Fuel cell control method and system, vehicle and computer readable storage medium

Abstract

The invention discloses a fuel cell control method and system, a vehicle and a computer readable storage medium. The method comprises the following steps: a functional layer calculates a sensing input signal according to a sensing value of a sensor; the function monitoring layer performs sensing verification on the received sensing input signal output by the function layer; judging whether the sensing verification result is abnormal or not; when the sensing verification result is abnormal, the function monitoring layer judges whether the sensing verification result triggers an emergency shutdown condition or not; when the sensing verification result triggers an emergency shutdown condition, the function monitoring layer generates an emergency shutdown instruction, and the function layer executes an emergency shutdown operation according to the emergency shutdown instruction; the function monitoring layer judges whether the function layer completes emergency shutdown operation or not; and when the function layer does not complete the emergency shutdown operation, the function monitoring layer executes the emergency shutdown operation. And the function monitoring layer is used for checking the function layer, and the emergency shutdown operation is executed when the function layer fails, so that the safety performance is improved.

Description

Technical Field

[0001] The present application relates to the field of fuel cell control technology, and in particular to a fuel cell control method, system, vehicle and computer-readable storage medium. Background Art

[0002] At present, the automotive hydrogen fuel cell engine system includes an air circuit, a hydrogen circuit and a cooling circuit, and the normal operation of the hydrogen fuel cell system is controlled by the hydrogen fuel cell software control. In the conventional hydrogen fuel cell control architecture, the software application layer usually runs in a single core of the controller, and a single algorithm is used to calculate the signal. When the signal is interfered or the sensor is abnormal, it will trigger a fault, which will cause the hydrogen fuel cell system to fail to operate normally and reduce the life of the hydrogen fuel cell stack to a certain extent. In addition, the operating state of the hydrogen fuel cell system is controlled by a state machine, and the state machine is controlled by setting the state machine jump condition. When the received state machine jump condition signal is incorrect, it will cause the state machine to jump abnormally, and then the hydrogen fuel cell system will operate abnormally. Summary of the invention

[0003] In view of this, the present application provides a fuel cell control method, a vehicle and a computer-readable storage medium, which can reduce the probability of shutdown of the fuel cell system and increase the life of the fuel cell stack.

[0004] The present application is introduced below from different aspects. It should be understood that the implementation methods and beneficial effects of the following different aspects can be referenced to each other.

[0005] In a first aspect, the present application provides a fuel cell control method, the fuel cell control method comprising: The functional layer in the processor calculates the sensing input signal according to the sensing value of the sensor, and the functional monitoring layer in the processor running in a different area from the functional layer performs sensing verification on the sensing input signal output by the received functional layer; The function monitoring layer determines whether the sensing verification result is abnormal; When the sensing verification result is abnormal, the functional monitoring layer determines whether the sensing verification result triggers an emergency shutdown condition; When the sensing verification result triggers the emergency stop condition, the functional monitoring layer generates an emergency stop command to the functional layer, and the functional layer performs the emergency stop operation according to the emergency stop command; The function monitoring layer determines whether the function layer completes the emergency shutdown operation; and When the functional layer fails to complete the emergency stop operation, the functional monitoring layer performs the emergency stop operation.

[0006] With the embodiments of the present application, the functional layer and the functional monitoring layer operate in different areas of the processor. When the input sensing signal of the functional layer triggers an emergency shutdown command and the functional layer cannot complete the emergency shutdown operation, the functional monitoring layer is used to perform the emergency shutdown operation to avoid loss of control of the fuel cell system and improve the safety performance of the fuel cell system.

[0007] In combination with the first aspect, in a possible implementation, the function monitoring layer calculates a sensing monitoring signal according to a sensing value of the sensor, controls a state of a monitoring state machine of the function monitoring layer according to the sensing monitoring signal, and receives a state of a function state machine in the function layer; Determine whether the state of the monitoring state machine is consistent with the state of the functional state machine; When the state of the functional state machine is inconsistent with the state of the monitoring state machine, the functional monitoring layer generates an emergency stop command to the functional layer.

[0008] In combination with the first aspect, in a possible implementation manner, the function monitoring layer calculates a sensing monitoring signal according to a sensing value of the sensor; The function monitoring layer calculates the difference between the sensing input signal and the sensing monitoring signal to obtain a sensing verification signal; The function monitoring layer determines whether the sensing verification signal is greater than the corresponding sensing verification threshold; When the sensing verification signal is greater than the sensing verification threshold, the function monitoring layer identifies that the sensing verification result is abnormal; and When the sensing verification signal is less than or equal to the sensing verification threshold, the function monitoring layer recognizes that the sensing verification result is normal.

[0009] In combination with the first aspect, in a possible implementation, when the sensing verification result is normal, the functional monitoring layer generates a sensing adjustment signal to the functional layer; wherein the sensing adjustment signal is an average value of the sensing input signal and the sensing monitoring signal; When the sensing verification result does not trigger the emergency shutdown condition, the functional monitoring layer generates a fault detection instruction to the functional layer.

