Control method and system for multiple controllers of fuel cell system

Abstract

The invention discloses a control method of multiple controllers of a fuel cell system, comprising a plurality of FCU controllers which are in communication connection and used for interactive control. And determining a master-slave relationship among the FCU controllers through interactive control among the plurality of FCU controllers, and allocating a corresponding control function to each FCU controller based on the master-slave relationship and executing the control function. The method has the advantages that the requirement of the high-power battery system is met by adding the FCU controllers and configuring the master and slave controllers, and the FCU controllers are provided with the same software architecture and function, so that the compatibility of the controllers is improved, the controllers can be replaced and used conveniently, the development cost is saved, and the controllers can be reused.

Description

Technical Field

[0001] The invention relates to the field of fuel cell control, and in particular to a control method for multiple controllers of a fuel cell system. Background Art

[0002] A fuel cell is a device that converts chemical energy in a fuel directly into electrical energy. The most common fuel cell is a hydrogen fuel cell, which uses hydrogen as fuel and oxygen in the air as an oxidant to output power. Fuel cells generally use a stack to supply power to the outside, and the stack consists of multiple fuel cell units.

[0003] In the prior art, high-power fuel cell systems are mostly composed of two or more stack modules due to the increase in stack power and the number of stack sections. As the number of stack modules increases, the complexity of the corresponding control system increases, and the number of parts and sensors increases. As a result, there may be a situation where the resources of a single FCU are insufficient. In particular, for vehicles with high power requirements, the insufficient resources of the FCU controller cannot meet the development of vehicles with high power requirements.

[0004] In view of the situation that a single FCU has insufficient resources in the prior art, an FCU with more abundant resources is generally selected to meet the purpose of satisfying the control resources. Selecting an FCU with more abundant resources usually involves higher development costs and changes in the tool chain. In addition, selecting an FCU with more abundant resources will undoubtedly hinder the development of the project for companies that are already familiar with a certain controller. The previously developed FCU controller software cannot be used and needs to be redeveloped, resulting in repeated development. Summary of the invention

[0005] The purpose of the present invention is to overcome the deficiencies of the prior art and provide a method for controlling multiple controllers of a fuel cell system, which adopts a multiple FCU controller solution to meet the demand for controlling a high-power fuel cell system.

[0006] In order to achieve the above-mentioned purpose, the technical solution adopted by the present invention is: a multi-controller control method for a fuel cell system, including multiple FCU controllers, which are communicatively connected to each other for interactive control, and the master-slave relationship between each FCU controller is determined through the interactive control between the multiple FCU controllers, and corresponding control functions are assigned to each FCU controller based on the master-slave relationship and executed.

[0007] Multiple FCU controllers jointly monitor and control the system in the fuel cell system; each FCU controller is pre-developed with all the software function modules required to implement system control. After startup, the FCU controller obtains the master-slave relationship through the interactive information between the FCU controllers and activates the corresponding software function modules in each FCU controller based on the master-slave relationship.

[0008] Among multiple FCU controllers, the control functions belonging to the controlled counterparts or actuators in the system are set in the master FCU controller according to the master-slave relationship, and the functions belonging to the observation and monitoring system are set in the slave FCU controller.

[0009] When developing software for multiple FCU controllers, the same or similar port functions are assigned and defined on the same pin number in the FCU controllers.

[0010] Among multiple FCU controllers, one or more pull-up pins are selected on the FCU controller to be connected to the KL15 signal; when KL15 is powered on, the FCU controller determines whether it is the master FCU controller or the slave FCU controller based on the level signal read by the pull-up pin. Multiple FCU controllers determine whether the master-slave relationship of the FCU controller is faulty by exchanging their own judgment results.

[0011] After the vehicle is powered on, each FCU controller reads the high and low level signals of the pull-up pin and analyzes the data received by the CAN channel pin, and determines whether it is the main FCU controller based on the high and low level signals or the data received by the CAN channel pin.

