Fuel cell control method, system, vehicle, and computer-readable storage medium

Abstract

The application discloses a fuel cell control method, system, vehicle and computer readable storage medium, the method comprising: a functional layer calculates a sensing input signal according to a sensing value of a sensor; a function monitoring layer performs sensing verification on the sensing input signal output by the functional layer; whether the sensing verification result is abnormal is determined; when the sensing verification result is abnormal, the function monitoring layer determines whether the sensing verification result triggers an emergency shutdown condition; when the sensing verification result triggers the emergency shutdown condition, the function monitoring layer generates an emergency shutdown instruction, and the functional layer executes the emergency shutdown operation according to the emergency shutdown instruction; the function monitoring layer determines whether the functional layer completes the emergency shutdown operation; when the functional layer does not complete the emergency shutdown operation, the function monitoring layer executes the emergency shutdown operation. The function monitoring layer is used for verifying the functional layer, and the emergency shutdown operation is executed when the functional layer fails, so that the safety performance is improved.

Description

Technical Field

[0001] The present application relates to the field of fuel cell control technology, and in particular to a fuel cell control method, system, vehicle, and computer-readable storage medium. Background Art

[0002] At present, the automotive hydrogen fuel cell engine system includes an air path, a hydrogen path, and a cooling path. The normal operation of the hydrogen fuel cell system is controlled by the hydrogen fuel cell software control. In the conventional hydrogen fuel cell control architecture, the software application layer usually runs in a single core of the controller, and a single algorithm is used to calculate the signal. When the signal is interfered with or the sensor is abnormal, a fault will be triggered, which will cause the hydrogen fuel cell system to fail to operate normally and reduce the life of the hydrogen fuel cell stack to a certain extent. In addition, the operating status of the hydrogen fuel cell system is controlled by a state machine, and the control of the state machine is achieved by setting the state machine jump condition. When the received state machine jump condition signal is incorrect, it will cause the state machine to jump abnormally, and then the hydrogen fuel cell system will operate abnormally. Summary of the Invention

[0003] In view of this, the present application provides a fuel cell control method, a vehicle, and a computer-readable storage medium, which can reduce the probability of fuel cell system shutdown and increase the life of the fuel cell stack.

[0004] The present application is introduced below from different aspects. It should be understood that the implementation methods and beneficial effects of the following different aspects can be referenced to each other.

[0005] In a first aspect, the present application provides a fuel cell control method, the fuel cell control method comprising:

[0006] The functional layer in the processor calculates the sensing input signal according to the sensing value of the sensor, and the functional monitoring layer in the processor running in a different area from the functional layer performs sensing verification on the sensing input signal output by the received functional layer;

[0007] The function monitoring layer determines whether the sensing verification result is abnormal;

[0008] When the sensing verification result is abnormal, the functional monitoring layer determines whether the sensing verification result triggers an emergency shutdown condition;

[0009] When the sensing verification result triggers the emergency stop condition, the functional monitoring layer generates an emergency stop instruction to the functional layer, and the functional layer performs the emergency stop operation according to the emergency stop instruction;

[0010] The function monitoring layer determines whether the function layer has completed the emergency shutdown operation; and

[0011] When the functional layer fails to complete the emergency stop operation, the functional monitoring layer performs the emergency stop operation.

[0012] In an embodiment of the present application, the functional layer and the functional monitoring layer operate in different areas of the processor. When the input sensing signal of the functional layer triggers an emergency shutdown instruction and the functional layer is unable to complete the emergency shutdown operation, the functional monitoring layer is used to perform the emergency shutdown operation to avoid the fuel cell system from losing control and improve the safety performance of the fuel cell system.

[0013] In conjunction with the first aspect, in one possible implementation, the function monitoring layer calculates a sensing monitoring signal based on a sensing value of the sensor, controls a state of a monitoring state machine of the function monitoring layer based on the sensing monitoring signal, and receives a state of a function state machine in the function layer;

[0014] Determine whether the state of the monitoring state machine is consistent with the state of the functional state machine;

[0015] When the state of the functional state machine is inconsistent with the state of the monitoring state machine, the functional monitoring layer generates an emergency stop command to the functional layer.

[0016] In conjunction with the first aspect, in a possible implementation, the function monitoring layer calculates and obtains a sensing monitoring signal according to a sensing value of the sensor;

[0017] The function monitoring layer calculates the difference between the sensing input signal and the sensing monitoring signal to obtain a sensing verification signal;

[0018] The function monitoring layer determines whether the sensing verification signal is greater than the corresponding sensing verification threshold;

[0019] When the sensing verification signal is greater than the sensing verification threshold, the function monitoring layer identifies that the sensing verification result is abnormal; and

[0020] When the sensing verification signal is less than or equal to the sensing verification threshold, the function monitoring layer recognizes that the sensing verification result is normal.

[0021] In conjunction with the first aspect, in one possible implementation, when the sensing verification result is normal, the functional monitoring layer generates a sensing adjustment signal to the functional layer; wherein the sensing adjustment signal is an average value of the sensing input signal and the sensing monitoring signal;

[0022] When the sensing verification result does not trigger the emergency shutdown condition, the functional monitoring layer generates a fault detection instruction to the functional layer.

