Method and device for locking fuel cell system, controller and fuel cell system

Abstract

The invention relates to a method and device for locking a fuel cell system, a controller and the fuel cell system. The method includes detecting a fault that causes hardware shutdown of the fuel cell system. The method also includes generating a fault indication in response to detecting the fault. The method further includes generating boot lock information based on the fault indication. The method further includes locking the fuel cell system according to the start lock information. In this manner, when the fuel cell system detects a fault associated with shutting down the fuel cell system on the hardware, the hardware shutdown is no longer directly performed, but the fuel cell system is locked on the software. Therefore, the fuel cell system can be prevented from being shut down too frequently on hardware, and the driving experience is improved on the premise of ensuring safety.

Description

Technical Field

[0001] The present disclosure relates to the field of fuel cells, and more particularly, to a method, an apparatus, a controller, a fuel cell system, and a medium for locking a fuel cell system. Background Art

[0002] In hydrogen fuel cell vehicles, the power core is the hydrogen fuel cell system. In the fuel cell system (FCS), the fuel cell control unit (FCCU) can control system operation through different mode conversions, such as shutdown, startup, fault shutdown, emergency shutdown, and test mode. During system control, if a fault is diagnosed and the system needs to be prevented from starting, the fuel cell system will be locked. This can avoid or reduce possible damage to the stack or components.

[0003] At the same time, functional safety is a very important concern in fuel cell systems. Therefore, in fuel cell systems, corresponding safety protection mechanisms are also set up to prevent hydrogen and high pressure from causing harm to the human body due to failure of the FCS electrical / electronic (E / E) system. In the safety protection mechanism, if any safety-related errors occur or the sensor is not ready, the safety monitoring function will also prevent the system from starting. Summary of the invention

[0004] Embodiments of the present disclosure provide a method, an apparatus, a device, a vehicle, and a medium for determining depth information of a driver.

[0005] In a first aspect of the present disclosure, a method for locking a fuel cell system is provided. The method includes detecting a fault that causes a hardware shutdown of the fuel cell system. The method also includes generating a fault indication in response to detecting the fault. The method also includes generating startup lock information based on the fault indication. The method also includes locking the fuel cell system according to the startup lock information.

[0006] According to an embodiment of the present disclosure, a fault associated with a safety standard level may cause the fuel cell system to be shut down in hardware. When the fuel cell system detects a fault associated with shutting down the fuel cell system in hardware, the hardware shutdown is no longer directly performed, but the fuel cell system is locked in software. Thus, it is possible to avoid shutting down the fuel cell system in hardware too frequently, thereby improving the driving experience while ensuring safety.

[0007] In some embodiments, generating the fault indication includes: in response to detecting the fault, generating a first indication indicating the fault; or in response to determining that the fault is repaired, generating a second indication indicating that there is no fault. Here, the fault indication includes the first indication and the second indication. In such an embodiment, by generating different indications, different fault states can be indicated.

[0008] In some embodiments, generating the startup lock information includes: recording the duration of the fault indication remaining unchanged; and generating the startup lock information in response to determining that the duration is greater than a predetermined time threshold. In such an embodiment, by caching the fault indication and timing, false locks caused by false faults can be avoided.

[0009] In some embodiments, the predetermined time threshold depends on the start-up time or self-test time of the sensor related to safety. In such an embodiment, false failures caused by the sensor being in an initialization or self-test state can be avoided.

[0010] In some embodiments, the method further includes: during the period when the fuel cell system is locked, in response to obtaining an instruction for a startup operation of the fuel cell system, inhibiting the startup operation; detecting startup information of the fuel cell system under the startup operation; and in response to determining that the startup information indicates that the startup process of the fuel cell system is triggered, shutting down the fuel cell system in hardware. In such an embodiment, by forcibly shutting down the fuel cell system when a startup trend is detected, it is possible to ensure that the fuel cell system cannot be started when the software lock fails.

[0011] In some embodiments, the method further includes: in response to determining that the startup information indicates that the fuel cell system does not have a startup tendency, determining that the startup operation is inhibited. In such an embodiment, by inhibiting the startup operation, it is not necessary to perform a shutdown on the hardware, reducing the number of hardware shutdowns.

[0012] In some embodiments, shutting down the fuel cell system in hardware includes: resetting a reset pin of a control chip of the fuel cell system. In such embodiments, the fuel cell system can be shut down stably.

[0013] In some embodiments, the startup information includes at least one of the following: a hydrogen injector (HGI) of the fuel cell system is actuated; a shut-off valve (SIV) of the fuel cell system is actuated; an anode inlet pressure of the fuel cell system is greater than a first pressure threshold; or an anode outlet pressure of the fuel cell system is greater than a second pressure threshold. In such an embodiment, it can be determined whether the system has a startup trend by detecting the operating status of the component.

[0014] In some embodiments, in response to acquiring the startup lock information, determining the fault type indicated by the startup lock information; determining whether the fault type triggers locking of the fuel cell system; and in response to determining that the fault type triggers locking of the fuel cell system, locking the fuel cell system. In such an embodiment, the fault type that triggers locking can be configured, thereby increasing the flexibility of system control.

[0015] In some embodiments, the fault includes at least one of the following: the fuel cell system was locked in the previous driving; or the sensor associated with safety was not ready. In such an embodiment, by monitoring the previous lock and the safety-related sensors, most situations that may cause personal harm can be covered.