[0012] During a power-on cycle, multiple FCU controllers perform handshake communication, and obtain each other's master-slave identification code based on the handshake communication, and determine whether there is a master-slave distinction failure based on the master-slave identification code. If so, a master-slave identification failure is reported and the power request of the corresponding vehicle is prohibited; if not, each FCU controller starts working.

[0013] A master-slave judgment module, a master status transfer module, a hard-wire acquisition module, a CAN receiving and transmitting module, an air path management module, a hydrogen path management module, an energy management module, a power management module, a water and heat management module and a fault diagnosis module are pre-developed and implemented in each FCU controller. After power-on, only the master-slave judgment module, the master status transfer module and the hard-wire acquisition module are in operation; the master-slave judgment module is enabled separately after the judgment is completed; if the FCU controller is in the master state, all the functional modules therein are lighted up; when the FCU controller is in the slave state, the fault diagnosis module and the assigned functional modules are lighted up.

[0014] Multiple FCU controllers use CAN communication to diagnose whether each other is working properly. If the master FCU controller is abnormal, the fuel cell system will be shut down immediately. If the slave FCU controller is abnormal, the load will be reduced to idle operation and the status of the slave FCU controller will be continuously monitored. If the slave FCU controller continues to be abnormal for a set time threshold, the battery system will be shut down.

[0015] A multi-controller control system for a fuel cell system, the control system comprising a plurality of FCU controllers, the plurality of FCU controllers being used to monitor a fuel cell stack of the fuel cell system; the plurality of FCU controllers being used to run the control method.

[0016] The advantages of the present invention are as follows: by adding FCU controllers and configuring master-slave mode, the requirements of high-power battery systems are met, and multiple FCU controllers are set with the same software architecture and functions, which improves the compatibility of the controllers, can be easily replaced, saves development costs, and can be reused.

[0017] This solution is compatible with fuel cell systems using a single controller and multiple controllers. This new software architecture can identify the master and slave controllers, and light up different functional modules in the software according to the master and slave functions, thereby realizing the control function of the entire system. At the same time, this architecture can also be expanded to more than two FCU controllers to be suitable for fuel cell system modules with higher power or their combinations, and it can also be compatible with situations where only a single controller is controlled.

[0018] The advantage of this solution is that fuel cell system manufacturers can expand the number and functions of familiar FCU controllers to meet the control requirements of fuel cell systems with higher power and more number, without having to use FCU controllers with more resources. At the same time, regardless of the number of FCU controllers, the same version of software is used, which facilitates the management and upgrade maintenance of software versions. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The following is a brief description of the contents expressed in the drawings of the present specification and the marks in the drawings:

[0020] Figure 1 A schematic diagram of the signal transmission principle for signal interaction and communication verification between the master and slave controllers of the present invention;

[0021] Figure 2 The pin definition design schematic diagram of the master-slave FCU controller of the present invention;

[0022] Figure 3 This is the enabling principle diagram of the main FCU controller of the present invention;

[0023] Figure 4A schematic diagram of the interaction between the master and slave controllers to determine the master and slave faults of the present invention;

[0024] Figure 5 It is a schematic diagram of the principle of the software function modules pre-developed in the FCU controller of the present invention;

[0025] Figure 6 This is the software architecture diagram of the CAN interface CAN0 of the FCU controller;

[0026] Figure 7 This is the software architecture diagram of the CAN interface CAN2 of the FCU controller;

[0027] Figure 8 This is the software architecture diagram of the CAN interface CAN3 of the FCU controller. DETAILED DESCRIPTION

[0028] The specific implementation of the present invention will be further explained in detail below by describing the optimal embodiment with reference to the accompanying drawings.