[0010] In combination with the first aspect, in a possible implementation, the sensing input signal includes a stack entry temperature sensing signal, a stack exit temperature sensing signal and a hydrogen pressure sensing signal; the sensing monitoring signal includes a stack entry temperature monitoring signal corresponding to the stack entry temperature sensing signal, an exit temperature monitoring signal corresponding to the exit temperature sensing signal and a hydrogen pressure monitoring signal corresponding to the hydrogen pressure sensing signal; the sensing verification signal includes a stack entry temperature verification signal, an exit temperature verification signal and a hydrogen pressure verification signal; the stack entry temperature verification signal, the exit temperature verification signal and the hydrogen pressure verification signal respectively correspond to a sensing verification threshold; when any one of the stack entry temperature verification signal, the exit temperature verification signal and the hydrogen pressure verification signal is abnormal, the functional monitoring layer identifies that the sensing verification result is abnormal.

[0011] In combination with the first aspect, in a possible implementation, the stack entry temperature sensing signal and the stack entry temperature monitoring signal are respectively calculated based on the sensing values ​​of temperature sensing elements of different types and located at the same position in the sensor; the stack exit temperature sensing signal and the stack exit temperature monitoring signal are respectively calculated based on the sensing values ​​of temperature sensing elements of different types and located at the same position in the sensor; the hydrogen pressure sensing signal is calculated based on the sensing value of the hydrogen pressure sensing element in the sensor, and the hydrogen pressure monitoring signal is calculated based on the sensing value of the hydrogen pressure sensing element in the sensor or calculated based on the air pressure using a pressure calculation model.

[0012] In combination with the first aspect, in a possible implementation, the emergency stop condition includes an emergency stop threshold; wherein the emergency stop threshold is greater than the sensing verification threshold; and the step of the function monitoring layer determining whether the sensing verification result triggers the emergency stop condition includes: The function monitoring layer determines whether the sensing verification result is greater than or equal to the emergency shutdown threshold; When the sensing verification result is greater than or equal to the emergency stop threshold, the functional monitoring layer identifies the sensing verification result as triggering an emergency stop condition; When the sensing verification result is less than the emergency stop threshold, the functional monitoring layer identifies that the sensing verification result does not trigger the emergency stop condition.

[0013] In a second aspect, the present application provides a fuel cell control system, which is applied to a vehicle; the vehicle further includes a sensor and a processor; the fuel cell control system includes a functional layer and a functional monitoring layer; the functional layer and the functional monitoring layer respectively operate in different areas of the processor; the functional layer calculates a sensing input signal according to a sensing value of the sensor; the functional monitoring layer includes: A signal processing module, used for receiving a sensing input signal output by the functional layer; The signal verification module is electrically connected to the signal processing module, and is used to perform a sensing verification on the sensing input signal and obtain a sensing verification result; when the sensing verification result is abnormal, the signal verification module determines whether the sensing verification result triggers an emergency stop condition; when the sensing verification result triggers the emergency stop condition, the signal verification module generates an emergency stop instruction to control the functional layer to perform an emergency stop operation; A shutdown monitoring module, used to determine whether the functional layer has completed the emergency shutdown operation; and The safety control module is used to execute the emergency stop operation when the functional layer has not completed the emergency stop operation.

[0014] In a third aspect, the present application provides a vehicle, which includes a processor and a memory, wherein the memory is used to store a plurality of program instructions, and when the processor calls the program instructions, the above-mentioned fuel cell control method can be implemented.

[0015] In a fourth aspect, the present application provides a computer-readable storage medium, which stores a plurality of program instructions, and the plurality of program instructions are suitable for being loaded by a processor and executing the above-mentioned fuel cell control method.

[0016] Compared with the prior art, this application has the following advantages: 1. In the embodiments of the present application, the functional layer and the functional monitoring layer operate in different areas of the processor. When the input sensing signal of the functional layer triggers the emergency shutdown condition and the emergency shutdown operation cannot be completed, the functional monitoring layer is used to perform the emergency shutdown operation to avoid the fuel cell system from losing control and improve the safety performance of the fuel cell system.

[0017] 2. In the embodiments of the present application, the functional monitoring layer verifies the sensing input signal of the functional layer, and uses different algorithms to verify the same signal, thereby increasing the credibility of the sensing input signal, reducing emergency shutdown operations caused by abnormal sensing input signals, and reducing the impact of emergency shutdown operations on the life of the battery stack.

[0018] 3. In the embodiments of the present application, the functional layer and the functional monitoring layer use the same jump conditions. Under the same conditions, the state of the monitoring state machine in the functional monitoring layer is used to verify the state of the functional state machine in the functional layer to optimize the robustness of the fuel cell control system. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0020] Figure 1 A flowchart of a fuel cell control method provided in an embodiment of the present application.

[0021] Figure 2 for Figure 1 Detailed flowchart of step S11 in FIG.

[0022] Figure 3 A schematic diagram of the modules of a fuel cell control system provided in an embodiment of the present application.

[0023] Figure 4 A schematic diagram of the modules of a vehicle provided in an embodiment of the present application.

[0024] Main component symbols Steps S11-S19, S111-S113 Vehicle 100 Fuel cell control system 1 Sensor 2 Pile temperature sensor 21 First stack temperature sensing element 211 The second stack temperature sensing element 212 Out-of-pile temperature sensor 22 The first out-of-stack temperature sensing element 221 The second out-of-stack temperature sensing element 222 Hydrogen pressure sensor 23 Processor 3 Memory 4 Communication interface 5 Functional layer 10 Function monitoring layer 20 Sensor input module 11 Control module 12 Fault management unit 121 Functional state machine management unit 122 Signal output module 13 Signal processing module 201 Signal verification module 202 Shutdown monitoring module 203 Security control module 204 Status check module 205 The following specific implementation methods will further illustrate the present application in conjunction with the above-mentioned drawings. DETAILED DESCRIPTION

[0025] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0026] In the description of the present application, it should be understood that the terms "first", "second", "third", "fourth" and "fifth" etc. are used to distinguish different objects rather than to describe a specific order.