[0016] In some embodiments, the method further comprises: in response to generating the startup lock information, causing the fuel cell system to present the fault or the fuel cell system to be locked. In such an embodiment, the current state can be notified to the driver to avoid unnecessary operations.

[0017] In a second aspect of the present disclosure, a device for locking a fuel cell system is provided. The device includes: an indication generation module configured to generate a fault indication in response to detecting a fault associated with a fault causing a hardware reset of the fuel cell system; an information generation module configured to generate startup locking information based on the fault indication; and a locking module configured to lock the fuel cell system according to the startup locking information.

[0018] In a third aspect of the present disclosure, a controller is provided, comprising: at least one processor; and a memory coupled to the at least one processor and having instructions stored thereon, wherein when the instructions are executed by the at least one processor, the controller executes the method according to the first aspect of the present disclosure.

[0019] In a fourth aspect of the present disclosure, a fuel cell system is provided, comprising the controller according to the third aspect of the present disclosure.

[0020] In a fifth aspect of the present disclosure, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer-executable instructions, wherein the computer-executable instructions are executed by a processor to implement the method provided according to the first aspect of the present disclosure.

[0021] It should be understood that the contents described in the summary of the invention are not intended to limit the key or important features of the embodiments of the present disclosure, nor are they intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. In the accompanying drawings, the same or similar reference numerals represent the same or similar elements, wherein:

[0023] Figure 1A A schematic diagram showing an example vehicle in which various embodiments of the present disclosure may be implemented;

[0024] Figure 1B Shows Figure 1A A schematic diagram of an example architecture of a vehicle in FIG.

[0025] Figure 2 A flow chart showing an example method for locking a fuel system according to some embodiments of the present disclosure;

[0026] Figure 3 A schematic diagram illustrating an example architecture for locking a fuel system according to some embodiments of the present disclosure is shown;

[0027] FIG. 4A to FIG. 4C A schematic diagram illustrating an example process for locking a fuel system according to some embodiments of the present disclosure is shown;

[0028] Figure 5 A block diagram illustrating an example apparatus for locking a fuel system according to some embodiments of the present disclosure; and

[0029] Figure 6 A block diagram of a device in which various embodiments of the present disclosure may be implemented is shown. DETAILED DESCRIPTION

[0030] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0031] In the description of the embodiments of the present disclosure, the term "including" and similar terms should be understood as open inclusion, that is, "including but not limited to". The term "based on" should be understood as "based at least in part on". The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment". The terms "first", "second", etc. may refer to different or the same objects. Other explicit and implicit definitions may also be included below.

[0032] It should be understood that when an element is referred to as being "connected" or "coupled" to another element, it can be directly connected or coupled to the other element or intervening elements may be present. Conversely, when an element is referred to as being "directly connected" or "directly coupled" to another element, there are no intervening elements. Other words used to describe the relationship between elements should be interpreted in a similar manner (e.g., "between" versus "directly between," "adjacent" versus "directly adjacent," etc.).

[0033] As discussed above, a safety protection mechanism is usually provided in the fuel cell system. When the safety protection mechanism is triggered, the fuel cell system will be shut down in hardware to prevent personal injury. However, false faults may be detected in the safety protection mechanism, resulting in the fuel cell system being shut down unnecessarily and possibly frequently. Since the fuel cell system shut down in hardware still needs to be manually started after the fault is repaired in order to make the fuel cell system run again, frequently shutting down the fuel cell system in hardware will take the driver a lot of time to restart the fuel cell system, greatly affecting the driving experience.

[0034] In view of this, a scheme for locking a fuel cell is proposed. In this scheme, a fault associated with a safety standard level can cause the fuel cell system to be shut down in hardware. When the fuel cell system detects a fault associated with shutting down the fuel cell system in hardware, the hardware shutdown is no longer performed directly, but the fuel cell system is locked in software. The fuel cell system locked in software can be unlocked after the fault is repaired without the need for other manual operations. Therefore, avoiding shutting down the fuel cell system in hardware too frequently can simplify user operations while ensuring safety, thereby optimizing the driving experience.

[0035] Figure 1A 1 shows a schematic diagram of an example vehicle 100 in which various embodiments of the present disclosure may be implemented. Figure 1A As shown, the vehicle 100 includes a fuel cell system 110 and an engine 120 powered by the fuel cell system 110. The engine 120 can use the electrical energy from the fuel cell system 110 and / or the power battery to output mechanical energy to drive the wheels so that the vehicle 100 travels. In general, the fuel cell system 110 may include a fuel cell control unit 111 (FCCU), a DC-DC converter 112, a fuel cell stack 113, two hydrogen storage tanks 114-1 and 114-2, and a power battery 115.

[0036] In the embodiment shown in FIG. 1 , the fuel cell control unit 111 may be arranged above the engine 120 and have a control chip for providing a computing function. The fuel cell control unit 111 may be configured to manage the electrical energy of the fuel cell stack 113 and the power battery 115, perform voltage control, and distribute electrical energy to the engine 120 and other active components. The DC-DC converter 112 may be coupled between the engine 120 and the fuel cell stack 113. The DC-DC converter 112 may be, for example, a boost converter to boost the DC power generated by the fuel cell stack 113 and supply it to the engine 120 to enable it to work. The fuel cell stack 113 is an electric energy conversion device assembled from multiple fuel cells. Two hydrogen storage tanks 114-1 and 114-2 may be used to store hydrogen, and hydrogen is supplied to the fuel cell stack 113 through a hydrogen supply system.