[0029] The present embodiment provides a method for controlling multiple controllers of a fuel cell system, which is used to meet the demand of high-power fuel cells for FCU controller resources, solve the defects of the prior art that replaces FCU controllers with more resources, and achieve the purpose of controlling the fuel cell system through the design of multiple fuel cell controllers FCU and the master-slave control method. Specifically, the present embodiment provides a method for controlling multiple controllers of a fuel cell system, including multiple FCU controllers, which realize the monitoring and control function of the fuel cell system by cooperating with multiple FCU controllers, and multiple FCU controllers are connected by communication to realize interactive control between multiple FCU controllers. Multiple FCU controllers are connected together by CAN communication to realize interactive control between each other. The master-slave relationship between each FCU controller is determined by interactive control between multiple FCU controllers, and corresponding control functions are assigned to each FCU controller based on the master-slave relationship and the corresponding control functions are executed. The control function is a pre-developed software function module, and each FCU controller executes the monitoring function of the fuel cell corresponding to the software function module according to the software function module assigned to it.

[0030] Multiple FCU controllers control the fuel cell in a collaborative control manner. Taking two FCU controllers as an example, one FCU controller is configured as a master controller and the other FCU controller is configured as a slave controller, and the fuel cell is controlled in a master-slave control manner. After the vehicle is powered on and started, the two FCU controllers communicate with each other to obtain their respective configuration codes, and judge their respective master-slave states and the master-slave states of the other controller based on their configuration codes. Based on this, it is judged whether the master-slave relationship between the two is normal. If so, the work will continue. Otherwise, the master-slave judgment failure will be reported, and the work will stop.

[0031] Multiple FCU controllers jointly monitor and control the battery stack in the fuel cell system; each FCU controller is pre-developed with all the software function modules required to control the battery stack. After startup, the FCU controller obtains the master-slave relationship through the interactive information between the FCU controllers and activates the corresponding software function modules in each FCU controller based on the master-slave relationship. In order to improve the compatibility and versatility of the FCU controller, during development, the same model of FCU controllers are selected for software function development. After the software function modules are developed, they are integrated into each FCU controller, so that each FCU controller has all the monitoring functions of the battery system. After the FCU is powered on, the master-slave relationship of each FCU controller is determined based on the interaction between the FCU controllers at the initial power-on stage, and then the corresponding software function modules are activated based on the master-slave relationship. The FCU controller implements the corresponding battery monitoring function by running the activated software function modules. For example, all software functional modules include module 1, module 2, module 3 and module 4, wherein the master FCU controller runs modules 1, 2 and 3, and the slave FCU controller runs module 4; the FCU controllers are interactively judged to determine which one is the master FCU controller and which one belongs to the slave FCU controller, and then the functions of the master and slave controllers can be executed by lighting up and activating modules 1, 2, 3 and 4 corresponding to the master and slave controllers.

[0032] The following settings can be followed when allocating software function modules in the master and slave controllers: In multiple FCU controllers, the software control functions of the controlled counterparts or actuators in the stack are set in the master FCU controller according to the master-slave relationship, and the functions of observing and monitoring the stack are set in the slave FCU controller, so as to achieve different control of the fuel cell by the master and slave controllers. According to the corresponding control functions, the electrical circuits are connected according to the functions when setting the FCU controller.

[0033] When developing software for multiple FCU controllers, the same or similar port functions are assigned and defined on the same pin number in the FCU controller, so that each FCU controller can be easily distinguished, replaced or compatible for application purposes. In order for the FCU controller to identify its own master-slave status after startup, one or more pull-up pins are selected on the FCU controller to be connected to the KL15 signal among multiple FCU controllers; when KL15 is powered on, the FCU controller determines whether it is the master FCU controller or the slave FCU controller based on the level signal read by the pull-up pin. Multiple FCU controllers determine whether the master-slave relationship of the FCU controller is faulty by exchanging their own judgment results. After power-on, the FCU controller determines whether it is the master controller or the slave controller based on the high-level signal on the pull-up pin, and then identifies its own master-slave status information.

