A hierarchical control system and method for a new energy storage fire test platform

Abstract

This invention discloses a layered control system and method for a new energy storage fire protection test platform. The system includes a task management layer, a coordination control layer, a safety interlock layer, and an execution interface layer. The coordination control layer includes a multi-source fusion early warning module and a fire extinguishing coordination state machine, which includes active fire control logic and passive fire control logic. The safety interlock layer operates independently of the coordination control layer and has a higher priority. During the gas extinguishing phase, the fire extinguishing coordination state machine controls the execution interface layer to close the air inlet and outlet before spraying the extinguishing agent, and adopts a graded threshold strategy: when the combustible gas concentration reaches the first threshold, the safety interlock layer only alarms; when it reaches the second threshold, forced ventilation is activated and the main valve of the extinguishing agent is closed; during the water spray phase, the ventilation equipment is activated, and emergency explosion relief is triggered when the pressure inside the chamber exceeds the threshold. This invention balances airtightness and ventilation requirements to achieve safe handling.

Description

Technical Field

[0001] This invention relates to the field of energy storage fire protection test control technology, and in particular to a hierarchical control system and method for a new energy storage fire protection test platform. Background Technology

[0002] New energy electrochemical energy storage systems may trigger battery thermal runaway and cause fires during charging and discharging, thus requiring systematic testing of the fire protection performance of energy storage systems. In the prior art, Chinese patent CN120948092B discloses a battery fire extinguishing test platform and method for energy storage power stations. This test platform includes an energy storage battery simulation chamber, a gas fire extinguishing system, a compressed air foam fire extinguishing system, a fire alarm control system, and a data acquisition system. In this scheme, the fire alarm control system simultaneously handles fire extinguishing system switching and equipment control functions, with safety interlocking and fire extinguishing control functions integrated within the same controller. When the fire alarm control system experiences communication interruption, program abnormality, or power supply failure, safety actions such as emergency stop, charging cut-off, and ventilation activation rely on the controller or its associated communication link, affecting the reliability of safety protection during the test. Furthermore, the fire extinguishing system in this scheme primarily relies on direct signals output by detectors. The controller's comprehensive judgment capability based on temperature, gas concentration, pressure, video, and battery management data is limited; when a single sensor is interfered with or fails, the accuracy of the fire extinguishing trigger timing decreases. Furthermore, during the switching of fire extinguishing media, the state transitions between module-level fire extinguishing, compartment-level fire extinguishing, water spraying, and ventilation have not yet been uniformly managed, and the control sequence may be discontinuous.

[0003] Chinese patent application CN121944452A discloses a station-type energy storage fire protection system and its control method based on multi-level collaborative control. This fire protection system includes cell-level, PACK-level, station-level, field-level, and cloud-level components. In this scheme, safety control functions are distributed and integrated across controllers at each level, and cross-level safety actions rely on communication links and upper-level decisions. When communication at a certain level fails, safety actions are difficult to complete independently locally, and the real-time performance and reliability of safety protection are affected by the communication link status. Furthermore, multi-source data fusion and risk assessment are distributed between the PACK and station-level components, and the control logic is bound to the physical level of the battery system. When the test platform connects to battery modules, battery management systems, energy storage converters, and fire protection control panels from different manufacturers, interface adaptation is required for each physical level, limiting the compatibility and scalability of the control system.

[0004] Furthermore, in existing energy storage fire protection test platforms, active fire suppression systems (such as gas extinguishing systems and water sprinkler systems) and passive fire suppression systems (such as emergency explosion relief panels) are typically installed independently. Gas extinguishing systems require high airtightness in the test chamber, necessitating the closure of air inlets and outlets during fire suppression to maintain the concentration of the extinguishing agent. Water sprinkler systems, on the other hand, generate large amounts of steam and flammable gases during fire suppression, requiring timely exhaust to prevent pressure buildup and gas accumulation. This creates a conflict between airtightness and exhaust requirements. In the event of unavoidable thermal runaway explosions, the lack of passive explosion relief mechanisms could lead to a sudden pressure surge, potentially causing structural damage and debris dispersion. Therefore, coordinating active and passive fire suppression within the same control system, and balancing the airtightness required for gas extinguishing systems with the exhaust requirements of water sprinkler systems, has become a pressing technical challenge in this field.

[0005] Therefore, the existing control system of the energy storage fire protection test platform has the following technical problems:

[0006] First, the safety control logic and the fire extinguishing control logic are integrated into the same controller. When the main controller communication is interrupted or the program is abnormal, the reliability of the safety action is reduced.

[0007] Second, the fusion processing of multi-source sensor data lacks a unified confidence calculation mechanism, and the accuracy of early warning decreases when a single sensor is interfered with or fails.

[0008] Third, there is a lack of coordination between active and passive fire suppression systems, and there is a contradiction between the airtightness required for gas extinguishing and the ventilation requirements for water spraying.

[0009] Fourth, interface adaptation between the control system and equipment from different manufacturers needs to be carried out separately for each physical layer, which increases the amount of data storage and data transmission and reduces the hardware processing speed.

[0010] Fifth, the water spray system is either an inherent system of the test platform or requires additional integration, and is not compatible with the water spray system deployed by the enterprise itself. Summary of the Invention

[0011] The purpose of this invention is to provide a hierarchical control system and method for a new energy storage fire protection test platform, in order to solve the technical problems in the prior art, such as: reduced reliability of safety action execution due to the integration of safety control logic and fire extinguishing control logic; decreased early warning accuracy due to the lack of a unified confidence calculation mechanism for multi-source sensor data fusion; contradiction between the airtightness requirements of gas fire extinguishing and the ventilation requirements of water sprinkler due to the lack of coordination between active and passive fire protection; increased data storage and data transmission due to the need for interface adaptation of equipment from multiple manufacturers; and incompatibility with water sprinkler systems deployed by enterprises themselves.

[0012] To achieve the above objectives, the present invention adopts the following technical solution.

[0013] Option 1: Provide a hierarchical control system for a new energy storage fire protection test platform, including:

[0014] The task management layer is used to configure test tasks and orchestrate test process sequences.

[0015] The coordination and control layer includes a multi-source fusion early warning module and a fire extinguishing coordination state machine. The multi-source fusion early warning module is used to fuse and process the acquired multi-source sensor data and generate an early warning signal. The fire extinguishing coordination state machine is used to generate control decisions based on the early warning signal and the test process sequence. The fire extinguishing coordination state machine includes active fire control logic and passive fire control logic. The active fire control logic includes a gas extinguishing stage and a water spray stage. The passive fire control logic includes an emergency explosion relief stage.

[0016] The safety interlocking layer is set independently of the coordination control layer in terms of control logic. The safety interlocking layer and the coordination control layer operate in parallel, and the safety actions of the safety interlocking layer have a higher priority than the control commands of the coordination control layer.

[0017] An execution interface layer is used to collect sensor data and control the actions of execution devices, including gas fire extinguishing equipment, water spray equipment, ventilation equipment, and emergency explosion relief equipment.

[0018] The fire extinguishing coordination state machine controls the execution interface layer to close the air inlet and outlet before spraying the gas extinguishing agent during the gas extinguishing phase. It also employs a graded threshold strategy during the gas extinguishing phase: when the combustible gas concentration reaches the first threshold, the safety interlock layer only outputs an alarm signal without activating the exhaust system; when the combustible gas concentration reaches the second threshold, which is higher than the first threshold, the safety interlock layer forcibly activates the exhaust system and closes the main valve of the extinguishing agent.

[0019] The fire suppression coordination state machine controls the execution interface layer to open the ventilation equipment during the water spraying phase, and triggers the passive fire control logic when the pressure inside the cabin exceeds the preset explosion relief pressure threshold, releasing the pressure inside the cabin through the emergency explosion relief equipment.

[0020] Furthermore, the fire suppression coordination state machine includes self-test state, arming state, charging state, thermal runaway early warning state, ignition state, module-level gas fire suppression state, cabin-level gas fire suppression preparation and spraying state, airtightness maintenance state, exhaust balance state, water spray state, emergency explosion relief state, and termination state.

[0021] Furthermore, in the airtightness maintenance state, the coordination control layer controls the execution interface layer to close the air inlet valve and the air outlet valve and monitor the pressure change rate inside the cabin; in the exhaust balance state, the coordination control layer controls the execution interface layer to open the exhaust valve and the exhaust fan and monitor the concentration of combustible gas inside the cabin, and starts the water spray equipment when the concentration of combustible gas is lower than the preset concentration threshold.

[0022] Furthermore, the conditions for transitioning from the airtightness maintenance state to the exhaust balance state include: the coordination control layer determines, based on the flame state inside the cabin and the temperature of the thermal runaway unit, that the water spray activation conditions are met. The water spray activation conditions include: the flame inside the cabin reignites within a preset observation time after being extinguished and the temperature of the thermal runaway unit is not lower than a preset unit temperature threshold, or the flame inside the cabin is not extinguished.

[0023] Furthermore, in the water spray state, the coordination control layer starts the water spray device through the execution interface layer, and the water spray continues for at least a preset duration. During the continuous water spray, the external temperature of the target battery module is obtained through the execution interface layer. When the external temperature of the target battery module is lower than the preset module temperature threshold, it enters the end state and keeps the exhaust system running. The exhaust fan in the water spray state adopts a low exhaust volume mode or an intermittent exhaust mode.

[0024] Furthermore, the safety interlocking layer includes a hard-wired interlocking circuit and a safety programmable logic controller (PLC). The hard-wired interlocking circuit includes a hatch interlocking circuit, a combustible gas over-limit interlocking circuit, an emergency stop interlocking circuit, and a pressure over-limit interlocking circuit. The execution interface layer includes a priority arbitration module, which is used to execute the highest priority instruction according to the priority of the hard-wired interlocking circuit over the safety PLC, and the priority of the safety PLC over the coordination control layer.

[0025] Furthermore, the combustible gas over-limit interlock circuit is configured as follows: in the non-gas extinguishing stage, when the combustible gas concentration reaches the first concentration threshold, the ignition circuit is cut off and the exhaust fan is started; in the gas extinguishing stage, when the combustible gas concentration reaches the first concentration threshold, only an alarm is triggered without starting the exhaust fan; when the combustible gas concentration reaches a second concentration threshold higher than the first concentration threshold, the exhaust fan is forcibly started, the charging is cut off, and the main valve of the extinguishing agent is closed; wherein, the gas extinguishing stage signal is input to the safety interlock layer through a hard-wired signal to block the start of the exhaust corresponding to the first concentration threshold in the gas extinguishing stage.

[0026] Furthermore, the execution interface layer includes a reconfigurable protocol adaptation middleware, which includes a protocol plug-in layer, a point table mapping layer, and a unified variable layer. The execution interface layer reserves an access interface for the water sprinkler system. When the enterprise water sprinkler system has a communication interface, the coordination control layer communicates with the enterprise water sprinkler system controller through the reconfigurable protocol adaptation middleware. When the enterprise water sprinkler system does not have a communication interface, the execution interface layer directly controls the solenoid valves and pump groups of the water sprinkler system through a distributed I / O module.

[0027] Option 2: A hierarchical control method for a new energy storage fire protection test platform is provided, the method being based on the aforementioned hierarchical control system, comprising:

[0028] The task management layer configures test tasks and arranges test process sequences;

[0029] The multi-source fusion early warning module of the coordination and control layer fuses the acquired multi-source sensor data and generates an early warning signal;

[0030] The fire suppression coordination state machine of the coordination control layer generates control decisions based on the early warning signal and the test process sequence. The fire suppression coordination state machine includes active fire control logic and passive fire control logic. The active fire control logic includes a gas extinguishing stage and a water spray stage. The passive fire control logic includes an emergency explosion relief stage.

[0031] The execution interface layer controls the operation of gas fire extinguishing equipment, water sprinkler equipment, ventilation equipment, and emergency explosion relief equipment based on the control decisions.