[0037] In some embodiments, the vehicle 100 may further include a panel 130 disposed inside. The panel 130 may be configured to notify the driver of the type of fault when a responsive fault is detected. For example, in the illustrated embodiment, the panel 130 may display four indicator icons. Icon 131 may, for example, indicate a battery power failure. Icon 132 may, for example, indicate a fault associated with a pneumatic component. Icon 133 may, for example, indicate a fault associated with an electrical parameter anomaly. Icon 134 may, for example, indicate that the fuel cell system 110 is locked. The architecture of the fuel cell system 110 will be described in detail below.

[0038] Figure 1B Shows Figure 1A Schematic diagram of an example architecture of a vehicle 100 in. The fuel cell system 110 is a system that converts the chemical energy of reactants (fuel and oxidant) into electrical energy and thermal energy through an electrochemical reaction process. In some embodiments, the fuel cell system 110 may be composed of a fuel cell stack 100, an air supply subsystem, a hydrogen supply subsystem, a thermal management subsystem, and a control subsystem. Among these components, the fuel cell stack 113 is the primary component. An electrochemical reaction occurs in the fuel cell stack 113 to provide electrical energy. Accordingly, other subsystems can coordinate with each other to ensure that the electrochemical reaction of the fuel cell stack 113 can be performed normally, efficiently and reliably.

[0039] In some embodiments, the fuel cell stack 113 may be composed of a plurality of single cells, a separator, a cooling plate, an intake manifold, etc. The fuel cell stack 113 may generate direct current by electrochemically reacting hydrogen gas and air, and simultaneously generate other byproducts such as heat and water. The fuel cell stack 113 may be composed of a plurality of single cells stacked in series. In some embodiments, the fuel cell stack 113 may be a proton exchange membrane fuel cell stack.

[0040] In some embodiments, the air supply subsystem of the fuel cell system 110 may include an air compressor 119, a filter, a flow meter, a humidifier, and a regulating valve. The air supply subsystem may filter, humidify, and pressure-regulate the air entering the fuel cell stack 113, so that the temperature, humidity, pressure, and flow rate of the cathode side of the fuel cell stack 113 are within an optimal range. The air compressor 119 may provide the fuel cell with air of the required pressure and flow rate according to the output power of the fuel cell stack 113, and plays an important role in the fuel cell system 100.

[0041] In some embodiments, the hydrogen supply subsystem of the fuel cell system 110 may include hydrogen storage tanks 114-1 and 114-2, a hydrogen injector 116, and a shut-off valve 118. The hydrogen supply subsystem may perform humidification and other related treatments on the fuel gas to be input (here, hydrogen), thereby converting the fuel gas into a hydrogen-rich gas suitable for operation in the fuel cell stack 113, so as to control the temperature, pressure, and flow rate (humidity) of the anode side of the fuel cell stack 113, while ensuring the utilization rate of the hydrogen.

[0042] In some embodiments, the thermal management subsystem of the fuel cell system 110 may include a radiator, etc. The thermal management subsystem may be configured to maintain the thermal balance of the fuel cell system 110. For example, the thermal management subsystem may recycle excess heat and perform auxiliary heating when the fuel cell system 110 is started, so that the inside of the fuel cell stack 113 quickly reaches a suitable temperature range, while ensuring that both the cathode and the anode operate in the best working state.

[0043] In some embodiments, the electronic control subsystem of the fuel cell system 110 may include a fuel cell control unit 111, a sensor 117-1 associated with electrical parameters, a sensor 117-2 associated with pneumatic parameters, an actuator valve, and a switch, etc. The electronic control subsystem can ensure that the components of the air subsystem, the hydrogen subsystem, and the thermal management subsystem can work in a coordinated and efficient manner so that they can exert their maximum efficiency.

[0044] like Figure 1BAs shown, when the vehicle 100 is started, on the cathode side of the fuel cell stack 113, the shut-off valve 118 in the hydrogen supply subsystem is activated, and the hydrogen stored in the hydrogen storage tanks 114-1 and 114-2 enters the hydrogen supply path. The hydrogen in the hydrogen supply path is input to the cathode of the fuel cell stack 113 under the action of the hydrogen injector 116. Relatively, on the cathode side of the fuel cell stack 113, air is input into the gas supply path from the outside of the vehicle 100. The air reaches the air compressor 119 in the gas supply path. After the air is pressurized, the air enters the heat exchanger for cooling. Finally, the air is applied to the anode of the fuel cell stack 113. After the chemical reaction in the fuel cell stack 113 is performed, the generated water and the remaining gas are output. At the same time, the electric energy generated in the fuel cell stack 113 is input into the DC-DC converter 112. After voltage adjustment, the generated electric energy is input from the DC-DC converter 112 to the engine 120 and / or the power battery 115.

[0045] It can be seen that in the above startup process, the shut-off valve 118 and the hydrogen injector 116 are started, and because the air is pressurized, the inlet and outlet pressures at the anode of the fuel cell stack 113 are increased. Therefore, when the fuel cell control unit 111 receives the sensing signals associated with these events, the fuel cell control unit 111 can determine that the startup process of the fuel cell system 100 is triggered, or the fuel cell system has been started.