[0027] In the description of this application, it should be noted that, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection, an electrical connection, or mutual communication; it can be a direct connection, or an indirect connection through an intermediate medium, it can be the internal connection of two elements or the interaction relationship between two elements. For ordinary technicians in this field, the specific meanings of the above terms in this application can be understood according to specific circumstances.

[0028] The term "comprises" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or device that includes a series of steps or modules is not limited to the listed steps or modules, but may optionally include steps or modules that are not listed, or may optionally include other steps or modules that are inherent to these processes, methods, products, or devices.

[0029] See also Figure 1 , which is a flow chart of a fuel cell control method according to at least one embodiment of the present application. In at least one embodiment of the present invention, the fuel cell control method is applied to a vehicle 100 (such as Figure 4 As shown in FIG. 1 , the vehicle 100 includes a fuel cell control system 1 and a sensor 2. Figure 3 As shown, the fuel cell control system 1 adopts the E-Gas architecture, which includes a functional layer 10, a functional monitoring layer 20 and a controller monitoring layer (not shown). The functional layer 10 and the functional monitoring layer 20 respectively operate in different areas of the processor 3, and data can be exchanged between the two.

[0030] In at least one embodiment of the present application, Figure 4 As shown, the sensor 2 includes a stack entry temperature sensing unit 21, a stack exit temperature sensing unit 22 and at least one hydrogen pressure sensing unit 23. The stack entry temperature sensing unit 21 further includes a first stack entry temperature sensing element 211 and a second stack entry temperature sensing element 212. The stack exit temperature sensing unit 22 further includes a first stack exit temperature sensing element 221 and a second stack exit temperature sensing element 222. The first stack exit temperature sensing element 221 and the second stack exit temperature sensing element 222 are different types of sensing elements, and both sense the stack exit temperature at the same position; the two stack exit temperature sensing elements are different types of sensing elements, and both sense the temperature at the same position. The sensor 2 may also include other types of sensors, such as a current sensor, a speed sensor, etc., but is not limited thereto. The current sensor may be used to detect the current of the solenoid valve. The speed sensor may be used to detect the speed of the driven side and the active side in the clutch (not shown). Therefore, based on the speed of the driven side and the speed of the active side, the speed difference at both ends of the clutch may be obtained.

[0031] The fuel cell control method comprises the following steps: In step S10 , the functional layer 10 calculates a sensing input signal according to the sensing value of the sensor 2 , and the functional monitoring layer 20 performs sensing verification on the sensing input signal output by the received functional layer 10 .

[0032] In at least one embodiment of the present application, the sensing input signal includes a stack entry temperature sensing signal, a stack exit temperature sensing signal, and a hydrogen pressure sensing signal. The stack entry temperature sensing signal is calculated based on the sensing value of the first stack entry temperature sensing element 211; the stack exit temperature sensing signal is calculated based on the sensing value of the first stack exit temperature sensing element 221; and the hydrogen pressure sensing signal is calculated based on the sensing value of the hydrogen pressure sensing unit 23.

[0033] In step S11 , the function monitoring layer 20 determines whether the sensing verification result is abnormal.

[0034] Please also read Figure 2 , which is a detailed flowchart of step S11.

[0035] In step S111 , the function monitoring layer 20 calculates a sensing monitoring signal according to the sensing value of the sensor 2 .

[0036] In at least one embodiment of the present application, the sensing monitoring signal includes a stack entry temperature monitoring signal, a stack exit temperature monitoring signal, and a hydrogen pressure monitoring signal. The stack entry temperature monitoring signal is calculated based on the sensing value of the second stack entry temperature sensing element 212; the stack exit temperature monitoring signal is calculated based on the sensing value of the second stack exit temperature sensing element 222. When there is only one hydrogen pressure sensing unit 23 in the sensor 2, the hydrogen pressure monitoring signal is sensed by the hydrogen pressure sensing unit 23. When there are two hydrogen pressure sensing units 23 in the sensor 2, the hydrogen pressure monitoring signal is sensed by the hydrogen pressure sensing unit 23.

[0037] In step S112 , the function monitoring layer 20 calculates the difference between the sensing input signal and the sensing monitoring signal to obtain a sensing verification signal.

[0038] In at least one embodiment of the present application, the sensing verification signal is the absolute value of the difference between the sensing input signal and the sensing monitoring signal. Specifically, the sensing verification signal includes a stack entry verification signal, a stack exit verification signal, and a hydrogen pressure verification signal.

[0039] In at least one embodiment of the present application, the functional monitoring layer 20 calculates the absolute value of the difference between the stack entry temperature sensing signal and the stack entry temperature monitoring signal as the stack entry temperature verification signal. Similarly, the functional monitoring layer 20 also calculates the absolute value of the difference between the stack temperature sensing signal and the stack exit temperature monitoring signal as the stack exit verification signal, and calculates the absolute value of the difference between the hydrogen pressure sensing signal and the hydrogen pressure monitoring signal as the hydrogen pressure verification signal.

[0040] In step S113 , the function monitoring layer 20 determines whether the sensing verification signal is greater than a corresponding sensing verification threshold.