[0032] The safety interlock layer operates in parallel with the coordination control layer, with safety actions having a higher priority than the coordination control layer. During the gas extinguishing phase, the fire extinguishing coordination state machine controls the execution interface layer to close the air inlet and outlet before spraying the gaseous extinguishing agent. During the gas extinguishing phase, a graded threshold strategy is adopted: when the combustible gas concentration reaches the first threshold, the safety interlock layer only outputs an alarm signal without activating the exhaust system; when the combustible gas concentration reaches the second threshold, which is higher than the first threshold, the safety interlock layer forcibly activates the exhaust system and closes the main extinguishing agent valve. During the water spray phase, the fire extinguishing coordination state machine controls the execution interface layer to open the exhaust system and triggers passive fire control logic when the cabin pressure exceeds a preset explosion relief pressure threshold, releasing the cabin pressure through emergency explosion relief equipment.

[0033] Furthermore, the multi-source fusion early warning module uses Dempster combination rules to fuse the basic probability allocation functions of each data source and calculate the comprehensive confidence level; when the conflict coefficient K is greater than the preset conflict threshold, it uses at least one of the following methods: evidence discount, weighted average, or outputting the observation status and transferring it to manual confirmation; the method also includes uploading the test data and status information to the task management layer, which stores the test data and status information in the database and automatically generates a test report.

[0034] The present invention has the following beneficial effects:

[0035] First, this invention sets the safety interlock layer to be independent of the coordination control layer in terms of control logic, and the safety interlock layer uses independent safety logic to execute safety actions. Therefore, when the coordination control layer experiences a communication interruption or program abnormality, the safety interlock layer can still independently execute safety actions such as emergency stop, charging cut-off, ventilation activation, and explosion venting trigger, reducing the dependence of safety actions on the main controller communication link and improving the reliability of safety action execution. Simultaneously, by defining arbitration rules that prioritize the safety interlock layer over the coordination control layer, conflicts between the outputs of the safety interlock and the coordination control layer are avoided.

[0036] Secondly, this invention uses a multi-source fusion early warning module to fuse temperature data, gas concentration data, pressure data, and video data and output graded early warning signals, which reduces the problem of decreased early warning accuracy when a single sensor is interfered with or fails, and lowers the false alarm rate and missed alarm rate.

[0037] Third, this invention unifies the management of active and passive fire control logic through a fire extinguishing coordination state machine. It maintains the airtightness of the test chamber before spraying the extinguishing agent during the gas extinguishing phase, activates the exhaust system during the water spray phase, and triggers emergency explosion venting when the pressure inside the chamber exceeds a preset explosion venting pressure threshold. Thus, this invention balances the airtightness required for gas extinguishing with the ventilation requirements of water spraying, reduces the problem of discontinuous control timing during extinguishing medium switching, and achieves safe handling through passive explosion venting when thermal runaway explosion is unavoidable.

[0038] Fourth, this invention utilizes a reconfigurable protocol adaptation middleware comprising a protocol plug-in layer, a point-to-point mapping layer, and a unified variable layer, enabling signals from devices from different manufacturers to be mapped to unified variable names through the unified variable layer. Therefore, this invention reduces the data storage and data transmission volume required for interface adaptation at each physical layer, improves hardware processing speed, and ensures compatibility with enterprise-deployed water sprinkler systems.

[0039] Fifth, this invention establishes an exhaust balance state before the water spraying stage, coordinating the control layer to control the execution interface layer to open the exhaust valves and exhaust fans, and monitoring the concentration of combustible gas in the chamber. The water spraying equipment is only activated when the combustible gas concentration is below a preset threshold. Therefore, this invention avoids the risk of deflagration caused by excessively high combustible gas concentrations when the water spraying system starts, and also reduces the increase in chamber pressure caused by the large amount of steam generated by the water spraying.

[0040] Sixth, this invention employs a graded threshold strategy during the gas extinguishing phase. When the combustible gas concentration reaches the first threshold, the safety interlock layer only alarms without activating the exhaust system to maintain the perfluorohexanone concentration. When the combustible gas concentration reaches a second threshold higher than the first threshold, the safety interlock layer forcibly activates the exhaust system and closes the main extinguishing agent valve. Thus, this invention resolves the contradiction between the airtightness requirements and safe ventilation requirements of gas extinguishing systems while ensuring safety. Attached Figure Description

[0041] The present invention will be further described below with reference to the accompanying drawings and specific embodiments.

[0042] Figure 1 This is a schematic diagram of the overall architecture of the hierarchical control system used in the fire protection test platform for new energy storage in this invention.

[0043] Figure 2 This is a functional block diagram of the multi-source fusion early warning module in the hierarchical control system of the present invention.

[0044] Figure 3 This is a schematic diagram of the state transition of the fire extinguishing coordination state machine in the hierarchical control system of the present invention.

[0045] Figure 4 This is a schematic diagram of the architecture of the reconfigurable protocol adaptation middleware in the hierarchical control system of the present invention.

[0046] Figure 5 This is a schematic diagram of the logic control of the safety interlocking layer of the present invention.

[0047] Figure 6 This is a circuit diagram of the combustible gas over-limit interlocking circuit in the safety interlocking layer of the present invention.

[0048] Figure 7 This is a flowchart illustrating the hierarchical control method for a new energy storage fire protection test platform in this invention. Detailed Implementation

[0049] To facilitate understanding of the technical means, creative features, objectives, and effects of this invention, the invention is further described below with reference to specific illustrations. The numerical values, frequencies, temperatures, concentrations, times, etc., given in the following specific embodiments are illustrative and not intended to limit the scope of protection of this invention. Those skilled in the art can adjust the following exemplary values ​​according to the actual test object, test chamber size, battery type, and fire extinguishing system configuration.

[0050] Terminology Explanation

[0051] "Active fire suppression" refers to fire suppression methods that require active triggering by the control system or manual operation, including gas extinguishing systems and water sprinkler systems.

[0052] "Passive fire protection" refers to pressure relief measures that are automatically activated by mechanical structures when the pressure inside the chamber exceeds a threshold, including emergency explosion relief panels.

[0053] The "coordination and control layer" refers to the control layer that performs multi-source data fusion, generates graded early warning signals, and generates collaborative firefighting decisions.

[0054] The "safety interlocking layer" refers to a control layer that is independent of the coordination control layer in terms of control logic and performs safety actions based on independent safety logic.

[0055] The “execution interface layer” refers to the interface layer that collects sensor data and controls the actions of the execution device.

[0056] The “task management layer” refers to the management layer that configures test tasks and arranges the test process sequence.

[0057] The "basic probability assignment function" refers to a function in evidence theory used to represent the degree to which each piece of evidence supports each subset of the identification framework.

[0058] The "conflict coefficient" is a parameter in Dempster's combination rule used to measure the degree of conflict between two pieces of evidence.

[0059] To address the technical problems of insufficient reliability of safety interlocks, single early warning criteria, lack of coordination between active and passive fire protection, contradiction between the airtightness requirements of gas extinguishing and the ventilation requirements of water spraying in the existing energy storage fire protection test platform control system, and insufficient compatibility, this invention provides a hierarchical control system for new energy storage fire protection test platforms.

[0060] See Figures 1 to 5 The hierarchical control system provided by this invention consists of four control layers: a task management layer 100, a coordination control layer 200, a safety interlock layer 300, and an execution interface layer 400.

[0061] The task management layer 100 is used to configure test tasks and arrange test process sequences, distribute the arranged test process sequences to the coordination control layer 200, receive test data and status information uploaded by the coordination control layer 200, and communicate with the coordination control layer 200 through industrial Ethernet. The communication protocol can be OPC UA.

[0062] The coordination control layer 200 is configured to generate graded early warning signals 216 (such as...) based on the test procedure sequence, by fusing multi-source sensor data and battery management data. Figure 2 (As shown) and fire extinguishing coordination decision-making, obtain sensor data and equipment status from the execution interface layer 400, issue control commands to the execution interface layer 400, upload test data to the task management layer 100, and synchronize status with the safety interlock layer 300.

[0063] The safety interlock layer 300 is configured to operate independently of the coordination control layer 200 in terms of control logic, execute safety actions based on independent safety logic, receive sensor signals from the execution interface layer 400, and directly control the safety execution device 330 (e.g., Figure 5 (As shown). The safety actions of the safety interlock layer 300 include active fire-fighting interlock actions and passive fire-fighting interlock actions. Active fire-fighting interlock actions include emergency stop triggering, hatch interlocking, and combustible gas over-limit interlocking. Passive fire-fighting interlock actions include pressure over-limit interlocking, which triggers the emergency explosion relief equipment or allows the emergency explosion relief panel to be passively opened when the pressure inside the cabin exceeds the preset explosion relief pressure threshold.

[0064] The execution interface layer 400 is configured to collect sensor data and control the actions of execution devices. It acquires data from sensors and execution devices, processes the data, and uploads it to the coordination control layer 200. Simultaneously, it receives and executes control commands issued by the coordination control layer 200. The execution interface layer 400 includes active fire suppression execution interfaces and passive fire suppression execution interfaces. The active fire suppression execution interface is used to connect gas extinguishing equipment and water sprinkler systems. The passive fire suppression execution interface is used to connect emergency explosion relief equipment. The execution interface layer 400 has a reserved interface for water sprinkler system access, ensuring the test platform is compatible with water sprinkler systems deployed by the enterprise.

[0065] In the resulting hierarchical control system, the task management layer 100 is responsible for configuring test tasks and arranging test process sequences; the coordination control layer 200 is responsible for generating multi-source data fusion early warning and fire extinguishing collaborative decisions; the safety interlock layer 300 is responsible for executing safety actions independently of the coordination control layer 200; and the execution interface layer 400 is responsible for sensor data acquisition and execution equipment control.

[0066] Based on an understanding of the overall functions and logical relationships of each layer of the system, the following section provides a more detailed explanation of the specific structural schemes of each component from a technical implementation perspective.

[0067] As an example of an implementable form, when this system is deployed, the four control layers interact with each other via both industrial Ethernet and hardwired signals; the task management layer 100 and the coordination control layer 200 transmit test process sequences and test data via industrial Ethernet; the coordination control layer 200 and the execution interface layer 400 transmit control commands and sensor data via industrial Ethernet; the safety interlock layer 300 and the execution interface layer 400 transmit safety signals and execution status via both hardwired signals and industrial Ethernet; and the safety interlock layer 300 and the coordination control layer 200 synchronize their status via hardwired handshake signals.

[0068] As an example of an implementable form, the task management layer 100 of this system may consist of a host computer, testing software, and a database.

[0069] The testing software provides a graphical user interface and supports configuration of five testing modes: electrical performance testing, detection and alarm testing, control system testing, environmental adaptability testing, and fire extinguishing performance testing. Each testing mode corresponds to a set of preset test procedure scripts. The test procedure scripts are described in a structured text format, including state node sequences, state transition conditions, execution actions, and timeout handling strategies. The host computer communicates with the coordination and control layer 200 via industrial Ethernet, and the communication protocol can use OPC UA.

[0070] As an example of an implementable form, the coordination control layer 200 of this system can be composed of an edge controller and a soft PLC, including two main modules: a multi-source fusion early warning module 210 and a fire extinguishing coordination state machine 220.

[0071] The input-output relationship of the multi-source fusion early warning module 210 is as follows: Figure 2 As shown, its input sources include five types of data:

[0072] Temperature data 211, for example, is a thermocouple or PT100, and the sampling frequency is, for example, 10Hz;

[0073] Gas concentration data 212, for example, are H2, CO, VOC, and combustible gases, with a sampling frequency of, for example, 1Hz;

[0074] Pressure data 213 is, for example, from an internal pressure sensor, with a sampling frequency of, for example, 10Hz;

[0075] Video data 214, for example, is an infrared and full-color camera device, with a frame rate of, for example, 30fps;

[0076] BMS data 215, for example, includes unit voltage, SOC, and insulation alarm, with a sampling frequency of, for example, 1Hz.

[0077] The sampling frequency and frame rate mentioned above are illustrative examples, and those skilled in the art can adjust them according to experimental needs.

[0078] The multi-source fusion early warning module 210 uses evidence theory to fuse the confidence levels of various data sources. Let the identification framework be Θ = {normal, Level 1 warning, Level 2 warning, Level 3 warning, Level 4 warning}. For the i-th data source, its basic probability allocation function is... , where A is a subset of Θ.

