Method for constructing safety architecture of hydrogen power system for hydrogen energy train

Abstract

This invention provides a method for constructing a safety architecture for hydrogen-powered trains, belonging to the field of rail transit train safety control technology. This invention elevates safety design from isolated components to the system level, covering the entire lifecycle and all operating conditions of the hydrogen-powered system, achieving comprehensive safety management both horizontally and vertically. It transforms passive protection into proactive defense, enabling early intervention through a closed-loop "monitoring-response-handling" system and rapid control intervention, effectively preventing the escalation of risks. The three-tiered defense architecture, in synergy with three levels of protection, ensures backup measures are available even when a single safety measure fails, significantly improving the system's fault tolerance and overall safety level. Closely addressing the risk characteristics of hydrogen-powered systems, with "blocking propagation" and "suppressing coupling" as its core principles, it effectively addresses specific risks such as hydrogen leakage, combustion and explosion, and cascading failures in electrochemical systems.

Description

Technical Field

[0001] This invention relates to the field of rail transit train safety control technology, specifically to a method for constructing a safety architecture for hydrogen-powered train hydrogen power systems. Background Technology

[0002] As a crucial development direction for clean energy rail transit, the safety of hydrogen-powered trains (typically including hydrogen storage and fuel cell systems) is the core factor determining their commercial viability. Traditional rail transit vehicle safety design focuses primarily on mechanical, electrical, and functional safety. However, hydrogen-powered systems introduce new risk sources such as high-pressure gaseous hydrogen and electrochemical reactions, exhibiting characteristics of concealment, coupling, and rapid evolution. Existing safety solutions are mostly passive protections against single components or isolated failures, lacking systematic control over the entire process from risk generation and propagation to evolution, making it difficult to effectively address cascading failures or safety accidents caused by the coupling of multiple factors. Therefore, there is an urgent need for a proactive, layered defense safety architecture construction method capable of penetrating all levels and processes of the hydrogen-powered system. Summary of the Invention

[0003] The purpose of this invention is to provide a method for constructing a safety architecture for hydrogen-powered trains, so as to solve at least one of the technical problems existing in the background art.

[0004] To achieve the above objectives, the present invention adopts the following technical solution:

[0005] This invention provides a method for constructing a safety architecture for hydrogen power systems in hydrogen-powered trains, comprising: a three-tiered defense-in-depth architecture based on a dual-core safety logic of "blocking propagation paths and suppressing coupling amplification," comprising component-level, subsystem-level, and system-level defenses, and achieving full-process risk management through the synergy of physical protection, control protection, and operational protection; the component-level protection focuses on independent components in the hydrogen power system, using inherently safe design, physical isolation, and safety margin design to block or reduce the generation of risk carriers at the source of risk; the subsystem-level protection focuses on hydrogen storage and supply, fuel cell power generation, and power management subsystems, deploying sensor networks and independent safety interlocking control logic to automatically trigger protection actions when anomalies are detected, thereby cutting off the risk propagation chain within the subsystem at critical nodes; the system-level protection focuses on the entire vehicle hydrogen power system, constructing a "monitoring-response-handling" closed loop, using integrated information for system-level safety status assessment and intelligent decision-making, executing graded response commands to suppress systemic coupling risks and complete the final handling.

[0006] Furthermore, the "blocking the propagation path" logic specifically includes: setting barriers or interruption mechanisms on the physical path or logical link of the generation and diffusion of hydrogen leakage, electric arc or overheating risk carriers; the "suppressing coupling amplification" logic specifically includes: preventing two or more independent risks or faults from becoming interrelated and causing nonlinear growth in the severity of consequences by designing isolation mechanisms, decoupling control strategies or rapid intervention procedures.

[0007] Furthermore, the physical protection layer mainly corresponds to the component-level protection, providing a basic passive security barrier; the control protection layer mainly corresponds to the subsystem-level protection, providing proactive and rapid intervention based on logical criteria; and the application protection layer mainly corresponds to the system-level protection, providing intelligent decision-making and handling based on global state assessment.

[0008] Furthermore, the three levels of physical protection, control protection, and operational protection achieve two-way interaction and coordination of status information and command information through the vehicle communication network, ensuring that the upper-level protection can take over in a timely manner when the lower-level protection fails.

[0009] Furthermore, the "independent safety interlock control logic" in the subsystem-level protection is independent of the main function control logic of the subsystem and has a higher level of safety integrity. It is used to trigger emergency cut-off, discharge, and isolation actions in the event of a fault.

[0010] Furthermore, the "monitoring-response-handling" closed loop in the system-level protection has a response strategy based on a preset multi-level safety strategy library and real-time diagnostic results. Handling actions include one or more of the following: adjusting the vehicle power strategy, triggering audible and visual alarms, transmitting early warning information to the ground center, or guiding emergency operations.

[0011] Furthermore, the intervention mechanisms include: an electrical decoupling mechanism: when the fuel cell voltage is abnormal and the hydrogen supply pressure drops simultaneously, the control unit immediately cuts off the hydrogen input to the stack and switches to backup energy storage power supply to prevent the fault from affecting the power output; a thermal runaway isolation mechanism: a fireproof partition and a temperature-sensitive damper are installed between the battery compartment and the hydrogen compartment. When an abnormal temperature is detected, the damper is automatically closed and an independent cooling circuit is activated; and a control transfer mechanism: when a local controller fails, the upper-level controller takes over its control functions and redistributes energy and load at the system level to prevent local faults from evolving into system paralysis.

[0012] Furthermore, multiple key safety parameters in the fuel cell system are monitored in real time, including but not limited to: hydrogen concentration, insulation resistance value, stack coolant outlet temperature, hydrogen heat exchanger temperature, air compressor outlet temperature, hydrogen path pressure, air path pressure, coolant pressure, smoke signal: monitoring whether smoke appears inside the system through smoke sensors, stack individual voltage: monitoring whether voltage abnormalities or flooding occur through a single-chip voltage inspection system, and system communication status.

[0013] Furthermore, the control logic hierarchy and triggering conditions include:

[0014] The safety interlock control logic adopts a multi-level response mechanism, which is divided into four levels according to the severity of the fault: early warning, power limiting, disconnection, and isolation.

[0015] Warning level: Non-critical safety parameters are abnormal; only the fault is reported, and the system continues to operate.

[0016] Power limiting level: If a decrease in fuel cell performance or a high coolant temperature is detected, the system will automatically reduce the output power and activate auxiliary cooling.