[0046] exist Figure 1A and Figure 1B In the illustrated embodiment, the fuel cell control unit 111 may, for example, execute a method for locking a fuel cell system according to an embodiment of the present disclosure, thereby locking the fuel cell system 110 when a safety-related fault is detected. In some embodiments, after power-on, the fuel cell control unit 111 may begin to execute a safety-related fault monitoring mechanism. The sensor 117-1 is, for example, a redundant voltage sensor provided to achieve a specific safety standard level. However, the fuel cell control unit 111 may detect that the sensor 117-1 is not ready, and generate a fault indication indicating a fault of the sensor 117-1. Conventionally, the fault indication will usually cause the fuel cell system to shut down in hardware. In an embodiment according to the present disclosure, the fault indication will be input into a fault diagnosis mechanism and processed to lock the fuel cell system 110 in software. Afterwards, in some embodiments, after locking, the vehicle 100 may notify the driver that the fuel cell system 110 is locked by making the icon 134 light up. After seeing the notification, the driver can unlock the fuel cell system 110 by repairing the corresponding fault.

[0047] It should be understood that Figure 1A and Figure 1BThe architecture of the fuel cell system and the corresponding operation process are only exemplary. The solution according to the embodiment of the present disclosure can also be used in other fuel cell systems, and the present disclosure is not intended to limit this. Figure 2 and Figure 3 A scheme for locking a fuel system according to an embodiment of the present disclosure will be described in detail.

[0048] Figure 2 FIG. 2 is a flow chart showing an example method 200 for locking a fuel system according to some embodiments of the present disclosure. The method 200 may be performed by, for example Figure 1A and Figure 1B The fuel cell control unit 111 in is executed.

[0049] like Figure 2 As shown, at box 210, a fault is detected that causes a hardware shutdown of the fuel cell system. Figure 1A and Figure 1B In the vehicle 100 shown, the fuel cell control unit 111 can detect a fault associated with causing the fuel cell system hardware to shut down. In some embodiments, the fault that causes the fuel cell system hardware to shut down may be a fault associated with a safety level. For example, in order for the vehicle to meet certain specific safety standards, redundant sensors may be provided in the vehicle to improve the robustness of the entire vehicle. Therefore, redundant sensors are associated with safety levels, and failure of redundant sensors may cause personal harm to the driver. Thus, in order to prevent personal injury, if the driver still wants to start the vehicle without repairing the fault, the fuel cell hardware will be shut down. In some embodiments, the fault that causes the fuel cell system hardware to shut down may be that the fuel cell system was locked during the previous trip. In some embodiments, a safety-related sensor in the startup or self-test process may also be considered a fault.

[0050] At block 220, a fault indication is generated if a fault is detected. Figure 1A and Figure 1B In the illustrated vehicle 100, the fuel cell control unit 111 may generate a fault indication after detecting a fault. For example, the fault indication may be a flag indicating the detected fault, which may identify the type of the fault.

[0051] At block 230, based on the fault indication, a startup lockout message is generated. Figure 1A and Figure 1B In the illustrated vehicle 100 , the fuel cell control unit 111 may generate a startup lock message based on the fault indication. In some embodiments, the fuel cell control unit 111 may set a flag indicating locking the fuel cell system 110 to true.

[0052] In block 240, the fuel cell system is locked according to the startup lock information. Figure 1A and Figure 1B In the vehicle 100 shown, the fuel cell control unit 111 can lock the fuel cell system 110 according to the startup lock information. After the fuel cell system 110 is locked, the fuel cell stack 113 of the fuel cell system 110 no longer operates, so that no new electric energy is produced. In some embodiments, after the fuel cell system 110 is locked, when the fuel cell control unit 111 receives an operation instruction from the driver to start the fuel cell system 110, the fuel cell control unit 111 may not execute the operation process associated with the fuel cell system 110. For example, the fuel cell control unit 111 can inhibit the start of the hydrogen injector 116 and the shut-off valve 118, so that the fuel cell stack 113 cannot perform a chemical reaction. It should be understood that the fuel cell control unit 111 can inhibit the driver's startup operation on the fuel cell system 110 by intervening in any link or operation of any component in the startup process.

[0053] exist Figure 2 In the illustrated embodiment, the fuel cell control unit 111 may be provided with a diagnostic application software for diagnosing component failures and locking the fuel cell system 110 in software after the failure is diagnosed. The fuel cell control unit 111 may also be provided with monitoring software for monitoring safety-related operations and shutting down the fuel cell system 110 in hardware after a safety-related failure is detected. According to an embodiment of the present disclosure, when the monitoring software of the fuel cell system 110 detects a safety-related failure, the hardware shutdown is no longer performed directly, but information indicating the safety-related failure is sent to the diagnostic application software, and the fuel cell system 110 is locked in software. In this way, it is possible to avoid shutting down the fuel cell system 110 in hardware too frequently, thereby improving the driving experience while ensuring safety.

