Energy storage device offline emergency discharge method, charging method and related device

Abstract

The application is suitable for the technical field of energy storage charging and discharging control, and particularly relates to an energy storage device offline emergency discharging method, a charging method and related devices. The energy storage device offline emergency discharging method comprises the following steps: an emergency control unit receives a hard trigger signal through a physical button; the emergency control unit switches the energy storage device to an off-grid mode in response to the hard trigger signal; battery state self-checking is completed in the off-grid mode; after the self-checking is passed, a wake-up signal is output to a back-end device through a switching circuit of the energy storage device; after the back-end device is woken up, offline identity authentication is performed on the back-end device based on a locally stored device identification white list; and the back-end device is discharged after the authentication is passed. The application solves the problem that the energy storage device cannot be discharged in an emergency under the conditions of power grid power failure, public network interruption and cloud platform offline, and realizes reliable hard triggering and complete power loss device wake-up in a pure offline environment.

Description

Technical Field

[0001] This application belongs to the field of energy storage charging and discharging control technology, and particularly relates to an offline emergency discharge method for an energy storage device, an offline emergency charging method for back-end equipment, an energy storage device, and back-end equipment. Background Technology

[0002] In the field of V2X bidirectional charging and discharging technology for new energy vehicles, mobile energy storage devices, and energy storage cabinets, V2L off-grid discharge function can output the power of the energy storage device to provide emergency power to local loads when the grid is down. V2X technology covers two main operating modes: V2G grid-connected mode and V2L off-grid mode. V2G grid-connected mode relies on the normal operation of the power grid and communication network, achieving synchronous and phase-to-frequency power supply with the grid through phase-locked loops and grid-connected protection. V2L off-grid mode, on the other hand, directly supplies power to local loads in an independent grid configuration when there is no external grid. Existing off-grid discharge startup schemes for V2X equipment are mainly divided into two categories. The first type relies on the energy storage battery or auxiliary power module built into the charging pile or back-end equipment. When the grid is down, the built-in power supply powers the control unit, activating the bidirectional power conversion unit to supply power to the load using the vehicle battery as input. The second type relies on an external uninterruptible power supply or energy storage device in the distribution box. When the grid is down, a switch is used to temporarily supply power to the de-energized charging pile, and the discharge process is executed after the charging pile restarts. In addition, the mode switching of existing solutions all rely on the automatic detection logic of the power grid status. The system automatically determines whether to enter the off-grid mode based on the loss of the power grid voltage signal.

[0003] In extreme scenarios such as war, major earthquakes, and extreme ice storms that cause simultaneous power outages and public network communication disruptions, the aforementioned solutions suffer from the following core flaws: Backend equipment may become completely powerless due to prolonged outages; pre-installed built-in power supplies may become depleted and fail due to prolonged standby; and external uninterruptible power supplies (UPS) may also run out of power after continuous outages, preventing the entire V2L system from starting. More critically, existing off-grid V2L devices lack the ability to reverse-energize completely depleted backend equipment—their startup requires the backend equipment to maintain power or have an independent, not-yet-depleted auxiliary power supply, failing to cover extreme scenarios where backend equipment is permanently depleted. Furthermore, the mode-switching mechanism relying on automatic grid status detection carries the risk of misjudgment and logical failure in abnormal operating conditions such as grid outages with residual voltage or reverse power flow. Currently, there is no purely offline emergency discharge startup solution that can be proactively initiated by the energy storage device and does not rely on the pre-installed power supply of the backend equipment in extreme conditions such as grid outages, public network interruptions, and cloud dispatch platform offline. Summary of the Invention

[0004] This application provides an offline emergency discharge method for energy storage devices, an offline emergency charging method for back-end equipment, an energy storage device, and back-end equipment. It can solve the problem that existing V2L devices cannot be actively initiated by the energy storage device and cannot rely on the pre-installed power supply of the back-end equipment under extreme conditions such as power outages, public grid interruptions, and cloud dispatch platform offline.

[0005] In a first aspect, embodiments of this application provide an offline emergency discharge method for an energy storage device, applied to an energy storage device, the energy storage device including an energy storage device main processor, an emergency control unit independent of the main processor, and physical buttons electrically connected to the emergency control unit, the method including: The emergency control unit receives a hard trigger signal via the physical button; The emergency control unit responds to the hard trigger signal, disables the grid status determination logic, and switches the energy storage device to off-grid mode; The energy storage device completes a battery status self-test in the off-grid mode. After the self-test passes, the switching circuit of the energy storage device is controlled to output a wake-up signal to the back-end device. The wake-up signal includes a first-level signal wake-up and a second-level power wake-up. The first-level signal wake-up is used to release the lockout state of the back-end device from the signal transmission path of the charging interface. The second-level power wake-up is used to provide starting power to the main controller of the back-end device from the high-voltage transmission path of the charging interface. The back-end device refers to the electrical device that is electrically connected to the charging interface. After the backend device is woken up, the energy storage device performs offline identity authentication on the backend device based on the locally stored device identifier whitelist. After successful certification, the energy storage device discharges to the backend equipment.

[0006] The technical solutions described in this application embodiment have at least the following technical effects: The offline emergency discharge method for energy storage devices provided in this application triggers the energy storage device to switch to an off-grid emergency state by using an external hard trigger signal based on the underlying firmware. This method can be used in situations where there is no power or grid connection, such as power outages, public grid interruptions, or cloud dispatch platform offline. It does not rely on the pre-installed power supply of the back-end equipment itself, but instead relies on the two-level energy bootstrapping architecture at the energy storage device to wake up the completely power-depleted back-end equipment. Combined with local whitelist offline identity authentication, it initiates emergency discharge, thereby improving the reliability of emergency power supply startup under extreme conditions.

[0007] In a second aspect, embodiments of this application provide an energy storage device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method as described in any of the first aspects.

[0008] Thirdly, embodiments of this application provide an offline emergency charging method for a backend device, applied to a backend device, the backend device including a backend device main controller and a low-power wake-up circuit, the method including: The low-power wake-up circuit receives a wake-up signal from the energy storage device through the charging interface; wherein, the energy storage device refers to a power supply device electrically connected to the back-end device through the charging interface; the wake-up signal is sent by the energy storage device after completing a battery status self-test in off-grid mode and passing the self-test, the off-grid mode is the mode in which the emergency control unit of the energy storage device switches in response to a hard trigger signal, and the hard trigger signal is a trigger signal received by the emergency control unit through the physical button; Upon receiving the wake-up signal, the low-power wake-up circuit wakes up the back-end device main controller, and the back-end device main controller sends the unique device identifier of the back-end device to the energy storage device through the signal transmission path of the charging interface; wherein, the unique device identifier is used by the energy storage device to perform offline identity authentication of the back-end device. Receive electrical energy from the energy storage device.

[0009] Fourthly, embodiments of this application provide a backend device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method described in any of the third aspects above.

[0010] Fifthly, embodiments of this application provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the method described in any of the first aspects above.

[0011] In a sixth aspect, embodiments of this application provide a computer program product that, when running on an emergency discharge control system, causes the emergency discharge control system to execute the offline emergency discharge method for the energy storage device described in any of the first aspects above.

[0012] It is understood that the beneficial effects of the second to sixth aspects mentioned above can be found in the relevant descriptions in the first aspect mentioned above, and will not be repeated here. Attached Figure Description

[0013] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0014] Figure 1 This is a schematic diagram of the structure of an emergency discharge control system provided in an embodiment of this application; Figure 2 This is a schematic flowchart of an offline emergency discharge method for an energy storage device provided in an embodiment of this application; Figure 3 This is a schematic diagram of the structure of an energy storage device provided in an embodiment of this application; Figure 4 This is a schematic diagram of the structure of a backend device provided in an embodiment of this application. Detailed Implementation

[0015] In related technologies, the external discharge function of existing new energy vehicles, mobile energy storage devices, and megawatt flash-charging energy storage cabinets mainly relies on conventional operating conditions with grid, electricity, and cloud platforms. V2G grid-connected equipment relies on phase-locked loops, grid-connected protection, and two-way communication protocols, and cannot work at all after the grid loses power; although V2L off-grid equipment can achieve load-carrying during power outages, it has defects.