[0079] The basic probability assignment function for each data source satisfies the normalization condition: For probabilities not explicitly assigned to a specific warning level, they are assigned to the identification framework Θ itself, i.e. The values ​​of the basic probability allocation functions for each data source are selected based on the statistical distribution in the historical test database, the experience of domain experts, and experimental calibration for specific battery types and test chamber sizes. For example, the BPA threshold and confidence level of the temperature data source are obtained through statistical analysis of the correlation between temperature rise rate and warning level in historical thermal runaway tests. The BPA value of the gas concentration data source is obtained through experimental calibration of the correlation between combustible gas concentration and thermal runaway stages.

[0080] The specific configuration of the fusion sequence of the multi-source fusion early warning module 210 is as follows: in the order of temperature data 211, gas concentration data 212, pressure data 213, video data 214, and BMS data 215, two pairs of Dempster combinations are performed in sequence, and the result of the previous fusion is used as one of the inputs for the next fusion, and finally the comprehensive confidence level is obtained.

[0081] In the pairwise fusion process described above, each fusion is performed according to the Dempster combination rule, which combines the basic probability assignment functions of the two pieces of evidence into a new basic probability assignment function according to the following formula:

[0082] ;

[0083] In the formula, and Let A be the basic probability assignment function for the two pieces of evidence involved in this fusion, A be a subset of the identification frame Θ, and K be the conflict coefficient, calculated as follows:

[0084] ;

[0085] In the formula The empty set indicates that the intersection of B and C is empty.

[0086] K reflects the degree of conflict between two pieces of evidence; the larger K is, the more severe the conflict. Therefore, when K is greater than a preset conflict threshold, it indicates a high degree of conflict between the evidence. In this case, Dempster's combination rule is not used directly, but at least one of the following processing methods is adopted:

[0087] Conflicting evidence is discounted, with the discount factor set based on the historical reliability of the sensors; multiple pieces of evidence are weighted and averaged before fusion; or an observation status is output and sent for manual confirmation. As an example, the preset conflict threshold is 0.90 to 0.98, preferably 0.95. The observation status is a monitoring status below the first-level warning level, which does not trigger any state transition in the fire suppression coordination state machine 220, but only provides a yellow indicator on the human-machine interface and records it in the database.

[0088] For temperature data source 211, the calculation method for BPA can be illustrated as follows: When the temperature rise rate is, for example, ≥3℃ / s, m ​​(Level 3 warning) = 0.7, m (Level 4 warning) = 0.2, m(Θ) = 0.1; when the temperature rise rate is, for example, between 1℃ / s and 3℃ / s, m ​​(Level 1 warning) = 0.5, m (Level 2 warning) = 0.3, m(Θ) = 0.2. The temperature rise rate threshold is, for example, 3℃ / s to 5℃ / s, preferably 3℃ / s.

[0089] For gas concentration data source 212, the calculation method for BPA can be illustrated as follows: When the combustible gas concentration is, for example, ≥25% LEL, m (Level 2 warning) = 0.6, m (Level 3 warning) = 0.3, m(Θ) = 0.1; when the combustible gas concentration is, for example, between 10% LEL and 25% LEL, m (Level 1 warning) = 0.6, m(Θ) = 0.4. The combustible gas concentration threshold is, for example, 20% LEL to 30% LEL, preferably 25% LEL.

[0090] For pressure data source 213, the calculation method of BPA can be exemplified as follows: when the pressure gradient exceeds the preset threshold, m (level 2 warning) = 0.5, m (level 3 warning) = 0.3, m(Θ) = 0.2.

[0091] For video data source 214, the calculation method of BPA can be illustrated as follows: when the confidence level of flame infrared feature recognition is ≥0.8, m (level 4 warning) = 0.9, m(Θ) = 0.1; when the confidence level of smoke texture recognition is ≥0.7, m (level 2 warning) = 0.5, m (level 3 warning) = 0.3, m(Θ) = 0.2.

[0092] For BMS data source 215, the calculation method of BPA can be illustrated as follows: when the voltage drop of a single cell exceeds the preset threshold, m(Level 3 warning) = 0.6, m(Θ) = 0.4; when the insulation alarm is triggered, m(Level 2 warning) = 0.5, m(Θ) = 0.5.

[0093] The warning level corresponding to the highest overall confidence level after fusion is the final output graded warning signal 216. The specific implementation of the dual-sensor confirmation and time-window correlation mechanism is as follows: when the warning levels of two independent data sources are consistent, the warning level is confirmed. When only one data source issues a warning, time-window correlation detection is initiated, waiting for confirmation from other data sources within a preset time window (e.g., 30 seconds). If no other data source confirms within the time window, the warning is output as an observation status. This preset time window is only an example and can be adjusted according to experimental needs.

[0094] The state transition relationships of the fire suppression coordination state machine 220 are as follows: Figure 3 As shown in the diagram, the fire suppression coordination state machine 220 is driven by the rule engine of the coordination control layer 200. The rule engine determines the execution conditions based on the graded early warning signal 216 output by the multi-source fusion early warning module 210 and the test data, and controls the state machine to transition between various state nodes. The state machine includes twelve state nodes: self-test state S0, arming state S1, charging / overcharging state S2, thermal runaway early warning state S3, ignition state S4, module-level gas fire suppression state S5, cabin-level gas fire suppression preparation and spraying state S6, airtightness maintenance state S7, exhaust balance state S8, water spray state S9, emergency explosion relief state S10, and termination state S11.

[0095] Furthermore, the working process and transition conditions of each state node are configured as follows.

[0096] S0, self-test state: checks the status of sensors, valves, communication, and insulation. When all checks are normal, it transitions to S1 state.

[0097] S1, Arming Status: Confirm hatches are closed, interlocks are engaged, and BMS communication is normal. After manual confirmation, transition to S2 status.

[0098] S2, Charging / Overcharging State: Overcharging of the thermal runaway unit and charging of the target module. When the graded warning signal 216 output by the multi-source fusion warning module 210 reaches level three or four, or when the temperature rise rate is ≥3℃ / s and the combustible gas concentration is ≥25%LEL, it switches to state S3.

[0099] S3, Thermal Runaway Warning State: Triggers audible and visual alarms, and data is encrypted and stored. When ignition conditions are met, it transitions to S4 state.

[0100] S4, Ignition State: The first ignition device is activated; if it fails, the second ignition device is activated; if it still fails, the backup ignition device is activated. When an open flame is confirmed, the system transitions to S5. In the test ignition mode, the combustible gas over-limit interlock of safety interlock layer 300 adopts a dual-threshold strategy. When the combustible gas concentration reaches the first concentration threshold but not the second concentration threshold, the ignition circuit is not cut off; only an alarm is triggered.

[0101] S5, Modular gas extinguishing state: The modular gas extinguishing equipment is activated to spray perfluorohexanone. If the open flame is not extinguished after the first preset time (e.g., 10 seconds), the system transitions to state S6.

[0102] S6, Chamber-level gas extinguishing preparation and spraying status: The coordination control layer 200 first controls the execution interface layer 400 to close the inlet and outlet valves. After confirming that the closing signals of the inlet and outlet valves are normal, a preset time is delayed, which is 10 to 30 seconds, and the pressure change rate inside the chamber is monitored. If the pressure change rate inside the chamber is less than the preset airtightness confirmation threshold, the airtightness of the test chamber is determined to meet the requirements. As an example, the preset airtightness confirmation threshold is 0.1 kPa / s to 0.5 kPa / s, preferably 0.2 kPa / s. After confirming that the airtightness of the test chamber meets the requirements, the chamber-level gas extinguishing equipment is then activated to spray perfluorohexanone. After the chamber-level gas extinguishing is completed, the process transitions to state S7.

[0103] In this application, the gas extinguishing phase refers to the period from when the fire extinguishing coordination state machine enters the cabin-level gas extinguishing preparation and injection state S6 until the end of the airtightness maintenance state S7 or the transition to the emergency explosion relief state S10. When entering the gas extinguishing phase, the coordination control layer 200 outputs a valid gas extinguishing phase signal to the safety interlock layer 300 via a hard-wired signal; after receiving the hard-wired signal, the safety interlock layer 300 blocks the start of exhaust ventilation corresponding to the first concentration threshold during the gas extinguishing phase.

[0104] S7, Airtightness Maintenance State: The coordination control layer 200 controls the execution interface layer 400 to close the inlet and outlet valves to maintain the airtightness of the test chamber and ensure the concentration of perfluorohexanone. The coordination control layer 200 monitors the pressure change rate inside the chamber. When the pressure change rate exceeds a preset change rate threshold but the pressure inside the chamber does not reach a preset explosion relief pressure threshold, the coordination control layer 200 issues an early warning and prepares to trigger an emergency explosion relief state. As an example, the preset change rate threshold can be 0.5 kPa / s to 2 kPa / s, preferably 1 kPa / s. When the pressure inside the chamber reaches the preset explosion relief pressure threshold, it transitions to state S10. When the coordination control layer 200 determines that the water spray activation conditions are met based on the flame state inside the chamber and the temperature of the thermal runaway unit, it transitions to state S8. The water spray activation conditions include: the flame inside the chamber reignites within a preset observation time after being extinguished and the temperature of the thermal runaway unit is not lower than a preset unit temperature threshold, or the flame inside the chamber is not extinguished. The preset observation time is 30 seconds to 120 seconds, preferably 60 seconds. When the flame inside the chamber is extinguished and there is no reignition, and the temperature of the thermal runaway unit is lower than the preset unit temperature threshold, the coordinated control layer 200 will not activate the water spray, maintaining the airtightness maintenance state or switching to the S11 state according to the test procedure.

[0105] S8, Exhaust Balance State: The coordination control layer 200 controls the execution interface layer 400 to open the exhaust valve and exhaust fan to exhaust combustible gas from the cabin. The coordination control layer 200 monitors the concentration of combustible gas in the cabin. When the concentration of combustible gas is lower than a preset concentration threshold, it transitions to state S9. The preset concentration threshold is, for example, 10% LEL to 25% LEL, preferably 10% LEL. In state S8, the exhaust fan continues to run until state S9 ends or the concentration of combustible gas in the cabin remains below the preset concentration threshold.

[0106] S9, Water Spray State: The coordination control layer 200 activates the water spray equipment deployed by the enterprise. The water spray continues for at least a preset duration (e.g., at least 12 hours). During the water spray, the coordination control layer 200 obtains the external temperature of the target battery module through the execution interface layer 400. When the external temperature of the target battery module is lower than a preset module temperature threshold, the coordination control layer 200 transitions to state S11 and keeps the exhaust system running to release combustible gases. The preset module temperature threshold is determined based on the thermal runaway characteristics of the target battery module, aiming to prevent reignition of the target battery module. When the water spray duration has reached the preset duration and the external temperature of the target battery module is still not lower than the preset module temperature threshold, the coordination control layer 200 maintains the water spray state and issues a check prompt.

[0107] To avoid continuous exhaust affecting the distribution of water spray mist and the fire extinguishing effect, the exhaust fan in S9 state adopts a low exhaust volume mode, or an intermittent exhaust mode when the concentration of combustible gas in the cabin is lower than the preset safe concentration threshold. In the low exhaust volume mode, the exhaust volume is less than the rated exhaust volume of the exhaust fan, sufficient to remove the steam and combustible gas generated by the water spray without affecting the water mist distribution. In the intermittent exhaust mode, the exhaust fan starts and stops periodically. However, during the period when the exhaust fan is stopped, the coordination control layer 200 continuously monitors the concentration of combustible gas in the cabin through the execution interface layer 400. When the concentration of combustible gas reaches the preset safe concentration threshold, the exhaust fan is immediately started and the system returns to the low exhaust volume mode or continuous exhaust mode.

