameters, and electrical status parameters; The multi-dimensional safety status parameter set is processed by linkage criteria to determine the linkage isolation action; the linkage isolation action includes: insulation linkage isolation action, communication failure fallback linkage action, over-temperature cascade linkage action, and electrical fault precise isolation action. Perform motion orchestration on the linked isolation actions to generate an isolation action sequence; According to the isolation action sequence, drive the power distribution switching unit and / or the local control unit of the equipment to implement fault isolation.

[0016] The beneficial effects of this invention are as follows: This invention constructs a globally linked fault isolation closed-loop control logic through an energy management system (EMS). The system rapidly collects safety parameters in four dimensions: AC / DC circuit insulation status, control communication status, temperature status, and electrical status. When the self-protection mechanism of a single subsystem is triggered, it can issue commands across regions to disconnect the relevant AC / DC circuits, precisely limiting serious faults that could otherwise cause the entire system to collapse to the individual hardware area. This avoids chain accidents and secondary disasters caused by the failure of a single physical component, thus improving the safety of power supply operations for mobile energy storage equipment.

[0017] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures particularly pointed out in this application.

[0018] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0019] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 This is a schematic diagram of a multi-dimensional integrated, all-dimensional security protection linkage system according to an embodiment of the present invention; Figure 2 This is a schematic diagram of a multi-dimensional fusion fault isolation method in an embodiment of the present invention. Detailed Implementation

[0020] The preferred embodiments of the present invention will be described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit the present invention.

[0021] This invention provides a multi-dimensional integrated all-dimensional safety protection linkage system, which is mainly installed and applied in the technical equipment of plug-in range-extended hybrid electric vehicles and belongs to the core complete set of equipment in the field of new energy storage and new power systems.

[0022] Please refer to the instruction manual appendix. Figure 1 The system includes an energy storage unit, a power conversion unit, a power distribution switching unit, a sensor acquisition unit, a local equipment control unit, and an energy management system (EMS).

[0023] In this embodiment, the energy storage unit uses a lithium iron phosphate battery pack with a total rated capacity of 352.08 kWh. The battery pack adopts a 2P204S structure and consists of four battery boxes, each with a capacity of 88.02 kWh. Each battery box is equipped with a battery management system (BMS), which is responsible for real-time monitoring and equalization management of the voltage, current, temperature, and state of charge (SOC) of the individual battery cells, and reports the battery status parameters to the energy management system (EMS).

[0024] In this embodiment, the power conversion unit is equipped with two power conversion systems (PCS) each with a rated power of 125 kW. The PCS is the core power electronic device for bidirectional conversion between DC and AC power, integrating IGBT power modules, drive circuits, sampling circuits, and a DSP control board. Each PCS has a built-in local control unit, which is an independent embedded controller with preset charging / discharging control strategies, overcurrent protection curves, overvoltage protection thresholds, and other parameters. Under normal operating conditions, the local control unit receives and executes power commands from the energy management system (EMS). In the event of an EMS communication failure, the local control unit can operate independently of the EMS, maintaining basic charging and discharging functions according to its preset strategies; this is the hardware basis for "backup operation."

[0025] In this embodiment, the power distribution switching unit includes controllable AC switching elements and controllable DC switching elements. The controllable AC switching element is a 500 kVA static transfer switch (STS). This device is based on power electronic devices (thyristors) to form a solid-state switch with no mechanical contacts. It can complete arc-free switching between two AC power sources within 5 milliseconds and receive closing and opening commands from the energy management system (EMS) through a control interface. The controllable DC switching element is a 1500 V DC circuit breaker. This circuit breaker uses an electromagnetic tripping mechanism and supports receiving electrical opening and closing commands from the EMS through a control coil, enabling remote controllable disconnection of the high-voltage DC circuit. The term "controllable" refers to the switching element having an electrical control interface, capable of responding to digital control commands issued by the EMS or the equipment's local control unit to perform opening (disconnection) or closing (closing) operations, unlike ordinary circuit breakers that can only be operated manually. The static transfer switch (STS) also has a built-in local control unit, which can independently execute switching control based on local preset logic in the event of a communication failure.

[0026] The sensing and acquisition unit is the data source for the system to acquire multi-dimensional safety status parameters, covering hundreds of monitoring nodes throughout the system. It mainly includes: an insulation detection module, responsible for real-time dynamic monitoring of the insulation resistance of each DC and AC circuit; a communication status monitoring module, responsible for real-time statistics of message transmission and reception of each communication link; a temperature sensor array, including negative temperature coefficient thermistors (NTC sensors) installed at battery cells, busbars, power modules, and cable joints, as well as an ambient temperature sensor; and an electrical quantity acquisition module, including current transformers and voltage transformers installed in each branch, responsible for real-time acquisition of current and voltage in each circuit.

[0027] The Energy Management System (EMS) is the global control center of this system. It runs on a high-performance industrial-grade computer or embedded controller and communicates bidirectionally with the aforementioned hardware units via industrial Ethernet (Modbus TCP / IP protocol) and fieldbus (CAN / RS485 protocol). It receives status parameters reported by the sensor acquisition unit in real time and issues control commands to the local control units of the power distribution switching unit and / or power conversion unit.