[0041] In at least one embodiment of the present application, the stack entry temperature verification signal corresponds to an abnormal stack entry temperature threshold (as a sensing verification threshold corresponding to the stack entry temperature), the stack exit temperature verification signal corresponds to an abnormal stack exit temperature threshold (as a sensing verification threshold corresponding to the stack exit temperature), and the hydrogen pressure verification signal corresponds to an abnormal hydrogen pressure threshold (as a sensing verification threshold corresponding to the hydrogen pressure). Among them, the abnormal stack entry temperature threshold, the abnormal stack exit temperature threshold, and the abnormal hydrogen pressure threshold are all empirical values ​​obtained by the fuel cell control system 1 by performing multiple tests by simulating temperature changes and / or pressure changes, and can be set according to requirements, and the specific values ​​are not limited. In at least one embodiment of the present application, under different test conditions, the sensing verification thresholds corresponding to any sensing verification signal are different from each other.

[0042] When the sensing verification signal is less than or equal to the sensing verification threshold, the function monitoring layer 20 recognizes that the sensing verification result is normal, and proceeds to step S12.

[0043] When the sensing verification signal is greater than the sensing verification threshold, the function monitoring layer 20 identifies that the sensing verification result is abnormal, and proceeds to step S13.

[0044] Step S12, when the sensing verification result is normal, the function monitoring layer 20 generates a sensing adjustment signal to the function layer 10, and returns to step S10.

[0045] In at least one embodiment of the present application, the sensing adjustment signal is the average value of the sensing input signal and the sensing monitoring signal. Specifically, the sensing adjustment signal includes an in-stack temperature adjustment signal, an out-stack temperature adjustment signal, and a hydrogen pressure adjustment signal. The in-stack temperature adjustment signal is the average value of the in-stack temperature sensing signal and the in-stack temperature monitoring signal. Similarly, the out-stack temperature adjustment signal is the average value of the out-stack temperature sensing signal and the out-stack temperature monitoring signal, and the hydrogen pressure adjustment signal is the average value of the hydrogen pressure sensing signal and the hydrogen pressure monitoring signal.

[0046] Step S13: when the sensing verification result is abnormal, the function monitoring layer 20 determines whether the sensing verification result triggers an emergency shutdown condition.

[0047] In at least one embodiment of the present application, the emergency shutdown condition includes an emergency shutdown threshold. The emergency shutdown threshold is greater than the abnormal threshold. That is, when the sensing verification signal is greater than the emergency shutdown threshold, it indicates that the difference between the sensing input signal and the monitoring sensing signal exceeds the fault range.

[0048] Step S14 , when the sensing verification result triggers an emergency stop condition, the function monitoring layer 20 generates an emergency stop instruction to the function layer 10 .

[0049] In at least one embodiment of the present application, the functional state machine of the functional layer 10 performs an emergency stop operation upon receiving an emergency stop command. The functional monitoring layer 20 may further accumulate the operation time while generating the emergency stop command, and enter step S16 when the operation time reaches the monitoring time threshold.

[0050] Step S15 , when the sensing verification result does not trigger the emergency shutdown condition, the function monitoring layer 20 generates a fault detection instruction to the function layer 10 .

[0051] In at least one embodiment of the present application, the function monitoring layer 20 is also provided with an anti-shake time. The function monitoring layer 20 accumulates the duration of the abnormal sensing verification result and the emergency shutdown condition is not triggered. When the duration is greater than the jitter threshold, the function monitoring layer 20 generates a fault detection instruction to the function layer 10. The jitter threshold can be 0.5 seconds, which can be set according to the requirements, and the present application does not limit the size of the jitter threshold.

[0052] In at least one embodiment of the present application, upon receiving the fault handling instruction output by the function monitoring layer 20, the function layer 10 performs fault management. Fault management is to classify the abnormal sensing input signals into different levels, formulate different management strategies and early warning methods, and promptly remind the user to perform maintenance inspections.

[0053] Step S16, the function monitoring layer 20 determines whether the function layer 10 has completed the emergency shutdown operation.

[0054] In at least one embodiment of the present application, the function monitoring layer 20 determines whether the emergency shutdown operation is completed by monitoring whether the processor 3 outputs a signal. When the emergency shutdown operation is completed, the processor 3 has no signal output; when the emergency shutdown operation is not completed, the processor 3 still has a signal output.

[0055] Step S17: When the function layer 10 has not completed the emergency shutdown operation, the function monitoring layer 20 performs the emergency shutdown operation.

[0056] In at least one embodiment of the present application, the fuel cell control method further includes, after step S12: In step S18, the functional monitoring layer 20 calculates a sensing monitoring signal based on the sensing value of the sensor 2, controls the state of the monitoring state machine of the functional monitoring layer 20 according to the sensing monitoring signal, and receives the state of the functional state machine in the functional layer 10 to control the state of the monitoring state machine in the functional monitoring layer 20 according to the sensing monitoring signal.