[0054] Figure 3 A schematic diagram of an example architecture 300 for locking a fuel system according to some embodiments of the present disclosure is shown. Figure 3 As shown, the architecture 300 includes two parts, namely, a fault diagnosis module 310 and a fault monitoring module 320. In some embodiments, the fault diagnosis module 310 and / or the fault monitoring module 320 may be arranged in Figure 1A and Figure 1B In the fuel cell control unit 111 in the embodiment. For example, the fault diagnosis module 310 may be application layer software, and the fault monitoring module 320 may be monitoring software.

[0055] Here, the fault diagnosis module 310 can execute a fault protection mechanism for a component fault diagnosed in the fuel cell system 110. For example, the components in the fuel cell system 110 can be set to work within a predetermined operating parameter range. When the detected operating parameter exceeds the predetermined operating parameter range, the fault diagnosis module 310 can diagnose the fault of the component and execute corresponding safety protection measures. The fault monitoring module 320 can execute a fault protection mechanism for a safety fault associated with a safety standard level in the fuel cell system. For example, the fault monitoring module 320 can monitor the operating parameters and the vehicle driving state associated with the safety fault, and execute corresponding safety protection measures when the safety fault is detected. In the example architecture of the present disclosure, the fault diagnosis module 310 and the fault monitoring module 320 can execute the corresponding protection mechanism relatively independently on the one hand. On the other hand, in order to implement the scheme of locking the fuel cell according to the present disclosure, an interface module 330 for providing the fault fault in the fault monitoring module 320 to the fault diagnosis module 310 is provided between the fault diagnosis module 310 and the fault monitoring module 320. The interface module 330 can process the fault fault and generate a startup locking message according to specific rules.

[0056] exist Figure 3 In the illustrated embodiment, in the fault diagnosis module 310, at block 311, the fault diagnosis module 310 acquires startup lock information indicating that a fault is diagnosed. In some embodiments, the fault diagnosis module 310 may perform diagnosis based on information sensed by the sensing device to determine whether a component in the fuel cell system is faulty. When a component is diagnosed as faulty, the fault diagnosis module 310 may generate startup lock information to indicate that the fuel cell system 110 should be locked.

[0057] In box 312, the fault diagnosis module 310 determines the fault type indicated by the startup lock information based on the startup lock information. In box 313, the fault diagnosis module 310 determines whether the determined fault type triggers the lock of the fuel cell system. If the fault diagnosis module 310 determines that the fault type should trigger the lock of the fuel cell system, it proceeds to box 314. In box 314, the fault diagnosis module 310 locks the fuel cell system 110. In some embodiments, a fuel cell system lock flag may be set in the fault diagnosis module 310. In such an embodiment, the fault diagnosis module 310 may set the lock flag to true so that the fuel cell system 100 enters a locked state. Conversely, if the fault diagnosis module 310 determines that the fault type does not trigger the lock of the fuel cell system, it proceeds to box 315. In box 315, the fault diagnosis module 310 maintains the current operation of the fuel cell system 110. In an embodiment where a lock flag is set, the fault diagnosis module 310 may set the lock flag to false so that the fuel cell system 100 is released from the locked state. In this way, when a component in the fuel cell system 100 is diagnosed as faulty, the system can be locked in software to prevent the faulty component from causing further damage.

[0058] In the fault monitoring module 320, in box 321, the fault monitoring module 320 monitors the operating parameters and vehicle driving state associated with the safety fault. In box 322, the fault monitoring module 320 generates a corresponding fault indication based on the monitored operating parameters and vehicle driving state. In some embodiments, when the fault monitoring module 320 detects the operating parameters and vehicle driving state indicating the occurrence of a fault, the fault monitoring module 320 can generate a fault indication indicating the fault, also referred to as a first indication. Correspondingly, when the detected fault is eliminated or repaired, the fault monitoring module 320 can generate a fault indication indicating that the fault is repaired based on this, also referred to as a second indication. In some embodiments, a fault monitoring flag can be set in the fault monitoring module 320. The fault monitoring flag can be set to true to indicate that a fault is detected, and set to false to indicate that the fault is repaired, or there is no fault.

[0059] In box 323, the fault monitoring module 320 detects an operating parameter associated with starting the fuel cell system. In box 324, the fault monitoring module 320 determines whether the detected operating parameter is greater than a predetermined threshold. If the fault monitoring module 320 determines that the operating parameter is greater than the predetermined threshold, it is considered that the fuel cell system has a startup trend and proceeds to box 325. In box 325, the fault monitoring module 320 shuts down the fuel cell system in hardware. In some embodiments, the fault monitoring module 320 can reset the chip 1131 of the fuel cell control unit 113 so that the fuel cell control unit 113 cannot continue to operate. If the fault monitoring module 320 determines that the operating parameter is less than the predetermined threshold, it is considered that the fuel cell system has no startup trend and proceeds to box 326. In box 326, the fault monitoring module 320 maintains the current state. In this way, after detecting a safety-related fault, the fuel cell system can be shut down in hardware to avoid safety hazards to personnel.