[0028] In the common practice of existing technologies, the aforementioned electrical subsystems typically execute independent protection logic, with physical protection, equipment self-protection, and upper-level software control being isolated from each other and lacking an effective coordination mechanism. The core of this invention lies in constructing a fault isolation closed-loop control logic through an energy management system (EMS), deeply binding the underlying independent hardware self-protection mechanism with the upper-level software control flow, thereby eliminating the safety blind spots of each subsystem operating independently.

[0029] The working process of the all-dimensional safety protection linkage system in this embodiment of the invention is a closed-loop real-time control cycle, and the energy management system (EMS) is configured to perform the following steps: The multi-dimensional safety status parameter set is collected by the sensing and acquisition unit; the multi-dimensional safety status parameter set includes at least: insulation status parameters of AC and DC circuits, control and communication status parameters, temperature status parameters, and electrical status parameters.

[0030] The Energy Management System (EMS) reads raw signals from the sensor acquisition unit via the communication bus at a preset high sampling frequency (set to 100 milliseconds as one acquisition cycle in this embodiment) to construct a multi-dimensional safety status parameter set.

[0031] The insulation detection module uses a low-frequency AC injection method to dynamically monitor the insulation resistance of the 1500V DC circuit and the 400V AC circuit in real time. A low-frequency (typically 1Hz to 5Hz), low-amplitude (typically 5V to 15V) sinusoidal AC test signal is injected into the circuit under test. By measuring the current response of the injected signal in the circuit, the insulation resistance value (unit: megohms) of the circuit to ground is calculated. The insulation status parameter is the insulation resistance detection value of each circuit. In this embodiment, the system sets a preset insulation safety threshold of 8 megohms and a warning threshold of 15 megohms. When the insulation resistance detection value of any circuit is lower than 15 megohms, the insulation status parameter indicates that the insulation level of that circuit has entered the warning range; when it is lower than 8 megohms, it indicates that the insulation level of that circuit is lower than the preset insulation safety threshold, triggering linkage isolation.

[0032] To eliminate the impact of transient interference on insulation test results, the system uses a sliding window mean filtering algorithm to preprocess the insulation resistance test values. The sliding window length is set to 10 consecutive acquisition cycles (i.e., 1000 milliseconds) to filter out insulation measurement spikes caused by transient impacts on the line, while retaining the true insulation degradation trend.

[0033] The communication status monitoring module performs real-time quality monitoring of the communication links between the energy management system (EMS) and each power conversion unit and power distribution switching unit. It performs rolling statistics on the transmission and reception of message frames for each communication link in 100-millisecond cycles. The output control communication status parameters include: the number of sent message frames, the number of successfully received message frames, the number of lost message frames, the transmission timestamp and reception timestamp sequence of each message frame, and the link online status flag (online / offline).

[0034] The temperature sensor array collects data at multiple points, including individual battery cells, battery cluster busbars, energy storage converter power modules, cable connectors, and ambient temperature, with a sampling frequency of 1Hz. Temperature status parameters include: real-time temperature values ​​at each monitoring node (in degrees Celsius), temperature changes at each monitoring node over the past 60 seconds (to calculate the rate of temperature rise, in degrees Celsius / minute), the maximum temperature difference between individual cells within the same battery pack (in degrees Celsius), and the current system state of charge (SOC) (reported in real-time by the battery management system (BMS), in percentage).

[0035] The electrical quantity acquisition module collects the current of each branch and the voltage of each node in real time, with a sampling frequency of no less than 1kHz. It then reports the current RMS values ​​of the current, RMS values ​​of the voltage, and the power factor of each branch to the energy management system (EMS) in real time via the communication bus. Simultaneously, the EMS polls and reads the self-protection trigger flag bits in the internal self-protection status registers of the energy storage converter (PCS) and the static transfer switch (STS), including the overcurrent protection trigger flag, overvoltage protection trigger flag, undervoltage protection trigger flag, and short-circuit protection trigger flag.

[0036] The multi-dimensional safety status parameter set is processed by linkage criteria to determine the linkage isolation actions to be performed. The types of linkage isolation actions include: insulation linkage isolation action, communication failure fallback linkage action, over-temperature cascade linkage action, and electrical fault precise isolation action.

[0037] The Energy Management System (EMS) performs parallel linkage criterion discrimination processing on a multi-dimensional safety status parameter set. The criteria for the four types of linkage isolation actions are independent and run in parallel; any one of the criteria, when met, can independently trigger the corresponding linkage isolation action. The criteria and determination process for each type of linkage isolation action are explained below.

[0038] The insulation linkage isolation action is designed to address the risks of electric shock and leakage caused by the deterioration of insulation performance in AC and DC circuits.

[0039] When the insulation status parameters of the AC / DC circuit indicate that the insulation level of the AC / DC circuit is lower than the preset insulation safety threshold (8 megohms in this embodiment), the energy management system (EMS) determines that the insulation fault triggering condition is met and immediately sends a trip control command to the controllable DC switching element (1500V DC circuit breaker) to disconnect the high-voltage DC output circuit; at the same time, if the preset unlocking condition is not met, the high-voltage output enable permission is locked.