[0057] In at least one embodiment of the present application, the functional layer 10 determines whether the sensing input signal satisfies the jump condition. When the sensing input signal satisfies the jump condition, the functional layer 10 controls the functional state machine to perform a state jump; when the sensing input signal does not meet the jump condition, the functional layer 10 controls the functional state machine to maintain the current state. In at least one embodiment of the present application, the state of the functional state machine includes an operating state and a fault state, and the jump condition may include a fault jump threshold. When the sensing input signal or the sensing adjustment signal is greater than the fault jump threshold, the jump condition for jumping from the operating state to the fault state is met; when the sensing input signal or the sensing adjustment signal is less than or equal to the fault jump threshold, the jump condition is not met. The functional state machine may also have multiple different states, such as an activated state, a waiting state, a standby state, etc., but is not limited thereto. The jump condition may also include a condition for the state machine to be adjusted from the activated state to the waiting state, a condition for the state machine to jump from the waiting state to the starting state, a condition for the state machine to jump from the operating state to the standby state, etc., and is not limited thereto. Among them, the jump condition may include a single condition or a combination of multiple conditions. For example, the condition for the functional state machine to adjust from the activated state to the started state is whether the key is in the On position; the condition for the functional state machine to jump from the activated state to the wait-to-start state is whether the high-voltage operation is completed; the condition for the functional state machine to jump from the wait-to-start state to the started state is whether the pressure signal is within the set value range and there is no fault.

[0058] In at least one embodiment of the present application, the monitoring state machine includes multiple states, and is consistent with the state of the functional state machine, which will not be described in detail here.

[0059] In step S19, the function monitoring layer 20 determines whether the state of the function state machine is consistent with the state of the monitoring state machine.

[0060] When the state of the functional state machine is consistent with the state of the monitoring state machine, return to step S10; When the state of the functional state machine is inconsistent with the state of the monitoring state machine, the process proceeds to step S14.

[0061] Compared with the prior art, this application has the following advantages: 1. In an embodiment of the present application, the functional layer 10 and the functional monitoring layer 20 operate in different areas of the processor 3. When the input sensing signal of the functional layer 10 triggers an emergency shutdown condition and the emergency shutdown operation cannot be completed, the functional monitoring layer 20 is used to perform the emergency shutdown operation to avoid the fuel cell control system 1 from losing control and improve the safety performance of the fuel cell control system 1.

[0062] 2. In the embodiment of the present application, the functional monitoring layer 20 verifies the sensing input signal of the functional layer 10 and the state of the functional state machine. It uses different algorithms to verify the same signal, thereby increasing the credibility of the sensing input signal, reducing emergency shutdown operations caused by abnormal sensing input signals, and further reducing the impact of emergency shutdown operations on the life of the battery stack.

[0063] 3. In the embodiment of the present application, the functional layer 10 and the functional monitoring layer 20 use the same jump condition. Under the same conditions, the state of the monitoring state machine in the functional monitoring layer 20 is used to verify the state of the functional state machine in the functional layer 10 to optimize the robustness of the fuel cell control system 1.

[0064] See also Figure 3 , which is a module diagram of a fuel cell control system 1 of at least one embodiment of the present application. The fuel cell control system 1 adopts an E-Gas architecture, which includes a functional layer 10, a functional monitoring layer 20, and a controller monitoring layer (not shown). The functional layer 10 and the functional monitoring layer 20 run in different areas of the processor 3, respectively, and data can be exchanged between the two.

[0065] The functional layer 10 includes a sensing input module 11 , a control module 12 and a signal output module 13 .

[0066] The sensing input module 11 is used to calculate the sensing value received from the sensor 2 to obtain a sensing input signal and output it to the function monitoring layer 20 .

[0067] The control module 12 includes a fault management unit 121 and a functional state machine management unit 122 .

[0068] The fault management unit 121 is used to receive the sensing input signal of the sensing input module 11 and the sensing adjustment signal output by the function monitoring layer 20, and perform fault management when it is determined that the input signal is abnormal according to the sensing input signal or the sensing adjustment signal. In at least one embodiment of the present application, the fault management unit 121 can classify the abnormal sensing input signal into different levels, formulate different management strategies and early warning methods, and promptly remind the user to perform maintenance inspections.

[0069] The function state machine management unit 122 is used to receive the sensing input signal of the sensing input module 11, and determine whether the sensing input signal meets the jump condition. When the sensing input signal meets the jump condition, the function state machine management unit 122 controls the function state machine to jump to a state; when the sensing input signal does not meet the jump condition, the function state machine management unit 122 controls the function state machine to maintain the current state.

[0070] In at least one embodiment of the present application, the state of the functional state machine includes an operating state and a fault state, and the jump condition may include a fault jump threshold. When the sensing input signal or the sensing adjustment signal is greater than the fault jump threshold, the jump condition for jumping from the operating state to the fault state is met; when the sensing input signal or the sensing adjustment signal is less than or equal to the fault jump threshold, the jump condition is not met. The functional state machine may also have multiple different states, such as an activated state, a waiting state, a standby state, etc., but is not limited thereto. The jump condition may also include a condition for the state machine to be adjusted from the activated state to the waiting state, a condition for the state machine to jump from the waiting state to the starting state, a condition for the state machine to jump from the running state to the standby state, etc., but is not limited thereto. Among them, the jump condition may include a single condition or a combination of multiple conditions. For example, the condition for the functional state machine to be adjusted from the activated state to the starting state is whether the key is in the On position; the condition for the functional state machine to jump from the activated state to the waiting state is whether the upper high pressure operation is completed; the condition for the functional state machine to jump from the waiting state to the starting state is whether the pressure signal is within the set value range and there is no fault.