[0108] S10, Emergency Explosion Relief State: When the pressure inside the chamber exceeds the preset explosion relief pressure threshold, the passive fire control logic is triggered. The emergency explosion relief panel opens upwards under the pressure of the high-pressure gas inside the chamber, achieving directional pressure relief. After the emergency explosion relief panel opens, the coordination control layer 200 immediately closes the main valve of the gas extinguishing agent, stops gas injection, and transitions to state S8. When the emergency explosion relief panel is manually reset and the temperature inside the chamber is lower than the preset module temperature threshold and the concentration of combustible gas is lower than the preset concentration threshold, the coordination control layer 200 transitions to state S11. The preset explosion relief pressure threshold is, for example, 1.1 to 1.3 times the design pressure of the test chamber, preferably 1.2 times.

[0109] S11, End Status: Inspection is conducted through the emergency explosion-proof entrance. After the manual confirmation test is completed, the state machine stops operating.

[0110] Furthermore, the state transitions of the fire suppression coordination state machine 220 are driven by the rule engine of the coordination control layer 200. The rule engine makes judgments based on the graded early warning signal 216 output by the multi-source fusion early warning module 210 and the test data execution conditions. The state transition records of the state machine are stored in a database for automatic generation of test reports.

[0111] Furthermore, the coordination control layer 200 is configured to generate coordinated fire suppression decisions based on the following decision logic:

[0112] If the flame inside the chamber is extinguished and there is no reignition, and the temperature of the thermal runaway unit is below the preset threshold and the external temperature of the module is below the preset threshold, then the test is terminated.

[0113] If the flame inside the cabin is extinguished but reignites and the temperature of the thermal runaway unit is not lower than the preset threshold, or if the flame inside the cabin is not extinguished, the water spray start-up conditions are met. The system first switches from the airtightness maintenance state to the exhaust balance state, opens the exhaust vent and exhaust fan, and switches to the water spray state after the concentration of combustible gas is lower than the preset concentration threshold.

[0114] If the fire inside the cabin is extinguished and there is no reignition, and the temperature of the thermal runaway unit is not lower than the preset threshold, then the airtightness maintenance state is entered, the air inlet and outlet are closed, and the concentration of gaseous fire extinguishing agent is maintained.

[0115] If the pressure inside the cabin exceeds the preset explosion relief pressure threshold during the airtightness maintenance state, the emergency explosion relief state will be entered.

[0116] During the gas extinguishing phase, if the flammable gas concentration reaches the first concentration threshold, the safety interlock layer 300 only alarms; if the flammable gas concentration reaches the second concentration threshold, the safety interlock layer 300 forcibly starts ventilation, cuts off charging, and closes the main valve of the extinguishing agent, and the coordination control layer 200 immediately enters the ventilation balance state. The preset unit temperature threshold is, for example, 60°C to 80°C, preferably 70°C.

[0117] The aforementioned fire suppression coordination state machine 220 requires the closure of the air inlet and outlet during the gas extinguishing phase to maintain the airtightness of the test chamber and ensure the concentration of perfluorohexanone. However, during thermal runaway, the concentration of combustible gas inside the chamber may continue to rise. If, according to conventional logic, exhaust ventilation is forcibly activated when the combustible gas concentration reaches the first concentration threshold, the airtightness of the test chamber will be compromised, leading to fire suppression failure. This system addresses the conflict between the airtightness requirements and safe exhaust requirements of gas extinguishing through a dual-threshold strategy using the combustible gas over-limit interlock in the safety interlock layer 300.

[0118] As an example of an implementable form, the safety interlock layer 300 of this system is set up independently of the coordination control layer 200 in terms of control logic, and runs in parallel with the coordination control layer 200. Their logical control relationship is as follows: Figure 5 As shown in the image.

[0119] There are two types of interactions between the safety interlock layer 300 and the coordination control layer 200 in this system:

[0120] One type is normal signal interaction, where the safety interlock layer 300 receives sensor signals from the execution interface layer 400 and synchronizes the safety status to the coordination control layer 200;

[0121] Another type is independent action under abnormal conditions, that is, when the coordination control layer 200 communication is interrupted, the safety interlock layer 300 can independently execute safety actions without relying on the output of the coordination control layer 200.

[0122] This safety interlocking layer 300 uses a hard-wired interlocking circuit 310 and a safety programmable logic controller 320 to implement safety actions.

[0123] As a further example, this hard-wired interlocking circuit 310 can be implemented using a relay interlocking circuit. As an example, the relay interlocking circuit consists of a sensor, a safety relay, and relay contacts connected in series in the execution circuit. The sensor drives the safety relay coil via a hardwire connection. The normally open or normally closed contacts of the safety relay are connected in series in the corresponding execution circuit, and the action of the contacts disconnects or connects the execution circuit. The specific circuit form of the hard-wired interlocking circuit 310 can be any relay interlocking circuit known to those skilled in the art, as long as it can achieve the following logical functions.

[0124] Furthermore, the signal from the hard-wired interlocking circuit 310 bypasses the processor and communication link of the coordination control layer 200, directly controlling the safety actuator 330 via relay coils and normally closed contacts. Specifically, the hard-wired interlocking circuit 310 includes four parallel interlocking branches: a hatch interlocking circuit, a combustible gas over-limit interlocking circuit, an emergency stop interlocking circuit, and a pressure over-limit interlocking circuit. The outputs of these four interlocking branches are respectively connected to the priority arbitration module of the execution interface layer 400. The four interlocking circuits address four types of safety risks during the test: ignition and overcharging risks when the hatch is not tightly closed, combustion and explosion risks when combustible gas exceeds limits, the need for manual emergency stop, and structural damage risks when cabin pressure exceeds limits.

[0125] The hatch interlock circuit is designed to address the ignition and overcharge risks when the hatch is not tightly closed. In this circuit, the hatch limit switch acts as a sensor; its contact state drives the safety relay coil. The normally open contact of the safety relay is connected in series in both the ignition and overcharge circuits. When the hatch is not tightly closed, the contact state of the hatch limit switch de-energizes the safety relay coil, causing the normally open contact to open, thus disconnecting both the ignition and overcharge circuits. This prevents the battery module from igniting or continuing to charge. The specific circuit configuration of the hatch interlock circuit can employ a conventional combination of limit switches and relays.

[0126] The combustible gas over-limit interlock circuit is designed to address the risk of combustion and explosion when combustible gas exceeds its limit. This circuit can be implemented using conventional safety relay interlock circuits. During the non-gas extinguishing phase, when the combustible gas concentration reaches a first concentration threshold, the ignition circuit is cut off and the exhaust fan is activated. During the gas extinguishing phase, when the combustible gas concentration reaches the first concentration threshold, only an alarm signal is output without activating the exhaust fan. When the combustible gas concentration reaches a second concentration threshold higher than the first, the exhaust fan is forcibly activated, charging is cut off, and the main extinguishing agent valve is closed. The gas extinguishing phase signal is input to the safety interlock layer 300 via a hard-wired signal to block the exhaust activation corresponding to the first concentration threshold during the gas extinguishing phase.

[0127] The specific circuit form of the aforementioned combustible gas over-limit interlock circuit can adopt a conventional safety relay interlock circuit in this field, as long as it can achieve the above-mentioned logical function. The second threshold is greater than the first threshold. For example, the first concentration threshold is, for instance, 20% LEL to 30% LEL, preferably 25% LEL; the second concentration threshold is, for instance, 45% LEL to 60% LEL, preferably 50% LEL. The safety basis is: a certain percentage of the lower explosive limit of the combustible gas is used as a safety margin. Combined with the structural strength of the test chamber and the explosion venting design, this ensures forced ventilation before reaching the explosion limit, while avoiding frequent ventilation during the gas extinguishing stage due to an excessively low threshold, which could compromise airtightness. The first and second thresholds can be set according to the size of the test chamber, the battery type, and the configuration of the extinguishing system.

[0128] It should be noted that the first and second concentration thresholds used in the combustible gas over-limit interlock of the safety interlock layer 300 are two independent sets of judgment logics compared to the graded warning signal 216 output by the multi-source fusion warning module 210. The graded warning signal 216 is used to coordinate the state transition and fire extinguishing coordination decision of the control layer 200; the safety interlock layer 300 directly executes safety actions independently through the hard-wired interlocking loop 310 and / or the safety programmable logic controller 320 based on the combustible gas concentration sensor signal and the hard-wired signal during the gas extinguishing stage. When the two judgments are inconsistent, the priority arbitration module of the execution interface layer 400 executes the highest priority instruction in the order that the hard-wired interlocking loop 310 takes precedence over the safety programmable logic controller 320, and the safety programmable logic controller 320 takes precedence over the coordination control layer 200. The actions of the safety interlock layer 300 are not blocked by the state machine output of the coordination control layer 200; only during the gas extinguishing stage, the safety interlock layer 300 blocks the start of the exhaust corresponding to the first concentration threshold through hard-wired signals to maintain the airtightness of the test chamber.

[0129] As a further example, see Figure 6 The diagram shows an example of a configuration of a combustible gas over-limit interlocking circuit.

[0130] Based on the diagram, this combustible gas over-limit interlocking circuit includes an independent safety power supply, fuses FU1 and FU2, a first concentration threshold switch output KGH1, a second concentration threshold switch output KGH2, a gas extinguishing stage relay KM-GAS, a first threshold safety relay K1, a second threshold safety relay K2, an alarm relay KA, an exhaust fan contactor KM-FAN, a charging cut-off intermediate relay K-CHG, and a extinguishing agent main valve closing relay K-GAS-VALVE. The independent safety power supply provides +24V and 0V, bypassing the processor and communication link of the coordination control layer 200. KGH1 and KGH2 are from the combustible gas alarm controller and are passive normally open contacts connected to this circuit via terminals X3 and X4. KGH1 closure indicates that the combustible gas concentration has reached the first concentration threshold, and KGH2 closure indicates that the combustible gas concentration has reached the second concentration threshold. The first concentration threshold is, for example, 20% LEL to 30% LEL, preferably 25% LEL; the second concentration threshold is, for example, 45% LEL to 60% LEL, preferably 50% LEL.

[0131] The KM-GAS coil is driven by a hard-wired signal output by the coordination control layer 200 during the gas extinguishing phase, and its normally closed contact is connected in series with the K1 coil circuit. When the extinguishing coordination state machine 220 enters the compartment-level gas extinguishing preparation and injection state S6, the coordination control layer 200 outputs an effective signal for the gas extinguishing phase, energizing the KM-GAS; this signal is deactivated when the airtightness maintenance state S7 ends or the emergency explosion relief state S10 is entered.

[0132] The K1 coil circuit connection is as follows: +24V via FU1, KGH1 normally open contact, KM-GAS normally closed contact, K1 coil to 0V. The K2 coil circuit connection is as follows: +24V via FU2, KGH2 normally open contact, K2 coil to 0V. The KA alarm coil is driven by either the KGH1 normally open contact or the KGH2 normally open contact; an alarm is output when either threshold is reached, and the alarm is not blocked by KM-GAS. The K1 normally open contact is connected in series with the KM-FAN exhaust fan contactor coil circuit, and the K1 normally closed contact is connected in series with the ignition device power supply circuit. K2 normally open contact 1 is connected in series with the KM-FAN exhaust fan contactor coil circuit, K2 normally open contact 2 is connected in series with the K-CHG charging cut-off intermediate relay coil circuit, K2 normally open contact 3 is connected in series with the K-GAS-VALVE extinguishing agent main valve closing relay coil circuit, and K2 normally closed contact is connected in series with the ignition device power supply circuit. The normally closed contacts of K-CHG are connected in series with the charging contactor coil circuit, and the normally closed contacts of K-GAS-VALVE are connected in series with the power supply circuit of the main extinguishing agent valve.

[0133] During the non-gas extinguishing phase, the KM-GAS coil is de-energized, and its normally closed contact closes. When the combustible gas concentration reaches the first concentration threshold, KGH1 closes, the K1 coil is energized, the K1 normally open contact closes to start the exhaust fan, and the K1 normally closed contact opens to cut off the ignition circuit. Simultaneously, KA outputs an alarm. When the combustible gas concentration reaches the second concentration threshold, KGH2 closes, the K2 coil is energized, the K2 normally open contact 1 closes to force the exhaust fan to start, the K2 normally open contact 2 closes to energize K-CHG and cut off its charging, the K2 normally open contact 3 closes to energize K-GAS-VALVE and close the main extinguishing agent valve, and the K2 normally closed contact opens to cut off the ignition circuit.