[0034] Furthermore, after the vehicle is powered on, each FCU controller reads the high and low level signals of the pull-up pin and analyzes the data received by the CAN channel pin, and determines whether it is the master FCU controller based on the high and low level or the data received by the CAN channel pin. The determination of whether it is the master FCU controller based on the data received by the CAN channel pin is based on the type of data received by the CAN pin, because the master controller and the slave controller are different in the components connected by the pin configuration, such as some signals can only be received by the master controller, and some signals can only be received by the slave controller CAN interface, so by reading the signal data of a specific CAN interface, it can be determined whether it is the master controller.

[0035] Through the high and low level signals of the pull-up pin and the signals received by the CAN interface, it is determined whether it is the master controller or the slave controller. Then each FCU controller obtains its own master-slave control status. The master-slave status is identified by the identification code. For example, if the identification code is 1, it is the master controller, and if the identification code is 2, it is the slave controller. Then, in a power-on cycle, multiple FCU controllers perform handshake communication, and obtain the master-slave identification code of each other based on the handshake communication, and determine whether there is a master-slave distinction fault based on the master-slave identification code. If so, it reports the failure to identify the master-slave fault and prohibits the power request of the corresponding vehicle; if not, each FCU controller starts working. Only when the handshake communication interacts and the master-slave relationship does not conflict, it is judged that there is no fault; taking two FCU controllers as an example, it is judged to be normal only when one identification code is 1 and the other identification code is 2, that is, the two are respectively the master and the slave, otherwise it is judged to be a fault. For multiple FCU controllers, the fault distinction logic can also be set.

[0036] In a preferred embodiment, a master-slave judgment module, a main state transfer module, a hard-wire acquisition module, a CAN receiving and transmitting module, an air path management module, a hydrogen path management module, an energy management module, a power management module, a hydrothermal management module and a fault diagnosis module are pre-developed and implemented in each FCU controller. After power-on, only the master-slave judgment module, the main state transfer module and the hard-wire acquisition module of the FCU controller are in operation; after the master-slave judgment module has made its judgment, they are enabled separately; if the FCU controller is in the master state, all the functional modules therein are lighted up; when the FCU controller is in the slave state, the fault diagnosis module and the assigned functional modules are lighted up.

[0037] Multiple FCU controllers use CAN communication to diagnose whether each other is working properly. If the main FCU controller is abnormal, the fuel cell system will be shut down immediately. If the slave FCU controller is abnormal, the load will be reduced to idle operation and the status of the slave FCU controller will be continuously monitored. If the slave FCU controller continues to be abnormal for a set time threshold, the battery system will be shut down. This can improve the reliability and stability of the operation of multiple FCU controllers and avoid safety accidents.

[0038] This embodiment also provides a multi-controller control system for a fuel cell system, which includes multiple FCU controllers, and the multiple FCU controllers are used to monitor the fuel cell stack of the fuel cell system; the multiple FCU controllers are used to run the control method in the above embodiment, thereby realizing control of the fuel cell system.

[0039] The present invention provides a solution for controlling a high-power fuel cell system with multiple controllers. The purpose is to increase the control resources by adding controllers based on the existing single FCU controller, while taking into account the problem of multi-controller software version management. The software designs of multiple FCU controllers are designed to have the same functions, and after distinguishing the master and slave controllers, different functional modules are lighted up respectively, thereby meeting the control requirements of the high-power fuel cell system.

[0040] The specific technical solution is:

[0041] Count the current hard-wire control resource requirements and allocate the hard-wire signals that need to be collected;

[0042] Count the current CAN control resource requirements, combine the controller's CAN channel resources, and allocate CAN channels to the current CAN-controlled components;

[0043] Design the master-slave control module so that the two FCU controllers can identify which is the master controller or the slave controller. At the same time, an alarm will be issued if the master and slave controllers cannot be identified;

[0044] Design the software architecture to meet the lighting parts and order of different functional modules in the master and slave controllers;

[0045] Design the signal interaction, communication verification and fault diagnosis functions between the master and slave controllers. Take the communication interaction control of the master and slave stacks of two controllers as an example, the schematic diagram is as follows Figure 1 shown.