[0040] The specific implementation method for locking the high-voltage output enable permission is as follows: The Energy Management System (EMS) internally runs a hierarchical access control state machine module. A state machine is a software control structure that, at any given time, is in one of several predefined states and, based on the current input (in this case, the insulation resistance detection value and its rate of change), switches to a target state according to predefined transition rules, while simultaneously outputting access control instructions corresponding to the target state. The states and transition logic of the hierarchical access control state machine are as follows: Initial state (normal operation state): When the insulation resistance detection value is higher than the warning threshold (15 megohms in this embodiment), the system operates normally, the high voltage output enable permission is open, and normal power-on and charging / discharging operations are allowed.

[0041] The first transition (from normal operation to warning-limited state): When the insulation resistance reading drops below the warning threshold (15 megohms) but remains above the preset insulation safety threshold (8 megohms), the state machine transitions to the warning-limited state. In this state, the Energy Management System (EMS) prohibits new load connections and limits the system's maximum output power to 80% of its rated power, while maintaining continuous power supply to existing loads. Simultaneously, it issues an insulation warning to maintenance personnel, prompting them to conduct insulation checks. If the insulation resistance reading subsequently rises above the warning threshold, the state machine automatically transitions back to normal operation.

[0042] The second transition (from warning-limited state to alarm-locked state): When the insulation resistance detection value further decreases and falls below the preset insulation safety threshold (8 megohms), or when the rate of decrease of the insulation resistance detection value exceeds the preset rate threshold (set to a decrease of more than 3 megohms per minute in this embodiment), the state machine transitions to the alarm-locked state. The main difference between the alarm-locked state and the warning-limited state is that the system not only performs power-limiting operations, but also directly controls the controllable DC switching element to disconnect and maintain the disconnected state, locks the high-voltage output enable bit, and rejects all automatic restart commands from remote or local sources. The purpose of introducing the rate of decrease criterion is that even if the current insulation resistance detection value has not yet fallen below the safety threshold, if the insulation level is detected to be rapidly deteriorating, the system should lock in advance to prevent the fault from escalating.

[0043] The third transition (from alarm lockout state to deadlock state): When the alarm lockout state persists for more than the preset duration (30 minutes in this embodiment) and the insulation resistance detection value has not recovered to a safe level, or when the system simultaneously detects both insulation and electrical faults, the state machine transitions to a deadlock state. The deadlock state is the most restrictive of the three states. The Energy Management System (EMS) sets a deadlock flag at the software kernel level. Once this flag is set, the system will completely reject all unlocking commands from remote communication interfaces (including the superior scheduling system and remote maintenance platform), and will only respond to operations from the local physical interface. The preset unlocking conditions must simultaneously meet the following two conditions: First, a maintenance reset signal indicating that the insulation fault has been resolved is received. This signal is generated by a qualified maintenance personnel operating the local physical reset button on the equipment panel after completing the insulation fault investigation on-site. Second, preset unlocking authentication is passed, meaning the maintenance personnel must enter a dedicated unlocking key or confirm the legitimacy of the operation through other authentication methods. Both conditions must be met simultaneously to clear the deadlock flag and restore high-voltage output enable permission.

[0044] The above-mentioned three-level state machine design ensures a precise match between insulation protection response and the severity of insulation faults; minor insulation fluctuations only trigger limited warnings to avoid unnecessary power outages; as insulation levels continue to deteriorate, the alarm is gradually upgraded to lockout and even deadlock, ensuring that the equipment must never be restarted with a fault in the event of a serious insulation fault, thus reducing the risk of high-risk operations such as backfeeding and electric shock leakage.

[0045] The communication failure fallback mechanism is designed to address the risk of system outages and power failures caused by communication interruptions between the Energy Management System (EMS) and downstream equipment due to strong external electromagnetic interference or communication equipment malfunctions.

[0046] The system analyzes the communication message statistics and timestamp information in the control communication status parameters to calculate the following three indicators for each communication link: The link packet loss rate is the ratio of the number of lost packets to the total number of packets to be received within the current statistical period. The value ranges from 0 to 1, where 0 indicates no packet loss and 1 indicates all packets are lost. Communication latency is the average time difference between the sending and receiving times of each packet within the current statistical period, measured in milliseconds. Latency jitter is the root mean square value of the difference between the single transmission latency of each packet within the current statistical period and the average latency, measured in milliseconds. It reflects the stability of the link transmission quality; a larger jitter value indicates a more unstable link transmission.

[0047] Subsequently, the system performs a weighted summation calculation on the three indicators to obtain a communication quality score. Each of the three indicators has a corresponding weight coefficient, the sum of which is 1, and each weight coefficient is greater than 0. Each indicator is first normalized by comparing it with its corresponding reference benchmark value, then multiplied by its respective weight coefficient, and the results are summed. The score is converted to a percentage score with 100 points as the maximum. A higher score indicates better communication link quality. In this embodiment, based on the high real-time requirements of the emergency power supply scenario, the weight coefficient for link packet loss rate is set to 0.5, the weight coefficient for communication latency is set to 0.3, and the weight coefficient for latency jitter is set to 0.2, meaning that packet loss rate has the highest weight in terms of its impact on communication quality. The reference benchmark value for communication latency is set to 50 milliseconds (representing the maximum acceptable latency required by the system's communication protocol), and the reference benchmark value for latency jitter is set to 20 milliseconds. Each normalized item is limited to an upper limit of 1 before being included in the summation to prevent negative scores when a single indicator exceeds the limit.