[0071] The function state machine management unit 122 is also used to receive the sensing adjustment signal output by the function monitoring layer 20 and use the sensing adjustment signal as an input signal. When receiving the sensing adjustment signal output by the function monitoring layer 20, the function state machine management unit 122 determines whether the sensing adjustment signal meets the jump condition. When the sensing adjustment signal meets the jump condition, the function state machine management unit 122 controls the function state machine to jump to a state; when the sensing adjustment signal does not meet the jump condition, the function state machine management unit 122 controls the function state machine to maintain the current state.

[0072] The functional state machine management unit 122 is further configured to execute an emergency stop operation upon receiving an emergency stop instruction output by the functional monitoring layer 20 .

[0073] In at least one embodiment of the present application, the control module 12 may also include an air system control unit, a hydrogen system control unit, a thermal management system control unit, and other control units. The air system control unit is used to detect the air conditions around the vehicle 100 and adjust the air circulation mode in the vehicle 100 in real time; the hydrogen system control unit is used to adjust the opening of the hydrogen proportional valve to control the hydrogen pressure before entering the stack; the thermal management system control unit is used to control and optimize the heat transfer process during the operation of the fuel cell.

[0074] The signal output module 13 is electrically connected to the control module 12 and the processor 3. The signal output module 13 is used to transmit the control signal generated by the control module 12 to the processor 3. In at least one embodiment of the present application, the control signal may include a shutdown control instruction.

[0075] The function monitoring layer 20 includes a signal processing module 201 , a signal verification module 202 , a shutdown monitoring module 203 , a safety control module 204 and a status verification module 205 .

[0076] The signal processing module 201 is connected to the sensing input module 11. The signal processing module 201 is used to receive the sensing input signal output by the sensing input module 11. The signal processing module 201 is also used to calculate the sensing value of the received sensor 2 to obtain a sensing monitoring signal. The signal processing module 201 is also used to control the state of the monitoring state machine in the functional monitoring layer 20 according to the sensing monitoring signal.

[0077] In at least one embodiment of the present application, the monitoring state machine includes multiple states, and is consistent with the state of the functional state machine, which will not be described in detail here.

[0078] The signal verification module 202 is connected to the signal processing module 201 and the fault management unit 121. The signal verification module 202 is used to perform sensing verification on the sensing input signal and determine whether the sensing verification result is abnormal. When the sensing verification result is normal, the signal verification module 202 generates a sensing adjustment signal to the functional layer 10. When the sensing verification result is abnormal, the signal verification module 202 determines whether the sensing verification result triggers an emergency stop condition. When the sensing verification result triggers an emergency stop condition, the signal verification module 202 generates an emergency stop instruction to the functional state machine management unit 122 of the functional layer 10. When the sensing verification result does not trigger an emergency stop condition, the signal verification module 202 generates a fault detection instruction to the fault management unit 121.

[0079] Specifically, the signal verification module 202 receives the sensing monitoring signal output by the signal processing module 201, calculates the difference between the sensing input signal and the sensing monitoring signal to obtain a sensing verification signal, and determines whether the sensing verification signal is greater than the corresponding sensing verification threshold. When the sensing verification signal is greater than the sensing verification threshold, the signal verification module 202 identifies that the sensing verification result is abnormal; when the sensing verification signal is less than or equal to the sensing verification threshold, the signal verification module 202 identifies that the sensing verification result is normal.

[0080] In at least one embodiment of the present application, the sensing input signal includes a stack entry temperature sensing signal, a stack exit temperature sensing signal and a hydrogen pressure sensing signal; the sensing monitoring signal includes a stack entry temperature monitoring signal corresponding to the stack entry temperature sensing signal, an exit temperature monitoring signal corresponding to the exit temperature sensing signal and a hydrogen pressure monitoring signal corresponding to the hydrogen pressure sensing signal; the sensing verification signal includes a stack entry temperature verification signal, an exit temperature verification signal and a hydrogen pressure verification signal; the stack entry temperature verification signal is the absolute value of the difference between the stack entry temperature sensing signal and the stack entry temperature monitoring signal; the exit temperature verification signal is the absolute value of the difference between the exit temperature sensing signal and the exit temperature monitoring signal; the hydrogen pressure verification signal is the absolute value of the difference between the hydrogen pressure sensing signal and the hydrogen pressure monitoring signal; the stack entry temperature verification signal, the exit temperature verification signal and the hydrogen pressure verification signal each correspond to a sensing verification threshold. The stack entry temperature verification signal corresponds to an abnormal stack entry temperature threshold (as the sensing verification threshold corresponding to the stack entry temperature), the stack exit temperature verification signal corresponds to an abnormal stack exit temperature threshold (as the sensing verification threshold corresponding to the stack exit temperature), and the hydrogen pressure verification signal corresponds to an abnormal hydrogen pressure threshold (as the sensing verification threshold corresponding to the hydrogen pressure). Among them, the abnormal stack entry temperature threshold, the abnormal stack exit temperature threshold, and the abnormal hydrogen pressure threshold are all values ​​obtained by the fuel cell control system 1 by performing multiple tests by simulating temperature changes and / or pressure changes. In at least one embodiment of the present application, under different test conditions, the sensing verification thresholds corresponding to any sensing verification signal are different. When any one of the stack entry temperature verification signal, the stack exit temperature verification signal, and the hydrogen pressure verification signal is abnormal, the signal verification module identifies that the sensing verification result is abnormal. The in-pile temperature sensing signal and the in-pile temperature monitoring signal are calculated based on the sensing values ​​of temperature sensing elements of different types and located at the same position in sensor 2; the out-pile temperature sensing signal and the out-pile temperature monitoring signal are calculated based on the sensing values ​​of temperature sensing elements of different types and located at the same position in sensor 2; the hydrogen pressure sensing signal is calculated based on the sensing value of the hydrogen pressure sensing element in sensor 2, and the hydrogen pressure monitoring signal is calculated based on the sensing value of the hydrogen pressure sensing element in sensor 2 or calculated based on the air pressure using a pressure calculation model.