[0060] As discussed above, if the fuel cell system 100 is shut down directly in hardware after a safety-related fault is detected, the problem of frequent shutdown may occur. In this regard, an interface module 330 is set to introduce faults related to safety-related faults into the fault diagnosis module 310, so that it allows triggering the lock of the fuel cell system 100 in software. In box 331, the fault diagnosis module 310 receives a fault indication from the fault monitoring module 320. The fault indication may include a first indication indicating a fault and a second indication indicating that the fault is repaired. In box 332, when the first indication is received, the fault diagnosis module 310 times the first indication to record the duration for which the first indication remains unchanged. In box 333, the fault diagnosis module 310 determines whether the recorded duration exceeds a predetermined time threshold. The time threshold may be calibrated according to possible faults and the time when the fault may heal itself. In some embodiments, the time threshold may be associated with the initialization time or self-test time of the sensor. In some embodiments, during the timing of the first indication, the fault diagnosis module 310 may end the timing when the second indication is received to record the duration from the start timing to the end timing. In other embodiments, the fault diagnosis module 310 may end the timing when the recorded timing reaches a predetermined time threshold, thereby determining that the maintenance time is greater than the predetermined time threshold.

[0061] In some embodiments, if the fault diagnostic module 310 determines that the duration is less than a predetermined time threshold, proceed to box 336. In box 336, the fault diagnostic module 310 discards the fault indication. If the fault diagnostic module 310 determines that the duration is greater than the predetermined time threshold, proceed to box 334. In box 334, the fault diagnostic module 310 generates a startup lockout message. After the startup lockout message is generated, on the one hand, proceed to box 312, and the startup lockout message will be input to box 312. On the other hand, proceed to box 318, in box 318, the fault diagnostic module 310 causes the fuel cell system to present a fault or the fuel cell system is locked. In some embodiments, the fault diagnostic module 310 can send the startup lockout message to the panel 130 so that the panel 130 displays that the fuel cell system 110 is locked. In this way, by caching the fault and timing it, it is possible to exclude the system lockout caused by a "false" safety-related fault.

[0062] In some driving situations, in box 322, the fault monitoring module 320 generates a fault monitoring indication and sends the fault monitoring indication to the fault diagnosis module 310. At this time, proceed to box 331. After the process described above, in box 334, the fault diagnosis module 310 generates startup lock information and triggers the lock of the fuel cell system 110. After the fuel cell system 110 is locked, when the driver's startup operation of the fuel cell system is received, the fuel cell control unit 111 of the fuel cell system 110 can inhibit the startup operation, so that the fault monitoring module 320 does not detect an operating parameter associated with starting the fuel cell system greater than a predetermined threshold in box 323. Therefore, in box 324, the fault monitoring module 320 determines that the operating parameter is less than the predetermined threshold, and confirms that the fuel cell system has no startup trend, thereby proceeding to box 326. In box 326, the fault monitoring module 320 maintains the current state. In such a situation, the lock on the software inhibits the operation of the fuel cell system, avoiding the safety-related fault directly causing the fuel cell system to shut down in hardware.

[0063] Figure 4A A schematic diagram of an example process 40A for locking a fuel system according to some embodiments of the present disclosure is shown. Figure 1A , Figure 1B and Figure 3 The embodiment shown is used to describe process 40A. Figure 4A As shown, process 40A shows the driving status of vehicle 400 at three time points during the driving process. Vehicle 400 includes a fuel cell system 410 for providing power for the vehicle and a panel 430 for displaying the status of vehicle 400.

[0064] At time point T11, the vehicle 400 is powered on. During the power-on process of the vehicle 400, the fuel cell system 410 monitors the operating status of the safety-related components. At this time, the fuel cell system 410 detects that the safety-related sensors (such as Figure 1B The electrical related sensor 170-1 in the control panel 430 is not ready, and generates a fault indication (also referred to as a first indication) indicating a sensor fault. The fault indication is displayed to the driver by an icon 431 of the panel 430. The dashed box of the icon 431 indicates that there is a potential, undetermined safety-related fault. For example, the fault indication can be a corresponding Figure 3 The fault monitoring module 320 in the fault monitoring module generates the fault indication. The fault indication is input to the Figure 3 In the interface module corresponding to the interface module 330 in the embodiment. After receiving the fault indication, the interface module times the fault indication.

[0065] At time point T12 during the timing period, the fault monitoring module detects that the sensor is ready and generates a repair indication (also referred to as a second indication) indicating that the sensor fault has been repaired. The repair indication is also input to the interface module. After receiving the repair indication, the interface module stops timing the fault indication and determines that the duration for which the fault indication remains unchanged is T12-T11. Figure 4A In the embodiment shown, T12-T11 is less than a predetermined time threshold. As a result, the interface module discards the fault indication and does not generate a startup lock message. At this time, the icon 431 of the panel 430 gradually becomes transparent. At time point T13, the vehicle 400 is started and starts to travel.

[0066] Figure 4B FIG. 4 is a schematic diagram of an example process 40B for locking a fuel system according to other embodiments of the present disclosure. Figure 1A , Figure 1B and Figure 3 The embodiment shown is used to describe process 40B. Figure 4B As shown, process 40B shows the driving status of vehicle 400 at three time points during the driving process.

[0067] At time point T21, the vehicle 400 is powered on. During the power-on process of the vehicle 400, the fuel cell system 410 detects that the safety-related sensors (eg Figure 1B The electrical related sensor 170-1) in the vehicle is not ready and generates a fault indication indicating a sensor fault. The fault indication is displayed to the driver by an icon 431 of the panel 430 to indicate that there is a potential safety-related fault. The fault indication can be generated by a fault monitoring module. The fault indication is input into the interface module. After receiving the fault indication, the interface module times the fault indication.

