Fuel cell system for vehicle, and control method and controller thereof

Abstract

The invention provides a fuel cell system for a vehicle, a control method thereof, and a controller. The fuel cell system includes a fuel cell and a DCDC converter. The control method comprises the following steps: acquiring one or more fault level signals, wherein each fault level signal indicates the severity of a fault in the fuel cell system; based on the one or more fault level signals, whether the most serious fault in the fuel cell system is a general level fault is judged, and the general level fault refers to the fault that the fuel cell system can continue to operate for a period of time after the fault occurs; when it is judged that the most serious fault in the fuel cell system is the general-grade fault, the fuel cell system is controlled to operate in a soft turn-off mode, in the soft turn-off mode, a fuel cell charges a high-voltage battery of a vehicle through a DCDC converter for a first preset duration or a second preset duration larger than the first preset duration, and in the soft turn-off mode, the fuel cell charges the high-voltage battery of the vehicle through the DCDC converter for the first preset duration or the second preset duration larger than the second preset duration. The fuel cell system is then turned off.

Description

TECHNICAL FIELD

[0001] The present application relates to a fuel cell system for a vehicle, and a method and a controller for controlling the fuel cell system. BACKGROUND

[0002] A fuel cell vehicle (FCV) is equipped with a fuel cell system and a power battery. The fuel cell system is capable of charging the power battery. Generally, once a fault in the fuel cell system is detected, the fuel cell system will be immediately shut down. This means that the fuel cell system will immediately stop outputting electric energy. However, it cannot be guaranteed that the remaining energy of the power battery can maintain the vehicle to complete a safe stop. In addition, frequent emergency shutdown of the fuel cell system will have a negative impact on the service life of the fuel cell. SUMMARY

[0003] In this context, embodiments of the present application propose a fuel cell system for a vehicle, and a method and a controller for controlling the fuel cell system.

[0004] To this end, according to an embodiment of one aspect of the present application, a method for controlling a fuel cell system is proposed. The fuel cell system is arranged on a vehicle and includes a fuel cell and a DCDC converter. The method includes: obtaining one or more fault level signals, each fault level signal indicating a severity of a fault in the fuel cell system; determining whether a most severe fault in the fuel cell system is a general level fault based on the one or more fault level signals, wherein the general level fault refers to a fault after which the fuel cell system is capable of continuing to operate for a period of time; and controlling the fuel cell system to operate in a soft shutdown mode when it is determined that the most severe fault in the fuel cell system is the general level fault, wherein in the soft shutdown mode, the fuel cell charges a high-voltage battery of the vehicle through the DCDC converter for a first predetermined time length or a second predetermined time length greater than the first predetermined time length, and then shuts down the fuel cell system.

[0005] According to an embodiment of another aspect of the present application, a fuel cell system for a vehicle is proposed, which includes: a fuel cell; a DCDC converter coupled to the fuel cell and configured to be capable of transmitting electric energy output by the fuel cell to a high-voltage battery of the vehicle; and a DCDC control unit included in the DCDC converter or communicatively connected to the DCDC converter, for executing the method as described above.

[0006] According to an embodiment of yet another aspect of the present application, a machine-readable storage medium is proposed, which stores executable instructions that, when executed, cause one or more processors to execute the method as described above.

[0007] According to an embodiment of the aspect of the application, a computer program product is presented, comprising computer-executable instructions that, when executed, cause one or more processors to perform the method as described above.

[0008] The above summary of the major aspects of the application is given in order to enable a basic understanding of these aspects. The summary does not intend to define the scope of any or all aspects of the application. The purpose of the summary is to present some implementations of these aspects in a simplified form as a prelude to the more detailed description to be given later. BRIEF DESCRIPTION OF DRAWINGS

[0009] The technical solutions of the present application will be more clearly understood from the following detailed description taken in conjunction with the accompanying drawings. It can be understood that the drawings are only used for exemplary description and are not intended to limit the scope of protection of the present application.

[0010] Figure 1 is a schematic block diagram of a fuel cell system according to an embodiment of the present application.

[0011] Figure 2 shows an implementation of the fuel cell system in Figure 1 .

[0012] Figure 3 is a flow chart of a method for controlling a fuel cell system according to an embodiment of the present application.

[0013] Figures 4-5 shows an implementation of the main steps of the method in Figure 3 . DETAILED DESCRIPTION

[0014] SUMMARY

[0015] Embodiments of the present application relate to a control scheme for a fuel cell system, which is arranged on a vehicle.

[0016] According to embodiments of the present application, the fuel cell system can be controlled to operate in a soft shutdown mode in case the most severe fault in the fuel cell system is a general level fault, i.e. the fuel cell system is controlled to continue operating for a certain period of time instead of shutting down the fuel cell system immediately. Thereby, the frequency of emergency power down of the fuel cell system is reduced, the availability of the fuel cell system is improved, and the fuel cell stack is protected.