[0134] During the gas extinguishing phase, the coordinated control layer 200 outputs a hard-wired signal to energize the KM-GAS coil, causing its normally closed contact to open and lock the K1 coil. If the combustible gas concentration reaches the first concentration threshold, KGH1 closes, only driving the KA alarm output; the K1 coil remains de-energized, the exhaust fan does not start, and the ignition circuit is not cut off, maintaining the airtightness of the test chamber and the concentration of perfluorohexanone. If the combustible gas concentration continues to rise and reaches the second concentration threshold, KGH2 closes, energizing the K2 coil. K2 is not locked by the KM-GAS and still forcibly starts the exhaust fan, cuts off charging, and closes the main extinguishing agent valve, while simultaneously cutting off the ignition circuit to prevent deflagration.

[0135] As can be seen from the above working process, in the non-gas extinguishing stage, both the first threshold and the second threshold trigger the corresponding safety actions; in the gas extinguishing stage, the first threshold only alarms and does not start the exhaust, while the second threshold still forces the exhaust to start, cuts off the charging and closes the main valve of the extinguishing agent, thereby ensuring explosion-proof safety while maintaining airtightness.

[0136] The auxiliary normally open contacts of K1 and K2 are connected to the first group of input terminals of the priority arbitration module of the execution interface layer 400 via terminals X9 and X10, respectively. The priority arbitration module executes the highest priority instruction in the order that the hard-wired interlocking circuit 310 takes precedence over the safety programmable logic controller 320, and the safety programmable logic controller 320 takes precedence over the coordination control layer 200, and uploads the conflict status to the task management layer 100.

[0137] The power supply circuit of the hard-wired interlocking circuit 310 does not pass through the processor and communication link of the coordination control layer 200. When the communication of the coordination control layer 200 is interrupted, it can still independently execute the safety actions corresponding to the first and second thresholds. K1 and K2 preferably adopt forced-guided contact safety relays to ensure that the normally open and normally closed contacts will not close simultaneously. The main valve of the extinguishing agent is preferably a normally open solenoid valve. When K-GAS-VALVE is energized, its normally closed contact disconnects the power supply to the main valve, and the main valve closes when de-energized. The charging contactor is preferably a normally open type. When K-CHG is energized, its normally closed contact disconnects the power supply to the charging contactor, and the charging contactor disconnects when de-energized.

[0138] The emergency stop interlock circuit is designed for manual emergency stop requirements. In this circuit, the emergency stop button acts as a sensor; its normally closed contact drives the safety relay coil. The normally open contact of the safety relay is connected in series in the power supply circuit of the main extinguishing agent valve and the power supply circuit of the charging contactor. When the emergency stop button is triggered, the normally closed contact opens, the safety relay coil is de-energized, the normally open contact opens, and the power supply to the main extinguishing agent valve and the charging contactor is cut off, thus stopping the test. The specific circuit configuration of the emergency stop interlock circuit can employ a conventional combination circuit of an emergency stop button and a safety relay.

[0139] The pressure over-limit interlock circuit is designed to address the structural damage risk when the internal pressure exceeds the limit. In this circuit, a pressure switch acts as a sensor, located on the top or side wall of the experimental chamber. The contact state of the pressure switch drives the coil of a safety relay. The normally open contact of the safety relay is connected in series in the power supply circuit of the electromagnetic lock for the emergency pressure relief plate locking mechanism. When the internal pressure exceeds the preset pressure relief threshold, the contact state of the pressure switch energizes the safety relay coil, closing the normally open contact, connecting the electromagnetic lock, unlocking it, and causing the emergency pressure relief plate to open upwards under the pressure of the high-pressure gas inside the chamber, achieving directional pressure relief. The specific circuit configuration of the pressure over-limit interlock circuit can employ a conventional pressure switch and relay combination circuit. The power supply circuit of the pressure over-limit interlock circuit does not pass through the processor and communication link of the coordination control layer 200, allowing it to independently execute passive fire-fighting interlock actions even when communication with the coordination control layer 200 is interrupted.

[0140] In this safety interlocking layer 300, the safety programmable logic controller 320 and the hard-wired interlocking circuit 310 constitute a dual logic. The hard-wired interlocking circuit 310 performs direct safety actions without going through the processor, while the safety programmable logic controller 320 performs safety logic actions that go through the processor. The safety programmable logic controller 320 is configured to run its safety logic program independently and synchronize its state with the coordination control layer 200 via a hard-wired handshake signal. When communication with the coordination control layer 200 is interrupted, the safety programmable logic controller 320 detects the loss of the heartbeat signal, automatically enters a safety state, and executes safety actions such as closing the main valve of the extinguishing agent, cutting off charging, starting ventilation, and allowing the emergency explosion relief panel to open passively.

[0141] Furthermore, after the safety interlock layer 300 completes the safety action, it needs to synchronize the safety status to the coordination control layer 200 and simultaneously transmit the output of the safety action to the execution interface layer 400. The four interlocking branch outputs of the hardwired interlocking loop 310 are respectively connected to the first set of inputs of the priority arbitration module of the execution interface layer 400, the safety output of the safety programmable logic controller 320 is connected to the second set of inputs of the priority arbitration module, and the control command output of the coordination control layer 200 is connected to the third set of inputs of the priority arbitration module. The priority arbitration module executes the highest priority instruction in the order that the first set of inputs takes precedence over the second set, and the second set takes precedence over the third set, and uploads the conflict status to the task management layer 100.

[0142] In this way, when any interlocking branch of the hard-wired interlocking circuit 310 is triggered, the priority arbitration module directly executes the safety action of that interlocking branch without waiting for instructions from the safety programmable logic controller 320 or the coordination control layer 200.

[0143] When the hard-wired interlocking circuit 310 is not triggered but the safety programmable logic controller 320 outputs a safety action, the priority arbitration module executes the safety action of the safety programmable logic controller 320.

[0144] When neither the hard-wired interlocking circuit 310 nor the safety programmable logic controller 320 is triggered, the priority arbitration module executes the control instructions of the coordination control layer 200.

[0145] Through the above-mentioned cooperation, the hard-wired interlocking circuit 310 and the safety programmable logic controller 320 constitute dual logic. The hard-wired interlocking circuit 310 provides direct safety protection that does not depend on the processor, while the safety programmable logic controller 320 provides safety protection that has been judged by the processor logic. The two complement each other.

[0146] As an example of an implementable form, the execution interface layer 400 of this system acquires sensor signals through distributed I / O modules and signal isolation barriers, and achieves compatible access of devices from different manufacturers through reconfigurable protocol adaptation middleware 410.

[0147] The reconfigurable protocol adapts to the architecture of middleware 410. Figure 4The diagram shows a protocol plugin layer 411, a point table mapping layer 412, and a unified variable layer 413. The protocol plugin layer 411 includes ModbusTCP, ModbusRTU, CAN, OPCUA, and MQTT plugins, used to convert communication protocols from different manufacturers' devices into a unified data format. The point table mapping layer 412 maps signal addresses from different manufacturers' devices to unified variable names. The unified variable layer 413 provides a unified variable access interface for the coordination control layer 200. When accessing devices from a new manufacturer, only the corresponding protocol plugin needs to be developed and the point table mapping file configured; the core code of the coordination control layer 200 does not need to be modified.

[0148] In practical applications of this system, since water spray systems are typically deployed by enterprises according to their testing needs, the execution interface layer 400 needs to provide compatible access methods. Therefore, the execution interface layer 400 in this system reserves an access interface for the water spray system. This access interface includes digital input / output interfaces, analog input interfaces, and communication interfaces. The digital input / output interfaces are used to connect the solenoid valves and pump sets of the water spray system. The analog input interfaces are used to acquire the flow rate and pressure of the water spray system. The communication interfaces include Modbus RTU, Modbus TCP, and CAN, used for communication with the enterprise's water spray system controller.

[0149] When the enterprise water sprinkler system has its own controller and communication interface, the coordination control layer 200 communicates with the enterprise water sprinkler system controller through the reconfigurable protocol adaptation middleware 410, issuing start and stop commands. The enterprise water sprinkler system controller controls the operation of its water sprinkler equipment according to the received commands. The coordination control layer 200 obtains the status feedback of the enterprise water sprinkler system through the unified variable layer 413. If the enterprise water sprinkler system controller is in local manual mode, the coordination control layer 200 will only issue a remote switching command and subsequently a start or stop command if the enterprise water sprinkler system controller supports remote forced switching and has obtained remote control authorization. If the enterprise water sprinkler system controller does not support remote forced switching, the coordination control layer 200 directly controls the solenoid valves and pump groups of the water sprinkler system through the distributed IO module of the execution interface layer 400.

[0150] When the enterprise's water sprinkler system lacks a communication interface, the execution interface layer 400 directly controls the solenoid valves and pump sets of the water sprinkler system through distributed I / O modules, and collects the flow rate and pressure of the water sprinkler system through analog input interfaces. The coordination control layer 200 has the highest control priority when the safety interlock layer 300 does not trigger the highest priority safety action. Through the above access method, the test platform of this invention can be compatible with the water sprinkler system deployed by the enterprise itself, and reduces the amount of data storage and data transmission required for interface adaptation at each physical level, thereby improving hardware processing speed.

[0151] The hierarchical control system for the new energy storage fire protection test platform based on the above scheme constructs a four-layer control architecture: a task management layer 100, a coordination control layer 200, a safety interlock layer 300, and an execution interface layer 400. The safety interlock layer 300 is logically independent of the coordination control layer 200. The safety interlock layer 300 uses a dual logic approach—a hard-wired interlocking circuit 310 and a safety programmable logic controller 320—to implement safety actions. The signal from the hard-wired interlocking circuit 310 bypasses the processor and communication link of the coordination control layer 200, directly controlling the safety execution device 330 via relay coils and normally closed contacts. The safety programmable logic controller 320 independently runs the safety logic program, synchronizing its state with the coordination control layer 200 through a hard-wired handshake signal. When communication with the coordination control layer 200 is interrupted, the safety programmable logic controller 320 detects the loss of the heartbeat signal and automatically enters a safe state. Therefore, this invention reduces the dependence of safety actions on the main controller's communication link and improves the reliability of safety action execution. Furthermore, the execution interface layer 400 is equipped with a priority arbitration module, with the priority order as follows: hard-wired interlocking circuit 310 is higher than safety programmable logic controller 320, and safety programmable logic controller 320 is higher than coordination control layer 200. When multiple control sources issue conflicting commands to the same execution device, the execution interface layer 400 executes the highest priority command according to the above priority and uploads the conflict status to task management layer 100.

[0152] Furthermore, this system incorporates a multi-source fusion early warning module 210 within the coordination control layer 200, fusing the confidence levels of temperature data 211, gas concentration data 212, pressure data 213, and video data 214. The multi-source fusion early warning module 210 calculates the basic probability allocation function of each data source and then fuses these functions using the Dempster combination rule to calculate the overall confidence level. The calculation process of the Dempster combination rule is executed in the edge controller of the coordination control layer 200, and the fused overall confidence level is stored in the memory of the edge controller. Thus, this invention reduces the problem of decreased early warning accuracy when a single sensor is interfered with or fails, lowering both the false alarm rate and the missed alarm rate. Further, the multi-source fusion early warning module 210 normalizes the basic probability allocation function of each data source, assigning unassigned probabilities to the recognition frame Θ; when the conflict coefficient K exceeds a preset conflict threshold, it employs at least one of the following methods: evidence discounting, weighted averaging, or outputting the observation status and transferring it to manual verification.