[0048] When the communication quality score of any communication link falls below a preset score threshold (set to 60 points in this embodiment), the system determines that the link quality does not meet normal scheduling requirements and automatically switches to a backup communication link according to a preset priority. In this embodiment, the system is configured with two communication links: the first priority link is a wired industrial Ethernet link (Modbus TCP / IP protocol), which has a large transmission capacity and strong anti-interference capability; the second priority link is a fieldbus link (CAN bus), serving as a backup link. When the communication quality score of the industrial Ethernet link falls below 60 points, the system switches to the CAN bus link; when the communication quality score of the CAN bus link also falls below 60 points, it is determined that all links do not meet normal scheduling requirements, and the system proceeds to the next fallback operation trigger logic.

[0049] The preset communication failure condition is that the communication quality score of all configured communication links simultaneously falls below the preset score threshold (60 points), or the online status flag of any communication link shows offline for three consecutive statistical cycles (i.e., 300 milliseconds). Meeting either of these conditions constitutes a preset communication failure, triggering a control handover. This allows the local control unit of the equipment to take over control of the power conversion unit and / or power distribution switching unit, entering a fallback operation mode. In fallback operation mode, each equipment's local control unit also automatically triggers takeover if it does not receive a heartbeat frame from the energy management system (EMS) within 500 consecutive milliseconds, ensuring that the equipment can reliably enter the fallback state even if the handover command cannot be delivered due to communication interruption. After entering fallback operation, the local control unit of the energy storage converter (PCS) independently executes power control according to the locally preset charging and discharging strategy, and the local control unit of the static transfer switch (STS) independently executes switching control according to the locally preset switching logic, ensuring that the core function of external power supply remains normal.

[0050] When the communication quality score of all communication links remains above the preset score threshold (60 points) for a duration exceeding the preset back-off stabilization time (set to 5 seconds in this embodiment), the Energy Management System (EMS) determines that the preset back-off conditions are met and generates and outputs a back-off command. To ensure the smoothness of the control back-off process, the system adopts a state synchronization handshake protocol to perform a smooth back-off. The EMS first reads the current operating status of the local control unit of each device (including the current power command value, the status of each switch, and the protection status) through the restored communication links, and confirms the consistency with the records on the EMS side. After confirming that there is no deviation, the control is transferred sequentially to each device according to the principle of "confirm first, then switch", and the control is smoothly transferred back from the local control unit of each device to the EMS, avoiding power surges or switch malfunctions caused by sudden changes in control.

[0051] The over-temperature tiered linkage action is designed to address the risk of thermal runaway in large-capacity battery systems. It achieves early prediction and precise control of thermal runaway through multi-parameter fusion and tiered intervention.

[0052] The system performs fusion calculations on temperature state parameters and at least one auxiliary thermal risk parameter to obtain the Thermal State Index (THI).

[0053] The Thermal State Index (THI) is calculated by weighted summation of the normalized values ​​of the following five parameters: the highest temperature currently monitored, the rate of temperature rise at the highest temperature point, the maximum temperature difference between individual cells within the same battery pack, the system's current state of charge (SOC), and the current ambient temperature. In the calculation, each parameter is first normalized by comparing it to its corresponding reference value, then multiplied by its corresponding weighting coefficient, and finally summed to obtain the THI value. A higher THI value indicates a higher current thermal safety risk to the system. Each of the five parameters has a corresponding weighting coefficient, the sum of which is 1, and each weighting coefficient is greater than 0. In this embodiment, the reference values ​​and weighting coefficients for each parameter of the lithium iron phosphate battery chemical system are calibrated as follows: the reference value for the highest temperature is set to 60 degrees Celsius (representing the upper limit of the rated maximum operating temperature of the lithium iron phosphate battery), with a weighting coefficient of 0.35; the reference value for the temperature rise rate is set to 2 degrees Celsius / minute (representing the upper limit of the temperature rise rate under normal charge and discharge conditions), with a weighting coefficient of 0.3; the reference value for the single-cell temperature difference is set to 8 degrees Celsius, with a weighting coefficient of 0.15; the normalized state of charge (SOC) value is directly taken as a percentage divided by 100, with a weighting coefficient of 0.1; and the reference value for the ambient temperature is set to 40 degrees Celsius (representing the upper limit of the rated operating ambient temperature of the system), with a weighting coefficient of 0.1.

[0054] The weighting coefficient for the rate of temperature rise (0.3) is second only to the maximum temperature because the rate of temperature rise is the most predictive characteristic signal in the early stages of thermal runaway. Even if the current absolute temperature is within a safe range, an abnormally high rate of temperature rise still indicates a very high risk of thermal runaway. Introducing this parameter can significantly improve the lead time for thermal runaway prediction. State of charge (SOC) is introduced as an auxiliary thermal risk parameter because at high SOC (e.g., SOC above 90%), the chemical instability of the positive electrode active material inside the battery increases significantly, resulting in a lower thermal runaway trigger threshold at the same temperature. The same temperature at high SOC implies a higher actual risk. Cell temperature difference is introduced as an auxiliary thermal risk parameter because excessive temperature difference between cells often indicates abnormal local heat dissipation or significantly high local cell internal resistance, which is a typical early characteristic signal of thermal runaway initiation.