[0017] Cut-off level: When any of the following conditions are detected, the safety controller immediately issues a cut-off command: the reading of any hydrogen concentration sensor exceeds 10% of the lower explosion limit, the insulation resistance value is lower than the set safety threshold, the outlet temperature of the fuel cell coolant exceeds the safety limit, the hydrogen pressure rises or falls abnormally beyond the set range, the smoke sensor alarms, or the communication of critical controllers in the system is lost for more than the set time.

[0018] Isolation level: If the fault persists or spreads after the cut-off level is triggered, the system will further perform physical isolation operations.

[0019] Furthermore, the actuators and linkage actions include: the safety controller controls the following actuators via hard-wired connection or safety bus:

[0020] Emergency shut-off valve: Located on the hydrogen inlet pipeline, it can be completely closed within 100ms after receiving a signal, cutting off the hydrogen supply;

[0021] Pressure relief valve: Located in the high-pressure section of the hydrogen circuit and at the outlet of the hydrogen storage container, it automatically opens when the pressure is too high to release the pressure to the safety tank or the atmosphere;

[0022] Main circuit breaker / contaminant: Located at the positive and negative output terminals of the fuel cell stack, it immediately disconnects upon receiving a disconnection command, cutting off the electrical output;

[0023] Auxiliary system power-off relay: A power supply relay that controls auxiliary equipment such as air compressors, water pumps, and PTCs to achieve power-off of non-core systems;

[0024] Ventilation and purging system: Upon triggering, it activates forced ventilation and hydrogen purging within the chamber to reduce the concentration of combustible gases.

[0025] The beneficial effects of this invention are as follows: It elevates safety design from isolated components to the system level, covering the entire life cycle and all operating conditions of the hydrogen power system, achieving comprehensive safety management both horizontally and vertically; it transforms passive protection into proactive defense, enabling early intervention through a closed-loop "monitoring-response-handling" system and rapid control intervention, effectively preventing the escalation of risks; the three-tiered defense architecture, in synergy with three levels of protection, ensures that backup measures are available even when a single safety measure fails, significantly improving the system's fault tolerance and overall safety level; and it closely addresses the risk characteristics of hydrogen power systems, focusing on "blocking propagation" and "suppressing coupling," effectively responding to specific risks such as hydrogen leakage, combustion and explosion, and cascading failures in electrochemical systems.

[0026] The advantages of additional aspects of the invention will be set forth more clearly in the following description or will be learned by practice of the invention. Attached Figure Description

[0027] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0028] Figure 1 This is an overall logical block diagram of the security architecture described in the embodiments of the present invention.

[0029] Figure 2 This is a schematic diagram of the three-tiered defense-in-depth architecture and three-layered protection coordination described in an embodiment of the present invention. Detailed Implementation

[0030] Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention.

[0031] It will be understood by those skilled in the art that, unless otherwise defined, all terms used herein (including technical and scientific terms) have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0032] It should also be understood that terms such as those defined in general dictionaries should be understood to have meanings consistent with their meanings in the context of the prior art, and should not be interpreted in an idealized or overly formal sense unless defined as here.

[0033] To facilitate understanding of the present invention, the present invention will be further explained and described below with reference to the accompanying drawings and specific embodiments. However, the specific embodiments do not constitute a limitation on the embodiments of the present invention.

[0034] Those skilled in the art should understand that the accompanying drawings are merely schematic diagrams of embodiments, and the components in the drawings are not necessarily essential for implementing the present invention.

[0035] This invention discloses a method for constructing a safety architecture for hydrogen-powered trains, belonging to the field of rail transit vehicle safety technology. Addressing the unique risks of hydrogen-powered systems, this method innovatively proposes a dual-core safety logic of "blocking propagation paths and suppressing coupling amplification," and based on this, constructs a three-tiered, in-depth defense architecture of "component-subsystem-system." Through the synergy of physical protection, control protection, and operational protection, it respectively blocks risk generation at the component source, cuts off the propagation chain at key nodes of subsystems, and achieves an intelligent closed loop of "monitoring-response-handling" at the whole vehicle system level. This invention achieves systematic, proactive, and in-depth control over the entire process of risks in hydrogen-powered trains from generation to evolution, significantly improving the overall safety level and reliability of hydrogen-powered trains.

[0036] Example 1

[0037] This embodiment provides a method for constructing a safety architecture for a hydrogen power system in a hydrogen-powered train. The method is based on a dual-core safety logic of "blocking propagation paths and suppressing coupling amplification," constructing a three-tiered defense-in-depth architecture encompassing component-level, subsystem-level, and system-level defenses. It achieves full-process risk management through the synergy of physical protection, control protection, and operational protection. Component-level protection focuses on independent components within the hydrogen power system, using inherently safe design, physical isolation, and safety margin design to block or reduce the generation of risk carriers at the source of risk. Subsystem-level protection focuses on hydrogen storage and supply, fuel cell power generation, and power management subsystems. By deploying sensor networks and independent safety interlocking control logic, it automatically triggers protective actions when anomalies are detected, cutting off the risk propagation chain within the subsystem at critical nodes. System-level protection focuses on the entire vehicle's hydrogen power system, constructing a "monitoring-response-handling" closed loop. It integrates information for system-level safety status assessment and intelligent decision-making, executes tiered response commands to suppress systemic coupling risks, and completes final handling.

[0038] The "blocking the propagation path" logic specifically refers to setting up barriers or interruption mechanisms on the physical path or logical link of the generation and spread of risk carriers such as hydrogen leakage, electric arc, and overheating.

[0039] The "suppress coupling amplification" logic specifically refers to preventing the non-linear growth of consequences caused by the correlation between two or more independent risks or faults through the design of isolation mechanisms, decoupling control strategies, or rapid intervention procedures. The physical protection layer mainly corresponds to the component-level protection, providing a basic passive safety barrier; the control protection layer mainly corresponds to the subsystem-level protection, providing proactive and rapid intervention based on logical criteria; and the application protection layer mainly corresponds to the system-level protection, providing intelligent decision-making and handling based on global state assessment.

[0040] The physical protection, control protection, and operational protection layers achieve bidirectional interaction and coordination of status and command information through the vehicle communication network, ensuring that the upper-level protection can take over in a timely manner when the lower-level protection fails. The "independent safety interlock control logic" in the subsystem-level protection is independent of the main function control logic of the subsystem and has a higher level of safety integrity. It is used to trigger emergency cut-off, discharge, and isolation actions in the event of a fault.

[0041] The "monitoring-response-handling" closed loop in the system-level protection has a response strategy based on a preset multi-level safety strategy library and real-time diagnostic results. Handling actions include one or more of the following: adjusting the vehicle power strategy, triggering audible and visual alarms, transmitting early warning information to the ground center, and guiding emergency operations.

