Block-Level Fault Isolation Primitive

Mechanism: The Per-Block Isolation Switch

Each modular substrate block contains an internal isolation switch positioned electrically between the block's terminals and the building-aggregate bus. The switch is a single point of authoritative disconnection for the entire block: when the switch is open, the block is electrically inert with respect to the aggregate, neither sourcing nor sinking current and presenting no path for fault propagation between the block interior and its neighbors. When the switch is closed, the block participates fully in aggregate dispatch under whatever charge or discharge schedule the building-level controller commands.

Two physical realizations are contemplated. The first uses solid-state semiconductor switching elements, typically silicon-carbide or gallium-nitride MOSFETs in series-parallel arrangements sized to the block's nameplate current, admitting fast actuation (microsecond to millisecond timescales) and zero-mechanical-wear lifetime. The second uses electromechanical contactors, whose galvanic isolation in the open state is more robust against transient overvoltages and whose conduction losses in the closed state are lower at high current ratings, at the cost of millisecond-to-second actuation times and finite mechanical cycle life.

Switch state is observable through the block's credentialed admissibility profile: the profile carries a signed assertion of the present switch position, the timestamp of the most recent state transition, and the trigger that caused the transition. A building-level operator or auditor verifying the credential can, without trusting the block's local controller, confirm whether the block is presently participating in aggregate dispatch and the chain of authoritative events that brought it to its current state. This observability is load-bearing for the architectural guarantees that follow: aggregate-level dispatch decisions, capacity reporting, and degradation accounting all depend on knowing with cryptographic confidence which blocks are in service.

Operating Parameters and Engineering Envelope

The isolation switch is engineered to the block's nameplate electrical envelope. Continuous-current rating tracks the block's discharge specification; surge ratings cover transient inrush during reconnection events and worst-case fault currents prior to upstream protection clearing. Voltage standoff in the open state is engineered to the building-bus voltage with margin sufficient to withstand transient overvoltages from neighboring blocks switching, lightning-induced surges on the building service entrance, and inverter-side fault conditions.

Actuation latency budgets differ by trigger class. Operator-commanded isolation tolerates seconds-to-minutes latency and is typically performed during planned-maintenance windows. State-of-health-threshold isolation tolerates similar latency, since the threshold-crossing event is itself a slow-evolving condition. Fault-detected isolation, by contrast, must complete on millisecond-to-tens-of-milliseconds timescales to limit fault energy delivered into the failing block. The dual-realization design (solid-state for fast paths, electromechanical for robust steady-state isolation) admits a hybrid embodiment in which both switch types are present in series, with the solid-state element handling fast fault interruption and the electromechanical element providing post-event galvanic isolation.

State-of-health thresholds are configurable on a per-block basis through the credentialed profile. Typical defaults isolate a block when round-trip efficiency falls below a specified fraction of nameplate (commonly 0.85), when usable capacity falls below a specified fraction of as-built (commonly 0.70), or when the leakage current under hold conditions exceeds a defined ceiling. Fault-detection inputs include cell-level over-temperature (per integrated thermistor arrays), internal-short detection (per impedance-spectroscopy or coulombic-anomaly methods), and electrolyte-loss detection where applicable to the underlying cell chemistry.

Alternative Embodiments

A first alternative embodiment integrates the isolation switch directly into the block's primary current-collector busbar, eliminating the discrete switch package and admitting current ratings limited only by the busbar cross-section. A second embodiment locates the switch externally to the block, in an interconnect-tray assembly between blocks, simplifying block-level manufacturing at the cost of slightly increased interconnect mass. A third embodiment uses a fusible-link element in series with a solid-state switch, so that catastrophic switch failure modes default to the open (safe) state.

Switch-control embodiments range from purely autonomous local control (block-internal microcontroller executing the trigger logic) through hierarchical control (block-level controller subordinate to a building-level orchestrator) to fully credentialed remote control (every state transition requires a signed authorization from a designated key-holder). The hierarchical embodiment is preferred for typical commercial deployments; the fully credentialed embodiment is contemplated for high-assurance applications such as critical-infrastructure backup.