[0016] Existing offline discharge equipment suffers from the following core defects: backend devices may completely lose power due to prolonged power outages; pre-installed built-in power supplies may become depleted and fail due to prolonged standby; and external uninterruptible power supplies may also run out of power after continuous power outages, preventing the entire V2L system from starting. Furthermore, the mode switching mechanism, which relies on automatic grid status detection, carries the risk of misjudgment and logic failure in abnormal operating conditions such as grid outages with residual voltage or reverse power flow.

[0017] To address the aforementioned issues, this application provides an offline emergency discharge method for energy storage devices. In this method, an external hard trigger signal based on the underlying firmware triggers the energy storage device to switch to an off-grid emergency state. This enables the device to operate without grid power, public grid interruptions, or cloud dispatch platform access, without relying on pre-installed power supplies in situations where there is no power or network. Instead, it uses a two-stage energy bootstrapping architecture at the energy storage device to reverse-wake up the completely de-powered backend equipment. Combined with local whitelist offline identity authentication, emergency discharge is initiated, improving the reliability of emergency power supply startup under extreme conditions.

[0018] The offline emergency discharge method for energy storage devices provided in this application embodiment can be applied to energy storage devices, where the energy storage device is the executing entity of the offline emergency discharge method for energy storage devices provided in this application embodiment; the offline emergency charging method for back-end devices provided in this application embodiment can be applied to back-end devices, where the back-end device is the executing entity of the offline emergency charging method for back-end devices provided in this application embodiment. This application embodiment does not impose any restrictions on the specific types of energy storage devices and back-end devices.

[0019] For example, energy storage devices can be new energy vehicles or mobile energy storage robots, and back-end equipment can be charging piles.

[0020] Please see Figure 1 The energy storage device and back-end equipment can be components of an emergency discharge control system, which can include a first hardware domain, a second hardware domain, a third hardware domain, and a fourth hardware domain. The first hardware domain is the energy storage device, including a main processor, an emergency control unit independent of the main processor, physical buttons electrically connected to the emergency control unit, a first switching circuit, a local evidence storage module, and a near-field communication module. The emergency control unit is continuously powered by the low-voltage battery of the energy storage device and connected to the physical buttons via an interrupt channel. It is used to independently sample hard trigger signals and set the emergency mode even in the event of a main processor operating system failure or partial freeze. The first switching circuit generates an enable signal to release the undervoltage lockout of the back-end equipment. The second hardware domain is the back-end equipment, including a low-power wake-up circuit, a back-end equipment main controller, a second switching circuit, a hardware interlock circuit, a non-volatile storage area, and an interlock switch array. The second switching circuit allows the back-end equipment to self-supply from the high-voltage path of the energy storage device. The hardware interlock circuit is connected between the drive signals of the first and second switching circuits to prevent high-voltage energy from flowing back to the low-voltage side of the energy storage device via the signal transmission path. The third hardware domain is the communication domain, which includes a near-field wireless communication channel, a local aggregation channel, a cellular mobile communication channel, and a satellite short message communication channel. This is used to export discharge data from the energy storage device and back-end equipment in environments without a public network. The fourth hardware domain is the remote settlement platform domain, which includes a data receiving and decryption module, a dual-end data cross-verification module, and a unified settlement module. This is used to receive integrity signatures uploaded by both ends and complete the settlement after network recovery.

[0021] The main processor, emergency control unit, and back-end main controller of the energy storage device can be a microcontroller, microprocessor, vehicle domain controller, or industrial control motherboard; the first switching circuit can be a switching circuit composed of MOSFET (Metal Oxide Semiconductor Field Effect Transistor) and optocoupler isolation drive, or a solid-state relay; the local storage module can be SPI NOR Flash memory; the near-field communication module can be a BLE communication module (Bluetooth Low Energy); the low-power wake-up circuit can be an edge-triggered hold circuit composed of a low-power comparator and latch; the second switching circuit can be a solid-state relay; the hardware interlocking circuit can be an AND gate logic chip or an interlocking relay group; the non-volatile storage area can be NOR / NAND Flash memory or EEPROM; the interlocking switch array is a mechanically interlocked relay group or an electronically interlocked switch matrix; the near-field wireless channel can be a BLE or Wi-Fi module; the local aggregation channel can be a CAN bus or a LoRa module (Long Range Radio). Long-distance radio; cellular mobile channels can be 4G or 5G modules; satellite short message channels can be BeiDou-3 regional short message RDSS modules (Radio Determination Satellite Service); remote settlement platform domains can be cloud servers, encryption gateways, and data comparison systems.

[0022] To better understand the offline emergency discharge method for energy storage devices and the offline emergency charging method for back-end devices provided in the embodiments of this application, the specific implementation process of the offline emergency discharge method for energy storage devices and the offline emergency charging method for back-end devices provided in the embodiments of this application will be described by way of example below.

[0023] Figure 2 This paper illustrates a schematic flowchart of an offline emergency discharge method for an energy storage device provided in an embodiment of this application. The offline emergency discharge method for the energy storage device includes: S100: The emergency control unit receives a hard trigger signal via a physical button. In response to the hard trigger signal, the emergency control unit disables the grid status determination logic and switches the energy storage device to off-grid mode.

[0024] It is understandable that shielding the grid status determination logic refers to bypassing the energy storage device's conventional detection process for grid voltage and frequency at the firmware level, allowing the energy storage device to directly enter off-grid mode without determining whether the grid exists or whether grid connection conditions are met. The shielding operation only affects the grid voltage / frequency detection function in the grid connection mode switching judgment module and does not affect the protection circuit's real-time monitoring of high-voltage circuit voltage / current. When a grid recovery notification is received via the communication module or the external voltage at the charging interface is detected to have returned to normal, the emergency control unit clears the emergency flag register, allowing the system to switch back from off-grid mode to normal operating mode. The emergency control unit is continuously powered by the energy storage device's low-voltage battery, and its power circuit does not pass through any power switching devices controlled by the main processor. Therefore, even in the event of a main processor operating system failure, partial freeze, or complete power failure, the emergency control unit continues to operate independently and can continuously monitor the status of physical buttons.

[0025] In one possible implementation, in S100, switching the energy storage device to off-grid mode includes: S110: When the emergency control unit detects that a physical button has been pressed, it sets the emergency flag register inside the emergency control unit in the interrupt service routine, and then wakes up the main processor.

[0026] It is understandable that the interrupt service routine (ISR) is the highest-priority interrupt handler function in the emergency control unit firmware. When a physical button is pressed, the level of the general-purpose input / output pins of the emergency control unit changes, triggering a hardware interrupt. The ISR immediately starts an internal timer. When the duration of continuous pressing reaches a preset threshold, the ISR directly performs a write operation on the corresponding bit in the emergency flag register to set it. This write operation is a register-level hardware operation and does not involve any operating system task scheduling or function calls. The emergency flag register is a non-volatile storage bit within the emergency control unit, and its state is not lost after power failure. Wake-up of the main processor is achieved by controlling the enable pin of the main processor's power management integrated circuit through the general-purpose input / output pins of the emergency control unit, enabling the main processor to power on from a power-down or hibernation state.

[0027] For example, the preset duration threshold is 3 seconds to prevent accidental triggering. The emergency flag register is bit 0 of the internal status register of the emergency control unit, denoted as the emergency flag bit. The emergency control unit is connected to the main processor via the integrated circuit bus I2C or the serial peripheral interface SPI, and is used to allow the main processor to read the register status after power-on.

[0028] Optionally, the preset duration threshold can also be set to 5 seconds or 10 seconds depending on the device installation location and usage scenario. The emergency control unit can also communicate with the main processor via a Universal Asynchronous Receiver / Transmitter (UART).