[0046] The present invention provides a high-power fuel cell system, including two FCU controllers, two fuel cell stacks, air inlet and outlet temperatures, pressure sensors, air compressors and other BOPs required for the air paths of the two fuel cell stacks, medium pressure, hydrogen inlet and outlet temperatures, pressure sensors, hydrogen circulation pumps and other BOPs required for the hydrogen paths of the two fuel cell stacks, water inlet and outlet temperatures, pressure sensors, water pumps and other BOPs required for the water paths of the two fuel cell stacks, as well as a current detection controller DCF and a fuel cell stack voltage detector CVM.

[0047] The present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable a computer to execute a multi-controller control method.

[0048] The high-power fuel cell multi-controller control method of the present invention can solve the problem of insufficient resources of a single FCU in a multi-stack system, while avoiding the cost and time waste caused by replacing the controller, and can effectively meet the precise control requirements of the high-power fuel cell system.

[0049] This embodiment is described by taking two FCU controllers as an example. The present invention provides a multi-controller control method for a high-power fuel cell system, comprising the following steps:

[0050] Step 1. Collect the sensor acquisition signals, PWM signals, and Howe ll signals required for the high-power fuel cell system. Assign the above signals to FCU1 and FCU2 respectively. Considering the mirroring effect of the software, two sensors with similar functions are assigned to the same pin. For example, pin 1 on FCU1 is connected to the water inlet temperature sensor of stack 1, and pin 1 on FCU2 is connected to the water inlet temperature sensor of stack 2. At the same time, try to put the main sensors actually controlled on the two stacks on the master FCU, and put the signals used for observation on the slave FCU. Similarly, important actuators such as valve bodies should also be placed on the master FCU.

[0051] Step 2: Allocate the CAN control components of the high-power fuel cell system to the corresponding CAN lines according to the CAN bus resources of the FCU. The selected FCU controller has 4 CAN lines.

[0052] like Figure 2As shown, under normal circumstances, CAN0 communicates with the FCU of the entire vehicle, and the CANs of FCU1 and FCU2 can be connected together to receive the enable and power settings of the entire vehicle.

[0053] CAN1 is for flashing CAN. Considering that two controllers cannot be flashed at the same time, CAN1 are not connected together.

[0054] CAN2 of FCU1 and FCU2 are connected together, and FCU2 sends status signals, fault diagnosis signals, and forwarding signals of CVM2 to FCU1 through this CAN. At the same time, the battery stack voltage monitor CVM1 is also connected to this CAN. Since CVM only reports key values ​​such as maximum and minimum voltages and total voltage under normal circumstances, the single-chip voltage is not reported. The relevant single-cell voltage value is sent only after receiving the instruction from FCU. Therefore, under certain circumstances, FCU1 sends an instruction to FCU2 to obtain the single-cell voltage value on battery stack 2.

[0055] As the main controller, CAN3 of FCU1 is connected to all BOP and CAN control valve body signals. CAN3 of FCU2 is connected to CVM2.

[0056] Step 3, design the master-slave control module. Select a pull-up pin on the master controller to connect to the KL15 signal, and do not connect it on the slave controller. When the KL15 signal is high, the corresponding signal pin is also high, and the master-slave logic is done through this. Since the hard wire has a virtual connection, it may cause misjudgment. Therefore, add a check to see if CAN3 has an air compressor heartbeat signal or a CVM heartbeat signal. See the specific process for details. Figure 3 .

[0057] This process is only tested once in a power-on cycle. At the same time, the two controllers need to confirm the handshake logic. Only when the values ​​reported by FCU1 and FCU2 are 1 and 2, or 2 and 1, respectively, can it be indicated that the master and slave are correctly distinguished. Other combinations of numbers indicate that the master and slave states cannot be distinguished. At this time, the master and slave cannot be identified fault should be reported. The system no longer responds to the settings and power requests of the entire vehicle.