[0068] At time point T22 during the timing period, the duration of the recorded fault indication remaining unchanged reaches a predetermined time threshold. The fault monitoring module stops timing the fault indication and determines that the duration of the fault indication is greater than the predetermined time threshold. Thus, the interface module generates the start locking information based on the fault indication and inputs the start locking information into the corresponding Figure 3 The fault diagnosis module 310 in the fault diagnosis module. The fault diagnosis module determines that the fault of the safety-related sensor is a fault that may cause harm to personnel, and locks the fuel cell system 410 in the software. At this time, the virtual frame of the icon 431 of the panel 430 disappears to show that the fault is determined. At the same time, the panel 430 displays the icon 432 to indicate that the fuel cell system 410 is locked. Afterwards, at time point T23, after the sensor fault is repaired, the fuel cell system 410 is unlocked in the software and starts driving.

[0069] Figure 4C FIG. 4 is a schematic diagram of an example process 40C for locking a fuel system according to yet other embodiments of the present disclosure. Figure 1A , Figure 1B and Figure 3 The embodiment shown is used to describe process 40C. Figure 4C As shown, process 40A shows the driving status of vehicle 400 at three time points during the driving process. Vehicle 400 includes a fuel cell system 410 for providing power for the vehicle and a panel 430 for displaying the status of vehicle 400.

[0070] At time point T31, the vehicle 400 is powered on. During the power-on process of the vehicle 400, the fuel cell system 410 obtains a safety-related historical driving record. At this time, the fuel cell system 410 detects that the fuel cell system 410 was locked during the last driving process. Based on this, the fuel cell system 410 generates a fault indication indicating the historical locking time. The fault indication is displayed to the driver by an icon 432 of the panel 430 to indicate that there may be a component fault that has not yet been repaired.

[0071] exist Figure 4CIn the illustrated embodiment, due to a software fault, the fault diagnosis module does not lock the fuel cell system based on the fault detection indication, and at time point T32, the fault monitoring module detects that the user's startup operation is not suppressed, so that the vehicle 400 has a startup trend. Here, the icon 433 of the panel 430 shows a startup trend. At time point T33, after detecting the startup trend, the fault monitoring module shuts down the fuel cell system 410 in hardware. For example, the fault monitoring module can be a chip reset of the fuel cell controller of the fuel cell system 410. As a result, the fuel cell system 410 is forced to shut down. Here, the icon 434 of the panel 430 indicates that the chip of the fuel cell controller is reset. At this time, the chip of the fuel cell controller needs to be manually repaired before it can be started again.

[0072] Figure 5 1 is a block diagram of an example apparatus 500 for locking a fuel system according to some embodiments of the present disclosure. Figure 5 As shown, the device 500 includes a fault detection module 510. The fault detection module 510 is configured to detect a fault that causes a hardware shutdown of the fuel cell system. The device 500 also includes an indication generation module 520. The indication generation module 520 is configured to generate a fault indication in response to detecting a fault. The device 500 also includes an information generation module 530. The information generation module 530 is configured to generate startup lock information based on the fault indication. The device 500 also includes a system lock module 540. The system lock module 540 is configured to lock the fuel cell system according to the startup lock information.

[0073] In some embodiments, the indication generating module 520 includes: a first indication generating unit configured to generate a first indication indicating the fault in response to detecting the fault; or a second indication generating unit configured to generate a second indication indicating that the fault is repaired in response to determining that the fault is repaired. Here, the fault indication includes the first indication or the second indication.

[0074] In some embodiments, the information generation module 530 includes: a timing unit configured to record the duration for which the fault indication remains unchanged in response to obtaining the fault indication; and an information generation unit configured to generate the start lock information in response to determining that the duration is greater than a predetermined time threshold.

[0075] In some embodiments, the predetermined time threshold depends on a startup time or a self-test time of a safety-related sensor.

[0076] In some embodiments, the device 500 also includes: an operation inhibition module, configured to inhibit the startup operation in response to obtaining an instruction for a startup operation of the fuel cell system during the period when the fuel cell system is locked; an information detection module, configured to detect startup information of the fuel cell system under the startup operation; and a system shutdown unit, configured to shut down the fuel cell system in hardware in response to determining that the startup information indicates that the startup process of the fuel cell system is triggered.

[0077] In some embodiments, the apparatus 500 further includes: a suppression determination module configured to determine that the startup operation is suppressed in response to determining that the startup information indicates that the startup process is not triggered.

[0078] In some embodiments, the system shutdown unit may be configured to reset a reset pin of a control chip of the fuel cell system.

[0079] In some embodiments, the startup information includes at least one of the following: a hydrogen injector (HGI) of the fuel cell system is actuated; a shut-off valve (SIV) of the fuel cell system is actuated; an anode inlet pressure of the fuel cell system is greater than a first pressure threshold; or an anode outlet pressure of the fuel cell system is greater than a second pressure threshold.

[0080] In some embodiments, the system locking module 540 includes: a type determination unit, configured to determine the fault type indicated by the startup locking information in response to obtaining the startup locking information; a locking determination unit, configured to determine whether the fault type triggers locking of the fuel cell system; and a system locking unit, configured to lock the fuel cell system in response to determining that the fault type triggers locking of the fuel cell system.

[0081] In some embodiments, the fault includes at least one of the following: the fuel cell system is locked in a previous driving; or a sensor associated with safety is not ready.