[0029] S120: After the main processor is woken up, it reads the status of the emergency flag register. When the emergency flag register indicates emergency mode, it does not load system service modules in the main processor's operating system that are unrelated to the off-network mode, but only loads the driver and control modules necessary for the off-network mode.

[0030] As can be understood, the bootloader is the first piece of code executed after the main processor powers on, located in the boot partition of the main processor's read-only memory or flash memory. After the main processor is awakened, it executes the bootloader, first reading the value of the emergency flag register of the emergency control unit via the communication bus. If the emergency flag indicates emergency mode, the bootloader does not load all system service modules unrelated to off-network mode from the regular operating system, including but not limited to the network communication protocol stack, cellular mobile communication drivers, graphical user interface framework, application layer services, and cloud connection services. It only loads the drivers and control modules necessary for the off-network independent network construction mode. This significantly shortens the main processor's boot time and avoids the risk of the system failing to enter emergency mode due to network protocol stack or graphics framework initialization failures.

[0031] For example, for a main processor running the Linux operating system, skipping the network protocol stack means not starting the TCP / IP protocol stack, not configuring network interfaces and routing tables; skipping the graphical user interface framework means not starting the X Window System or Wayland display services. For a main processor running the AUTOSAR architecture, skipping irrelevant modules means not starting the COM stack and the DCM stack, but only starting the Microcontroller Abstraction Layer (MCAL) and the ECU Abstraction Layer.

[0032] Alternatively, a dedicated emergency boot partition can be pre-configured in the flash memory. This partition contains only a minimal kernel, and the bootloader will jump directly to this partition to execute when it detects emergency mode.

[0033] S200: In off-grid mode, the energy storage device completes a battery status self-test. After passing the self-test, the switching circuit controlling the energy storage device outputs a wake-up signal to the back-end equipment. This wake-up signal includes a first-level signal wake-up and a second-level power wake-up. The first-level signal wake-up is used to release the lockout state of the back-end equipment from the signal transmission path of the charging interface. The second-level power wake-up is used to provide startup power to the main controller of the back-end equipment from the high-voltage transmission path of the charging interface. The back-end equipment refers to the electrical equipment electrically connected to the charging interface.

[0034] For backend devices: The low-power wake-up circuit receives the wake-up signal from the energy storage device through the charging interface. The energy storage device refers to the power supply equipment electrically connected to the backend device via the charging interface. The wake-up signal is sent by the energy storage device after completing a battery status self-check in off-grid mode and passing the self-check. Off-grid mode is the mode in which the emergency control unit of the energy storage device switches in response to a hard trigger signal, which is a trigger signal received by the emergency control unit via a physical button.

[0035] It is understandable that the battery status self-check includes detecting whether the battery's State of Charge (SOC) is higher than a preset charge threshold. Only when the SOC is higher than the preset threshold will the subsequent process continue to prevent irreversible damage to the battery from deep discharge. The wake-up signal is a pulse signal actively output from the energy storage device to the back-end device via the charging interface, along with startup energy (the pulse signal is transmitted through the signal transmission path of the charging interface, and the startup energy is transmitted through the high-voltage transmission path of the charging interface). This is used to unlock the back-end device, which is in a completely power-depleted state without external power supply, and to inject initial energy, thereby activating the low-power wake-up circuit in the back-end device. This unlocks the hardware lock-up state of the back-end device and starts the main controller of the back-end device using the startup energy. This process differs from the prerequisite in traditional V2L discharge where the back-end device needs to be powered on itself to operate. The above process forms a two-stage energy bootstrapping architecture: the first stage outputs a pulse signal through the signal transmission path to wake up the low-power wake-up circuit of the back-end device; the second stage provides startup energy to the main controller of the back-end device through the high-voltage transmission path.

[0036] For example, the energy storage device also includes a battery management unit, which is a battery management chip (Battery Management System). The battery management unit can perform a self-test of the battery status in off-grid mode. After the self-test is passed, the energy storage device outputs a wake-up signal to the back-end device through the signal transmission path of the charging interface.

[0037] For example, the preset power threshold can be 20% of the battery's rated capacity. The signal transmission path of the charging interface is the auxiliary pin of the charging gun.

[0038] Optionally, the preset power threshold can be adjusted to any value between 10% and 30% depending on the battery type and emergency scenario requirements.

[0039] In one possible implementation, in S200, the switching circuit controlling the energy storage device outputs a wake-up signal to the backend device, including: S210 controls the first switching circuit to output a pulse signal with preset electrical parameters to the backend device through the signal transmission path of the charging interface. The pulse signal, after being processed by the signal conditioning circuit inside the backend device, releases the lockout state of the backend device.

[0040] For the backend equipment: After the low-power wake-up circuit receives the pulse signal sent by the energy storage device through the signal transmission path of the charging interface, it conditions the pulse signal and releases the lockout state of the backend equipment's main controller based on the conditioned pulse signal. The pulse signal is a pulse signal with preset electrical parameters sent by the first switching circuit of the energy storage device.

[0041] It is understandable that the first switching circuit is a switching device used by the energy storage device to control the output of the wake-up signal, and is controlled by the general input / output signals of the battery management unit through an isolated drive circuit. A pulse signal with preset electrical parameters means that the voltage amplitude, peak current, and duration of the pulse are all preset fixed values. The setting of these parameters needs to meet two conditions: first, the pulse energy is sufficient to drive the low-power wake-up circuit inside the back-end device; second, it does not exceed the electrical carrying capacity of the charging interface signal transmission path.

[0042] The signal conditioning circuit (i.e., the low-power wake-up circuit) includes an overvoltage protection circuit, a rectification circuit, a filtering circuit, and a voltage comparator circuit connected in sequence. The pulse signal first undergoes overvoltage protection via a transient voltage suppression diode, then is converted to a DC level after half-wave rectification by a Schottky diode and filtering by a filter capacitor. This DC level is fed into the non-inverting input of the low-power comparator and compared with a preset reference threshold voltage connected to the inverting input. When the DC level exceeds the reference threshold, the comparator output flips from low to high. This high-level signal is sent in two ways: one to the enable pin of the power management chip in the backend device to release the chip-level undervoltage lockout, and the other is latched and held by a latch to ensure that the wake-up state is not lost after the pulse ends. Releasing the lockout state of the backend device means releasing the backend device from the state of being forcibly shut down by hardware due to undervoltage, allowing the main controller of the backend device to power on and start.

[0043] For example, the first switching circuit is an isolation drive circuit composed of an N-channel MOSFET switch and an optocoupler isolator. Specifically, the power input drives the MOSFET gate through the optocoupler isolator, turning on the MOSFET, thus turning on the first switching circuit. The function of the optocoupler is that, since the back-end device connected to the charging interface is in a completely de-powered state and its circuit state is unpredictable, the optocoupler provides significant electrical isolation between the power supply and the charging interface. Even if the back-end device has a short-circuit fault, it will not damage the energy storage device. The preset electrical parameters of the pulse signal are an amplitude of 24 volts, a peak current of 150 mA, a duration of 500 milliseconds, and a square wave waveform. The low-voltage battery voltage of the energy storage device is 12 volts or 24 volts, which is boosted to 24 volts by a boost converter before being output.

[0044] Alternatively, a solid-state relay can be used in the first switching circuit instead of the combination of MOSFET and optocoupler. The pulse parameters can also be adjusted according to the actual power consumption requirements of the wake-up circuit inside the back-end device; for example, the amplitude can be adjusted to any value between 12 volts and 28 volts.

[0045] For example, the signal conditioning circuit includes a self-powered edge-triggered hold circuit. This circuit includes an overvoltage protection branch, an energy storage power supply path, and a voltage comparison branch.

[0046] Alternatively, the signal conditioning circuit can use a window comparator instead of a single threshold comparator to achieve more accurate voltage range determination. The latch can also be replaced by a non-volatile register within the microcontroller.

[0047] S220 outputs electrical energy from the energy storage device through the high-voltage transmission path of the charging interface to provide startup power for the main control unit of the back-end equipment. The back-end equipment, after receiving initial power, controls the second switching circuit to conduct, obtaining electrical energy from the energy storage device through the high-voltage transmission path of the charging interface.