[0058] At the same time, the master-slave logic can be designed to be compatible with a single-stack system or multiple-stack systems. More controller pins are selected and pulled up to the KL15 hard-wire signal, and the combination of several hard-wire signals with or without voltage is used to determine whether it is a single stack or a dual stack or more number of stacks, thereby achieving software compatibility expansion and reuse.

[0059] Step 4: Design the software architecture. Divide the software architecture of FCU into the following modules: master-slave judgment module, master status transfer module, hard line acquisition module, CAN receiving and sending module, air path management module, hydrogen path management module, energy management module, power management module, water and heat management module, and fault diagnosis module. Figure 5 . After the FCU controller is powered on, only the master-slave judgment module, the main state transfer module, and the hard-line acquisition module are in operation, and other modules are not lit up for the time being. After the master-slave judgment module has completed the judgment, they will be enabled separately. If the FCU controller is in the master state, all modules in it will be lit up; when the FCU controller is in the slave state, the fault diagnosis module will be lit up. The lighting logic of the CAN path is as follows: the CAN0 module of the master controller FCU1 lights up the VCU receiving and sending modules, and the CAN0 module of the slave controller FCU2 lights up the VCU receiving module, and the sending module is not lit. That is, all information is exchanged through the master controller. The CAN2 module of the master controller FCU1 lights up the CVM1 sending and receiving, fault diagnosis receiving, and status signal receiving. The CAN2 module on the slave controller FCU2 lights up the fault diagnosis sending and status signal sending modules, and sends status signals and fault diagnosis signals. The CAN3 module of the main controller FCU1 is responsible for receiving and sending signals from the hydrogen circuit, water thermal management, and power module related BOPs, while the CAN3 module of FCU2 is responsible for receiving and sending signals on CVM2. The power supply relay of the BOP is energized after the FCU controller wakes up, so the FCU receives its signal after power-on, so it is not distinguished and lit. Figure 6 , 7 , as shown in Figure 8.

[0060] Step 5: Design the signal interaction, communication verification, and fault diagnosis functions between the master and slave controllers. Design the signals collected from the FCU controller and the corresponding fault codes, the master-slave judgment logic value of the slave controller, the single cell voltage signal of CVM2, and the instructions of the master FCU controller for the single cell voltage signal of CVM2 into DBC. At the same time, add a rolling counter signal to each signal frame to allow the master and slave controllers to detect whether the other party is communicating normally. If any controller has a communication abnormality, the system stops running.

[0061] In the second aspect of the present invention, the embodiment of the present invention also provides a high-power fuel cell control system, including two fuel cell controllers, two stacks and supporting auxiliary components: air compressor, circulation pump, water pump, proportional valve, tail exhaust valve, etc. And supporting sensors: hydrogen inlet temperature, pressure sensor, hydrogen outlet temperature, pressure sensor, air inlet temperature, pressure sensor of two stacks, air outlet temperature, pressure sensor of two stacks, water inlet temperature, pressure sensor of two stacks, water outlet temperature, pressure sensor of two stacks, heat dissipation gas water outlet temperature sensor, air flow meter, etc. And a CVM controller for detecting the voltage of the stack and a DCDC converter for boosting and regulating current. Among them, each pressure, temperature, and flow sensor is electrically connected to the fuel cell controller. The communication between each auxiliary component and the fuel cell controller is CAN communication. The dual fuel cell controller collects the hard-line signal of the sensor, receives the communication signal from the BOP, and performs logical operations internally, thereby realizing the scheduling and control of each component, as well as the fault diagnosis and protection functions of the system, so that the fuel cell system can generate electricity normally. At the same time, the two controllers use CAN communication to diagnose each other to see if they are working properly. If the main controller is abnormal, it will be shut down immediately. If the slave controller is abnormal, it will be reduced to idle speed until the slave controller recovers. If it still cannot recover within a certain period of time, it will be shut down.

[0062] In a third aspect of the present invention, an embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to implement logical functions such as master-slave judgment.