[0082] In some embodiments, the apparatus 500 further comprises: a lock presentation module configured to cause the fuel cell system to present the fault or the fuel cell system to be locked in response to generating the startup lock information.

[0083] It can be understood that by using the apparatus 500 of the present disclosure, at least one of the advantages that can be achieved by the method or process described above can be achieved.

[0084] Figure 6A schematic block diagram of an example device 600 that can be used to implement an embodiment of the present disclosure is shown. As shown, the device 600 includes a computing unit 601, which can perform various appropriate actions and processes according to computer program instructions stored in a read-only memory (ROM) 602 or loaded from a storage unit 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the device 600 can also be stored. The computing unit 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0085] A number of components in the device 600 are connected to the I / O interface 605, which may include, for example: an input unit 606, such as a keyboard, a mouse, etc.; an output unit 607, such as various types of displays, speakers, etc.; a storage unit 608, such as a disk, an optical disk, etc.; and a communication unit 609, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 609 allows the device 600 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0086] The computing unit 601 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 601 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 601 performs the various methods and processes described above, such as method 200. For example, in some embodiments, the method 200 may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 608. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 600 via the ROM 602 and / or the communication unit 609. When the computer program is loaded into the RAM 603 and executed by the computing unit 601, one or more steps of the method 200 described above may be performed. Alternatively, in other embodiments, the computing unit 601 may be configured to perform the method 200 in any other appropriate manner (e.g., by means of firmware).

[0087] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chip systems (SOCs), load programmable logic devices (CPLDs), and the like.

[0088] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0089] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In addition, although each operation is depicted in a specific order, this should be understood as requiring such operations to be performed in the specific order shown or in a sequential order, or requiring that all illustrated operations should be performed to obtain the desired result. In certain environments, multitasking and parallel processing may be advantageous. Similarly, although several specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Certain features described in the context of separate embodiments can also be implemented in a single implementation in combination. On the contrary, the various features described in the context of a single implementation can also be implemented in multiple implementations individually or in any suitable sub-combination.

[0090] Although the subject matter has been described in language specific to structural features and / or methodological logical actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims.

Claims

1. A method for locking a fuel cell system, comprising: detecting a fault causing a hardware shutdown of the fuel cell system; generating a fault indication in response to detecting the fault; generating startup locking information based on the fault indication; as well as The fuel cell system is locked according to the startup lock information.

2. The method of claim 1 , wherein generating the fault indication comprises: In response to detecting the fault, generating a first indication indicating the fault; or In response to determining that the fault is fixed, generating a second indication indicating that the fault is fixed, and The fault indication includes the first indication or the second indication.

3. The method according to claim 1, wherein generating the startup lock information comprises: In response to obtaining the fault indication, recording a duration for which the fault indication remains unchanged; as well as In response to determining that the duration is greater than a predetermined time threshold, the startup lock information is generated. 4 . The method according to claim 3 , wherein the predetermined time threshold depends on a start-up time or a self-test time of a safety-related sensor.

5. The method according to claim 1, further comprising: In response to acquiring an instruction for a startup operation of the fuel cell system, inhibiting the startup operation while the fuel cell system is locked; detecting startup information of the fuel cell system under the startup operation; as well as In response to determining that the startup information indicates that a startup process of the fuel cell system is triggered, the fuel cell system is shut down in hardware.

6. The method according to claim 5, further comprising: In response to determining that the startup information indicates that the startup process is not triggered, it is determined that the startup operation is suppressed.

7. The method of claim 5, wherein shutting down the fuel cell system in hardware comprises: Reset the reset pin of the control chip of the fuel cell system.

8. The method according to claim 5, wherein the startup information includes at least one of the following: A hydrogen injector (HGI) of the fuel cell system is actuated; A shutoff valve (SIV) of the fuel cell system is actuated; The anode inlet pressure of the fuel cell system is greater than a first pressure threshold; or The anode outlet pressure of the fuel cell system is greater than a second pressure threshold.

9. The method of claim 1 , wherein locking the fuel cell system comprises: In response to acquiring the startup lock information, determining a fault type indicated by the startup lock information; determining whether the fault type triggers a lockout of the fuel cell system; as well as In response to determining that the fault type triggers a lockout of the fuel cell system, the fuel cell system is locked out.

10. The method according to claim 1, wherein the fault comprises at least one of the following: The fuel cell system was locked during the previous trip; or The safety-related sensor is not ready.

11. The method according to claim 1, further comprising: In response to generating the startup lock information, the fuel cell system is caused to exhibit the fault or the fuel cell system is locked.

12. A device for locking a fuel cell system, comprising: a fault detection module configured to detect a fault causing a hardware shutdown of the fuel cell system; an indication generating module configured to generate a fault indication in response to detecting the fault; an information generating module, configured to generate startup locking information based on the fault indication; as well as The system locking module is configured to lock the fuel cell system according to the startup locking information.

13. A controller comprising: at least one processor; as well as A memory coupled to the at least one processor and having instructions stored thereon, the instructions, when executed by the at least one processor, causing the controller to perform the method according to any one of claims 1-11.

14. A fuel cell system comprising the controller according to claim 13.

15. A computer-readable storage medium having computer-executable instructions stored thereon, wherein the computer-executable instructions are executed by a processor to implement the method according to any one of claims 1 to 11.

Images