[0048] For backend equipment: The main controller of the backend equipment receives startup power through the high-voltage transmission path of the charging interface to complete the startup, and then controls the second switching circuit to conduct. The second switching circuit is used to obtain power from the energy storage device through the high-voltage transmission path of the charging interface to supply power to the electrical load of the backend equipment.

[0049] It can be understood that after the back-end device receives initial power, it means that the main controller of the back-end device powers on and completes initialization after receiving the DC level output by the aforementioned signal conditioning circuit. The second switching circuit is a switching device inside the back-end device used to draw power from the high-voltage side of the energy storage device, and is controlled by the main controller of the back-end device. The high-voltage transmission path is the transmission path in the charging interface that carries the high-voltage DC power from the energy storage device, and is physically independent of the aforementioned signal transmission path used to transmit pulse signals. The back-end device temporarily draws power from the high-voltage side of the energy storage device through the second switching circuit, and the power drawn is limited to within a preset power threshold. This power is used to start the AC-to-DC auxiliary power supply module inside the back-end device, providing a stable low-voltage operating power supply for the back-end device.

[0050] For example, the second switching circuit is a bidirectional thyristor switch (TRIAC) driven by an optocoupler. When the main controller of the back-end device starts up, it outputs a high level to the optocoupler to drive the TRIAC to conduct, allowing the energy storage device to continuously supply power to the back-end device through the second switching circuit. The high-voltage transmission path is the high-voltage pin of the charging gun. The preset power threshold is 50 watts, and current limiting protection is achieved through a 20-ohm, 50-watt rated current-limiting resistor and a 2-amp fuse connected in series. The high-voltage side voltage range of the energy storage device is 300 volts to 800 volts DC.

[0051] Alternatively, the second switching circuit can also use a solid-state relay or a high-voltage isolating switch to replace the TRIAC.

[0052] S230: After confirming that the back-end equipment is operating independently, the signal transmission path is disconnected while the high-voltage transmission path continues to provide power.

[0053] For backend devices: Backend devices continuously receive electrical energy.

[0054] It can be understood that self-sustaining operation of back-end equipment refers to the ability of the AC-to-DC auxiliary power module inside the back-end equipment to provide a stable operating voltage to various circuit modules after the startup and voltage regulation process. For example, when the main controller of the back-end equipment detects that the output voltage of the auxiliary power module is stable at a preset rated voltage (e.g., 12V±5%) for more than 200ms, it determines that the back-end equipment has achieved self-sustaining operation and sends a high-level feedback signal to the energy storage device via an isolation optocoupler. The back-end equipment notifies the battery management unit to shut down the first switching circuit through an isolation feedback channel, for example, by sending a feedback signal to the energy storage device via an isolation optocoupler. After receiving the feedback signal, the battery management unit sets the control signal of the first switching circuit to an invalid level, physically shutting down the first switching circuit. After this, the back-end equipment operates entirely through the high-voltage transmission path, and the signal transmission path containing the first switching circuit is physically disconnected; there is no longer any electrical connection between the high-voltage transmission path and the signal transmission path.

[0055] Alternatively, feedback notifications can also be implemented via the Controller Area Network (CAN) bus, but it must be ensured that the CAN transceiver is functioning correctly after the auxiliary power supply has stabilized.

[0056] Optionally, a hardware interlock logic is configured between the drive signal of the first switching circuit and the drive signal of the second switching circuit. The hardware interlock logic ensures that when the second switching circuit is turned on, the first switching circuit is forced to remain in the off state regardless of the value of the drive signal of the first switching circuit.

[0057] As can be understood, hardware interlocking logic is a set of mutually exclusive logic implemented entirely by hardware circuits without software intervention. It ensures that the first and second switching circuits cannot be simultaneously on. When the second switching circuit is on, there is a DC high voltage of 300 to 800 volts on the high-voltage transmission path. If the first switching circuit also accidentally turns on at this time, the high-voltage energy may flow back to the low-voltage side of the energy storage device through the signal transmission path, causing the low-voltage circuit of the energy storage device to burn out. Hardware interlocking logic eliminates this safety hazard through pure hardware. Even if the software control logic malfunctions, hardware interlocking can guarantee safety at the physical level.

[0058] For example, the hardware interlock logic is implemented using cross-coupled logic circuits. Specifically, the hardware interlock circuit includes a first NAND gate and a second NAND gate. The first input of the first NAND gate receives the drive signal from the first switching circuit, and the second input of the first NAND gate is connected to the output of the second NAND gate. The first input of the second NAND gate receives the drive signal from the second switching circuit, and the second input of the second NAND gate is connected to the output of the first NAND gate. The output of the first NAND gate is connected to the enable terminal of the first switching circuit, and the output of the second NAND gate is connected to the enable terminal of the second switching circuit. Under normal conditions, both the first and second switching circuit drive signals are low, both NAND gates output high, and both switching circuits are in the off state. When the first switching circuit needs to be turned on, its drive signal flips to a high level, and the output of the first NAND gate flips to a low level, turning on the first switching circuit. At the same time, this low level is fed back to the second input of the second NAND gate, forcibly locking the output of the second NAND gate to a high level, so that the second switching circuit is forced to remain in the off state regardless of the value of its drive signal. Similarly, when the second switching circuit is turned on, the first switching circuit is forcibly locked in the off state. This achieves hardware interlocking between the two switching circuits.

[0059] After the backend device is woken up, the S300 energy storage device performs offline identity authentication for the backend device based on the locally pre-stored device identifier whitelist.

[0060] For backend devices: Upon receiving the wake-up signal, the low-power wake-up circuit wakes up the backend device's main controller. The backend device's main controller then sends the backend device's unique identifier to the energy storage device through the signal transmission path of the charging interface. This unique identifier is used by the energy storage device for offline authentication of the backend device.

[0061] As can be understood, offline identity authentication refers to the entire authentication process where the energy storage device verifies the identity of backend devices solely based on a pre-stored device identifier whitelist in its local memory. This process does not rely on any external network connection or involve any data interaction with the cloud platform. The device identifier whitelist is a list of authorized device identifiers distributed by the cloud platform or imported into the energy storage device's local memory when the network is functioning normally. Each whitelist entry contains a hashed device identifier, authorization level, and validity period. When a backend device is activated, its main controller sends a unique device identifier to the energy storage device. Upon receiving this identifier, the energy storage device retrieves it from the pre-stored whitelist to perform offline identity authentication.

[0062] For example, the whitelist is stored in the serial peripheral interface flash memory chip of the energy storage device, with a capacity of not less than 16 megabytes, and is divided into two logical areas: a permanent whitelist partition and a temporary whitelist partition. Entries in the permanent whitelist are valid indefinitely, while entries in the temporary whitelist are automatically deleted after a preset validity period, preferably 1 to 24 hours.

[0063] Alternatively, the whitelist can also be updated offline on-site using the operator's near-field communication card or Bluetooth device.

[0064] In one possible implementation, within the S300, offline authentication of backend devices is performed based on a locally pre-stored device identifier whitelist, including: S310: After the backend device is woken up, it reads the device's unique identifier and calculates the first hash value of the device's unique identifier.

[0065] As we understand it, a device's unique identifier is a unique code embedded in the battery management system or vehicle control unit at the factory, such as a charging pile serial number or SN code. After being activated, the backend device sends this unique identifier via the controller area network bus or the auxiliary communication channel of the charging interface. The energy storage device then uses a preset hash algorithm to perform a hash operation on this identifier, obtaining a fixed-length first hash value. The purpose of using the hash value instead of the original identifier for comparison is to protect device privacy; even if the whitelist data stored in the energy storage device is illegally read, the original device unique identifier cannot be recovered.

[0066] For example, the default hash algorithm is the Chinese national cryptographic SM3 hash algorithm, and the output is a 32-byte hash value. The controller area network bus is a CAN 2.0B bus conforming to the ISO 11898 standard.