[0055] The system compares the Thermal State Index (THI) with four graded thresholds to determine the tiered trigger level. After each level is triggered, it maintains the action of that level and continuously monitors it. The system then decides whether to escalate to the next level based on the THI change trend. Level 1 Trigger (Temperature Control Enhancement Level): The trigger condition is that the THI reaches the first-level threshold (set to 0.6 in this embodiment). The system determines that the tiered trigger level is Level 1, outputs a temperature control enhancement command, controls the liquid-cooled thermal management unit (rated cooling capacity 13 kW) to increase to full-load cooling power operation, and simultaneously starts the auxiliary cooling fan to enhance heat exchange capacity and suppress further temperature rise. After executing the temperature control enhancement action, the system continuously monitors the THI change trend: if the THI falls back below the first-level threshold within the preset observation time (set to 5 minutes in this embodiment), the temperature control enhancement action is considered effective, and the Level 1 defense line operation is maintained; otherwise, it proceeds to the Level 2 judgment.

[0056] Second-level trigger (power derating level): The trigger condition is that THI still reaches the second-level threshold (set to 0.75 in this embodiment) while maintaining the temperature control enhancement action. The system outputs a derating command simultaneously while maintaining the temperature control enhancement action, linearly reducing the output power of the power conversion unit at a rate of 10% per minute to reduce the heat power density of the internal heat source of the system.

[0057] Level 3 Trigger (Shutdown Isolation Level): The trigger condition is that after the power derating action is performed, the THI still reaches the third-level threshold (set to 0.9 in this embodiment), or the absolute value of the temperature of any single unit in the temperature status parameters exceeds the preset shutdown temperature threshold (set to 70 degrees Celsius in this embodiment). This level is triggered when either of the above conditions is met. The system outputs a shutdown isolation command, immediately controlling the power conversion unit to shut down, disconnecting the controllable DC switching elements and controllable AC switching elements of the relevant branches, and cutting off all electrical energy conversion output.

[0058] Level 4 Trigger (Fire Protection Linkage Level): The triggering condition is that the THI reaches the fourth-level threshold (set to 0.95 in this embodiment), or the rate of temperature rise exceeds the thermal runaway judgment threshold (set to 5 degrees Celsius / minute in this embodiment) and this state lasts for more than 30 seconds. Meeting either of the above conditions triggers this level. The system outputs a fire warning command and triggers the system's audible and visual alarm device to remind on-site personnel to evacuate immediately; at the same time, it sends a start command to the fire protection execution unit (the battery box has a built-in heptafluoropropane gas fire extinguishing system) to automatically extinguish the fire.

[0059] In the aforementioned four-tiered defense system, each action is executed according to a strict sequential constraint: the temperature control enhancement action, as the first-tier defense, must be triggered before the power derating action; the power derating action must be triggered before the shutdown isolation action; and the shutdown isolation action must be triggered before the fire alarm linkage action. This sequential constraint will be explicitly encoded as a directed constraint edge in the action dependency graph during the action orchestration process in step three to ensure the correctness of the tiered execution.

[0060] The precise isolation action for electrical faults is designed to address electrical faults such as abnormal electrical circuits and equipment self-protection triggering. By accurately identifying the fault area and isolating the minimum necessary range, it maintains normal power supply to non-faulty areas to the greatest extent possible while eliminating the fault.

[0061] When the electrical status parameters characterize a circuit abnormality that meets preset electrical fault conditions, this type of linkage isolation action is triggered. The preset electrical fault conditions include the following: the effective value of any branch current exceeds 120% of the branch's rated current (overcurrent fault); the voltage of any node exceeds 110% of the rated voltage (overvoltage fault) or falls below 85% of the rated voltage (undervoltage fault); any branch current experiences a sudden change exceeding five times the rated current within a single acquisition cycle (short circuit characteristic). These criteria are independent of each other; meeting any one of them determines that the preset electrical fault condition is met. Furthermore, when any self-protection trigger flag bit in the power conversion unit's equipment self-protection state is set, this type of linkage isolation action is also triggered.

[0062] After triggering this type of linkage isolation action, the system determines the fault area based on the source location of the fault characteristics in the electrical status parameters (located to the specific branch through the acquisition channel number where the fault current is located) and the fault device identifier in the device's self-protection status (located to the specific device through the communication address of the device that issued the self-protection trigger signal), combined with the system topology diagram stored in the system (describing the physical connection relationship between each branch switch element and electrical node).

[0063] After identifying the fault area, the system locates the upstream controllable DC and / or upstream controllable AC switching elements directly electrically connected to the fault area in the topology diagram, sends tripping control commands to them, and controls their disconnection to achieve physical electrical isolation of the fault area. Here, "upstream" refers to the switching element located on the power supply side of the fault area in the topology hierarchy. Disconnecting the upstream switching element physically cuts off the power path to the fault area, preventing the continuous flow of fault current. Simultaneously, the system triggers an audible and visual alarm to remind on-site personnel to inspect and troubleshoot the isolated fault area.