[0023] In combination with the first aspect, in a possible implementation, the sensing input signal includes a stack entry temperature sensing signal, a stack exit temperature sensing signal and a hydrogen pressure sensing signal; the sensing monitoring signal includes a stack entry temperature monitoring signal corresponding to the stack entry temperature sensing signal, an exit temperature monitoring signal corresponding to the exit temperature sensing signal and a hydrogen pressure monitoring signal corresponding to the hydrogen pressure sensing signal; the sensing verification signal includes a stack entry temperature verification signal, an exit temperature verification signal and a hydrogen pressure verification signal; the stack entry temperature verification signal, the exit temperature verification signal and the hydrogen pressure verification signal respectively correspond to a sensing verification threshold; when any one of the stack entry temperature verification signal, the exit temperature verification signal and the hydrogen pressure verification signal is abnormal, the functional monitoring layer identifies that the sensing verification result is abnormal.

[0024] In combination with the first aspect, in one possible implementation, the entry temperature sensing signal and the entry temperature monitoring signal are respectively calculated based on the sensing values ​​of temperature sensing elements of different types and located at the same position in the sensor; the exit temperature sensing signal and the exit temperature monitoring signal are respectively calculated based on the sensing values ​​of temperature sensing elements of different types and located at the same position in the sensor; the hydrogen pressure sensing signal is calculated based on the sensing value of the hydrogen pressure sensing element in the sensor, and the hydrogen pressure monitoring signal is calculated based on the sensing value of the hydrogen pressure sensing element in the sensor or calculated based on the air pressure using a pressure calculation model.

[0025] In conjunction with the first aspect, in one possible implementation, the emergency shutdown condition includes an emergency shutdown threshold; wherein the emergency shutdown threshold is greater than the sensing verification threshold; and the step of the functional monitoring layer determining whether the sensing verification result triggers the emergency shutdown condition includes:

[0026] The function monitoring layer determines whether the sensing verification result is greater than or equal to the emergency shutdown threshold;

[0027] When the sensing verification result is greater than or equal to the emergency shutdown threshold, the functional monitoring layer identifies the sensing verification result as triggering an emergency shutdown condition;

[0028] When the sensing verification result is less than the emergency shutdown threshold, the functional monitoring layer identifies that the sensing verification result does not trigger the emergency shutdown condition.

[0029] In a second aspect, the present application provides a fuel cell control system for use in a vehicle; the vehicle further includes a sensor and a processor; the fuel cell control system includes a functional layer and a functional monitoring layer; the functional layer and the functional monitoring layer respectively operate in different areas of the processor; the functional layer calculates a sensing input signal based on a sensing value of the sensor; the functional monitoring layer includes:

[0030] A signal processing module, configured to receive a sensing input signal output by the functional layer;

[0031] A signal verification module is electrically connected to the signal processing module and is used to perform sensing verification on the sensing input signal and obtain a sensing verification result; when the sensing verification result is abnormal, the signal verification module determines whether the sensing verification result triggers an emergency stop condition; when the sensing verification result triggers the emergency stop condition, the signal verification module generates an emergency stop instruction to control the functional layer to perform the emergency stop operation;

[0032] A shutdown monitoring module, used to determine whether the functional layer has completed the emergency shutdown operation; and

[0033] The safety control module is used to execute the emergency stop operation when the functional layer has not completed the emergency stop operation.

[0034] In a third aspect, the present application provides a vehicle comprising a processor and a memory, wherein the memory is used to store a plurality of program instructions, and when the processor calls the program instructions, the above-mentioned fuel cell control method can be implemented.

[0035] In a fourth aspect, the present application provides a computer-readable storage medium, which stores a plurality of program instructions, and the plurality of program instructions are suitable for being loaded by a processor and executing the above-mentioned fuel cell control method.

[0036] Compared with the prior art, this application has the following advantages:

[0037] 1. In an embodiment of the present application, the functional layer and the functional monitoring layer operate in different areas of the processor. When the input sensing signal of the functional layer triggers an emergency shutdown condition and the emergency shutdown operation cannot be completed, the functional monitoring layer is used to perform the emergency shutdown operation to avoid the fuel cell system from losing control and improve the safety performance of the fuel cell system.

[0038] 2. In the embodiment of the present application, the functional monitoring layer verifies the sensing input signal of the functional layer, and uses different algorithms to verify the same signal, thereby increasing the credibility of the sensing input signal, reducing emergency shutdown operations caused by abnormal sensing input signals, and reducing the impact of emergency shutdown operations on the life of the battery stack.

[0039] 3. In the embodiment of the present application, the functional layer and the functional monitoring layer use the same jump conditions. Under the same conditions, the state of the monitoring state machine in the functional monitoring layer is used to verify the state of the functional state machine in the functional layer to optimize the robustness of the fuel cell control system. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without any creative work.

[0041] Figure 1 This is a flow chart of a fuel cell control method provided in an embodiment of the present application.

[0042] Figure 2 for Figure 1 Detailed flowchart of step S11 in FIG.

[0043] Figure 3 A schematic diagram of the modules of the fuel cell control system provided in an embodiment of the present application.

[0044] Figure 4 A schematic diagram of the modules of a vehicle provided in an embodiment of the present application.

[0045] Description of main component symbols

[0046] Steps S11-S19, S111-S113

[0047] Vehicle 100

[0048] Fuel cell control system 1

[0049] Sensor 2

[0050] Pile temperature sensor 21

[0051] First stack temperature sensing element 211

[0052] Second stack temperature sensing element 212

[0053] Outlet temperature sensor 22

[0054] First stack temperature sensing element 221

[0055] Second stack temperature sensing element 222

[0056] Hydrogen pressure sensor 23

[0057] Processor 3

[0058] Memory 4

[0059] Communication interface 5

[0060] Functional layer 10

[0061] Function monitoring layer 20

[0062] Sensing input module 11

[0063] Control module 12

[0064] Fault management unit 121

[0065] Functional state machine management unit 122

[0066] Signal output module 13

[0067] Signal processing module 201

[0068] Signal verification module 202

[0069] Shutdown monitoring module 203

[0070] Security control module 204

[0071] Status verification module 205

[0072] The following specific implementation methods will further illustrate the present application in conjunction with the above-mentioned drawings. DETAILED DESCRIPTION

[0073] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this application.