[0042] Example 2

[0043] In this embodiment, in order to overcome the lack of systematicness and initiative in the existing safety design of hydrogen-powered trains, a systematic safety architecture construction method is provided that can block risks at the source and suppress their amplification during the propagation process, so as to realize the closed-loop management of risks of hydrogen power systems throughout the entire process.

[0044] The proposed method for constructing a safety architecture for hydrogen-powered trains follows a dual-core safety logic of "blocking propagation paths and suppressing coupling amplification." Based on this logic, a three-tiered defense-in-depth system of "components-subsystems-systems" is constructed. Through the synergy of physical protection, control protection, and operational protection, layered management and control are achieved throughout the entire process from risk generation to evolution.

[0045] The construction method includes the following steps:

[0046] Step S1: Establish dual-core security logic.

[0047] The logic for blocking propagation paths involves establishing barriers at key points in the generation or propagation of risks such as hydrogen leakage, overheating, overvoltage, and insulation failure, preventing the risk from spreading to other components or subsystems. Specifically, these barriers constitute a multi-layered, multi-type physical and electrical protection structure system designed to create barriers at key nodes along the generation or propagation paths of different risk carriers, including hydrogen leakage, overheating, overvoltage, and insulation failure. Details are as follows:

[0048] (1) Physical barriers to address hydrogen leakage risk:

[0049] Primary sealing barrier: The hydrogen storage container (cylinder) body and its bottle mouth valve and bottle tail valve are made of hydrogen-compatible materials (such as carbon fiber wound gas cylinders conforming to GB / T 35544 or GB / T 42612) and special sealing structures.

[0050] Secondary sealing and containment barrier: The high-pressure hydrogen pipeline system uses high-quality seamless stainless steel pipes (compliant with GB / T14976—2012) and minimizes the number of flanges, joints, and other connection points. All connections are made by welding or special sealing methods.

[0051] Level 3 containment and flow guidance barrier: A dedicated compartment or protective enclosure for the hydrogen storage and supply system. This compartment is a closed or semi-closed metal structure built around the hydrogen storage cylinders, valves, and main pipelines.

[0052] Ventilation and Emission Barriers: Ventilation openings or inlets and outlets of a forced ventilation system are installed at the top or highest point of the dedicated compartment. A dedicated exhaust port for a hydrogen safety release device (TPRD) is installed on the roof of the locomotive, with the exhaust pipe leading from the safety valve of the hydrogen storage container directly to the roof exhaust port.

[0053] Configure connection and location relationships:

[0054] The hydrogen storage cylinder is fixed to the vehicle frame by an anti-loosening fastening device, and there is a shock-absorbing pad between the cylinder and the fixed bracket.

[0055] High-pressure pipelines are fixed to the vehicle body or a special bracket by non-metallic anti-wear pads and metal clamps, and rigid contact between the pipelines and the fixing components is avoided to prevent wear.

[0056] The dedicated hydrogen storage and supply system compartment is completely physically isolated from other compartments such as the locomotive driver's cab, passenger compartment, and electrical cabinets, and the compartment walls have a certain degree of fire resistance integrity. The air inlets and outlets of the ventilation system are designed to create directional airflow, ensuring that leaked hydrogen can be promptly carried out of the compartment and preventing its accumulation inside.

[0057] The safety vent is located on the outer surface of the locomotive top, and its opening direction is designed to ensure that the emitted hydrogen gas diffuses rapidly vertically or diagonally upwards, away from potential ignition sources such as side windows, air inlets, personnel activity areas, and the running gear and electrical equipment below.

[0058] (2) Physical barriers to address overheating risk:

[0059] Thermal insulation layer: A thermal insulation cover or wrapping layer made of high-temperature resistant thermal insulation materials (such as ceramic fiber or composite thermal insulation felt) is installed between the hydrogen storage container, high-pressure pipeline and adjacent heat sources such as exhaust pipe, engine compartment, and braking resistor.

[0060] Heat dissipation and isolation structure: The air outlet of the radiator (such as the coolant radiator) of the hydrogen fuel cell system is equipped with a guide air duct to direct the hot air to the grille on the side wall or top of the vehicle body for discharge, so as to prevent the hot air from directly blowing on the hydrogen storage system components or other equipment.

[0061] Physical partition: A fire-resistant partition wall or partition (compliant with Q / CRRC J 1071.3 requirements) shall be installed between the hybrid power system (including fuel cell and power battery) installation area and the driver's cab.

[0062] Configure connection and location relationships:

[0063] The heat shield is fixed near the heat source or hydrogen system components that need protection by a bracket, maintaining a certain gap between itself and the protected object and the heat source to form a stable air insulation layer.

[0064] The air duct of the radiator is sealed to the air outlet of the radiator. The air duct path is as short and straight as possible, and the end outlet position is higher than or far away from the air inlet of the hydrogen storage chamber.

[0065] As part of the vehicle's internal structure, the fireproof partition completely separates the engine compartment from the driver's cab, and all cables and pipes passing through it are sealed with fireproof sealing materials.

[0066] (3) Physical barriers to address overpressure risk:

[0067] Intrinsically safe relief barriers: Mechanical safety relief devices (TPRDs), including safety valves or rupture discs, are installed directly on the hydrogen storage container or on pipelines very close to the container.

[0068] Pressure buffer and isolation barrier: In the hydrogen supply pipeline, an overflow valve (overflow protection valve) is installed between the high-pressure side and the low-pressure side; and a shut-off valve is installed in pipeline sections with different pressure levels.

[0069] Configure connection and location relationships:

[0070] The safety relief device should be installed directly on the interface of the hydrogen storage container or on the adjacent first high-pressure pipeline, and no shut-off valve of any kind is allowed to be installed between it and the protected container.

[0071] Relief valves are typically installed downstream of the main shut-off valve and before the pressure regulator. Shut-off valves are installed at pipeline sections depending on the system design.

[0072] All pressure relief devices have their outlets connected to the aforementioned roof safety vents via dedicated pipes.

[0073] (4) Physical barriers to address the risk of insulation failure:

[0074] Barrier composition:

[0075] Basic insulation barrier: High-voltage cables, busbars, and electrical equipment (such as traction converters and DC / DC converters) themselves comply with the insulation design of GB / T 21414, GB / T 32350.1, etc., including sufficient electrical clearances, creepage distances, and insulating materials.

[0076] Enclosure protection barrier: High-voltage electrical equipment is placed in a sealed enclosure or cabinet with a protection rating of at least IP65 (external) or IP42 (internal).

[0077] Physical isolation barriers: High-voltage electrical components (boxes, cabinets) should maintain the safety distance specified in the design between themselves and hydrogen storage containers and hydrogen pipelines, or grounded metal isolation plates should be installed.