[0067] Alternatively, the default hash algorithm can also be the SHA-256 algorithm.

[0068] S320: Search for a whitelist entry that matches the first hash value in the whitelist partition of the local storage area.

[0069] It can be understood that the whitelist partition is a logical partition within the non-volatile storage area of ​​an energy storage device specifically used to store a whitelist of device identifiers. The energy storage device uses a binary search algorithm to search for an entry in the whitelist that matches the first hash value. The binary search assumes that the whitelist entries were sorted by hash value during storage. Each whitelist entry includes three fields: the hash value of the device identifier, the authorization level, and the expiration time stamp.

[0070] Alternatively, when the number of whitelist entries is small, sequential search can be used instead of binary search. Whitelist entries can also be stored using a hash table structure to further improve search speed.

[0071] S330: If a matching entry is found, the dynamic token sent by the backend device is further verified. After successful verification, the discharge switch is closed. The dynamic token is generated by the backend device in combination with the device's preset key, running counter, and local clock. The verification of the dynamic token has a fault-tolerant window to compensate for clock drift in offline mode.

[0072] For backend devices: After the backend device's main controller is woken up, it sends a unique device identifier to the energy storage device, then generates a dynamic token based on the backend device's pre-configured key, running counter, and local clock, and sends the dynamic token to the energy storage device. The unique device identifier is used by the energy storage device to search within the whitelisted partitions of its local storage area, and the dynamic token is used for further verification by the energy storage device after a matching entry for the unique device identifier is found. The dynamic token verification is configured with a fault-tolerant window to compensate for clock drift in offline mode.

[0073] As can be understood, a dynamic token is a one-time identity credential generated by the backend device using a preset digital signature algorithm based on its own pre-set key, the current value of the hardware runtime counter, and the current timestamp of the local real-time clock. The hardware runtime counter is a hardware register within the backend device; its value monotonically increases with the device's power-on runtime and is not lost after power failure, preventing the replay of previously recorded valid tokens. The local clock is the backend device's internal real-time clock, powered by an independent backup battery, and may experience some clock drift during prolonged offline operation. The fault tolerance window refers to setting a positive and negative tolerance range for timestamp comparison when verifying the dynamic token, ensuring that even if the local clock experiences a few minutes of error due to offline drift, the dynamic token can still pass verification. After successful verification, the energy storage device outputs a control signal to close the discharge switch, establishing a discharge circuit.

[0074] For example, the default digital signature algorithm is the SM2 elliptic curve signature algorithm, a national standard cryptographic standard. The hardware runtime counter is a 32-bit unsigned integer, initialized to zero at the factory, and increments by one every hour the device runs after power-on. The fault tolerance window is ±5 minutes. The discharge switch is a high-voltage DC relay or contactor in the backend equipment.

[0075] Alternatively, the dynamic token can also use a hash-based message authentication code (HMAC) instead of a digital signature. The fault tolerance window can also be set to ±10 minutes based on the crystal oscillator accuracy of the real-time clock.

[0076] After S400 is certified, discharge the backend device.

[0077] For backend equipment: receiving electrical energy from energy storage devices.

[0078] It is understandable that after certification, the energy storage device establishes a charging and discharging circuit with the back-end equipment, and the energy storage device discharges to the back-end equipment through the high-voltage transmission path of the charging interface.

[0079] Optionally, the method also includes: S510, the energy storage device generates an initial verification anchor point during the first discharge and stores the initial verification anchor point in the local memory.

[0080] For backend devices: When charging for the first time, the backend device generates an initial verification anchor point and stores the initial verification anchor point in local memory.

[0081] The initial verification anchor point is understood to be a verification value generated and stored in local memory when the energy storage device or backend equipment first performs a discharge or charge operation. It serves as the starting point and root of trust for the entire verification chain. Subsequent discharge or charge records generate verification values ​​sequentially based on this initial verification anchor point. "Storing" refers to writing the initial verification anchor point into a write-protected area of ​​local memory, which cannot be modified or erased after being written. The generation materials for the initial verification anchor point include the factory serial number of the energy storage device or backend equipment and a random seed value generated by a true random number generator during the manufacturing stage. These materials are determined at the time of device manufacture and cannot be predicted or tampered with externally.

[0082] For example, the initial verification anchor is generated as follows: the device's unique identifier, factory serial number, and 256-bit factory random seed value are concatenated, and then a 32-byte hash value is calculated using the national cryptographic SM3 hash algorithm, which serves as the initial verification anchor. The factory random seed is stored in the embedded security element chip with an integrated security encryption engine and cannot be read through the debugging interface.

[0083] Alternatively, the initial verification anchor point can also be issued by the cloud platform when the device first connects to the network for registration. However, in this case, the device cannot generate a complete verification chain before the first network registration, and the default fill value can be used as a temporary verification anchor point.

[0084] In S520, during each discharge process, the checksum of the current discharge record is calculated by combining various fields of the current discharge data, the checksum of the previous discharge record, the clock information at the time of record generation, and the random factor generated this time. Based on the checksums of multiple discharge records, a hash chain-like integrity signature is generated. The energy storage device and the backend equipment each independently maintain a checksum chain consisting of multiple discharge records. Each discharge record is assigned a unique session identifier, which is generated by hashing the device identifier, timestamp, and random number.

[0085] For the backend device: During each charging process, the verification value of the current charging record is calculated by combining various fields of the current charging data, the verification value of the previous charging record, the clock information of the current record generation time, and the random factor generated this time. An integrity signature in the form of a hash chain is then generated based on the verification values ​​of multiple charging records. The backend device maintains a verification chain consisting of multiple charging records, each assigned a unique session identifier. This unique session identifier is generated by hashing the device identifier, timestamp, and random number.

[0086] It can be understood that the fields of the current discharge or charging data refer to all discharge parameters recorded during a single discharge process, including the concatenation of fields such as discharge start and end time, cumulative power, power information, and termination reason. The checksum of the previous discharge or charging record refers to the checksum obtained by hashing the immediately preceding record in the checksum chain. The clock information at the time of generation of this record refers to the timestamp read from the local real-time clock when this discharge record is written to the memory. The random factor generated this time refers to a new random number generated by the hardware random number generator during this calculation, used to enhance the security of the checksum chain, so that the same discharge data generates different checksums at different times. All discharge or charging records and checksums are generated into an integrity signature in the form of a hash chain. The integrity signature can be used to verify whether the discharge record has been altered. The energy storage device and the back-end equipment each maintain a complete checksum independently, and the two checksum chains do not affect each other. A unique session identifier is used to associate two discharge records generated by the same discharge event at the energy storage device end and the back-end equipment end respectively. After the network is restored, the cloud platform matches and compares the data from both ends based on the same session identifier.

[0087] For example, the checksum is calculated using the national cryptographic SM3 hash algorithm. The current discharge data, the checksum of the previous record, the current timestamp, and the current random salt value are concatenated and input into the SM3 algorithm to obtain a 32-byte checksum. The unique session identifier is the first 12 bytes of the concatenated value of the device identifier, the current timestamp, and the current random number, after being hashed using the SM3 algorithm.

[0088] Alternatively, the hash algorithm can also use SHA-256 instead of SM3.

[0089] In S530, once network communication is restored, the energy storage device and the back-end equipment will upload their respective integrity signatures to the cloud platform. The cloud platform will then cross-verify the integrity signatures and complete the unified settlement.

[0090] It is understandable that network communication restoration refers to the restoration of public network communication after the power grid is restored, or the restoration of internet connection through other means (such as emergency communication vehicles or satellite internet) even though the power grid has not yet been restored. An integrity signature is a complete data packet containing discharge data and a hash chain verification value. After receiving the integrity signatures uploaded by both ends, the cloud platform first pairs the data based on the session identifier, and then compares key fields such as cumulative power consumption and start and end times of the paired data. If the difference is within the preset tolerance range, settlement is completed directly; if the difference exceeds the tolerance range, a manual verification process is triggered. If only one end uploaded data (the other end's device is damaged), the data from the surviving end is used as the basis for settlement, and a mark indicating that the surviving end's hash chain integrity verification has passed is attached.