[0074] In the description of this application, it should be understood that the terms "first", "second", "third", "fourth" and "fifth" are used to distinguish different objects rather than to describe a specific order.

[0075] In the description of this application, it should be noted that, unless otherwise expressly specified or limited, the terms "installed," "connected," and "connected" should be understood in a broad sense. For example, they can refer to fixed connections, detachable connections, or integral connections; they can refer to mechanical connections, electrical connections, or mutual communication; they can refer to direct connections or indirect connections through an intermediate medium; they can refer to internal communication between two components or the interaction between two components. Those skilled in the art will understand the specific meanings of the above terms in this application based on specific circumstances.

[0076] The terms "comprise," "comprising," and any variations thereof, are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or apparatus comprising a series of steps or modules is not limited to the listed steps or modules but may optionally include steps or modules not listed, or may optionally include other steps or modules inherent to the process, method, product, or apparatus.

[0077] See also Figure 1 , which is a flow chart of a fuel cell control method according to at least one embodiment of the present application. In at least one embodiment of the present invention, the fuel cell control method is applied to a vehicle 100 (such as Figure 4 As shown in FIG. 1 , the vehicle 100 includes a fuel cell control system 1 and a sensor 2. Figure 3 As shown, the fuel cell control system 1 adopts the E-Gas architecture, which includes a functional layer 10, a functional monitoring layer 20, and a controller monitoring layer (not shown). The functional layer 10 and the functional monitoring layer 20 respectively operate in different areas of the processor 3, and data can be exchanged between them.

[0078] In at least one embodiment of the present application, Figure 4 As shown, sensor 2 includes an inlet temperature sensor 21, an outlet temperature sensor 22, and at least one hydrogen pressure sensor 23. The inlet temperature sensor 21 further includes a first inlet temperature sensor element 211 and a second inlet temperature sensor element 212. The outlet temperature sensor 22 further includes a first outlet temperature sensor element 221 and a second outlet temperature sensor element 222. The first outlet temperature sensor element 221 and the second outlet temperature sensor element 222 are different types of sensing elements and both sense the outlet temperature at the same location. The two outlet temperature sensors are different types of sensing elements and both sense the temperature at the same location. Sensor 2 may also include other types of sensors, such as current sensors and speed sensors, but is not limited to these. A current sensor can be used to detect the current of the solenoid valve. A speed sensor can be used to detect the speed of the driven and driving sides of a clutch (not shown). Therefore, based on the speed of the driven and driving sides, the speed difference across the clutch can be determined.

[0079] The fuel cell control method includes the following steps:

[0080] In step S10 , the functional layer 10 calculates a sensing input signal according to the sensing value of the sensor 2 , and the functional monitoring layer 20 performs sensing verification on the sensing input signal output by the received functional layer 10 .

[0081] In at least one embodiment of the present application, the sensing input signals include a stack entry temperature sensing signal, a stack exit temperature sensing signal, and a hydrogen pressure sensing signal. The stack entry temperature sensing signal is calculated based on the sensing value of the first stack entry temperature sensing element 211 ; the stack exit temperature sensing signal is calculated based on the sensing value of the first stack exit temperature sensing element 221 ; and the hydrogen pressure sensing signal is calculated based on the sensing value of the hydrogen pressure sensing unit 23 .

[0082] In step S11 , the function monitoring layer 20 determines whether the sensing verification result is abnormal.

[0083] Please also refer to Figure 2 , which is a detailed flowchart of step S11.

[0084] In step S111 , the function monitoring layer 20 calculates and obtains a sensing monitoring signal according to the sensing value of the sensor 2 .

[0085] In at least one embodiment of the present application, the sensing monitoring signals include a stack entry temperature monitoring signal, a stack exit temperature monitoring signal, and a hydrogen pressure monitoring signal. The stack entry temperature monitoring signal is calculated based on the sensed value of the second stack entry temperature sensing element 212; the stack exit temperature monitoring signal is calculated based on the sensed value of the second stack exit temperature sensing element 222. When the sensor 2 has only one hydrogen pressure sensing unit 23, the hydrogen pressure monitoring signal is sensed by the hydrogen pressure sensing unit 23. When the sensor 2 has two hydrogen pressure sensing units 23, the hydrogen pressure monitoring signal is sensed by the hydrogen pressure sensing unit 23.

[0086] In step S112 , the function monitoring layer 20 calculates the difference between the sensing input signal and the sensing monitoring signal to obtain a sensing verification signal.

[0087] In at least one embodiment of the present application, the sensing verification signal is the absolute value of the difference between the sensing input signal and the sensing monitoring signal. Specifically, the sensing verification signal includes a stack entry verification signal, a stack exit verification signal, and a hydrogen pressure verification signal.