[0153] Furthermore, this system includes a fire suppression coordination state machine 220 in the coordination control layer 200. The fire suppression coordination state machine 220 includes active fire suppression control logic and passive fire suppression control logic. The active fire suppression control logic includes a gas extinguishing phase and a water spray phase, while the passive fire suppression control logic includes an emergency explosion relief phase. During the gas extinguishing phase, the control execution interface layer 400 closes the air inlet and outlet before spraying the gaseous extinguishing agent to maintain the airtightness of the test chamber. During the water spray phase, the control execution interface layer 400 opens the exhaust system to discharge combustible gases and vapors. When the pressure inside the chamber exceeds a preset explosion relief pressure threshold, the passive fire suppression control logic is triggered, releasing the pressure inside the chamber through the emergency explosion relief system. Thus, this invention balances the airtightness required for gas extinguishing with the ventilation requirements for water spraying, and achieves safe handling through passive explosion relief when thermal runaway explosion is unavoidable. Furthermore, during the gas extinguishing phase, the combustible gas over-limit interlock of the safety interlock layer 300 adopts a dual-threshold strategy. When the concentration of combustible gas inside the chamber reaches the first concentration threshold, the safety interlock layer 300 only outputs an alarm signal and notifies the coordination control layer 200, without activating the ventilation equipment. When the concentration of combustible gas inside the chamber reaches a second concentration threshold higher than the first concentration threshold, the safety interlock layer 300 forcibly activates the ventilation equipment, cuts off the charging equipment, and closes the main valve of the extinguishing agent.

[0154] Furthermore, this system incorporates a reconfigurable protocol adaptation middleware 410 within the execution interface layer 400, comprising a protocol plugin layer 411, a point table mapping layer 412, and a unified variable layer 413. The protocol plugin layer 411 converts the communication protocols of devices from different manufacturers into a unified data format. The point table mapping layer 412 maps the signal addresses of devices from different manufacturers to unified variable names. The unified variable layer 413 provides a unified variable access interface for the coordination control layer 200. When accessing devices from a new manufacturer, only the corresponding protocol plugin needs to be developed and the point table mapping file configured; no modification to the core code of the coordination control layer 200 is required. In particular, the execution interface layer 400 reserves an interface for water sprinkler systems, ensuring compatibility of the test platform with water sprinkler systems deployed by the enterprise itself. Therefore, this invention reduces the data storage and data transmission volume required for interface adaptation at each physical layer, thereby improving hardware processing speed. Furthermore, when the enterprise water sprinkler system has a communication interface, the coordination control layer 200 communicates with the enterprise water sprinkler system controller through the reconfigurable protocol adaptation middleware 410, and issues start or stop commands when the enterprise water sprinkler system controller supports remote control. When the enterprise water sprinkler system does not have a communication interface or the enterprise water sprinkler system controller does not support remote control, the execution interface layer 400 directly controls the solenoid valves and pump sets of the water sprinkler system through distributed I / O modules.

[0155] Furthermore, this system establishes an exhaust balance state before the water spraying stage. The coordination control layer 200 controls the execution interface layer 400 to open the exhaust valves and exhaust fans, and monitors the concentration of combustible gas in the chamber. The water spraying equipment is only started when the concentration of combustible gas is lower than a preset concentration threshold. Thus, this invention avoids the risk of deflagration caused by excessively high combustible gas concentrations when the water spraying system starts, while also reducing the pressure increase in the chamber caused by the large amount of steam generated by the water spraying. Further, during the water spraying process, the exhaust fan adopts a low exhaust volume mode or intermittent exhaust mode to discharge steam and combustible gas while avoiding affecting the distribution of the water spray mist.

[0156] Based on this, the present invention further provides a hierarchical control method for a new energy storage fire protection test platform. The hierarchical control method of the present invention is executed by a coordination control layer 200, including steps S1 to S6, the process of which is as follows: Figure 7 As shown in the diagram. During the execution of the method, the safety interlock layer 300 and the coordination control layer 200 operate in parallel and execute safety actions independently. The safety actions have a higher priority than the control commands of the coordination control layer 200.

[0157] Step S1: Receive the test procedure sequence issued by the task management layer 100. The test procedure sequence received in this step includes the state node sequence, state transition conditions, execution actions, and timeout handling strategies. This step uses the received test procedure sequence as the basis for executing steps S2 to S5.

[0158] Step S2: Obtain multi-source sensor data and battery management data from the execution interface layer 400. The multi-source sensor data obtained in this step includes temperature data 211, gas concentration data 212, pressure data 213, video data 214, and BMS data 215. This step provides the acquired data to step S3 for fusion processing.

[0159] Step S3: The multi-source fusion early warning module 210 calculates the basic probability allocation function of each data source, normalizes the basic probability allocation function of each data source, assigns the unassigned probability to the recognition frame Θ, fuses the basic probability allocation functions of each data source using the Dempster combination rule, calculates the comprehensive confidence score, and outputs a graded early warning signal 216 based on the comprehensive confidence score. When the conflict coefficient K is greater than the preset conflict threshold, at least one of the following methods is used: evidence discounting, weighted averaging, or outputting the observation status and transferring it to manual confirmation. In this step, the Dempster combination rule is specifically used for multi-source data fusion, and a dual-sensor confirmation and time window correlation mechanism is adopted. This step provides the graded early warning signal 216 to step S4 for fire suppression collaborative decision-making.

[0160] Step S4: Based on the graded early warning signal 216 and the test procedure sequence, a fire suppression coordination decision is generated through the fire suppression coordination state machine 220. The fire suppression coordination state machine 220 in this step includes active fire control logic and passive fire control logic. The active fire control logic includes a gas extinguishing stage and a water sprinkler stage, while the passive fire control logic includes an emergency explosion relief stage. This step provides the generated fire suppression coordination decision to step S5 for execution.

[0161] Step S5: The fire suppression coordination decision is sent to the execution interface layer 400, enabling the execution interface layer 400 to control the operation of the gas fire suppression equipment, water sprinkler equipment, ventilation equipment, charging equipment, and emergency explosion relief equipment. In this step, the execution interface layer 400 uses the reconfigurable protocol adaptation middleware 410 to achieve compatible access for equipment from different manufacturers and reserves an access interface for the water sprinkler system. This step feeds back the execution status to step S2.

[0162] Step S6: Upload the test data and status information to the task management layer 100. The task management layer 100 stores the test data and status information in the database and automatically generates a test report.

[0163] During the execution of steps S1 to S6 by the coordination control layer 200, the safety interlock layer 300 operates in parallel with the coordination control layer 200 based on independent safety logic. The safety interlock layer 300 can independently trigger safety actions without relying on the output of the coordination control layer 200. These safety actions include active and passive fire interlock actions. The parallel operation of the safety interlock layer 300 does not constitute part of the method steps of the coordination control layer 200, but rather is an independent safety mechanism executed in parallel with steps S1 to S6.

[0164] Based on an understanding of the overall function and logical coordination of each step in the above method, the following section provides a more detailed explanation of the specific implementation plan for each step from a technical implementation perspective.

[0165] As an example of an implementable form, step S1 in this method can be implemented through the following sub-step scheme.

[0166] In sub-step S1-1, the coordination and control layer 200 in the system receives the test procedure sequence issued by the task management layer 100. The task management layer 100 loads the corresponding test procedure script according to the test mode selected by the user. The test modes include electrical performance test mode, detection and alarm test mode, control system test mode, environmental adaptability test mode, and fire extinguishing performance test mode.

[0167] In sub-steps S1-2, the coordination control layer 200 parses the test process sequence, extracts the state node sequence, state transition conditions, execution actions and timeout handling strategies, and stores the parsing results in the memory of the coordination control layer 200 for use in steps S2 to S5.

[0168] As an example of an implementable form, step S2 in this method can be implemented through the following sub-step scheme.

[0169] In sub-step S2-1, the coordination control layer 200 obtains temperature data 211, gas concentration data 212, pressure data 213, video data 214, and BMS data 215 from the execution interface layer 400. The execution interface layer 400 collects sensor signals through distributed I / O modules and signal isolation barriers, converts them into a unified data format through the reconfigurable protocol adaptation middleware 410, and then uploads them to the coordination control layer 200.

[0170] In another embodiment, the coordination control layer 200 periodically checks the signal validity and data rationality of each sensor after sub-step S2-1. When a sensor failure is detected, the coordination control layer 200 automatically switches to a backup sensor or estimates based on data interpolation from adjacent sensors. When the number of faulty sensors exceeds a preset threshold, the coordination control layer 200 degrades its operation and issues a maintenance prompt. This embodiment can improve the reliability of multi-source sensor data acquisition and reduce warning interruptions caused by single sensor failures.

[0171] In sub-step S2-2, the coordination control layer 200 stores the data obtained in sub-step S2-1 in the memory of the edge controller and establishes data caches according to the data source type for use in step S3.

[0172] As an example of an implementable form, step S3 in this method can be implemented through the following sub-step scheme.

[0173] In sub-step S3-1, the coordination control layer 200, based on the data buffer established in sub-step S2-2, calculates the basic probability allocation function of each data source through the multi-source fusion early warning module 210. For example, for temperature data source 211, when the temperature rise rate is, for example, ≥3℃ / s, m(Level 3 early warning) = 0.7, m(Level 4 early warning) = 0.2, m(Θ) = 0.1. For gas concentration data source 212, when the combustible gas concentration is, for example, ≥25%LEL, m(Level 2 early warning) = 0.6, m(Level 3 early warning) = 0.3, m(Θ) = 0.1. For pressure data source 213, when the pressure gradient exceeds a preset threshold, m(Level 2 early warning) = 0.5, m(Level 3 early warning) = 0.3, m(Θ) = 0.2. For video data source 214, when the confidence level of flame infrared feature recognition is, for example, ≥0.8, m(Level 4 early warning) = 0.9, m(Θ) = 0.1. For BMS data source 215, when the voltage of a single cell drops sharply beyond the preset threshold, m(Level 3 warning) = 0.6 and m(Θ) = 0.4.

[0174] In another embodiment, the multi-source fusion early warning module 210, based on the basic probability allocation function of each data source calculated in sub-step S3-1, further employs a thermal runaway trend prediction algorithm based on LSTM / GRU. This algorithm takes the time series of temperature data 211, gas concentration data 212, and voltage data as input and outputs a predicted thermal runaway probability value within a future time window. The training data for the algorithm comes from a historical experimental database. The prediction results serve as auxiliary criteria for the multi-source fusion early warning module 210, used to initiate an early warning response in advance. This embodiment can improve the lead time for thermal runaway early warning by utilizing historical data without increasing the number of sensor hardware.

[0175] In sub-step S3-2, the coordination control layer 200, based on the basic probability allocation function calculated in sub-step S3-1, sequentially performs pairwise fusion of temperature data 211, gas concentration data 212, pressure data 213, video data 214, and BMS data 215. Each fusion is performed according to the Dempster combination rule, combining the basic probability allocation functions of the two pieces of evidence into a new basic probability allocation function.

[0176] ;

[0177] In the formula, and Let A be the basic probability assignment function for the two pieces of evidence involved in this fusion, A be a subset of the identification frame Θ, and K be the conflict coefficient, calculated as follows:

[0178] ;

[0179] In the formula The empty set indicates that the intersection of B and C is empty.

[0180] K reflects the degree of conflict between two pieces of evidence. When K is greater than a preset conflict threshold, at least one of the following methods is used: evidence discounting, weighted averaging, or outputting the observation status and transferring it to manual verification.

[0181] In sub-step S3-3, the coordination control layer 200 outputs a graded early warning signal 216 based on the comprehensive confidence level calculated in sub-step S3-2. When the early warning levels of two independent data sources are consistent, the early warning level is confirmed. When only one data source issues an early warning, a time window correlation detection is initiated, waiting for confirmation from other data sources within a preset time window (e.g., 30 seconds). The coordination control layer 200 stores the graded early warning signal 216 in the output buffer of the edge controller for later retrieval in step S4.

[0182] As an example of an implementable form, step S4 in this method can be implemented through the following sub-step scheme.

[0183] In sub-step S4-1, the coordination control layer 200 determines whether to trigger the state transition of the fire suppression coordination state machine 220 based on the graded early warning signal 216 output in step S3. When the early warning level reaches level three or four, the state machine transitions from state S2 to state S3.