[0081] In at least one embodiment of the present application, the signal verification module 202 is also provided with an anti-shake time. The signal verification module 202 accumulates the duration of the abnormal sensing verification result and the emergency shutdown condition is not triggered. When the duration is greater than the jitter threshold, the function monitoring layer 20 generates a fault detection instruction to the function layer 10. The jitter threshold can be 0.5 seconds, which can be set according to the requirements, and the present application does not limit the size of the jitter threshold.

[0082] In at least one embodiment of the present application, the emergency stop condition includes an emergency stop threshold. The emergency stop threshold is greater than the sensing verification threshold. The signal verification module 202 is also used to determine whether the sensing verification result is greater than or equal to the emergency stop threshold. When the sensing verification result is greater than or equal to the emergency stop threshold, the signal verification module 202 identifies that the sensing verification result triggers the emergency stop condition; when the sensing verification result is less than the emergency stop threshold, the signal verification module 202 identifies that the sensing verification result does not trigger the emergency stop condition. In at least one embodiment of the present application, the signal verification module 202 can further accumulate the operating time while generating the emergency stop instruction.

[0083] The shutdown monitoring module 203 is electrically connected to the processor 3. The shutdown monitoring module 203 is used to determine whether the functional layer 10 has completed the emergency shutdown operation. In at least one embodiment of the present application, the shutdown monitoring module 203 determines whether the functional layer 10 has completed the emergency shutdown operation when the operation time reaches the monitoring time threshold. The shutdown monitoring module 203 determines whether the functional layer 10 has completed the emergency shutdown operation by monitoring the output signal of the processor 3. When the emergency shutdown operation is completed, the processor 3 has no signal output; when the emergency shutdown operation is not completed, the processor 3 still has a signal output.

[0084] The safety control module 204 is electrically connected to the shutdown monitoring module 203. The safety control module 204 is used to perform an emergency shutdown operation when the functional layer 10 has not completed the emergency shutdown operation.

[0085] The state checking module 205 is electrically connected to the function state machine management unit 122. The state checking module 205 is used to receive the state of the function state machine output by the function state machine management unit 122, receive the state of the monitoring state machine output by the signal processing module 201, and determine whether the state of the function state machine is consistent with the state of the monitoring state machine. When the state of the function state machine is inconsistent with the state of the monitoring state machine, the state checking module 205 generates an emergency stop command to the function state machine management unit 122 in the function layer 10.

[0086] See also Figure 4, which is a block diagram of a vehicle 100 of at least one embodiment of the present application. The vehicle 100 is a hybrid vehicle. It is understood that the present application does not limit the type of the vehicle 100, for example, it can be a plug-in hybrid vehicle or a gasoline-electric hybrid vehicle. Among them, the vehicle 100 uses a fuel cell as a power source.

[0087] The vehicle 100 includes a fuel cell control system 1, a sensor 2, a processor 3, a memory 4, and a communication interface 5. The fuel cell control system 1, the sensor 2, the processor 3, the memory 4, and the communication interface 5 can be connected via a communication bus and communicate with each other.

[0088] The specific contents of the fuel cell control system 1 and the sensor 2 can refer to the specific description of the above-mentioned fuel cell control method, which will not be described in detail here.

[0089] The processor 3 may be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of the above program.

[0090] The memory 4 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 4 may exist independently and be connected to the processor 3 via a bus. The memory 4 may also be integrated with the processor 3.

[0091] The memory 4 is used to store program instructions for executing the above scheme, and the execution is controlled by the processor 3. The processor 3 is used to execute the program instructions stored in the memory 4. The program instructions stored in the memory 4 can be executed Figure 1 as well as Figure 2 Part or all of the steps of the fuel cell control method described in.

[0092] The communication interface 5 is used to communicate with other devices or communication networks, such as Ethernet, Radio Access Network (RAN), Wireless Local Area Networks (WLAN), etc.

[0093] The embodiment of the present application also provides a computer-readable storage medium. The computer-readable storage medium stores program instructions, and when the program instructions are executed on a computing device, the computing device executes the fuel cell control method provided in the above embodiment.

[0094] It is obvious to those skilled in the art that the present application is not limited to the details of the above exemplary embodiments, and that the present application can be implemented in other specific forms without departing from the spirit or basic features of the present application. Therefore, as long as they are within the scope of the essence and spirit of the present application, appropriate changes and modifications made to the above embodiments should fall within the scope of protection claimed in the present application.

Claims

1. A fuel cell control method, characterized in that: The fuel cell control method comprises: The functional layer in the processor calculates a sensing input signal according to the sensing value of the sensor, and the functional monitoring layer in the processor that runs in a different area from the functional monitoring layer performs sensing verification on the sensing input signal output by the received functional layer; The function monitoring layer determines whether the sensing verification result is abnormal; When the sensing verification result is abnormal, the function monitoring layer determines whether the sensing verification result triggers an emergency shutdown condition; When the sensing verification result triggers the emergency stop condition, the function monitoring layer generates an emergency stop instruction to the function layer, and the function layer performs an emergency stop operation according to the emergency stop instruction; The function monitoring layer determines whether the function layer completes the emergency shutdown operation; and When the functional layer fails to complete the emergency shutdown operation, the functional monitoring layer performs the emergency shutdown operation.