[0078] Equipotential bonding and grounding barrier: All high-voltage equipment metal casings, hydrogen storage system mounting brackets, vehicle body structures, etc., are reliably connected to the vehicle's unified grounding busbar via grounding conductors. The hydrogen refueling port is equipped with a dedicated grounding device and an equipotential bonding interface with the hydrogen refueling nozzle.

[0079] Connection and position settings: The high-voltage electrical cabinet is securely installed on the vehicle body with bolts and grounding wires, and the cross-sectional area of ​​the grounding wires meets the standards.

[0080] One end of the metal isolation plate is connected to the high-voltage cabinet or vehicle body, and the other end is grounded to the vehicle body.

[0081] The grounding terminal of the hydrogen refueling port is exposed, facilitating connection to the grounding wire of the hydrogen refueling station; its equipotential bonding structure is mechanically linked to the hydrogen refueling gun interface.

[0082] Suppressing Coupling Amplification Logic: For scenarios where multiple risks or faults may couple with each other, leading to a sharp amplification of consequences, intervention mechanisms such as isolation and decoupling are designed to suppress the occurrence of chain reactions.

[0083] Intervention mechanisms include:

[0084] Electrical decoupling mechanism: When the fuel cell voltage is abnormal and the hydrogen supply pressure drops at the same time, the control unit immediately cuts off the hydrogen input of the stack and switches to backup energy storage power supply to avoid the fault affecting the power output;

[0085] Thermal runaway isolation mechanism: A fireproof partition and a temperature-sensitive damper are installed between the battery compartment and the hydrogen compartment. When an abnormal temperature is detected, the damper is automatically closed and an independent cooling circuit is activated.

[0086] Control handover mechanism: When a local controller fails, the next higher level controller takes over its control functions and redistributes energy and load at the system level to prevent local failures from evolving into system paralysis.

[0087] Step S2: Construct a three-tiered defense-in-depth architecture.

[0088] Level 1: Component-level protection. At the component level, such as hydrogen cylinders, valves, pipelines, fuel cell stacks, and DC / DC converters, intrinsic safety design, redundancy design, safety margin design, and physical isolation measures are used to block or minimize the generation of risk carriers at the source of risk.

[0089] Level 1: Component-level protection.

[0090] The specific design content is as follows. Its core lies in eliminating or suppressing the generation of risk carriers to the greatest extent possible from the physical source by combining various design methods at the level of core components such as hydrogen cylinders (hydrogen storage containers), valves, pipelines, fuel cell stacks, and DC / DC converters:

[0091] (1) Intrinsically safe design:

[0092] Hydrogen storage containers (hydrogen cylinders):

[0093] Materials and Processes: The cylinders are manufactured using materials with good compatibility with hydrogen, with priority given to those conforming to GB / T 35544 or GB / T42612 standards for automotive compressed hydrogen carbon fiber fully wound cylinders. The inner liner and other metal parts in contact with hydrogen must be made of materials recommended in Appendix D of GB / T29729—2022 that have low hydrogen embrittlement sensitivity (such as specific grades of stainless steel and aluminum alloys), and verified through compatibility and hydrogen embrittlement tests according to GB / T 34542.2 and GB / T 34542.3.

[0094] Structural integrity: The design working pressure should not be lower than the nominal working pressure (e.g., 70 MPa) and should have a sufficient safety factor. The design life of the gas cylinder needs to comprehensively consider the effects of fatigue loads (e.g., charge-discharge cycles, pressure fluctuations) and the long-term effects of the hydrogen environment.

[0095] Valves and Piping:

[0096] Material selection: The valve body, valve core, and high-pressure pipeline (seamless steel pipe, conforming to GB / T 14976—2012) are all made of hydrogen-compatible and hydrogen-embrittlement-resistant metallic materials. Seals are made of non-metallic materials with excellent hydrogen permeability resistance (such as specific fluororubbers and polytetrafluoroethylene composites).

[0097] Connection reliability: Welding is preferred for pipe connections to reduce potential leakage points such as flanges and threaded joints. When joints must be used, use proven, dedicated hydrogen joints with multiple sealing structures and affix anti-loosening markings.

[0098] Fuel cell stack:

[0099] Materials and Interfaces: Metal components such as bipolar plates and end plates within the fuel cell stack are made of corrosion-resistant and hydrogen-embrittlement-resistant materials. The membrane electrode assembly (MEA) and its sealing design must ensure long-term sealing stability and structural integrity within varying operating pressure, temperature, and humidity ranges to prevent hydrogen and oxygen cross-contamination.

[0100] Safety foundation: The stack design complies with the safety requirements of GB / T 20042.2—2023, ensuring voltage uniformity between individual cells and uniform internal fluid distribution, thereby reducing the risk of local overheating or uneven reaction from the source.

[0101] High-voltage electrical components such as DC / DC converters:

[0102] Insulation and clearance: In strict accordance with GB / T 32350.1 (based on IEC 62497-1), sufficient electrical clearances and creepage distances shall be designed to withstand the highest operating voltage of the system and possible overvoltages.

[0103] Enclosure protection: The enclosure is designed with a protection rating of not less than IP65 (external vehicle mounting) or IP42 (internal machine room) to effectively prevent dust and water spray from entering and causing insulation degradation or short circuit.

[0104] (2) Redundancy design:

[0105] Hydrogen supply shutdown redundancy: At least two stages of shutdown valves are integrated into the hydrogen storage container inlet: the first stage is an electrically powered main shutdown valve (automatically closes in the event of power failure), and the second stage is a manually operated shutdown valve (normally open, used for emergency operation or isolation in case of main valve failure). The two functions are independent, constituting shutdown redundancy.

[0106] Sensor redundancy: For key parameter monitoring points, such as hydrogen storage tank pressure and key chamber hydrogen concentration, a dual-sensor configuration (such as two pressure sensors and two hydrogen detectors) is adopted, which are arranged in the same or adjacent positions. Fault diagnosis and alarm triggering are performed through "OR" logic or comparison logic to avoid single-point monitoring failure.

[0107] Control signal redundancy: For safety-related control commands (such as emergency cut-off signals), a redundant transmission method is adopted, using both hard-wired loops and network communication commands in parallel. Even in the event of network communication failure, the hard-wired loops can still perform safety actions.

[0108] (3) Safety margin design:

[0109] Pressure margin: The design pressure of the hydrogen storage system and high-pressure pipelines, as well as the rated working pressure of all pressure-bearing components (such as cylinders, valves, and fittings), are all higher than the maximum allowable working pressure (MAWP) of the system, with a clearly defined safety margin (e.g., more than 1.25 times). The set burst or opening pressure of the safety relief device (TPRD) is between the working pressure and the design pressure, ensuring that it activates before the component structure fails in the event of overpressure.