[0088] In at least one embodiment of the present application, the functional monitoring layer 20 calculates the absolute value of the difference between the stack entry temperature sensing signal and the stack entry temperature monitoring signal as the stack entry temperature verification signal. Similarly, the functional monitoring layer 20 also calculates the absolute value of the difference between the stack temperature sensing signal and the stack exit temperature monitoring signal as the stack exit verification signal, and calculates the absolute value of the difference between the hydrogen pressure sensing signal and the hydrogen pressure monitoring signal as the hydrogen pressure verification signal.

[0089] In step S113 , the function monitoring layer 20 determines whether the sensing verification signal is greater than a corresponding sensing verification threshold.

[0090] In at least one embodiment of the present application, the stack entry temperature verification signal corresponds to an abnormal stack entry temperature threshold (serving as a sensing verification threshold corresponding to the stack entry temperature), the stack exit temperature verification signal corresponds to an abnormal stack exit temperature threshold (serving as a sensing verification threshold corresponding to the stack exit temperature), and the hydrogen pressure verification signal corresponds to a abnormal hydrogen pressure threshold (serving as a sensing verification threshold corresponding to the hydrogen pressure). The abnormal stack entry temperature threshold, abnormal stack exit temperature threshold, and abnormal hydrogen pressure threshold are empirical values ​​obtained by the fuel cell control system 1 through multiple tests simulating temperature and / or pressure changes. These values ​​can be set as needed, and the specific values ​​are not limited. In at least one embodiment of the present application, under different test conditions, the sensing verification thresholds corresponding to any sensing verification signal are different.

[0091] When the sensing verification signal is less than or equal to the sensing verification threshold, the function monitoring layer 20 recognizes that the sensing verification result is normal and proceeds to step S12.

[0092] When the sensing verification signal is greater than the sensing verification threshold, the function monitoring layer 20 identifies that the sensing verification result is abnormal and proceeds to step S13 .

[0093] In step S12 , when the sensing verification result is normal, the function monitoring layer 20 generates a sensing adjustment signal to the function layer 10 , and returns to step S10 .

[0094] In at least one embodiment of the present application, the sensing adjustment signal is the average of the sensing input signal and the sensing monitoring signal. Specifically, the sensing adjustment signal includes an inlet temperature adjustment signal, an outlet temperature adjustment signal, and a hydrogen pressure adjustment signal. The inlet temperature adjustment signal is the average of the inlet temperature sensing signal and the inlet temperature monitoring signal. Similarly, the outlet temperature adjustment signal is the average of the outlet temperature sensing signal and the outlet temperature monitoring signal, and the hydrogen pressure adjustment signal is the average of the hydrogen pressure sensing signal and the hydrogen pressure monitoring signal.

[0095] Step S13 : When the sensing verification result is abnormal, the function monitoring layer 20 determines whether the sensing verification result triggers an emergency shutdown condition.

[0096] In at least one embodiment of the present application, the emergency shutdown condition includes an emergency shutdown threshold. The emergency shutdown threshold is greater than the abnormality threshold. That is, when the sensing verification signal is greater than the emergency shutdown threshold, it indicates that the difference between the sensing input signal and the monitoring sensing signal exceeds the fault range.

[0097] In step S14 , when the sensing verification result triggers an emergency shutdown condition, the function monitoring layer 20 generates an emergency shutdown instruction to the function layer 10 .

[0098] In at least one embodiment of the present application, the functional state machine of the functional layer 10 executes an emergency stop operation upon receiving an emergency stop command. The functional monitoring layer 20 may further accumulate an operation time while generating the emergency stop command, and enter step S16 when the operation time reaches a monitoring time threshold.

[0099] Step S15 : When the sensing verification result does not trigger the emergency shutdown condition, the function monitoring layer 20 generates a fault detection instruction to the function layer 10 .

[0100] In at least one embodiment of the present application, the functional monitoring layer 20 is also configured with an anti-jitter timer. The functional monitoring layer 20 accumulates the duration of abnormal sensor verification results without triggering an emergency shutdown condition. When this duration exceeds a jitter threshold, the functional monitoring layer 20 generates a fault detection instruction to the functional layer 10. The jitter threshold can be 0.5 seconds and can be set as needed. This application does not impose any restrictions on the jitter threshold.

[0101] In at least one embodiment of the present application, upon receiving a fault handling instruction output by the function monitoring layer 20, the function layer 10 performs fault management. Fault management involves classifying abnormal sensor input signals into different levels, formulating different management strategies and early warning methods, and promptly reminding users to perform maintenance inspections.

[0102] In step S16 , the function monitoring layer 20 determines whether the function layer 10 has completed the emergency shutdown operation.

[0103] In at least one embodiment of the present application, the function monitoring layer 20 determines whether the emergency shutdown operation is completed by monitoring whether the processor 3 outputs a signal. When the emergency shutdown operation is completed, the processor 3 does not output a signal; when the emergency shutdown operation is not completed, the processor 3 still outputs a signal.

[0104] Step S17: When the function layer 10 has not completed the emergency shutdown operation, the function monitoring layer 20 performs the emergency shutdown operation.

[0105] In at least one embodiment of the present application, the fuel cell control method further includes, after step S12:

[0106] In step S18, the functional monitoring layer 20 calculates a sensing monitoring signal based on the sensing value of the sensor 2, controls the state of the monitoring state machine of the functional monitoring layer 20 according to the sensing monitoring signal, and receives the state of the functional state machine in the functional layer 10 and controls the state of the monitoring state machine in the functional monitoring layer 20 according to the sensing monitoring signal.