[0091] For example, the preset tolerance range is that the cumulative power difference does not exceed 0.1 kWh. Network communication restoration includes 4G or 5G cellular mobile communication restoration, Ethernet connection restoration, or Wi-Fi connection restoration.

[0092] In one possible implementation, within the S530, the energy storage device and the back-end equipment upload their respective integrity signatures to the cloud platform, including at least one of the following methods: First upload method: In the first upload method, the mobile terminal reads the evidence data encrypted by the preset encryption algorithm from the energy storage device or back-end equipment locally through near-field wireless communication, and automatically uploads it to the cloud platform after the mobile terminal restores its Internet connection.

[0093] Understandably, the first upload method is suitable for scenarios where a mobile terminal is present but there is no public network coverage. Operators use a mobile terminal with a dedicated application installed to establish a connection with the energy storage device or backend equipment via a near-field communication protocol. The operator reads the encrypted evidence data from the device's local storage. The data is temporarily stored locally on the mobile terminal in a secure sandbox, inaccessible to other applications. Once the mobile terminal moves to an area with internet access or waits for public network access to be restored, the application automatically uploads the temporarily stored evidence data to the cloud platform via an encrypted transmission channel, eliminating the need for manual operation by the operator.

[0094] For example, the near-field wireless communication uses the Bluetooth Low Energy (BLE) 5.0 protocol, with an effective communication range of approximately 10 meters. Encrypted storage employs the Chinese national standard SM4 symmetric encryption algorithm, with the encryption key derived from a pre-set key on the device. The encrypted transmission channel uses the Transport Layer Security (TLS) 1.3 encryption protocol.

[0095] Alternatively, near-field wireless communication can use Wi-Fi Direct or NFC instead of Bluetooth.

[0096] Second upload method: In the second upload method, the discharge data of the energy storage device or back-end equipment is aggregated to a data acquisition device via local communication, and then uploaded to the cloud platform via the cellular mobile communication channel. When cellular mobile communication is unavailable, the data acquisition device switches to the satellite short message communication channel and only uploads the verification value and key business fields of the latest discharge record. The complete data will be re-uploaded to the cloud platform after cellular mobile communication is restored.

[0097] Understandably, the second upload method is suitable for multi-device scenarios where there is no public network coverage and operators are not on-site, making it impossible to collect data from each device individually via mobile terminals. A data acquisition device is installed within the deployment area of ​​the energy storage device or backend equipment, establishing a connection with each device via a local wired or low-power wireless communication protocol, and periodically collecting the stored data from each device. When cellular mobile communication is unavailable, it automatically switches to the satellite short message communication channel. Due to the extremely limited capacity of a single satellite short message transmission, only the checksum of the latest discharge record and key business fields such as cumulative power and timestamp are sent. The complete data record is retrieved from the local storage of the acquisition device and re-transmitted to the cloud platform after cellular mobile communication is restored.

[0098] For example, local communication uses an RS485 bus with Modbus RTU protocol, or LoRa wireless communication. The cellular mobile communication module is a 4G LTE module. The satellite short message communication module is the BeiDou-3 Regional Short Message Radio Determination Service (RDSS) module. The format of the simplified data packet is: 8 bytes of session identifier, 32 bytes of latest record hash value, 8 bytes of cumulative total battery power, 8 bytes of current timestamp, and 2 bytes of cyclic redundancy check (CRC16), with a total transmission length of approximately 60 bytes.

[0099] Third upload method: In the third upload method, after communication is restored, the energy storage device and back-end equipment will automatically encrypt and upload all offline evidence data to the cloud platform in batches.

[0100] Understandably, the third upload method is suitable for scenarios where power supply from the power grid and public network communication have been fully restored. After power-on, the energy storage device and backend equipment automatically detect the internet connection status of the communication module. Once internet availability is detected, all evidence-based data accumulated during the offline period is immediately encrypted and uploaded to the cloud platform in batches according to time sequence. During the upload process, the cloud platform confirms receipt of each batch of data, and supports resuming interrupted uploads. After all data is uploaded, the device receives a confirmation receipt from the cloud platform, indicating that the batch of offline data has been successfully entered into the settlement system.

[0101] Optionally, when multiple energy storage devices simultaneously request access to the same backend device, the method further includes: S610: The backend equipment determines the access priority based on the battery power status, battery health and device authorization level of each energy storage device, and queues them according to the priority.

[0102] Queuing, as we understand it, refers to the process where, when multiple energy storage devices request access to the same backend device almost simultaneously, the backend device's main controller creates an access request entry for each requesting device. These entries are then sorted according to a preset priority rule to determine the access order of each energy storage device. The energy storage device that currently obtains access rights exclusively uses the high-voltage circuit of the backend device, while other energy storage devices wait in the predetermined order. Queuing information and estimated waiting times can be communicated to the operators of each energy storage device via the backend device's display screen or indicator lights. The preset priority rule is as follows: First priority is based on the battery's State of Charge (SOC), with the higher SOC value granting priority access; when SOC is the same, the second priority is based on the battery's State of Health (SOH), with the higher SOH value granting priority access; when both SOC and SOH are the same, the third priority is based on the device's authorization level, with the higher authorization level granting priority access; when all three are the same, the request is sorted by arrival timestamp, with the first request granting priority access. The SOC and SOH data of each energy storage device are reported to the backend device via the controller's local area network bus or the charging interface auxiliary communication channel.

[0103] Optionally, in emergency rescue scenarios, an emergency vehicle priority level can be added, allowing emergency vehicles with specific authorization markings to access the system first, regardless of their State of Charge (SOC) and State of Health (SOH).

[0104] In S620, energy storage devices that have not obtained access rights enter a waiting queue, while those that have obtained access rights exclusively occupy the high-voltage circuit through an interlocked switch array configured at the charging interface of the back-end equipment. The interlocked switch array ensures that at any given time, only one energy storage device can be connected to the high-voltage circuit.

[0105] It can be understood that an interlocking switch array is a set of hardware-implemented mutually exclusive switches deployed at the charging interface of a backend device. Its function is to ensure that, physically, at any given time, only one charging interface's high-voltage circuit is in a closed state. When an energy storage device gains access, the interlocking switch array only connects the high-voltage circuit of the interface corresponding to that energy storage device; the high-voltage circuits of all other interfaces are physically locked in the open position and cannot be closed. When switching to the next energy storage device in the waiting queue, the backend device's main controller first disconnects the high-voltage circuit of the current device, then releases the mechanical interlock of the target device's corresponding interface, and finally closes the high-voltage circuit of that interface.

[0106] For example, the interlocking switch array is an N+1 pole mechanical interlocking relay group, where N is the number of charging ports, and the armatures of each relay are interconnected by mechanical linkages. When the coil of any relay is energized and its armature is attracted, the mechanical linkage pushes the armatures of all other relays to remain in the released position, thereby ensuring that at most one relay is closed at any given time.

[0107] Optionally, the method also includes: S710: When a connection failure or protective shutdown event occurs during discharge, both the energy storage device and the back-end equipment synchronously record the event data. The event data is stored in an independent storage partition, and each event data record is associated with a retention timer. When the recorded retention time reaches the preset time, only the hashed summary information of the event data is retained.

[0108] It is understandable that abnormal connection disconnection refers to the charging gun being abnormally unplugged during discharge, the electrical connection of the charging interface being unexpectedly interrupted, or the auxiliary communication channel being interrupted, causing the backend equipment to be unable to maintain communication with the energy storage device. Protective shutdown refers to the automatic emergency shutdown triggered by the protection circuit of the energy storage device or backend equipment due to the detection of abnormal states such as over-temperature, over-current, and decreased insulation resistance, which is a safety protection action. When these two types of events occur, the energy storage device and the backend equipment each record a default event data in their local independent encrypted storage partition, and the records at both ends are independent of each other. The independent storage partition is a dedicated partition in the device's non-volatile memory that is physically isolated from the normal discharge data area. It is managed with an independent data encryption key. A regular factory reset operation only erases the user configuration area and will not touch the data in this independent storage partition. Retention duration refers to a timer that starts counting down from the time each default event record is generated. When the retention duration of the record reaches the preset duration, considering the principle of minimum necessity for data compliance, the original detailed data of the default event is cleared, and only the hashed summary information is retained for long-term evidence preservation.