[0110] Temperature margin: The permissible operating temperature range of component materials (especially metallic materials) is much wider than the sum of the extreme ambient temperatures and operating temperature rise that the system may encounter. For example, based on an ambient temperature of -40°C to +45°C, after considering the combined effects of solar radiation, nearby heat sources, and self-heating, the selected materials can still maintain stable performance.

[0111] Electrical stress margin: The voltage rating, current capacity, breaking capacity and other key parameters of electrical components such as DC / DC converters, contactors, and cables are maintained with sufficient derating margin to withstand instantaneous overshoot, short-term overload and long-term aging effects, while meeting the rated operating conditions.

[0112] (4) Physical isolation measures:

[0113] Hazardous source isolation: Hydrogen storage containers and high-pressure valve assemblies are centrally located in a dedicated, fully physically separated, sealed or semi-sealed compartment from other equipment compartments (such as electrical cabinets, power battery compartments, and driver's cab). This compartment has a robust structure and smooth inner walls to prevent protrusions from causing accidental impacts to the hydrogen cylinders.

[0114] Heat source and gas pipeline isolation: The laying path of hydrogen pipelines (especially high-pressure sections) must be strictly kept away from high-temperature components such as exhaust pipes, braking resistors, and traction converter radiators, and maintain the prescribed safe distance. When avoidance is not possible, a fixed heat shield made of non-combustible heat-insulating material must be installed on the outside of the hydrogen pipeline or high-temperature components to form a stable physical thermal barrier.

[0115] High-voltage electrical equipment must be isolated from hydrogen-related areas: The installation locations of electrical equipment such as DC / DC converters and high-voltage distribution boxes must maintain a safe distance from hydrogen storage and supply chambers, hydrogen refueling ports, and hydrogen emission ports. If layout constraints exist, a grounded metal partition should be installed between the two to physically separate them, preventing arcs and sparks from electrical faults from affecting hydrogen-related areas.

[0116] Component shock resistance and isolation: The hydrogen storage container is mounted on the vehicle frame using a dedicated fastening mechanism with anti-loosening devices (such as anti-loosening nuts and locking washers), and elastic shock-absorbing pads are installed between the container and the mounting bracket. The main pipelines are secured using a combination of clamps and anti-wear pads to prevent rigid contact and friction with the vehicle structure. This design aims to isolate the container from vibrations and shocks during operation, preventing mechanical damage that could lead to leaks.

[0117] Level Two: Subsystem-level Protection. At the subsystem level, including hydrogen storage and supply subsystems, fuel cell power generation systems, and hybrid power management systems, control and protection measures are implemented to cut off the risk propagation chain at critical nodes. Specifically, this includes:

[0118] Deploy a sensor network to monitor key parameters in real time (such as hydrogen concentration, pressure, temperature, and voltage);

[0119] The system is designed with independent safety interlock control logic. When an abnormality is detected, it automatically triggers the emergency shut-off valve, pressure relief valve, circuit breaker and other actions to physically isolate the faulty unit.

[0120] The safety interlock control logic in this embodiment is based on an independent control unit (safety controller, operating independently of the main FCU), which monitors multiple key safety parameters in the fuel cell system in real time, including but not limited to:

[0121] Hydrogen concentration: Monitored by hydrogen concentration sensors located in the fuel cell stack cavity, hydrogen connection points, tailpipe, etc.

[0122] Insulation resistance value: The insulation status of the system to ground is monitored in real time by an insulation tester;

[0123] Key temperatures include: fuel cell coolant outlet temperature, hydrogen heat exchanger temperature, and air compressor outlet temperature.

[0124] Key pressures include hydrogen pressure, air pressure, and coolant pressure.

[0125] Smoke signal: The system monitors for smoke within its interior using smoke sensors.

[0126] Individual cell voltage: The voltage monitoring system is used to check for abnormal voltage or water flooding.

[0127] System communication status: Monitor whether the communication of key devices such as FCU and sensors is interrupted or abnormal.

[0128] 2. Control logic hierarchy and triggering conditions

[0129] The safety interlock control logic adopts a multi-level response mechanism, which is divided into four levels according to the severity of the fault: early warning, power limiting, disconnection, and isolation.

[0130] Warning level: Non-critical safety parameters are abnormal (such as communication loss of individual sensors, or slightly higher non-critical temperature), only the fault is reported, and the system continues to operate;

[0131] Power limiting level: If a decrease in fuel cell performance or a high coolant temperature is detected, the system will automatically reduce the output power and activate auxiliary cooling.

[0132] Cut-off level: The safety controller immediately issues a cut-off command when any of the following conditions are detected:

[0133] Any hydrogen concentration sensor reading exceeds the lower explosive limit by 10%;

[0134] The insulation resistance value is lower than the set safety threshold (e.g., 500Ω / V).

[0135] The coolant outlet temperature of the fuel cell stack exceeds the safety limit.

[0136] The hydrogen gas pressure rises or falls abnormally beyond the set range;

[0137] Smoke sensor alarm;

[0138] Communication with critical controllers within the system (such as FCU and air compressor controller) is lost for more than a set time.

[0139] Isolation level: If the fault persists or spreads after the cut-off level is triggered, the system will further perform physical isolation operations.

[0140] 3. Implementing mechanisms and coordinated actions

[0141] The safety controller controls the following actuators via hardwired connection or safety bus:

[0142] Emergency shut-off valve: Located on the hydrogen inlet pipeline, it can be completely closed within 100ms after receiving a signal, cutting off the hydrogen supply;

[0143] Pressure relief valve: Located in the high-pressure section of the hydrogen circuit and at the outlet of the hydrogen storage container, it automatically opens when the pressure is too high to release the pressure to the safety tank or the atmosphere;

[0144] Main circuit breaker / contaminant: Located at the positive and negative output terminals of the fuel cell stack, it immediately disconnects upon receiving a disconnection command, cutting off the electrical output;

[0145] Auxiliary system power-off relay: A power supply relay that controls auxiliary equipment such as air compressors, water pumps, and PTCs to achieve power-off of non-core systems;

[0146] Ventilation and purging system: Upon triggering, it activates forced ventilation and hydrogen purging within the chamber to reduce the concentration of combustible gases.

[0147] Enables secure communication and coordinated shutdown between controllers within the subsystem.

[0148] Level 3: System-level protection. At the level of the whole vehicle hydrogen power system, FMECA (Failure Mode, Effects and Criteria Analysis) is conducted to integrate the failure modes that affect safety. For the integrated failure modes, monitoring methods are determined, response methods and handling measures are given, forming a proactive protection closed loop of "monitoring-response-handling".