[0184] In another embodiment, the coordination control layer 200 performs simulation verification using a digital twin model before sub-step S4-1. The coordination control layer 200 constructs a digital twin model of the experimental chamber, mapping temperature, gas, pressure, video, and valve status in real time. Before the extinguishing agent is sprayed, the coordination control layer 200 uses the digital twin model to simulate and predict the fire extinguishing effect, optimizing the timing and dosage of the extinguishing agent spray. The deviation between the simulation results and the actual experimental data is used to correct the model parameters online. This embodiment can predict the fire extinguishing effect before the extinguishing agent is sprayed, reducing ineffective spraying of the extinguishing agent.

[0185] In sub-step S4-2, the state machine, based on the state transition of sub-step S4-1, initiates the ignition device in state S4. After confirming the open flame, it transitions to state S5 to activate the module-level gas extinguishing equipment. When the open flame persists for a first preset time (e.g., 10 seconds), it transitions to state S6 to activate the cabin-level gas extinguishing equipment. In state S6, the coordination control layer 200 first controls the execution interface layer 400 to close the inlet and outlet valves. After confirming the closure is complete, it delays for 20 seconds and monitors the cabin pressure change rate. If the pressure change rate is less than 0.2 kPa / s, the airtightness is deemed to meet the requirements, and then the cabin-level gas extinguishing equipment is activated to spray perfluorohexanone.

[0186] In sub-step S4-3, the state machine transitions to state S7 after state S6, which is the airtightness maintenance state. The coordination control layer 200 controls the execution interface layer 400 to close the inlet and outlet valves, maintaining the airtightness of the test chamber and monitoring the pressure change rate within the chamber. In state S7, the coordination control layer 200 monitors the pressure change rate. When the pressure change rate exceeds a preset threshold but the chamber pressure has not reached a preset explosion relief pressure threshold, the coordination control layer 200 issues a warning and prepares to trigger the emergency explosion relief state. When the chamber pressure reaches the preset explosion relief pressure threshold, it immediately transitions to state S10, triggering the passive fire control logic to release the chamber pressure through the emergency explosion relief device. After the emergency explosion relief panel is opened, the coordination control layer 200 immediately closes the main valve of the gas extinguishing agent, stops gas injection, and transitions to state S8. After the emergency explosion relief panel is manually reset, the coordination control layer 200 transitions to state S11. When the coordination control layer 200 determines that the water spray activation conditions are met based on the flame state inside the chamber and the temperature of the thermal runaway unit, it transitions to state S8. The water spray activation conditions include: the flame inside the chamber reignites within a preset observation time after being extinguished, and the temperature of the thermal runaway unit is not lower than a preset unit temperature threshold, or the flame inside the chamber remains unextinguished. The preset observation time is 30 to 120 seconds, preferably 60 seconds. When the flame inside the chamber is extinguished without reignition and the temperature of the thermal runaway unit is lower than the preset unit temperature threshold, the coordination control layer 200 does not activate the water spray, maintaining the airtightness maintenance state or transitioning to state S11 according to the test procedure.

[0187] In sub-step S4-4, when the water spray system needs to be activated, the state machine transitions from state S7 to state S8, i.e., the exhaust balance state. The coordination control layer 200 controls the execution interface layer 400 to open the exhaust valve and exhaust fan, expelling combustible gas from the cabin and monitoring the concentration of combustible gas in the cabin. When the concentration of combustible gas is lower than a preset concentration threshold, the system transitions to state S9, activating the water spray system deployed by the enterprise. The preset concentration threshold is, for example, 10% LEL to 25% LEL, preferably 10% LEL. This value can be adjusted according to the type of water spray system, the volume of the cabin space, and the type of combustible gas. In state S8, the exhaust fan continues to run until state S9 ends or the concentration of combustible gas in the cabin remains below the preset concentration threshold.

[0188] In sub-steps S4-5, in state S9, the coordination control layer 200 activates the water spray equipment deployed by the enterprise. The water spray continues for at least a preset duration, such as at least 12 hours. During the continuous water spraying, the coordination control layer 200 obtains the external temperature of the target battery module through the execution interface layer 400. When the external temperature of the target battery module is lower than a preset module temperature threshold, the coordination control layer 200 transitions to state S11 and activates the exhaust system to release combustible gas. The preset module temperature threshold is determined based on the thermal runaway characteristics of the target battery module, aiming to prevent reignition. When the water spraying duration reaches the preset duration and the external temperature of the target battery module is not lower than the preset module temperature threshold, the coordination control layer 200 maintains the water spraying state and issues a check prompt. To avoid continuous exhaust affecting the water mist distribution and fire extinguishing effect, the exhaust fan in state S9 adopts a low exhaust volume mode or an intermittent exhaust mode. For example, in low exhaust mode, the exhaust volume is no more than 30% of the rated exhaust volume of the exhaust fan; in intermittent exhaust mode, the exhaust fan is turned on for 10 to 30 seconds and then stopped for 30 to 60 seconds, and the cycle continues.

[0189] Furthermore, during the execution of sub-steps S4-2 to S4-5, the coordination control layer 200 dynamically calculates the required amount of extinguishing agent based on the target battery module's battery type, the number of thermal runaway cells, the internal space volume, and the flame state. The calculation method combines empirical formulas with real-time data correction. This implementation can dynamically adjust the amount of extinguishing agent according to actual test conditions, reducing extinguishing agent waste.

[0190] As an example of an implementable form, step S5 in this method can be implemented through the following sub-step scheme.

[0191] In sub-step S5-1, the coordination control layer 200 sends the fire suppression coordination decision generated in sub-step S4 to the execution interface layer 400. The execution interface layer 400 receives the control commands through the reconfigurable protocol adaptation middleware 410. The middleware includes a protocol plug-in layer 411, a point table mapping layer 412, and a unified variable layer 413.

[0192] Sub-step S5-2 executes the control instructions parsed by the interface layer 400 based on sub-step S5-1, and controls the operation of the gas fire extinguishing equipment, water spray equipment, ventilation equipment, charging equipment and emergency explosion relief equipment through the distributed IO module.

[0193] In sub-step S5-3, the execution interface layer 400 collects the execution status of the device actions based on sub-step S5-2 and feeds it back to the coordination control layer 200 through the unified variable layer 413 to form a closed-loop control.

[0194] As an example of an implementable form, step S6 in this method can be implemented through the following sub-step scheme.

[0195] In sub-step S6-1, the coordination control layer 200 uploads the test data and status information to the task management layer 100. The test data includes temperature data 211, gas concentration data 212, pressure data 213, video data 214, BMS data 215, graded early warning signals 216, state machine state transition records, and equipment execution status.

[0196] In sub-step S6-2, the task management layer 100 stores the test data and status information uploaded in sub-step S6-1 into the database, and automatically generates a test report based on the state machine state transition record.

[0197] The following five application examples illustrate in detail the implementation process of the present invention. Example 1 is a complete embodiment of the battery module-level and battery compartment-level fire protection test process, covering the entire process from thermal runaway triggering to fire extinguishing completion. Examples 2 to 5 are specialized verification embodiments based on Example 1, respectively verifying the integration of electrical performance testing and fire protection testing, independent operation of the safety interlock layer, reconfigurable protocol adaptation, and airtightness maintenance and ventilation balance.

[0198] Example 1: Fire protection tests at the battery module level and battery compartment level.

[0199] This embodiment is a complete test process implementation of the present invention, covering the battery module-level fire protection test stage and the battery compartment-level fire extinguishing test stage. System configuration and deployment: The test compartment is transported to the test site, battery modules are arranged, and electrical interfaces and sensors are connected. The host computer starts the test software, selects the "fire extinguishing performance test mode", and configures the test parameters. The water sprinkler system deployed by the enterprise is connected to the test platform through the water sprinkler system access interface reserved in the execution interface layer 400.

[0200] Battery module-level fire protection test phase: The task management layer 100 issues the test procedure sequence. The coordination control layer 200 obtains sensor data from the execution interface layer 400 and monitors the temperature rise rate and gas concentration through the multi-source fusion early warning module 210. When the temperature rise rate is ≥3℃ / s and the gas concentration is ≥25%LEL, or the multi-source fusion early warning level reaches level three or four, the multi-source fusion early warning module 210 outputs a level three early warning signal. Based on the level three early warning signal, the coordination control layer 200 transitions to state S3 via the state machine. After the ignition conditions are met, the state machine transitions to state S4 and activates the first ignition device. After the open flame is confirmed, the state machine transitions to state S5 and activates the module-level gas extinguishing equipment to spray perfluorohexanone. The acquisition unit within the module collects the spray status and flame status in real time. If the open flame is not extinguished for, for example, 10 seconds, the state machine transitions to state S6 and activates the cabin-level gas extinguishing equipment. In S6 state, the coordination control layer 200 first controls the execution interface layer 400 to close the air inlet valve and the air outlet valve. After confirming that the closing signal is normal, it delays for 20 seconds and monitors the pressure change rate inside the cabin. If the pressure change rate is less than 0.2 kPa / s, it is determined that the air tightness meets the requirements, and the cabin-level gas fire extinguishing equipment is activated to spray perfluorohexanone.

[0201] Battery compartment fire suppression test phase: After completing the compartment-level gas fire suppression, the state machine transitions to state S7, i.e., the airtightness maintenance state. The coordination control layer 200 controls the execution interface layer 400 to close the inlet and outlet valves to maintain the airtightness of the test compartment and ensure the concentration of perfluorohexanone. The coordination control layer 200 monitors the rate of pressure change inside the compartment. If the pressure inside the compartment exceeds the preset explosion relief pressure threshold (e.g., 1.2 times the design pressure of the test compartment), the state machine transitions to state S10, triggering the passive fire suppression control logic. The emergency explosion relief panel opens upwards under the pressure of the high-pressure gas inside the compartment, achieving directional pressure relief. After the emergency explosion relief panel opens, the coordination control layer 200 immediately closes the main valve of the gas extinguishing agent, stops gas injection, and transitions to state S8.

[0202] If water spraying needs to be activated, the state machine transitions from state S7 to state S8, the exhaust balance state. The coordination control layer 200 controls the execution interface layer 400 to open the exhaust valves and exhaust fans to expel combustible gases from the cabin. When the concentration of combustible gases falls below a preset concentration threshold (e.g., 10% LEL), the state machine transitions to state S9, activating the water spraying equipment deployed by the enterprise. Water spraying continues for, for example, at least 12 hours. During water spraying, when the external temperature of the target battery module falls below a preset threshold, the state machine transitions to state S11, activating the exhaust system to release combustible gases. In state S9, the exhaust fans operate in an intermittent exhaust mode, periodically starting and stopping, and monitoring the combustible gas concentration during shutdowns to minimize the impact on the distribution of water spray mist.

[0203] During the gas extinguishing phase, if the flammable gas concentration reaches the first concentration threshold of 25% LEL, the safety interlock layer 300 will only sound an alarm and notify the coordination control layer 200, without initiating ventilation, to maintain the perfluorohexanone agent concentration. If the flammable gas concentration continues to rise and reaches the second concentration threshold of 50% LEL, the safety interlock layer 300 will forcibly initiate ventilation, cut off charging, and close the main extinguishing agent valve. The coordination control layer 200 will then switch to state S8 to prevent deflagration.

[0204] This embodiment achieves accurate identification of thermal runaway through a multi-source fusion early warning module 210, and automatically triggers and coordinates module-level gas fire suppression, compartment-level gas fire suppression, airtightness maintenance, exhaust balancing, water spraying, and emergency explosion venting through a state machine, avoiding delays and errors caused by manual judgment. This embodiment fully demonstrates the collaborative working process of active and passive fire control logic.

[0205] Example 2: Integrated verification of electrical performance testing and fire protection testing.

[0206] This embodiment is a specific verification embodiment used to verify the functionality of the hierarchical control system of the present invention in integrating electrical performance testing and fire protection testing. This embodiment is implemented based on the test platform and hierarchical control method described in Embodiment 1. The task management layer 100 first selects the "electrical performance test mode," and the coordination control layer 200 controls the execution interface layer 400 to sequentially perform insulation resistance testing, withstand voltage testing, grounding continuity testing, and insulation monitoring device function testing. After the tests are completed, the task management layer 100 automatically switches to the "fire extinguishing performance test mode," and the coordination control layer 200 takes over the control process, executing the fire protection test according to the process described in Embodiment 1. The electrical performance test data and the fire protection test data are stored in the same database, supporting correlation analysis.