[0064] The linkage isolation actions are processed by motion orchestration to generate an isolation action sequence.

[0065] In real-world operating scenarios, multiple types of faults may occur concurrently, leading to the simultaneous triggering of various linkage isolation actions. For example, an electrical fault may cause localized overheating, triggering both the overheating cascade linkage action and the precise electrical fault isolation action simultaneously; or a communication link may be interrupted during insulation fault handling, triggering both the communication fault fallback linkage action and the insulation linkage isolation action simultaneously. If the execution order and control allocation of multiple linkage isolation actions are not systematically addressed, conflicts and competition between actions will lead to isolation failures and even secondary faults. Therefore, this invention introduces an action orchestration mechanism to transform multiple linkage isolation actions into a sequence of isolation actions with a clearly defined execution order. The action orchestration process specifically includes: For all confirmed triggered linkage isolation actions, action entries are generated by encapsulating each atomic operation unit into a standardized action entry, resulting in a set of action entries. Each action entry contains at least the following four fields: Action type identifier, indicating which category the entry belongs to: insulation linkage, communication backup, over-temperature cascade, or electrical precision isolation; Control object identifier, indicating the specific object to which the action entry is executed, such as a DC circuit breaker with a specific number, the local control unit of a specific energy storage converter, or a specific static transfer switch; Command parameters, i.e., the specific control command and its parameter values, such as tripping, derating to 50% of rated power, or activating a fire extinguishing device; Execution sequence flag, indicating the list of preceding dependent entries for this action entry, i.e., which action entries must be completed before this entry.

[0066] Taking the case of a temperature-controlled cascade linkage action where the Thermal State Index (THI) has exceeded the fourth-level threshold as an example, the system generates four action entries: Entry A (temperature control enhancement, no prerequisites), Entry B (power derating, prerequisite is Entry A), Entry C (shutdown isolation, prerequisite is Entry B), and Entry D (firefighting linkage, prerequisite is Entry C), thus forming a complete serial dependency chain.

[0067] Dependency resolution is performed on the execution time markers of all action items in the action item set to construct an action dependency graph. The action dependency graph uses each action item as a node and the dependency relationship as a directed edge (if the execution time marker of action item B contains action item A as a prerequisite, then a directed edge is drawn from A to B in the graph, indicating that A must be executed before B).

[0068] The dependencies explicitly defined in this invention include the following two categories: Serial sequence constraint: There is a strict serial sequence constraint between the temperature control enhancement action, power derating action, shutdown isolation action and fire linkage action within the over-temperature tiered linkage action. In the action dependency diagram, this is reflected by three directed edges: the temperature control enhancement item points to the power derating item, the power derating item points to the shutdown isolation item, and the shutdown isolation item points to the fire linkage item. This ensures that the four-level defense line is executed in the predetermined tiered order and cannot skip levels or be out of order.

[0069] Mutually exclusive control assignment constraint: After a communication failure fallback action transfers control to the local control unit of the equipment, the same controlled object must not simultaneously receive conflicting control commands from both the Energy Management System (EMS) and the local control unit. If two action entries target the same controlled object, and one belongs to the communication fallback category (i.e., a local takeover command issued by the EMS) and the other belongs to the EMS remote control category, then there is a mutual exclusion constraint between them. This constraint is marked with a mutual exclusion marker in the action dependency diagram, indicating that neither can appear in the final execution queue simultaneously.

[0070] The action item set is subjected to mutual exclusion conflict detection. All action item pairs are traversed to detect whether the following two types of conflict exist: First, control ownership conflict, that is, under the same control object, there are remote control items from the energy management system (EMS) side and local takeover items triggered by communication back-end linkage actions at the same time; Second, action target conflict, that is, there are contradictory instructions for opening and closing for the same switching element at the same time.

[0071] When the conflict detection results indicate a conflict in control ownership, the conflict is resolved according to the "local priority" principle: the control ownership is determined to be the local control unit of the equipment, the corresponding energy management system (EMS) remote control entry in the action entry set is canceled, and a corrected local control entry is generated (the control object identifier remains unchanged, the action type is corrected to the communication fallback type, and the command parameters are updated to local control parameters) to replace the original entry in the action entry set, thus updating the action entry set.

[0072] The "local priority" principle is adopted because when a communication failure linkage action has been triggered, the communication link itself is in an unreliable state. The remote control commands issued by the Energy Management System (EMS) through the damaged link are at risk of being mistransmitted, delayed, or lost, and the reliability of the commands cannot be guaranteed. However, the local control unit of the equipment is directly connected to the controlled equipment through local hardwiring or onboard bus, and the communication reliability is not affected by external electromagnetic interference. Therefore, prioritizing local control can effectively prevent erroneous isolation actions caused by unreliable remote commands.

[0073] The set of action items after conflict resolution is topologically sorted according to the action dependency graph, and all action items are organized into an ordered list of action items with a clear execution order.