[0149] The following are the failure modes that affect the safety of hydrogen power systems after FMECA (Failure Mode, Effects, and Hazard Analysis), along with their corresponding safety impacts, monitoring methods, response methods, and mitigation measures:

[0150] Insulation tester failure: If the insulation tester fails, it will be unable to detect when the insulation performance deteriorates, posing a risk of electric shock and high-voltage spark fire; the fault is detected by maintenance personnel and the built-in testing system; after the system detects the fault, the PCU controller reports the fault and shuts down the PCU, not responding to the control requirements of the fuel cell system or the whole vehicle; replacement is required in the future.

[0151] Hydrogen concentration sensor failure: If the hydrogen concentration sensor fails, it will not be able to alarm when there is a hydrogen leak or abnormal hydrogen concentration, posing a risk of hydrogen accumulation and explosion; the fault is detected by maintenance personnel and the built-in testing system; the system reports a sensor failure, the vehicle can still run but loses the alarm function; replacement is required in the future.

[0152] Smoke sensor failure: If the smoke sensor fails, it will not be able to alarm in case of fire or smoke, which may lead to the spread of the fire; the fault is detected by maintenance personnel and the built-in testing system; the system reports the fault, the vehicle can still run but loses the smoke alarm function; replacement is required later.

[0153] Cracks or deformation of the electrical box casing: If the electrical box casing is cracked or deformed, the entry of humid air may cause condensation, reduce electrical insulation, and pose a risk of electric shock and high-voltage spark fire; the fault is detected by maintenance personnel through inspection and the built-in testing system; the system reports an insulation fault, cuts off the hydrogen supply and switches to pure electric operation; replacement is then carried out.

[0154] Cracked or deformed top cover of electrical box: If the top cover of the electrical box is cracked or deformed, humid air may enter, which may cause condensation, reduce electrical insulation, and pose a risk of electric shock and high-voltage spark fire; the fault is detected by maintenance personnel and the built-in testing system; the system reports an insulation fault, cuts off the hydrogen supply and switches to pure electric operation; replacement is then carried out.

[0155] Copper busbar overheating and melting: If the copper busbar overheats and melts due to overcurrent or poor contact, it may cause nearby accessories to catch fire and cause a fire; the fault is detected by maintenance personnel and the built-in testing system; the system cuts off the hydrogen supply and switches to pure electric operation; the copper busbar is then replaced and tested.

[0156] Insulation board cracking or deformation: If the insulation board is cracked or deformed, the insulation performance will be reduced, posing a risk of electric shock and high-voltage spark fire; the fault is detected by maintenance personnel and the built-in testing system; the system cuts off the hydrogen supply and switches to pure electric operation; replacement is required afterward.

[0157] Poorly fitted, damaged, or dislodged high-voltage wiring harness connectors: If the high-voltage wiring harness connectors are poorly fitted or damaged, they may short-circuit and cause a fire; the fault is checked by maintenance personnel and tested by the built-in testing system; the system disconnects the fuel cell system and switches to pure electric operation; the cables are then checked and tightened, and replaced if necessary.

[0158] Poor grounding harness connector engagement: If the grounding harness connector is not properly engaged, static electricity cannot be discharged and may become a source of fire; the fault is detected and inspected by maintenance personnel; the system does not affect normal operation but there is a risk of static electricity fire; replacement is required in the future.

[0159] Poor connection of the high-voltage fan power supply harness connector: If the high-voltage fan power supply harness connector is not properly connected, it may cause a short circuit and fire; the fault is checked by maintenance personnel and detected by the built-in testing system; the system disconnects the fuel cell system and switches to pure electric operation; the cables are then checked and tightened, and replaced if necessary.

[0160] Chemical air filter failure: If the chemical air filter fails, foreign objects may enter and clog the single-cell fuel cell stack, causing localized overheating and burn-out. The fault is detected by maintenance personnel through inspection and the built-in testing system. The system cuts off the hydrogen supply and switches to pure electric operation. Replacement is then required.

[0161] Hydrogen heat exchanger leak: If the hydrogen heat exchanger leaks, there is an extreme risk of explosion due to the hydrogen leak; the fault is detected by maintenance personnel and the built-in testing system; the system cuts off the hydrogen supply and switches to pure electric operation; replacement is then required.

[0162] Hydrogen hose leak: If the hydrogen hose leaks, there is a risk of explosion in extreme cases; the fault is detected by maintenance personnel and the built-in testing system; the system cuts off the hydrogen supply and switches to pure electric operation; replacement is required afterward.

[0163] Hydrogen pipe leakage or deformation: If the hydrogen pipe leaks or deforms, there is an extreme risk of explosion due to hydrogen leakage; the fault is detected by maintenance personnel and the built-in testing system; the system cuts off the hydrogen supply and switches to pure electric operation; replacement is required afterward.

[0164] Insulation joint leakage: If the insulation joint leaks, there is an extreme risk of explosion due to hydrogen leakage; the fault is detected by maintenance personnel and the built-in testing system; the system cuts off the hydrogen supply and switches to pure electric operation; replacement is required afterward.

[0165] Hydrogen line connector leakage: If the hydrogen line connector leaks, there is an extreme risk of explosion due to hydrogen leakage; the fault is detected by maintenance personnel and the built-in testing system; the system cuts off the hydrogen supply and switches to pure electric operation; replacement is required afterward.

[0166] Leakage of the half-through straight-through ferrule connector: If the half-through straight-through ferrule connector leaks, there is an extreme risk of explosion due to hydrogen leakage; the fault is detected by maintenance personnel and the built-in testing system; the system cuts off the hydrogen supply and switches to pure electric operation; replacement is then required.

[0167] Water tank welding assembly leakage or deformation: If the water tank welding assembly leaks or deforms, there is a risk of hydrogen leakage, which may explode if exposed to a source of ignition; the fault is detected by maintenance personnel and the built-in testing system; the system does not affect normal operation but there is a risk of leakage; replacement is required in the future.

[0168] Loose or broken clamps (hydrogen system): If the clamps are loose or broken, there is a risk of explosion in extreme cases due to hydrogen leakage; the fault is detected by maintenance personnel and the built-in testing system; the system cuts off the hydrogen supply and switches to pure electric operation; replacement is required afterward.

[0169] Plug leakage: If the plug leaks, excessive coolant leakage may cause the fuel cell stack to overheat and be damaged. Hydrogen leakage poses an explosion risk. The fault is detected by maintenance personnel and the built-in testing system. The system cuts off the hydrogen supply and switches to pure electric operation. Replacement is required afterward.