[0109] In one application scenario, namely V2L off-grid emergency discharge for new energy vehicles, the execution process of the offline emergency discharge method for energy storage devices and the offline emergency charging method for back-end equipment provided in this application is as follows: 1. When the operator triggers an external hard trigger signal, the emergency discharge control system switches to emergency mode; 2. Tap the screen or press the physical button to activate the device's emergency interface; 3. Click the physical button and press and hold for 3 seconds to complete the secondary confirmation; 4. The BMS (Battery Management System) of new energy vehicles detects the battery SOC and prompts the user to connect the charging gun after the SOC reaches the preset threshold. 5. Once the charging gun is inserted, the vehicle outputs a wake-up pulse through the two-stage energy bootstrapping architecture to start the modified charging station; 6. The charging pile passes offline certification and the off-grid discharge circuit is activated; 7. When multiple vehicles connect, the system automatically queues them, and the hardware circuit prevents collisions; 8. The entire discharge process is performed with dual-copy offline evidence storage, generating a session ID and hash chain; 9. Whether the shutdown is normal or the disconnection is abnormal, local encrypted evidence storage and default marking will be completed. 10. Automatically upload and deduplicate data after network recovery; manually export data for settlement if network outage occurs for an extended period.

[0110] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0111] This application also provides an energy storage device. Figure 3 This is a schematic diagram of the structure of an energy storage device provided in an embodiment of this application. Figure 3 As shown, the energy storage device 3 in this embodiment includes: at least one processor 30 ( Figure 3 Only one is shown in the image), at least one memory 31 ( Figure 3 (Only one is shown in the image) and a computer program 32 stored in the at least one memory 31 and executable on the at least one processor 30, wherein when the processor 30 executes the computer program 32, it causes the energy storage device 3 to perform the steps in any of the above-described embodiments of the offline emergency discharge method for energy storage devices.

[0112] For example, the computer program 32 may be divided into one or more units, which are stored in the memory 31 and executed by the processor 30 to complete this application. The one or more units may be a series of computer program instruction segments capable of performing a specific function, which describe the execution process of the computer program 32 in the energy storage device 3.

[0113] The energy storage device 3 may include, but is not limited to, a processor 30 and a memory 31. Those skilled in the art will understand that... Figure 3 This is merely an example of energy storage device 3 and does not constitute a limitation on energy storage device 3. It may include more or fewer components than shown, or combine certain components, or different components, such as input / output devices, network access devices, buses, etc.

[0114] The processor 30 can be a Central Processing Unit (CPU), or it can be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0115] In some embodiments, the memory 31 may be an internal storage unit of the energy storage device 3, such as a hard disk or memory of the energy storage device 3. In other embodiments, the memory 31 may be an external storage device of the energy storage device 3, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the energy storage device 3. Furthermore, the memory 31 may include both internal storage units and external storage devices of the energy storage device 3. The memory 31 is used to store operating systems, applications, bootloaders, data, and other programs, such as the program code of computer programs. The memory 31 can also be used to temporarily store data that has been output or will be output.

[0116] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps in any of the above embodiments of the offline emergency discharge method for energy storage devices.

[0117] This application provides a computer program product that, when run on an energy storage device, enables the energy storage device to perform the steps described in any of the above-described offline emergency discharge method embodiments.

[0118] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the above-described embodiments of this application can be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the above-described offline emergency discharge method embodiments for various energy storage devices. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include at least: any entity or device capable of carrying the computer program code to the energy storage device, a recording medium, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium, such as a USB flash drive, a portable hard drive, a magnetic disk, or an optical disk.

[0119] This application also provides a backend device. Figure 4 This is a schematic diagram of the structure of a backend device provided in one embodiment of this application. Figure 4 As shown, the backend device 4 of this embodiment includes: at least one processor 40 ( Figure 4 Only one is shown in the image), at least one memory 41 ( Figure 4 (Only one is shown in the image) and a computer program 42 stored in the at least one memory 41 and executable on the at least one processor 40. When the processor 40 executes the computer program 42, it causes the back-end device 4 to implement the steps in any of the above embodiments of the offline emergency charging method for back-end devices, or causes the back-end device 4 to implement the functions of each unit in the above embodiments of the apparatus.

[0120] For example, the computer program 42 may be divided into one or more units, which are stored in the memory 41 and executed by the processor 40 to complete this application. The one or more units may be a series of computer program instruction segments capable of performing a specific function, which describe the execution process of the computer program 42 in the back-end device 4.

[0121] The backend device 4 may include, but is not limited to, a processor 40 and a memory 41. Those skilled in the art will understand that... Figure 4This is merely an example of backend device 4 and does not constitute a limitation on backend device 4. It may include more or fewer components than shown in the figure, or combine certain components, or different components. For example, it may also include input / output devices, network access devices, buses, etc.

[0122] The processor 40 can be a Central Processing Unit (CPU), but it can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0123] In some embodiments, the memory 41 may be an internal storage unit of the back-end device 4, such as a hard disk or memory of the back-end device 4. In other embodiments, the memory 41 may be an external storage device of the back-end device 4, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the back-end device 4. Further, the memory 41 may include both internal storage units and external storage devices of the back-end device 4. The memory 41 is used to store operating systems, applications, bootloaders, data, and other programs, such as the program code of computer programs. The memory 41 can also be used to temporarily store data that has been output or will be output.

[0124] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps in any of the above embodiments of the offline emergency discharge method for energy storage devices.

[0125] This application provides a computer program product that, when run on a backend device, enables the backend device to implement the steps in any of the above-described offline emergency discharge method embodiments for energy storage devices.

[0126] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the above-described embodiments of this application can be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the offline emergency discharge method embodiments of the various energy storage devices described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include at least: any entity or device capable of carrying the computer program code to a backend device, a recording medium, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium. Examples include USB flash drives, portable hard drives, magnetic disks, or optical disks.

[0127] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. An offline emergency discharge method for an energy storage device, characterized in that, The method is applied to an energy storage device, the energy storage device including a main processor, an emergency control unit independent of the main processor, and physical buttons electrically connected to the emergency control unit. The emergency control unit receives a hard trigger signal via the physical button; The emergency control unit responds to the hard trigger signal, disables the grid status determination logic, and switches the energy storage device to off-grid mode; The energy storage device completes a battery status self-test in the off-grid mode. After the self-test passes, the switching circuit of the energy storage device is controlled to output a wake-up signal to the back-end device. The wake-up signal includes a first-level signal wake-up and a second-level power wake-up. The first-level signal wake-up is used to release the lockout state of the back-end device from the signal transmission path of the charging interface. The second-level power wake-up is used to provide starting power to the main controller of the back-end device from the high-voltage transmission path of the charging interface. The back-end device refers to the electrical device that is electrically connected to the charging interface. After the backend device is woken up, the energy storage device performs offline identity authentication on the backend device based on the locally stored device identifier whitelist. After successful certification, the energy storage device discharges to the backend equipment.

2. The offline emergency discharge method for an energy storage device as described in claim 1, characterized in that, Switching the energy storage device to off-grid mode includes: The emergency control unit sets the emergency flag register inside the emergency control unit in the interrupt service routine, and then wakes up the main processor; After the main processor is woken up, it reads the status of the emergency flag register. When the emergency flag register indicates emergency mode, it does not load system service modules in the main processor's operating system that are unrelated to the off-network mode, but only loads the driver and control modules necessary for the off-network mode.