[0074] During topological sorting, the number of times each node (action item) in the action dependency graph is dependent on other nodes (i.e., in-degree) is first counted. All nodes with an in-degree of 0 (i.e., items that do not depend on any other action items and can be executed immediately) are added to the initial executable queue. Then, nodes are taken out one by one from the executable queue and added to the ordered action item list. At the same time, the in-degree of all successor nodes of that node is decremented by 1. If the in-degree of a successor node drops to 0 as a result, it is added to the executable queue. The above process is repeated until the executable queue is empty.

[0075] If the ordered action list contains all the items in the action item set, the topology sorting is successful, and the ordered action list is output as the isolated action sequence. If the number of items in the ordered action list is less than the total number of items in the action item set, it indicates that there is a directed loop, i.e., circular dependency, in the action dependency graph. The system outputs a sorting anomaly alarm and activates a preset degradation handling scheme, abandoning the current arrangement result and instead executing the preset minimum safety isolation action set in a fixed priority order. This includes sequentially controlling the disconnection of all controllable DC switching elements (highest priority), controlling the disconnection of all controllable AC switching elements (second highest priority), and outputting a shutdown isolation command to control the power conversion unit to shut down (third highest priority). This ensures that the system can still reliably complete the most basic physical electrical isolation in the event of an arrangement anomaly, preventing the fault from spreading.

[0076] According to the isolation action sequence, drive the power distribution switching unit and / or the local control unit of the equipment to implement fault isolation.

[0077] The Energy Management System (EMS) issues control commands to each actuator in sequence according to the ordered action item list, driving the implementation of fault isolation.

[0078] During instruction execution, the system provides feedback confirmation for the execution result of each instruction. For disconnection instructions for controllable DC and AC switching elements, the system confirms reliable disconnection by reading the switch auxiliary contact status feedback signal or the corresponding branch current measurement value (the current should drop to near 0 after disconnection) within a preset timeout period after the instruction is issued. If no confirmation feedback is received within the timeout period, the system resends the instruction once. If no confirmation is received, an alarm is triggered and a backup isolation path is activated (sending the disconnection instruction to the controllable switching element at the higher level to perform a wider range of isolation). The entire instruction issuance and feedback confirmation process forms a closed loop, ensuring that every isolation action is reliably executed.

[0079] This invention provides a multi-dimensional fusion-based fault isolation method, such as... Figure 2 As shown, it includes: Step 1: Obtain the multi-dimensional safety status parameter set; the multi-dimensional safety status parameter set shall include at least: insulation status parameters of AC and DC circuits, control and communication status parameters, temperature status parameters, and electrical status parameters; Step 2: Perform linkage criterion discrimination processing on the multi-dimensional safety status parameter set to determine the linkage isolation action; the linkage isolation action includes: insulation linkage isolation action, communication failure fallback linkage action, over-temperature cascade linkage action, and electrical fault precise isolation action; Step 3: Perform motion orchestration on the linked isolation actions to generate an isolation action sequence; Step 4: Drive the power distribution switching unit and / or the local control unit of the equipment to implement fault isolation according to the isolation action sequence.

[0080] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A multi-dimensional integrated, all-dimensional security protection linkage system, characterized in that, It includes an energy storage unit, a power conversion unit, a power distribution switching unit, a sensing and acquisition unit, and an energy management system (EMS). The power distribution switching unit includes at least one controllable DC switching element and at least one controllable AC switching element. The power conversion unit and / or the power distribution switching unit are equipped with a local control unit. The energy management system (EMS) is configured to perform the following steps: The sensing and acquisition unit collects a multi-dimensional safety status parameter set; the multi-dimensional safety status parameter set includes at least: insulation status parameters of AC and DC circuits, control and communication status parameters, temperature status parameters, and electrical status parameters; The multi-dimensional safety status parameter set is processed by linkage criteria to determine the linkage isolation actions to be performed. The types of linkage isolation actions include: insulation linkage isolation action, communication failure fallback linkage action, over-temperature cascade linkage action, and electrical fault precise isolation action. Perform motion orchestration on the linked isolation actions to generate an isolation action sequence; According to the isolation action sequence, drive the power distribution switching unit and / or the local control unit of the equipment to implement fault isolation.

2. The multi-dimensional integrated all-dimensional security protection linkage system as described in claim 1, characterized in that, The steps for determining the insulation linkage isolation action include: When the insulation status parameter of the AC / DC circuit indicates that the insulation level of the AC / DC circuit is lower than the preset insulation safety threshold, the controllable DC switching element is controlled to disconnect the high-voltage DC output circuit. At the same time, if the preset unlocking condition is not met, the high-voltage output enable permission is locked.

3. The multi-dimensional integrated, all-dimensional security protection linkage system as described in claim 2, characterized in that, Locking the high-voltage output enable permission includes: Perform state machine transition processing on the current security state and operation request state to determine the target state of the hierarchical permission state machine and output the corresponding permission control instructions; The hierarchical permission state machine includes at least the following: Warning of restricted status is used to prohibit the connection of new loads and / or limit the maximum output power while maintaining the current power supply; Alarm lockout state is used to keep the controllable DC switching element in the open position and prevent automatic restart; Deadlock state is used to prevent unlocking via remote control and requires local unlocking confirmation conditions to be met before unlocking can be performed; and the preset unlocking conditions include at least receiving a maintenance reset signal indicating that the insulation fault has been eliminated and passing the preset unlocking authentication.