[0170] Cooling pipe joint leakage: If the cooling pipe joint leaks, excessive coolant leakage may cause the fuel cell stack to overheat and be damaged. Hydrogen leakage poses an explosion risk. The fault is detected by maintenance personnel and the built-in testing system. The system cuts off the hydrogen supply and switches to pure electric operation. Replacement is then carried out.

[0171] Overheating of fuel cell stack cooling water outlet temperature: If the cooling water outlet temperature of the stack is too high, in extreme cases it may cause the stack to overheat and perforate, resulting in hydrogen leakage and potentially an explosion; the fault is detected by maintenance personnel through inspection and the built-in testing system; the system is disconnected from the fuel cell system and switched to pure electric operation; subsequent troubleshooting and analysis of the cooling fan and water pump.

[0172] Fuel cell stack hydrogen pressure exceeding limit: If the hydrogen pressure in the fuel cell stack exceeds the limit, the overpressure of hydrogen may lead to leakage and poses an explosion risk; the fault is detected by maintenance personnel through inspection and the built-in testing system; the system disconnects the fuel cell system and switches to pure electric operation; subsequent troubleshooting and analysis of the combination valve.

[0173] Open flame outside the fuel cell stack: If there is an open flame outside the stack, it may cause a fire or explosion if hydrogen leaks. The fault is detected by maintenance personnel through inspection and the built-in testing system. The system disconnects the fuel cell system and switches to pure electric operation. Extinguish the open flame or call the fire department if personnel safety is ensured.

[0174] Excessive hydrogen-air cross-pressure in fuel cell stack: If the hydrogen-air cross-pressure in the stack exceeds the limit, it may lead to hydrogen-air leakage, which may pose an explosion risk in extreme cases; the fault is detected by maintenance personnel through inspection and the built-in testing system; the system disconnects the fuel cell system and switches to pure electric operation; subsequent troubleshooting and analysis of the combination valve.

[0175] Fuel cell stack fluid leakage: If the stack fluid leaks, there is an extreme risk of explosion due to hydrogen leakage; the fault is detected by maintenance personnel through inspection and the built-in testing system; the system disconnects the fuel cell system and switches to pure electric operation; subsequent investigation and analysis of the three-chamber circuit.

[0176] Pipe joint leakage: If the pipe joint leaks, there is an extreme risk of explosion due to hydrogen leakage; the fault is detected by maintenance personnel and the built-in testing system; the system cuts off the hydrogen supply and switches to pure electric operation; replacement is required afterward.

[0177] Hose Leak: If the hose leaks, there is an extreme risk of explosion due to hydrogen leakage; the fault is detected by maintenance personnel and the built-in testing system; the system cuts off the hydrogen supply and switches to pure electric operation; replacement is required afterward.

[0178] Hydrogen concentration sensor failure: If the hydrogen concentration sensor fails, the degree of hydrogen leakage cannot be detected. If a leak exists, it may cause an explosion. The fault is checked by maintenance personnel and tested by the built-in testing system. The system is disconnected from the fuel cell system and switched to pure electric operation. The connection harness is then checked, and the hydrogen concentration sensor is replaced and tested if necessary.

[0179] Flanged hand valve joint leakage: If the flanged hand valve joint leaks, there is an extreme risk of explosion due to hydrogen leakage; the fault is detected by maintenance personnel and the built-in testing system; the system cuts off the hydrogen supply and switches to pure electric operation; replacement is then required.

[0180] Loose or detached clamps (fuel cell stack system): If the clamps become loose or detached, coolant or hydrogen may leak, which in extreme cases may cause damage to the fuel cell stack or an explosion; the fault is detected by maintenance personnel and the built-in testing system; the system cuts off the hydrogen supply and switches to pure electric operation; the bolts are then tightened or replaced.

[0181] Damaged shock absorber structure: If the shock absorber structure is damaged, the system may become loose or fall off, affecting the safety of the entire vehicle; the fault is inspected and tested by maintenance personnel; the system disconnects the fuel cell system and switches to pure electric operation; replacement is then carried out.

[0182] Main radiator failure or coolant leakage: In extreme cases, failure of the main radiator or coolant leakage may lead to overheating and perforation of the fuel cell stack; the fault is detected by maintenance personnel and the built-in testing system; the system is disconnected from the fuel cell system and switched to pure electric operation; replacement is then carried out.

[0183] Main and auxiliary radiator failure or coolant leakage: If the main and auxiliary radiators fail or the coolant leaks, in extreme cases it may lead to overheating and perforation of the fuel cell stack; the fault is checked by maintenance personnel and detected by the built-in testing system; the system is disconnected from the fuel cell system and switched to pure electric operation; replacement is then carried out.

[0184] Leaks in the assembly tailpipe and cooling silicone tubing: If there is a leak in the assembly tailpipe and cooling silicone tubing, in extreme cases it may cause the fuel cell stack to overheat and perforate; the fault is detected by maintenance personnel and the built-in testing system; the system disconnects the fuel cell system and switches to pure electric operation; replacement is then carried out.

[0185] Hydrogen concentration sensor (exhaust) failure: If the hydrogen concentration sensor (exhaust) fails, hydrogen leakage at the exhaust cannot be detected, which may cause an explosion. The fault is checked by maintenance personnel and tested by the built-in testing system. The system is disconnected from the fuel cell system and switched to pure electric operation. The connection harness is then checked, and the hydrogen concentration sensor is replaced and tested if necessary.

[0186] Steel pipe leakage (roof accessory): If the steel pipe leaks, in extreme cases it may cause the fuel cell stack to overheat and perforate; the fault is detected by maintenance personnel and the built-in testing system; the system disconnects the fuel cell system and switches to pure electric operation; replacement is then carried out.

[0187] Silicone tubing leak (roof accessory): If the silicone tubing leaks, in extreme cases it may cause the fuel cell stack to overheat and perforate; the fault is detected by maintenance personnel and the built-in testing system; the system disconnects the fuel cell system and switches to pure electric operation; replacement is then required.

[0188] Step S3: Achieve three-tiered protection coordination.

[0189] Physical protection layer: mainly corresponds to component-level protection, providing a basic, passive security barrier.

[0190] Control and protection layer: mainly corresponds to subsystem-level protection, providing proactive, logical control for rapid intervention.

[0191] Utilizing protection layers: This mainly corresponds to system-level protection, providing global and intelligent decision-making and handling.

[0192] Information sharing and command coordination among the three levels ensure that if the protection of the next level fails, the protection of the next level can take over in a timely manner, forming a defense in depth.

[0193] While the specific embodiments of the present invention have been described above in conjunction with the accompanying drawings, this is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that, based on the technical solutions disclosed in the present invention, various modifications or variations that can be made by those skilled in the art without creative effort should be included within the scope of protection of the present invention.