[0207] This embodiment verifies that the hierarchical control system of the present invention can complete electrical performance tests and fire protection tests on the same control platform, reducing the time and wiring operations required for switching test equipment.

[0208] Example 3: Verification of independent operation of safety interlock layer.

[0209] This embodiment is a specific verification embodiment used to verify the function of the safety interlock layer 300 of the present invention in independently executing safety actions when the communication of the coordination control layer 200 is interrupted. This embodiment is implemented based on the test platform and hierarchical control method described in Embodiment 1. When the coordination control layer 200 is operating normally, the safety interlock layer 300 continuously monitors the hatch status, combustible gas concentration, and cabin pressure through the hard-wired interlock circuit 310. When the communication of the coordination control layer 200 is simulated to be interrupted, the safety programmable logic controller 320 detects the loss of the heartbeat signal, automatically enters a safety state, and executes safety actions such as closing the main valve of the extinguishing agent, cutting off the charging contactor, starting the exhaust fan, and allowing the emergency explosion relief plate to be passively opened. The execution interface layer 400 executes according to the priority of hard-wired interlocking first, safety PLC second, and coordination control layer third, ensuring that the safety actions are not overridden by the abnormal output of the coordination control layer.

[0210] This embodiment verifies the technical effect of the safety interlock layer 300 performing safety actions independently of the coordination control layer 200, that is, when the coordination control layer 200 is interrupted, the safety interlock layer 300 can still perform safety actions independently.

[0211] Example 4: Verification of reconfigurable protocol adaptation.

[0212] This embodiment is a specific verification embodiment used to verify the compatibility of the reconfigurable protocol adaptation middleware 410 of the present invention with devices from different manufacturers. This embodiment is implemented based on the test platform and hierarchical control method described in Embodiment 1. The test platform needs to connect to the BMS of the first manufacturer, the fire control panel of the second manufacturer, and the water sprinkler system deployed by the third manufacturer. The BMS of the first manufacturer uses the Modbus TCP protocol, the fire control panel of the second manufacturer uses the CAN protocol, and the water sprinkler system of the third manufacturer uses the Modbus RTU protocol. The execution interface layer 400 connects to the BMS of the first manufacturer through the Modbus TCP plugin, to the fire control panel of the second manufacturer through the CAN plugin, and to the water sprinkler system of the third manufacturer through the Modbus RTU plugin. The point table mapping layer 412 maps the signal addresses of the devices from each manufacturer to unified variable names. The unified variable layer 413 provides a unified variable access interface for the coordination control layer 200. The coordination control layer 200 can access the data of the devices from each manufacturer simultaneously without modifying the core code.

[0213] This embodiment verifies the technical effect of the reconfigurable protocol adaptation middleware 410 in reducing the amount of data storage and data transmission required for interface adaptation, and verifies the functionality of the test platform of the present invention in compatibility with the water spray system deployed by the enterprise itself.

[0214] Example 5: Specific verification of airtightness maintenance and exhaust balance.

[0215] This embodiment is a specific verification embodiment used to verify the transition logic of the fire suppression coordination state machine 220 of the present invention between the airtightness maintenance state and the exhaust balance state. This embodiment is implemented based on the test platform and layered control method described in Embodiment 1. After the chamber-level gas fire suppression is completed, the state machine transitions to state S7, i.e., the airtightness maintenance state. The coordination control layer 200 controls the execution interface layer 400 to close the air inlet valve and the air outlet valve to maintain the airtightness of the test chamber and ensure the concentration of perfluorohexanone agent. The coordination control layer 200 monitors the pressure change rate inside the chamber. When water spray needs to be activated, the state machine transitions from state S7 to state S8, i.e., the exhaust balance state. The coordination control layer 200 controls the execution interface layer 400 to open the exhaust valve and exhaust fan to discharge combustible gas from the chamber. When the concentration of combustible gas is lower than a preset concentration threshold (e.g., 10% LEL), the state machine transitions to state S9 and activates the water spray equipment deployed by the enterprise. During the S9 water spraying process, the exhaust fan operates in a low exhaust volume mode, with the exhaust volume being less than the rated exhaust volume of the exhaust fan, in order to remove the steam and combustible gases generated by the water spraying, while avoiding affecting the water mist distribution.

[0216] This embodiment verifies the technical effect of the fire extinguishing coordination state machine 220 of the present invention in balancing the airtightness required for gas fire extinguishing and the ventilation requirements required for water spraying by setting the airtightness maintenance state and the ventilation balance state.

[0217] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of this invention is defined by the appended claims and their equivalents.

Claims

1. A hierarchical control system for a new energy storage fire protection test platform, characterized in that, include: The task management layer is used to configure test tasks and orchestrate test process sequences. The coordination and control layer includes a multi-source fusion early warning module and a fire extinguishing coordination state machine. The multi-source fusion early warning module is used to fuse and process the acquired multi-source sensor data and generate an early warning signal. The fire extinguishing coordination state machine is used to generate control decisions based on the early warning signal and the test process sequence. The fire extinguishing coordination state machine includes active fire control logic and passive fire control logic. The active fire control logic includes a gas extinguishing stage and a water spray stage. The passive fire control logic includes an emergency explosion relief stage. The safety interlocking layer is set independently of the coordination control layer in terms of control logic. The safety interlocking layer and the coordination control layer operate in parallel, and the safety actions of the safety interlocking layer have a higher priority than the control commands of the coordination control layer. An execution interface layer is used to collect sensor data and control the actions of execution devices, including gas fire extinguishing equipment, water spray equipment, ventilation equipment, and emergency explosion relief equipment. The fire extinguishing coordination state machine controls the execution interface layer to close the air inlet and outlet before spraying the gas extinguishing agent during the gas extinguishing phase. It also employs a graded threshold strategy during the gas extinguishing phase: when the combustible gas concentration reaches the first threshold, the safety interlock layer only outputs an alarm signal without activating the exhaust system; when the combustible gas concentration reaches the second threshold, which is higher than the first threshold, the safety interlock layer forcibly activates the exhaust system and closes the main valve of the extinguishing agent. The fire suppression coordination state machine controls the execution interface layer to open the ventilation equipment during the water spraying phase, and triggers the passive fire control logic when the pressure inside the cabin exceeds the preset explosion relief pressure threshold, releasing the pressure inside the cabin through the emergency explosion relief equipment.

2. The system according to claim 1, characterized in that, The fire suppression coordination state machine includes self-test state, arming state, charging state, thermal runaway early warning state, ignition state, module-level gas fire suppression state, cabin-level gas fire suppression preparation and spraying state, airtightness maintenance state, exhaust balance state, water spray state, emergency explosion relief state, and termination state.

3. The system according to claim 2, characterized in that, In the airtightness maintenance state, the coordination control layer controls the execution interface layer to close the air inlet valve and the air outlet valve and monitors the pressure change rate inside the cabin; in the exhaust balance state, the coordination control layer controls the execution interface layer to open the exhaust valve and the exhaust fan and monitors the concentration of combustible gas inside the cabin. When the concentration of combustible gas is lower than the preset concentration threshold, the water spray equipment is activated.

4. The system according to claim 2, characterized in that, The conditions for transitioning from the airtightness maintenance state to the exhaust balance state include: the coordination control layer determines, based on the flame state inside the cabin and the temperature of the thermal runaway unit, that the water spray activation conditions are met. The water spray activation conditions include: the flame inside the cabin reignites within a preset observation time after being extinguished and the temperature of the thermal runaway unit is not lower than a preset unit temperature threshold, or the flame inside the cabin is not extinguished.

5. The system according to claim 2, characterized in that, In the water spray state, the coordination control layer starts the water spray equipment through the execution interface layer. The water spray lasts for at least a preset time. During the water spray, the external temperature of the target battery module is obtained through the execution interface layer. When the external temperature of the target battery module is lower than the preset module temperature threshold, the system enters the end state and keeps the exhaust system running. The exhaust fan in the water spray state adopts a low exhaust volume mode or an intermittent exhaust mode.

6. The system according to claim 1, characterized in that, The safety interlocking layer includes a hard-wired interlocking circuit and a safety programmable logic controller (PLC). The hard-wired interlocking circuit includes a hatch interlocking circuit, a combustible gas over-limit interlocking circuit, an emergency stop interlocking circuit, and a pressure over-limit interlocking circuit. The execution interface layer includes a priority arbitration module, which is used to execute the highest priority instruction according to the priority of the hard-wired interlocking circuit over the safety PLC, and the priority of the safety PLC over the coordination control layer.

7. The system according to claim 6, characterized in that, The combustible gas over-limit interlock circuit is configured as follows: during the non-gas extinguishing stage, when the combustible gas concentration reaches the first concentration threshold, the ignition circuit is cut off and the exhaust fan is started; during the gas extinguishing stage, when the combustible gas concentration reaches the first concentration threshold, only an alarm is triggered without starting the exhaust fan; when the combustible gas concentration reaches a second concentration threshold higher than the first concentration threshold, the exhaust fan is forcibly started, the charging is cut off, and the main valve of the extinguishing agent is closed; wherein, the gas extinguishing stage signal is input to the safety interlock layer through a hard-wired signal to block the start of the exhaust corresponding to the first concentration threshold during the gas extinguishing stage.

8. The system according to claim 1, characterized in that, The execution interface layer includes a reconfigurable protocol adaptation middleware, which includes a protocol plug-in layer, a point table mapping layer, and a unified variable layer. The execution interface layer reserves an access interface for the water sprinkler system. When the enterprise water sprinkler system has a communication interface, the coordination control layer communicates with the enterprise water sprinkler system controller through the reconfigurable protocol adaptation middleware. When the enterprise water sprinkler system does not have a communication interface, the execution interface layer directly controls the solenoid valves and pump groups of the water sprinkler system through a distributed IO module.

9. A hierarchical control method for a new energy storage fire protection test platform, characterized in that, The method is based on the hierarchical control system according to any one of claims 1 to 8, and the method includes: The task management layer configures test tasks and arranges test process sequences; The multi-source fusion early warning module of the coordination and control layer fuses the acquired multi-source sensor data and generates an early warning signal; The fire suppression coordination state machine of the coordination control layer generates control decisions based on the early warning signal and the test process sequence. The fire suppression coordination state machine includes active fire control logic and passive fire control logic. The active fire control logic includes a gas extinguishing stage and a water spray stage. The passive fire control logic includes an emergency explosion relief stage. The execution interface layer controls the operation of gas fire extinguishing equipment, water sprinkler equipment, ventilation equipment, and emergency explosion relief equipment based on the control decisions. The safety interlock layer operates in parallel with the coordination control layer, with safety actions having a higher priority than the coordination control layer. During the gas extinguishing phase, the fire extinguishing coordination state machine controls the execution interface layer to close the air inlet and outlet before spraying the gaseous extinguishing agent. During the gas extinguishing phase, a graded threshold strategy is adopted: when the combustible gas concentration reaches the first threshold, the safety interlock layer only outputs an alarm signal without activating the exhaust system; when the combustible gas concentration reaches the second threshold, which is higher than the first threshold, the safety interlock layer forcibly activates the exhaust system and closes the main extinguishing agent valve. During the water spray phase, the fire extinguishing coordination state machine controls the execution interface layer to open the exhaust system and triggers passive fire control logic when the cabin pressure exceeds a preset explosion relief pressure threshold, releasing the cabin pressure through emergency explosion relief equipment.

10. The method according to claim 9, characterized in that, The multi-source fusion early warning module uses Dempster combination rules to fuse the basic probability allocation functions of each data source and calculate the comprehensive confidence level. When the conflict coefficient K is greater than the preset conflict threshold, it uses at least one of the following methods: evidence discount, weighted average, or outputting the observation status and transferring it to manual confirmation. The method also includes uploading the test data and status information to the task management layer, which stores the test data and status information in the database and automatically generates a test report.

Images