Composition with Adjacent Primitives

The fault-isolation primitive composes with the credentialed-lineage primitive disclosed in the parent provisional: every isolation event is signed as an attestation appended to the block's lineage chain, providing an auditable record of the block's service history that persists across decommissioning and any subsequent material recovery. A second-life or end-of-life auditor inspecting a block's lineage chain can reconstruct the complete sequence of isolation events, the triggers that caused them, and the operator or autonomous-controller identities authorizing them.

The primitive further composes with the building-aggregate dispatch primitive: the building-level controller's awareness of which blocks are isolated and why feeds directly into capacity reporting, degradation forecasting, and warranty-claim adjudication. End-of-life material-recovery flows are gated on an isolated-and-attested state, ensuring that a block enters the recovery pipeline only after a signed retirement event has been recorded in its lineage.

Prior-Art Distinctions

The structural analog is per-cell isolation in lithium-ion pack architectures, in which individual cells or small groups of cells carry fuses or switches admitting localized fault containment. The disclosed primitive is structurally similar but operates at building-substrate scale rather than cell scale, with isolation granularity matched to the modular block rather than the individual cell, and with attestations recorded at building-aggregate timescales rather than within a single product lifecycle.

Conventional integrated-pour energy-storage installations, particularly the large vanadium-redox-flow and molten-salt installations that compete for utility-scale stationary storage, cannot isolate at the cell level. Their architectures are monolithic by construction: a single tank, a single membrane stack, a single thermal envelope. Failure modes propagate through the shared medium and recovery requires extensive draining, neutralization, or thermal cycling. The block-level isolation primitive admits the modular productized architecture to retain a property, graceful per-cell degradation, that is foundational to the lithium-ion pack ecosystem and unavailable to the integrated-pour competitors.

Prior-art building-scale battery-energy-storage systems (BESS) typically isolate at the rack or string level rather than the block level, with isolation events handled by manual disconnection during maintenance windows rather than autonomously and credentially. The present disclosure is distinguished by the combination of finer granularity, autonomous trigger logic, and cryptographic attestation of every isolation event.

Disclosure Scope

The disclosure encompasses energy-storage architectures comprising a plurality of modular blocks, each block containing an internal isolation switch operable to disconnect the block from a building-aggregate electrical bus, where the switch state and its transition history are recorded in a credentialed lineage chain associated with the block. The scope is switch-technology-agnostic (solid-state, electromechanical, hybrid, fusible-link, or equivalent) and trigger-class-agnostic (state-of-health, fault, operator command, or any combination).

The scope further encompasses methods of operating such architectures, including the autonomous trigger logic that determines when a block enters isolation, the signing and chaining protocols that record isolation events, and the building-level dispatch protocols that account for partially-isolated aggregates in capacity reporting and warranty adjudication. Methods of decommissioning, recycling, or repurposing isolated blocks where the isolation attestation gates entry into downstream material flows are within scope.

Equivalents include block-internal isolation realized through any combination of switching, fusing, and credentialed-attestation elements that achieves the disclosed combination of fault containment, autonomous triggering, and lineage-chain recording, regardless of physical packaging or specific switch technology. The granularity scope extends from sub-block (cell-cluster) isolation through block-level to multi-block module isolation, where the corresponding attestation is recorded at the matching granularity in the lineage chain.

Embodiments contemplated for retrofit application, in which existing modular-block deployments lacking integrated isolation switches are upgraded through interconnect-tray retrofits or external switching cabinets, are within scope where the retrofit installation establishes a credentialed attestation pipeline matching that disclosed for greenfield installations. Retrofit pathways admit accelerated deployment of the fault-isolation primitive into existing block populations without requiring per-block re-manufacture, and the disclosure expressly contemplates such pathways as a commercially significant adoption route.

Reduction-to-practice pathways disclosed for guidance include bench-scale demonstration of the credentialed attestation pipeline against simulated trigger sequences, module-scale demonstration of fault-current interruption performance against representative internal-short transients, and field-deployment demonstration of multi-year autonomous operation with autonomous trigger events recorded and verifiable through the lineage chain. The boundary of the disclosed primitive is set not by any specific switch technology or trigger-logic implementation but by the combination of granular fault isolation, autonomous triggering, and credentialed attestation that distinguishes the architecture from coarser-grained or non-attested prior-art alternatives.