Claims

1. A method for constructing a safety architecture for a hydrogen-powered train's hydrogen propulsion system, characterized in that, include: Based on the dual-core safety logic of "blocking the propagation path and suppressing coupling amplification," a three-tiered defense-in-depth architecture is constructed, encompassing component-level, subsystem-level, and system-level defenses. This architecture achieves full-process risk management through the synergy of physical protection, control protection, and operational protection. Component-level protection focuses on independent components within the hydrogen power system, using inherently safe design, physical isolation, and safety margin design to block or reduce the generation of risk carriers at the source of risk. Subsystem-level protection focuses on hydrogen storage and supply, fuel cell power generation, and power management subsystems. By deploying sensor networks and independent safety interlock control logic, it automatically triggers protective actions upon detecting anomalies, cutting off the risk propagation chain within the subsystem at critical nodes. System-level protection focuses on the entire vehicle's hydrogen power system, constructing a "monitoring-response-handling" closed loop. This involves integrating information for system-level safety status assessment and intelligent decision-making, executing tiered response commands to suppress systemic coupling risks, and completing the final handling.

2. The method for constructing a safety architecture for a hydrogen-powered train's hydrogen propulsion system according to claim 1, characterized in that, The "blocking the propagation path" logic specifically includes: setting barriers or interruption mechanisms on the physical path or logical link of the generation and diffusion of hydrogen leakage, electric arc or overheating risk carriers; the "suppressing coupling amplification" logic specifically includes: preventing the nonlinear growth of the severity of consequences caused by the correlation between two or more independent risks or faults through the design of isolation mechanisms, decoupling control strategies or rapid intervention procedures.

3. The method for constructing a safety architecture for a hydrogen-powered train hydrogen propulsion system according to claim 1, characterized in that, The physical protection layer mainly corresponds to the component-level protection, providing a basic passive security barrier; the control protection layer mainly corresponds to the subsystem-level protection, providing proactive and rapid intervention based on logical criteria; the application protection layer mainly corresponds to the system-level protection, providing intelligent decision-making and handling based on global state assessment.

4. The method for constructing a safety architecture for a hydrogen-powered train hydrogen propulsion system according to claim 3, characterized in that, The three levels of physical protection, control protection, and operational protection are interconnected through a vehicle communication network to achieve two-way interaction and coordination of status and command information, ensuring that the upper level of protection can take over in a timely manner when the lower level of protection fails.

5. The method for constructing a safety architecture for a hydrogen-powered train hydrogen propulsion system according to claim 1, characterized in that, The "independent safety interlock control logic" in the subsystem-level protection is independent of the main function control logic of the subsystem and has a higher level of safety integrity. It is used to trigger emergency cut-off, discharge, and isolation actions in the event of a fault.

6. The method for constructing a safety architecture for a hydrogen-powered train hydrogen propulsion system according to claim 1, characterized in that, The "monitoring-response-handling" closed loop in the system-level protection has a response strategy based on a preset multi-level safety strategy library and real-time diagnostic results. Handling actions include one or more of the following: adjusting the vehicle power strategy, triggering audible and visual alarms, transmitting early warning information to the ground center, or guiding emergency operations.

7. The method for constructing a safety architecture for a hydrogen-powered train hydrogen propulsion system according to claim 1, characterized in that, Intervention mechanisms include: electrical decoupling mechanism: when the fuel cell voltage is abnormal and the hydrogen supply pressure drops simultaneously, the control unit immediately cuts off the hydrogen input to the stack and switches to backup energy storage power supply to prevent the fault from affecting the power output; thermal runaway isolation mechanism: a fireproof partition and a temperature-sensitive damper are installed between the battery compartment and the hydrogen compartment. When an abnormal temperature is detected, the damper is automatically closed and an independent cooling circuit is activated; control transfer mechanism: when a local controller fails, the upper-level controller takes over its control functions and redistributes energy and load at the system level to prevent local faults from evolving into system paralysis.

8. The method for constructing a safety architecture for a hydrogen-powered train hydrogen propulsion system according to claim 1, characterized in that, Real-time monitoring of multiple key safety parameters in the fuel cell system, including but not limited to: hydrogen concentration, insulation resistance value, stack coolant outlet temperature, hydrogen heat exchanger temperature, air compressor outlet temperature, hydrogen path pressure, air path pressure, coolant pressure, smoke signal: monitoring whether smoke appears inside the system through smoke sensors, stack individual voltage: monitoring whether voltage abnormalities or flooding occur through a single-chip voltage inspection system, and system communication status.

9. The method for constructing a safety architecture for a hydrogen-powered train hydrogen propulsion system according to claim 1, characterized in that, Control logic hierarchy and triggering conditions, including: The safety interlock control logic adopts a multi-level response mechanism, which is divided into four levels according to the severity of the fault: early warning, power limiting, disconnection, and isolation. Warning level: Non-critical safety parameters are abnormal; only the fault is reported, and the system continues to operate. Power limiting level: If a decrease in fuel cell performance or a high coolant temperature is detected, the system will automatically reduce the output power and activate auxiliary cooling. Cut-off level: When any of the following conditions are detected, the safety controller immediately issues a cut-off command: the reading of any hydrogen concentration sensor exceeds 10% of the lower explosion limit, the insulation resistance value is lower than the set safety threshold, the outlet temperature of the fuel cell coolant exceeds the safety limit, the hydrogen pressure rises or falls abnormally beyond the set range, the smoke sensor alarms, or the communication of critical controllers in the system is lost for more than the set time. Isolation level: If the fault persists or spreads after the cut-off level is triggered, the system will further perform physical isolation operations.

10. The method for constructing a safety architecture for a hydrogen-powered train hydrogen propulsion system according to claim 1, characterized in that, Actuators and their linkage actions include: The safety controller controls the following actuators via hard-wired connection or safety bus: Emergency shut-off valve: Located on the hydrogen inlet pipeline, it can be completely closed within 100ms after receiving a signal, cutting off the hydrogen supply; Pressure relief valve: Located in the high-pressure section of the hydrogen circuit and at the outlet of the hydrogen storage container, it automatically opens when the pressure is too high to release the pressure to the safety tank or the atmosphere; Main circuit breaker / contaminant: Located at the positive and negative output terminals of the fuel cell stack, it immediately disconnects upon receiving a disconnection command, cutting off the electrical output; Auxiliary system power-off relay: A power supply relay that controls auxiliary equipment such as air compressors, water pumps, and PTCs to achieve power-off of non-core systems; Ventilation and purging system: Upon triggering, it activates forced ventilation and hydrogen purging within the chamber to reduce the concentration of combustible gases.

Images