[0107] In at least one embodiment of the present application, the functional layer 10 determines whether the sensed input signal meets a transition condition. When the sensed input signal meets the transition condition, the functional layer 10 controls the functional state machine to transition to a new state. When the sensed input signal does not meet the transition condition, the functional layer 10 controls the functional state machine to maintain its current state. In at least one embodiment of the present application, the functional state machine includes an operating state and a fault state, and the transition condition may include a fault transition threshold. When the sensed input signal or the sensed adjustment signal is greater than the fault transition threshold, the transition condition for transitioning from the operating state to the fault state is met. When the sensed input signal or the sensed adjustment signal is less than or equal to the fault transition threshold, the transition condition is not met. The functional state machine may have multiple different states, such as an active state, a waiting state, a standby state, and the like, but is not limited thereto. Transition conditions may also include, but are not limited to, conditions for adjusting the state machine from the active state to the waiting state, conditions for transitioning the state machine from the waiting state to the starting state, conditions for transitioning the state machine from the operating state to the standby state, and the like. Transition conditions may include a single condition or a combination of multiple conditions. For example, the condition for the functional state machine to adjust from the activated state to the started state is whether the key is in the On position; the condition for the functional state machine to jump from the activated state to the wait-to-start state is whether the high-voltage operation is completed; the condition for the functional state machine to jump from the wait-to-start state to the started state is whether the pressure signal is within the set value range and there is no fault.

[0108] In at least one embodiment of the present application, the monitoring state machine includes multiple states, which are consistent with the states of the functional state machine and will not be described in detail here.

[0109] In step S19 , the function monitoring layer 20 determines whether the state of the function state machine is consistent with the state of the monitoring state machine.

[0110] When the state of the functional state machine is consistent with the state of the monitoring state machine, return to step S10;

[0111] When the state of the functional state machine is inconsistent with the state of the monitoring state machine, the process proceeds to step S14.

[0112] Compared with the prior art, this application has the following advantages:

[0113] 1. In an embodiment of the present application, the functional layer 10 and the functional monitoring layer 20 operate in different areas of the processor 3. When the input sensing signal of the functional layer 10 triggers an emergency shutdown condition and the emergency shutdown operation cannot be completed, the functional monitoring layer 20 is used to perform the emergency shutdown operation to prevent the fuel cell control system 1 from losing control and improve the safety performance of the fuel cell control system 1.

[0114] 2. In an embodiment of the present application, the functional monitoring layer 20 verifies the sensing input signal of the functional layer 10 and the status of the functional state machine. It uses different algorithms to verify the same signal, increases the credibility of the sensing input signal, reduces emergency shutdown operations caused by abnormal sensing input signals, and further reduces the impact of emergency shutdown operations on the life of the battery stack.

[0115] 3. In the embodiment of the present application, the functional layer 10 and the functional monitoring layer 20 use the same jump conditions. Under the same conditions, the state of the monitoring state machine in the functional monitoring layer 20 is used to verify the state of the functional state machine in the functional layer 10 to optimize the robustness of the fuel cell control system 1.

[0116] See also Figure 3 , which is a block diagram of a fuel cell control system 1 according to at least one embodiment of the present application. The fuel cell control system 1 utilizes the E-Gas architecture and includes a functional layer 10, a functional monitoring layer 20, and a controller monitoring layer (not shown). The functional layer 10 and the functional monitoring layer 20 operate in different areas of the processor 3, and data can be exchanged between them.

[0117] The functional layer 10 includes a sensing input module 11 , a control module 12 and a signal output module 13 .

[0118] The sensing input module 11 is used to calculate the sensing value received from the sensor 2 to obtain a sensing input signal and output the signal to the function monitoring layer 20 .

[0119] The control module 12 includes a fault management unit 121 and a function state machine management unit 122 .

[0120] The fault management unit 121 is configured to receive the sensing input signal from the sensing input module 11 and the sensing adjustment signal output by the function monitoring layer 20, and to perform fault management when an abnormality is detected in the input signal based on the sensing input signal or the sensing adjustment signal. In at least one embodiment of the present application, the fault management unit 121 can classify abnormal sensing input signals into different levels, formulate different management strategies and early warning methods, and promptly remind the user to perform maintenance inspections.

[0121] The function state machine management unit 122 is configured to receive a sensing input signal from the sensing input module 11 and determine whether the sensing input signal satisfies a transition condition. If the sensing input signal satisfies the transition condition, the function state machine management unit 122 controls the function state machine to transition to another state. If the sensing input signal does not satisfy the transition condition, the function state machine management unit 122 controls the function state machine to maintain its current state.

[0122] In at least one embodiment of the present application, the state of the functional state machine includes an operating state and a fault state, and the transition condition may include a fault transition threshold. When the sensing input signal or the sensing adjustment signal is greater than the fault transition threshold, the transition condition for transitioning from the operating state to the fault state is satisfied; when the sensing input signal or the sensing adjustment signal is less than or equal to the fault transition threshold, the transition condition is not satisfied. The functional state machine may also have multiple different states, such as an active state, a standby state, and a standby state, but is not limited thereto. The transition conditions may also include, but are not limited to, conditions for the state machine to transition from the active state to the standby state, conditions for the state machine to transition from the standby state to the start state, and conditions for the state machine to transition from the operating state to the standby state. The transition condition may include a single condition or a combination of multiple conditions. For example, the condition for the functional state machine to transition from the active state to the start state is whether the key is in the on position; the condition for the functional state machine to transition from the active state to the standby state is whether the high-pressure operation is completed; and the condition for the functional state machine to transition from the standby state to the start state is whether the pressure signal is within a set value range and no fault is present.