3. The offline emergency discharge method for an energy storage device as described in claim 1, characterized in that, The switching circuit controlling the energy storage device outputs a wake-up signal to the backend equipment, including: The control first switching circuit outputs a pulse signal with preset electrical parameters to the back-end device through the signal transmission path of the charging interface; wherein, the pulse signal is used to release the lockout state of the back-end device after being processed by the signal conditioning circuit inside the back-end device; Electrical energy is output from the energy storage device through the high-voltage transmission path of the charging interface to provide startup power for the main control unit of the back-end device; wherein, after obtaining initial power supply, the back-end device can control the second switching circuit to conduct and obtain electrical energy from the energy storage device through the high-voltage transmission path of the charging interface; Once the back-end equipment is confirmed to be self-sustaining, the signal transmission path is disconnected while the high-voltage transmission path continues to provide power.

4. The offline emergency discharge method for an energy storage device as described in claim 3, characterized in that, The drive signal of the first switching circuit and the drive signal of the second switching circuit are configured with hardware interlock logic. The hardware interlock logic enables the first switching circuit to be forced to remain in the off state when the second switching circuit is turned on, regardless of the value of the drive signal of the first switching circuit.

5. The offline emergency discharge method for an energy storage device as described in claim 1, characterized in that, The offline identity authentication of the backend device based on a locally pre-stored device identifier whitelist includes: After the backend device is woken up, the device's unique identifier is read, and the first hash value of the device's unique identifier is calculated; Search for a whitelist entry that matches the first hash value in the whitelist partition of the local storage area; If a matching entry is found, the dynamic token sent by the backend device is further verified. After successful verification, the discharge switch is closed. The dynamic token is generated by the backend device in combination with the device's preset key, running counter, and local clock. The verification of the dynamic token is set with a fault-tolerant window to compensate for clock drift in offline mode.

6. The offline emergency discharge method for an energy storage device as described in claim 1, characterized in that, The method further includes: The energy storage device generates an initial verification anchor point during the first discharge and stores the initial verification anchor point in the local memory. During each discharge process, the verification value of the current discharge record is calculated by taking the fields of the current discharge data, the verification value of the previous discharge record, the clock information of the current record generation time, and the random factor generated this time. Based on the verification values ​​of multiple discharge records, an integrity signature in the form of a hash chain is generated. The energy storage device maintains a verification chain composed of multiple discharge records. Each discharge record is assigned a unique session identifier, which is generated by hashing the device identifier, timestamp, and random number. Once network communication is restored, the energy storage device uploads the integrity signature to the cloud platform; wherein, the cloud platform is able to perform cross-verification of the integrity signature uploaded by the energy storage device and the backend device and then complete unified settlement. Preferably, the energy storage device uploads the integrity signature to the cloud platform, including at least one of the following methods: First upload method: The energy storage device sends the evidence data encrypted with a preset encryption algorithm to the mobile terminal via near-field wireless communication; the evidence data is used to be automatically uploaded to the cloud platform by the mobile terminal after the Internet connection is restored; Second upload method: The energy storage device sends its discharge data to the acquisition device via local communication, and the acquisition device can upload the discharge data of the energy storage device to the cloud platform via a cellular mobile communication channel; Third upload method: When communication is restored, the energy storage device will automatically encrypt and upload all offline evidence data to the cloud platform in batches; Preferably, the method further includes: When a connection failure or protective shutdown occurs during the discharge process, the energy storage device records the event data. The event data is stored in an independent storage partition, and each event data is associated with a retention time. When the recorded retention time reaches a preset time, only the hashed summary information of the event data is retained.

7. An energy storage device, characterized in that, The method includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the method as claimed in any one of claims 1 to 6.

8. A method for offline emergency charging of backend devices, characterized in that, Applied to backend devices, the backend devices including a backend device main controller and a low-power wake-up circuit, the method includes: The low-power wake-up circuit receives a wake-up signal from the energy storage device through the charging interface; wherein, the energy storage device refers to a power supply device electrically connected to the back-end device through the charging interface; the wake-up signal is sent by the energy storage device after completing a battery status self-test in off-grid mode and passing the self-test, the off-grid mode is the mode in which the emergency control unit of the energy storage device switches in response to a hard trigger signal, and the hard trigger signal is a trigger signal received by the emergency control unit through the physical button; Upon receiving the wake-up signal, the low-power wake-up circuit wakes up the back-end device main controller, and the back-end device main controller sends the unique device identifier of the back-end device to the energy storage device through the signal transmission path of the charging interface; wherein, the unique device identifier is used by the energy storage device to perform offline identity authentication of the back-end device. Receive electrical energy from the energy storage device.

9. The offline emergency charging method for backend devices as described in claim 8, characterized in that, Upon receiving the wake-up signal, the low-power wake-up circuit wakes up the backend device main controller, including: After the low-power wake-up circuit receives the pulse signal sent by the energy storage device through the signal transmission path of the charging interface, it performs signal conditioning on the pulse signal and releases the lockout state of the back-end device main controller based on the conditioned pulse signal; wherein, the pulse signal is a pulse signal with preset electrical parameters sent by the first switching circuit of the energy storage device. The back-end device main controller receives startup power through the high-voltage transmission path of the charging interface to complete startup, and then controls the second switching circuit to be turned on; wherein, the second switching circuit is used to obtain power from the energy storage device through the high-voltage transmission path of the charging interface to supply power to the electrical load of the back-end device. The backend device continuously receives electrical energy; Preferably, the back-end device main controller sends the unique device identifier of the back-end device to the energy storage device through the signal transmission path of the charging interface, including: After the backend device's main controller is woken up, it sends the device's unique identifier to the energy storage device, then generates a dynamic token based on the backend device's preset key, running counter, and local clock, and sends the dynamic token to the energy storage device. The unique device identifier is used by the energy storage device to search within a whitelist partition of its local storage area, and the dynamic token is used for further verification by the energy storage device after finding a matching entry for the unique device identifier. The dynamic token's verification is configured with a fault-tolerant window to compensate for clock drift in offline mode. Preferably, the method further includes: The backend device generates an initial verification anchor point during the first charging and stores the initial verification anchor point in local memory. During each charging process, the verification value of the current charging record is calculated by taking the various fields of the current charging data, the verification value of the previous charging record, the clock information of the current record generation time, and the random factor generated this time. Based on the verification values ​​of multiple charging records, an integrity signature in the form of a hash chain is generated. The backend device maintains a verification chain composed of multiple charging records. Each charging record is assigned a unique session identifier, which is generated by hashing the device identifier, timestamp, and random number. Once network communication is restored, the backend device uploads the integrity signature to the cloud platform; wherein, the cloud platform is able to perform cross-verification of the integrity signature uploaded by the energy storage device and the backend device before completing unified settlement; Preferably, the backend device uploads the integrity signature to the cloud platform in at least one of the following ways: First upload method: The backend device sends the evidence data encrypted with a preset encryption algorithm to the mobile terminal via near-field wireless communication; the evidence data is used to be automatically uploaded to the cloud platform by the mobile terminal after the Internet connection is restored; Second upload method: The backend device sends its charging data to the acquisition device via local communication, and the acquisition device can upload the charging data of the backend device to the cloud platform via a cellular mobile communication channel; Third upload method: When communication is restored, the backend device will automatically encrypt and upload all offline evidence data to the cloud platform in batches; Preferably, the method further includes: When a connection failure or protective shutdown occurs during charging, the backend device records the event data. The event data is stored in an independent storage partition, and each event data is associated with a retention timer. When the recorded retention time reaches a preset time, only the hashed summary information of the event data is retained. Preferably, when multiple energy storage devices simultaneously request access to the same backend device, the method further includes: Access priorities are determined based on the battery charge status, battery health, and device authorization level of each energy storage device, and queuing is performed according to these priorities. Energy storage devices that have not obtained access rights enter a waiting queue, while energy storage devices that have obtained access rights exclusively occupy the high-voltage circuit through the interlocked switch array configured in the charging interface of the back-end equipment; wherein, the interlocked switch array is used to ensure that at most one energy storage device can access the high-voltage circuit at any given time.

10. A backend device, characterized in that, The method includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the method as claimed in any one of claims 8 to 9.

Images