[0063] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0064] Obviously, the specific implementation of the present invention is not limited to the above-mentioned methods. As long as various non-substantial improvements are made using the method concept and technical solution of the present invention, they are all within the protection scope of the present invention.

Claims

1. A control method for a multi-controller of a fuel cell system, characterized in that: It includes multiple FCU controllers, which are communicatively connected to each other for interactive control. The master-slave relationship between the multiple FCU controllers is determined through the interactive control between the multiple FCU controllers, and corresponding control functions are assigned to each FCU controller based on the master-slave relationship and executed.

2. The control method of a multi-controller of a fuel cell system according to claim 1, characterized in that: Multiple FCU controllers jointly monitor and control the fuel cell system; each FCU controller is pre-developed with all the software function modules required to implement system control. After startup, the FCU controller obtains the master-slave relationship through the interactive information between the FCU controllers and activates the corresponding software function modules in each FCU controller based on the master-slave relationship.

3. The control method of a multi-controller of a fuel cell system according to claim 2, characterized in that: Among multiple FCU controllers, the control functions belonging to the controlled counterparts or actuators in the system are set in the master FCU controller according to the master-slave relationship, and the functions belonging to the observation and monitoring system are set in the slave FCU controller.

4. The method for controlling a multi-controller of a fuel cell system according to claim 2, characterized in that: When developing software for multiple FCU controllers, the same or similar port functions are assigned and defined on the same pin number in the FCU controllers.

5. A method for controlling a multi-controller of a fuel cell system according to any one of claims 1 to 4, characterized in that: Among multiple FCU controllers, one or more pull-up pins are selected on the FCU controller to be connected to the KL15 signal; when KL15 is powered on, the FCU controller determines whether it is the master FCU controller or the slave FCU controller based on the level signal read by the pull-up pin. Multiple FCU controllers determine whether the master-slave relationship of the FCU controller is faulty by exchanging their own judgment results.

6. The control method of a multi-controller of a fuel cell system according to claim 5, characterized in that: After the vehicle is powered on, each FCU controller reads the high and low level signals of the pull-up pin and analyzes the data received by the CAN channel pin, and determines whether it is the main FCU controller based on the high and low level signals or the data received by the CAN channel pin.

7. The control method of a multi-controller of a fuel cell system according to claim 5, characterized in that: During a power-on cycle, multiple FCU controllers perform handshake communication, and obtain each other's master-slave identification code based on the handshake communication, and determine whether there is a master-slave distinction failure based on the master-slave identification code. If so, a master-slave identification failure is reported and the power request of the corresponding vehicle is prohibited; if not, each FCU controller starts working.

8. The control method of a multi-controller of a fuel cell system according to claim 5, characterized in that: A master-slave judgment module, a master status transfer module, a hard-wire acquisition module, a CAN receiving and transmitting module, an air path management module, a hydrogen path management module, an energy management module, a power management module, a hydrothermal management module and a fault diagnosis module are pre-developed and implemented in each FCU controller. After power-on, only the master-slave judgment module, the master status transfer module and the hard-wire acquisition module are in operation; after the master-slave judgment module has finished judging, other functional modules are enabled separately; if the FCU controller is in the master state, all the functional modules therein are lighted up; when the FCU controller is in the slave state, the fault diagnosis module and the assigned functional modules are lighted up.

9. A method for controlling a multi-controller of a fuel cell system as claimed in claim 8, characterized in that: Multiple FCU controllers use CAN communication to diagnose whether each other is working properly. If the master FCU controller is abnormal, the fuel cell system will be shut down immediately. If the slave FCU controller is abnormal, the load will be reduced to idle operation and the status of the slave FCU controller will be continuously monitored. If the slave FCU controller continues to be abnormal for a set time threshold, the battery system will be shut down.

10. A multi-controller control system for a fuel cell system, characterized in that: The control system includes a plurality of FCU controllers, and the plurality of FCU controllers are used to monitor the fuel cell stack of the fuel cell system; the plurality of FCU controllers are used to run the control method as described in claims 1-9.

Images