[0123] The functional state machine management unit 122 is further configured to receive the sensing adjustment signal output by the functional monitoring layer 20 and use the sensing adjustment signal as an input signal. Upon receiving the sensing adjustment signal output by the functional monitoring layer 20, the functional state machine management unit 122 determines whether the sensing adjustment signal meets a transition condition. If the sensing adjustment signal meets the transition condition, the functional state machine management unit 122 controls the functional state machine to transition to another state. If the sensing adjustment signal does not meet the transition condition, the functional state machine management unit 122 controls the functional state machine to maintain its current state.

[0124] The functional state machine management unit 122 is further configured to execute an emergency shutdown operation upon receiving an emergency shutdown instruction output by the functional monitoring layer 20 .

[0125] In at least one embodiment of the present application, the control module 12 may further include an air system control unit, a hydrogen system control unit, a thermal management system control unit, and other control units. The air system control unit is used to detect the air conditions surrounding the vehicle 100 and adjust the air circulation mode within the vehicle 100 in real time; the hydrogen system control unit is used to adjust the opening of the hydrogen proportional valve to control the hydrogen pressure before entering the stack; and the thermal management system control unit is used to control and optimize the heat transfer process during the operation of the fuel cell.

[0126] The signal output module 13 is electrically connected to the control module 12 and the processor 3. The signal output module 13 is used to transmit the control signal generated by the control module 12 to the processor 3. In at least one embodiment of the present application, the control signal may include a shutdown control instruction.

[0127] The function monitoring layer 20 includes a signal processing module 201 , a signal verification module 202 , a shutdown monitoring module 203 , a safety control module 204 and a status verification module 205 .

[0128] Signal processing module 201 is connected to sensor input module 11. Signal processing module 201 is configured to receive the sensing input signal output by sensor input module 11. Signal processing module 201 is also configured to calculate the sensed value received from sensor 2 to generate a sensing monitoring signal. Signal processing module 201 is also configured to control the state of the monitoring state machine in functional monitoring layer 20 based on the sensing monitoring signal.

[0129] In at least one embodiment of the present application, the monitoring state machine includes multiple states, which are consistent with the states of the functional state machine and will not be described in detail here.

[0130] The signal verification module 202 is connected to the signal processing module 201 and the fault management unit 121. The signal verification module 202 is used to perform sensor verification on the sensing input signal and determine whether the sensor verification result is abnormal. If the sensor verification result is normal, the signal verification module 202 generates a sensor adjustment signal to the functional layer 10. If the sensor verification result is abnormal, the signal verification module 202 determines whether the sensor verification result triggers an emergency shutdown condition. If the sensor verification result triggers an emergency shutdown condition, the signal verification module 202 generates an emergency shutdown instruction to the functional state machine management unit 122 of the functional layer 10. If the sensor verification result does not trigger an emergency shutdown condition, the signal verification module 202 generates a fault detection instruction to the fault management unit 121.

[0131] Specifically, the signal verification module 202 receives the sensing monitoring signal output by the signal processing module 201, calculates the difference between the sensing input signal and the sensing monitoring signal to obtain a sensing verification signal, and determines whether the sensing verification signal is greater than a corresponding sensing verification threshold. If the sensing verification signal is greater than the sensing verification threshold, the signal verification module 202 identifies the sensing verification result as abnormal; if the sensing verification signal is less than or equal to the sensing verification threshold, the signal verification module 202 identifies the sensing verification result as normal.

[0132] In at least one embodiment of the present application, the sensing input signal includes an entry temperature sensing signal, an exit temperature sensing signal and a hydrogen pressure sensing signal; the sensing monitoring signal includes an entry temperature monitoring signal corresponding to the entry temperature sensing signal, an exit temperature monitoring signal corresponding to the exit temperature sensing signal and a hydrogen pressure monitoring signal corresponding to the hydrogen pressure sensing signal; the sensing verification signal includes an entry temperature verification signal, an exit temperature verification signal and a hydrogen pressure verification signal; the entry temperature verification signal is the absolute value of the difference between the entry temperature sensing signal and the entry temperature monitoring signal; the exit temperature verification signal is the absolute value of the difference between the exit temperature sensing signal and the exit temperature monitoring signal; the hydrogen pressure verification signal is the absolute value of the difference between the hydrogen pressure sensing signal and the hydrogen pressure monitoring signal; the entry temperature verification signal, the exit temperature verification signal and the hydrogen pressure verification signal each correspond to a sensing verification threshold. The stack entry temperature verification signal corresponds to a stack entry temperature abnormality threshold (serving as the sensing verification threshold corresponding to the stack entry temperature), the stack exit temperature verification signal corresponds to a stack exit temperature abnormality threshold (serving as the sensing verification threshold corresponding to the stack exit temperature), and the hydrogen pressure verification signal corresponds to a hydrogen pressure abnormality threshold (serving as the sensing verification threshold corresponding to the hydrogen pressure). The stack entry temperature abnormality threshold, the stack exit temperature abnormality threshold, and the hydrogen pressure abnormality threshold are all values ​​obtained by the fuel cell control system 1 by performing multiple tests simulating temperature changes and / or pressure changes. In at least one embodiment of the present application, under different test conditions, the sensing verification threshold corresponding to any sensing verification signal is different. When any one of the stack entry temperature verification signal, the stack exit temperature verification signal, and the hydrogen pressure verification signal is abnormal, the signal verification module identifies that the sensing verification result is abnormal. The in-stack temperature sensing signal and the in-stack temperature monitoring signal are respectively calculated based on the sensing values ​​of temperature sensing elements of different types and located at the same position in sensor 2; the out-stack temperature sensing signal and the out-stack temperature monitoring signal are respectively calculated based on the sensing values ​​of temperature sensing elements of different types and located at the same position in sensor 2; the hydrogen pressure sensing signal is calculated based on the sensing value of the hydrogen pressure sensing element in sensor 2, and the hydrogen pressure monitoring signal is calculated based on the sensing value of the hydrogen pressure sensing element in sensor 2 or calculated based on the air pressure using a pressure calculation model.