2. The fuel cell control method according to claim 1, characterized in that: The fuel cell controller also includes: The function monitoring layer calculates a sensing monitoring signal according to the sensing value of the sensor, controls the state of the monitoring state machine of the function monitoring layer according to the sensing monitoring signal, and receives the state of the function state machine in the function layer; Determining whether the state of the monitoring state machine is consistent with the state of the functional state machine; When the state of the functional state machine is inconsistent with the state of the monitoring state machine, the functional monitoring layer generates the emergency stop instruction to the functional layer.

3. The fuel cell control method according to claim 1, characterized in that: The step of determining whether the sensing verification result is abnormal by the function monitoring layer includes: The function monitoring layer calculates and obtains a sensing monitoring signal according to the sensing value of the sensor; The function monitoring layer calculates the difference between the sensing input signal and the sensing monitoring signal to obtain a sensing verification signal; The function monitoring layer determines whether the sensing verification signal is greater than a corresponding sensing verification threshold; When the sensing verification signal is greater than the sensing verification threshold, the function monitoring layer identifies that the sensing verification result is abnormal; and When the sensing verification signal is less than or equal to the sensing verification threshold, the function monitoring layer identifies that the sensing verification result is normal.

4. The fuel cell control method according to claim 3, characterized in that: The fuel cell controller also includes: When the sensing verification result is normal, the functional monitoring layer generates a sensing adjustment signal to the functional layer; wherein the sensing adjustment signal is an average value of the sensing input signal and the sensing monitoring signal; When the sensing verification result does not trigger the emergency shutdown condition, the functional monitoring layer generates a fault detection instruction to the functional layer.

5. The fuel cell control method according to claim 3, characterized in that: The sensing input signal includes a stack entry temperature sensing signal, a stack exit temperature sensing signal and a hydrogen pressure sensing signal; the sensing monitoring signal includes a stack entry temperature monitoring signal corresponding to the stack entry temperature sensing signal, an exit temperature monitoring signal corresponding to the exit temperature sensing signal and a hydrogen pressure monitoring signal corresponding to the hydrogen pressure sensing signal; the sensing verification signal includes a stack entry temperature verification signal, an exit temperature verification signal and a hydrogen pressure verification signal; the stack entry temperature verification signal, the exit temperature verification signal and the hydrogen pressure verification signal respectively correspond to a sensing verification threshold; when any one of the stack entry temperature verification signal, the exit temperature verification signal and the hydrogen pressure verification signal is abnormal, the functional monitoring layer identifies that the sensing verification result is abnormal.

6. The fuel cell control method according to claim 5, characterized in that: The stack entry temperature sensing signal and the stack entry temperature monitoring signal are respectively calculated based on the sensing values ​​of temperature sensing elements of different types and located at the same position in the sensor; the stack exit temperature sensing signal and the stack exit temperature monitoring signal are respectively calculated based on the sensing values ​​of temperature sensing elements of different types and located at the same position in the sensor; the hydrogen pressure sensing signal is calculated based on the sensing value of the hydrogen pressure sensing element in the sensor, and the hydrogen pressure monitoring signal is calculated based on the sensing value of the hydrogen pressure sensing element in the sensor or calculated based on the air pressure using a pressure calculation model.

7. The fuel cell control method according to claim 3, characterized in that: The emergency stop condition includes an emergency stop threshold; wherein the emergency stop threshold is greater than the sensing verification threshold; and the step of the function monitoring layer determining whether the sensing verification result triggers the emergency stop condition includes: The function monitoring layer determines whether the sensing verification result is greater than or equal to the emergency shutdown threshold; When the sensing verification result is greater than or equal to the emergency shutdown threshold, the function monitoring layer identifies that the sensing verification result triggers the emergency shutdown condition; When the sensing verification result is less than the emergency shutdown threshold, the function monitoring layer identifies that the sensing verification result does not trigger the emergency shutdown condition.

8. A fuel cell control system, applied to a vehicle; the vehicle further comprises a sensor and a processor; characterized in that: The fuel cell control system comprises a functional layer and a functional monitoring layer; the functional layer and the functional monitoring layer respectively operate in different areas of the processor; the functional layer calculates a sensing input signal according to a sensing value of the sensor; The function monitoring layer includes: A signal processing module, used for receiving the sensing input signal output by the functional layer; A signal verification module, electrically connected to the signal processing module, for performing a sensing verification on the sensing input signal and obtaining a sensing verification result; when the sensing verification result is abnormal, the signal verification module determines whether the sensing verification result triggers an emergency stop condition; when the sensing verification result triggers an emergency stop condition, the signal verification module generates an emergency stop instruction to control the functional layer to perform an emergency stop operation; A shutdown monitoring module, used to determine whether the functional layer completes the emergency shutdown operation; and A safety control module is used to perform an emergency stop operation when the functional layer has not completed the emergency stop operation.

9. A vehicle, characterized in that: The vehicle includes a processor and a memory, the memory is used to store a plurality of program instructions, and when the processor calls the program instructions, the fuel cell control method as described in any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a plurality of program instructions, and the plurality of program instructions are suitable for being loaded by a processor and executing the fuel cell control method according to any one of claims 1 to 7.

Images