4. The multi-dimensional integrated, all-dimensional security protection linkage system as described in claim 1, characterized in that, The steps for determining the backup action in case of communication failure include: When the control communication status parameters indicate a communication anomaly that meets the preset communication fault conditions, a control handover is triggered, causing the local control unit of the equipment to take over the control of the power conversion unit and / or the power distribution switching unit and enter fallback operation; when the control communication status parameters indicate that communication has recovered and meet the preset back-off conditions, a back-off command is generated and output to execute the control handover back to the energy management system (EMS).

5. The multi-dimensional integrated, all-dimensional security protection linkage system as described in claim 4, characterized in that, The steps for determining the backup action in case of communication failure also include: Analyze communication message statistics and message timestamp information to obtain link packet loss rate, communication latency, and latency jitter; The link packet loss rate, communication latency, and latency jitter are fused together to obtain a communication quality score; When the communication quality score is lower than the preset score threshold, the link is switched between at least two communication links according to the preset priority; wherein the communication links include at least one or more of wired industrial Ethernet links and fieldbus links. When at least two communication links fail to meet the preset switchback conditions, a fallback operation is triggered, which is then taken over by the device's local control unit.

6. The multi-dimensional integrated, all-dimensional security protection linkage system as described in claim 1, characterized in that, The steps for determining the over-temperature cascade linkage action include: When the temperature status parameter indicates that the temperature abnormality meets the preset over-temperature condition, at least the temperature control enhancement action and the power derating action shall be executed according to the preset tiered strategy. If the temperature status parameters still meet the preset shutdown conditions after the power derating operation is performed, a shutdown isolation command is output to cut off the energy conversion output. When the temperature status parameters further indicate the presence of a fire risk and meet the preset fire conditions, a fire warning command is output and the fire-fighting execution unit is activated to carry out fire suppression.

7. The multi-dimensional integrated, all-dimensional security protection linkage system as described in claim 6, characterized in that, The steps for determining the super-temperature cascade linkage action also include: The temperature state parameter and at least one auxiliary thermal risk parameter are fused and calculated to obtain a comprehensive thermal state index; wherein, the auxiliary thermal risk parameter includes at least one or more of the following: temperature rise rate, state of charge, individual cell temperature difference, and ambient temperature. The thermal state comprehensive index is compared with multiple graded thresholds to determine the tiered trigger level, and the corresponding temperature control enhancement command, derated command, shutdown command and / or fire linkage command are determined according to the tiered trigger level.

8. The multi-dimensional integrated, all-dimensional security protection linkage system as described in claim 1, characterized in that, The steps for determining the precise isolation action of electrical faults include: When the electrical status parameter characterization circuit abnormally meets the preset electrical fault conditions and / or when the power conversion unit's equipment self-protection status characterization self-protection is triggered, the fault area is determined according to the electrical status parameter and / or equipment self-protection status, and the upstream controllable DC switching element and / or controllable AC switching element electrically connected to the fault area is disconnected to achieve physical electrical isolation of the fault area.

9. The multi-dimensional integrated, all-dimensional security protection linkage system as described in claim 1, characterized in that, The linkage isolation actions are processed through motion orchestration to generate an isolation action sequence, including: The linkage isolation action is processed to generate action entries, resulting in a set of action entries; each action entry includes at least an action type identifier, a controlled object identifier, instruction parameters, and an execution timing marker. Dependency resolution is performed on the execution timing markers of each action item in the action item set to obtain an action dependency graph; among which, the dependencies include at least: the serial order constraints between the internal temperature control enhancement action of the over-temperature cascade linkage action, the power derating action, the shutdown isolation action and the fire linkage action, and the mutual exclusion constraints of control ownership between the communication failure fallback linkage action and other linkage actions. Perform mutual exclusion conflict detection on the action item set to obtain conflict detection results; when the conflict detection results indicate that there is a conflict of control ownership, prioritize the control ownership to the local control unit of the device, and replace the corresponding original item in the action item set with the updated action item. The set of action items after conflict resolution is topologically sorted according to the action dependency graph to obtain an ordered list of action items with execution order. The ordered list of action items is then output as an isolated action sequence.

10. A multi-dimensional fusion fault isolation method, applied to the all-dimensional security protection linkage system as described in any one of claims 1 to 9, characterized in that, Fault isolation methods include: Obtain a multi-dimensional safety status parameter set; the multi-dimensional safety status parameter set includes at least: insulation status parameters of AC / DC circuits, control and communication status parameters, temperature status parameters, and electrical status parameters; The multi-dimensional safety status parameter set is processed by linkage criteria to determine the linkage isolation action; the linkage isolation action includes: insulation linkage isolation action, communication failure fallback linkage action, over-temperature cascade linkage action, and electrical fault precise isolation action. Perform motion orchestration on the linked isolation actions to generate an isolation action sequence; According to the isolation action sequence, drive the power distribution switching unit and / or the local control unit of the equipment to implement fault isolation.

Images