[0133] In at least one embodiment of the present application, the signal verification module 202 is also configured with an anti-jitter timer. The signal verification module 202 accumulates the duration of abnormal sensor verification results without triggering an emergency shutdown condition. When this duration exceeds a jitter threshold, the functional monitoring layer 20 generates a fault detection instruction to the functional layer 10. The jitter threshold can be 0.5 seconds and can be set as needed. This application does not impose any restrictions on the jitter threshold.

[0134] In at least one embodiment of the present application, the emergency stop condition includes an emergency stop threshold. The emergency stop threshold is greater than the sensing verification threshold. The signal verification module 202 is also used to determine whether the sensing verification result is greater than or equal to the emergency stop threshold. When the sensing verification result is greater than or equal to the emergency stop threshold, the signal verification module 202 identifies that the sensing verification result triggers the emergency stop condition; when the sensing verification result is less than the emergency stop threshold, the signal verification module 202 identifies that the sensing verification result does not trigger the emergency stop condition. In at least one embodiment of the present application, the signal verification module 202 can further accumulate operating time while generating the emergency stop command.

[0135] The shutdown monitoring module 203 is electrically connected to the processor 3. The shutdown monitoring module 203 is used to determine whether the functional layer 10 has completed the emergency shutdown operation. In at least one embodiment of the present application, the shutdown monitoring module 203 determines whether the functional layer 10 has completed the emergency shutdown operation when the operation time reaches the monitoring time threshold. The shutdown monitoring module 203 determines whether the functional layer 10 has completed the emergency shutdown operation by monitoring the output signal of the processor 3. When the emergency shutdown operation is completed, the processor 3 has no signal output; when the emergency shutdown operation is not completed, the processor 3 still has a signal output.

[0136] The safety control module 204 is electrically connected to the shutdown monitoring module 203. The safety control module 204 is used to execute an emergency shutdown operation when the functional layer 10 has not completed the emergency shutdown operation.

[0137] The state verification module 205 is electrically connected to the functional state machine management unit 122. The state verification module 205 is configured to receive the functional state machine status output by the functional state machine management unit 122, receive the monitoring state machine status output by the signal processing module 201, and determine whether the functional state machine status is consistent with the monitoring state machine status. If the functional state machine status is inconsistent with the monitoring state machine status, the state verification module 205 generates an emergency shutdown command to the functional state machine management unit 122 in the functional layer 10.

[0138] See also Figure 4 , which is a block diagram of vehicle 100 according to at least one embodiment of the present application. Vehicle 100 is a hybrid vehicle. It is understood that the present application does not limit the type of vehicle 100; for example, it may be a plug-in hybrid vehicle or a gasoline-electric hybrid vehicle. Vehicle 100 utilizes a fuel cell as its power source.

[0139] The vehicle 100 includes a fuel cell control system 1, a sensor 2, a processor 3, a memory 4, and a communication interface 5. The fuel cell control system 1, the sensor 2, the processor 3, the memory 4, and the communication interface 5 can be connected via a communication bus and communicate with each other.

[0140] The specific contents of the fuel cell control system 1 and the sensor 2 can be found in the specific description of the above fuel cell control method, and will not be described in detail here.

[0141] The processor 3 may be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of the above program.

[0142] The memory 4 can be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compact disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 4 can exist independently and be connected to the processor 3 via a bus. The memory 4 can also be integrated with the processor 3.

[0143] The memory 4 is used to store program instructions for executing the above scheme, and the execution is controlled by the processor 3. The processor 3 is used to execute the program instructions stored in the memory 4. The program instructions stored in the memory 4 can be executed. Figure 1 as well as Figure 2 Part or all of the steps of the fuel cell control method described in.

[0144] The communication interface 5 is used to communicate with other devices or communication networks, such as Ethernet, Radio Access Network (RAN), Wireless Local Area Networks (WLAN), etc.

[0145] The present application also provides a computer-readable storage medium having program instructions stored therein, which, when executed on a computing device, causes the computing device to execute the fuel cell control method provided in the aforementioned embodiment.

[0146] It is obvious to those skilled in the art that the present application is not limited to the details of the above exemplary embodiments and that the present application can be implemented in other specific forms without departing from the spirit or essential features of the present application. Therefore, as long as they are within the scope of the essence of the present application, appropriate changes and modifications made to the above embodiments should fall within the scope of protection claimed in the present application.

Claims

1. A fuel cell control method, characterized in that: The fuel cell control method includes: The functional layer in the processor calculates a sensing input signal according to the sensing value of the sensor, and the functional monitoring layer in the processor that operates in a different area from the functional layer performs sensing verification on the sensing input signal output by the functional layer; The function monitoring layer determines whether the sensing verification result is abnormal; When the sensing verification result is abnormal, the function monitoring layer determines whether the sensing verification result triggers an emergency shutdown condition; When the sensing verification result triggers the emergency stop condition, the function monitoring layer generates an emergency stop instruction to the function layer, and the function layer performs an emergency stop operation according to the emergency stop instruction; The function monitoring layer determines whether the function layer completes the emergency shutdown operation; and When the functional layer fails to complete the emergency shutdown operation, the functional monitoring layer performs the emergency shutdown operation.

