I am beginning to understand the case for an oversized BMS and undersized fuse/wire to increase system impedance in highly parallel systems. (Say design load per string is 50A-- set your BMS parameters for 50A, but size it at 100A, and fuse it at 60-70A as an example.)
Sorry, a bit long -
You can do that but it would still be treating the BMS as a fuse/OPD (overcurrent protection device). The other reason not to do it is efficiency higher impedance would mean higher heat loss. Also if a set of batteries dump into another the extra impedance would be like light bulb filaments, burn hotter and hotter unless they had enough air cooling they would eventually melt the sheath.
When the mosfet on the BMS is most likely to fail is where there is a dead short across the terminals or wire between the terminal and the bus bar.
The other case which is similar to thread most likely cause is the two or more strings dumping current into a single string.
The cause can be hooking up a low SOC string to a set of two or more other strings that are fully charged. It can be a shorted cell causing lower impedance in a string. This causes the whole string inpedance to be less than other strings so they dump current to try and equalize. But no matter how much they dump the voltage and resistance never comes up so they keep dumping.
Assume all strings are fused with class T
With one other string the dump doesn't ever exceed either fuse OR the BMS max current - things get hot and cells may or may not vent.
With two other strings the current will exceed the short string fuse and BMS - The BMS tries to shutdown the current and it is at 200% capacity - no bet on if it succeeds or the mosfets on it short. If it succeeds then current is turned off in 0.0001sec or so. If it fails then the fets short and the class T blows after a period of time.
With three other strings the current can be 3 times rated current of the bad string the class T lasts 30 seconds.
The more strings the more times rated current can flow - Ohms law applies and you can do the math to figure out how much depending on a dead short internal or 1 or more shorted cells.
At 2 times rated current the class T will last 5 full minutes - long enough for the heating to cause a problem
At 5 times rated current (short) it blows in a very reasonable time.
Just a sample of 100amp JJN fuse chart
The OP had 7 strings using Mega fuses - 125v 58v - here is the chart - Should blow in 0.1 sec
But, as it blows the fuse element draws an arc across the empty space it leaves behind. Very small voltage 2.45v if it was a single cell, but at 600 amps the arc would continue even though the fuse element is gone. Arcs are very very hot - we weld steel with it and do other things. Now the AIC of that type fuse is 2500amps - so in theory it should have gone out while the element was still burning away.
But we have seen with testing a dead short a lot of times blows apart the cheaper and plastic body fuses. Usually with some fire and melted metal fuse element.
So we are back to not enough left to know the actual cause of the fire.
To extinguish an arc the higher AIC rated fuses are filled with sand or other things that block the arc physically. They are also physically larger with a longer distance the arc would have to fill to keep on once the element is burned away. They also typically have a ceramic or reinforced fiberglass body to contain the arc and resulting heat.
So to my way of thinking the ideal method to be safe would be a combination of items - fuses, BMS, shunts, controller.
One idea - a batrium style BMS with shut trips on all strings watching for overcurrent in or out and a contactor to turn a string/all strings off.
-- this is basically how batrium recommends installing today, not sure about 5 years ago -
Also a fuse on each string in case the contactor fails shorted - I haven't looked at the docs to see if batrium recommends this.
The other idea is to substitute a standard BMS for the batrium per string and have a shunt that trips a contactor if overcurrent is detected for more than X number of milliseconds - X to be determined by nuisance trips verse high loads kicking in and drawing current.
Trip at the wrong time and the compressor stalls and you loose your airplane ... uhm - wait, wrong window -
But for real, if you trip when an AC is starting it stalls the compressor and can't start again until that bleeds off, they have a pressure switch for this.
Follow the shunt/contactor/controller combo with a fuse per string.
YES, it will cost a bit more, but it covers all possible faults that I can think of other than being in a fireproof detached room to start with.