2. The fuel cell control method according to claim 1, wherein: The fuel cell controller further includes: The function monitoring layer calculates a sensing monitoring signal according to the sensing value of the sensor, controls the state of the monitoring state machine of the function monitoring layer according to the sensing monitoring signal, and receives the state of the function state machine in the function layer; Determining whether the state of the monitoring state machine is consistent with the state of the functional state machine; When the state of the functional state machine is inconsistent with the state of the monitoring state machine, the functional monitoring layer generates the emergency stop instruction to the functional layer.

3. The fuel cell control method according to claim 1, wherein: The step of determining whether the sensing verification result is abnormal by the function monitoring layer includes: The function monitoring layer calculates and obtains a sensing monitoring signal according to the sensing value of the sensor; The function monitoring layer calculates the difference between the sensing input signal and the sensing monitoring signal to obtain a sensing verification signal; The function monitoring layer determines whether the sensing verification signal is greater than a corresponding sensing verification threshold; When the sensing verification signal is greater than the sensing verification threshold, the function monitoring layer identifies that the sensing verification result is abnormal; and When the sensing verification signal is less than or equal to the sensing verification threshold, the function monitoring layer identifies that the sensing verification result is normal.

4. The fuel cell control method according to claim 3, characterized in that: The fuel cell controller further includes: When the sensing verification result is normal, the function monitoring layer generates a sensing adjustment signal to the functional layer; wherein the sensing adjustment signal is an average value of the sensing input signal and the sensing monitoring signal; When the sensing verification result does not trigger the emergency shutdown condition, the functional monitoring layer generates a fault detection instruction to the functional layer.

5. The fuel cell control method according to claim 3, characterized in that: The sensing input signal includes a stack entry temperature sensing signal, a stack exit temperature sensing signal and a hydrogen pressure sensing signal; the sensing monitoring signal includes a stack entry temperature monitoring signal corresponding to the stack entry temperature sensing signal, an exit temperature monitoring signal corresponding to the exit temperature sensing signal and a hydrogen pressure monitoring signal corresponding to the hydrogen pressure sensing signal; the sensing verification signal includes a stack entry temperature verification signal, an exit temperature verification signal and a hydrogen pressure verification signal; the stack entry temperature verification signal, the exit temperature verification signal and the hydrogen pressure verification signal respectively correspond to a sensing verification threshold; when any one of the stack entry temperature verification signal, the exit temperature verification signal and the hydrogen pressure verification signal is abnormal, the functional monitoring layer identifies that the sensing verification result is abnormal.

6. The fuel cell control method according to claim 5, wherein: The in-stack temperature sensing signal and the in-stack temperature monitoring signal are respectively calculated based on the sensing values ​​of temperature sensing elements of different types and located at the same position in the sensor; the out-stack temperature sensing signal and the out-stack temperature monitoring signal are respectively calculated based on the sensing values ​​of temperature sensing elements of different types and located at the same position in the sensor; the hydrogen pressure sensing signal is calculated based on the sensing value of the hydrogen pressure sensing element in the sensor, and the hydrogen pressure monitoring signal is calculated based on the sensing value of the hydrogen pressure sensing element in the sensor or calculated based on the air pressure using a pressure calculation model.

7. The fuel cell control method according to claim 3, characterized in that: The emergency shutdown condition includes an emergency shutdown threshold; wherein the emergency shutdown threshold is greater than the sensing verification threshold; the step of the function monitoring layer determining whether the sensing verification result triggers the emergency shutdown condition includes: The function monitoring layer determines whether the sensing verification result is greater than or equal to the emergency shutdown threshold; When the sensing verification result is greater than or equal to the emergency shutdown threshold, the function monitoring layer identifies that the sensing verification result triggers the emergency shutdown condition; When the sensing verification result is less than the emergency shutdown threshold, the function monitoring layer identifies that the sensing verification result does not trigger the emergency shutdown condition.

8. A fuel cell control system, used in a vehicle; the vehicle further comprises a sensor and a processor; characterized in that: The fuel cell control system includes a functional layer and a functional monitoring layer; the functional layer and the functional monitoring layer respectively operate in different areas of the processor; the functional layer calculates a sensing input signal based on the sensing value of the sensor; The function monitoring layer includes: a signal processing module, configured to receive the sensing input signal output by the functional layer; a signal verification module, electrically connected to the signal processing module, configured to perform sensing verification on the sensing input signal and obtain a sensing verification result; when the sensing verification result is abnormal, the signal verification module determines whether the sensing verification result triggers an emergency stop condition; when the sensing verification result triggers the emergency stop condition, the signal verification module generates an emergency stop instruction to control the functional layer to perform an emergency stop operation; A shutdown monitoring module, configured to determine whether the functional layer has completed the emergency shutdown operation; and A safety control module is used to perform an emergency stop operation when the functional layer has not completed the emergency stop operation.

9. A vehicle, characterized in that: The vehicle includes a processor and a memory, the memory is used to store a plurality of program instructions, and when the processor calls the program instructions, the fuel cell control method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a plurality of program instructions, and the plurality of program instructions are suitable for being loaded by a processor and executed by the fuel cell control method according to any one of claims 1 to 7.

Images