[0017] According to embodiments of the present application, the vehicle can be safely parked in limp home mode or driven to a safe area for a certain period of time during which the fuel cell system continues operating, thanks to the soft shutdown mode.

[0018] According to an embodiment of the present application, in the soft-off mode, two kinds of off situations are designed, i.e., 1) an off situation requested by the fuel cell control unit to shut down the fuel cell system and 2) a situation where the fuel cell control unit does not request to shut down the fuel cell system and the DCDC control unit decides to shut down the fuel cell system. These two kinds of off situations can ensure that the fuel cell system continues to run for a period of time after a general level fault occurs and is then reliably shut down.

[0019] Exemplary System

[0020] Figure 1 A fuel cell system 100 according to an embodiment of the present application is shown, which is provided on a vehicle. The vehicle configured with the fuel cell system 100 is called a fuel cell vehicle (FCV: Fuel cell vehicle). As shown in Figure 1 The fuel cell vehicle FCV is also configured with a high-voltage battery (HV BAT) 200, which is coupled with the fuel cell system 100. According to an embodiment of the present application, the high-voltage battery 200 is used to provide power for the vehicle, and the fuel cell system 100 is capable of charging the high-voltage battery 200. It should be understood that the high-voltage battery 200 is also called a power battery in some places.

[0021] As shown in Figure 1 The fuel cell system 100 includes a fuel cell 10 and a DCDC converter 20. The fuel cell 10 converts the chemical energy of fuel (e.g., high-purity hydrogen) and oxidant (e.g., oxygen or air) into electrical energy through an electrochemical reaction. The DCDC converter 20 transmits the electrical energy output by the fuel cell 10 to the high-voltage battery 200 to charge the high-voltage battery 200.

[0022] In one embodiment, the fuel cell 10 includes a fuel cell stack 11 and a fuel cell control unit (FCCU: fuel cell control unit) 12. The fuel cell stack 11 and the fuel cell control unit 12 can be packaged in the same housing to form a single product. The DCDC converter 20 includes a boost or buck circuit (Boost / Buck) 21, a contactor (Contactor) 22, and a DCDC control unit (DCDC CU) 23. The boost or buck circuit 21, the contactor 22, and the DCDC control unit 23 can be packaged in the same housing to form a single product.

[0023] Figure 2 An implementation of the fuel cell system 100 in Figure 1 is shown. As shown in Figure 2As shown, the fuel cell control unit 12 controls the operation of the fuel cell stack 11, for example, controls the start-up and shut-down of the fuel cell stack 11. The fuel cell control unit 12 can exchange information with the DCDC control unit 23. The DCDC control unit 23 controls the operation of the boost or buck circuit 21, for example, controls the start-up, shut-down and regulates the output voltage of the boost or buck circuit 21 by controlling the controllable or semi-controllable power switches of the boost or buck circuit 21. The DCDC control unit 23 also controls the on and off of the contactors 22. The contactors 22 can include a switch Cp coupled to the positive DC bus and a switch Cn coupled to the negative DC bus. The DCDC control unit 23 controls the on and off of the switches Cp and Cn to control the on and off of the power supply circuit that supplies power to the high voltage battery 200.

[0024] In addition, a plurality of sensors, for example, one or more voltage sensors, one or more current sensors and one or more temperature sensors, can be provided in the fuel cell system 100 and on the power supply circuit that supplies power to the high voltage battery 200.

[0025] Exemplary Method

[0026] Figure 3 is a flow chart of a method 300 of controlling the fuel cell system 100 according to an embodiment of the present application. The method 300 can be implemented by a controller (not shown) of the fuel cell system 100 or by the DCDC control unit 23 described above.

[0027] Here, the controller of the fuel cell system can be a controller independent of the fuel cell control unit 12 and the DCDC control unit 23, can be a controller containing the fuel cell control unit 12 and the DCDC control unit 23, or can be a high-level controller (i.e., a system controller) higher than the level of the fuel cell control unit 12 and the DCDC control unit 23.

[0028] The method 300 will be described below by way of example with the DCDC control unit 23 implementing the method 300.

[0029] Referring to Figure 3 At block 302, the DCDC control unit 23 obtains one or more sets of redundant measurements. Each set of redundant measurements contains a first measurement and a second measurement of the same object in the fuel cell system 100. One of the first and second measurements can be a primary measurement and the other can be a redundant measurement.

[0030] Some embodiments of the first and second measurements will be described below.

[0031] In one embodiment, the first and second measurement results may include two physical measurement values ​​obtained by measuring the same object (eg, the same physical parameter) twice by the same sensor. Figure 2 , two current measurement values ​​obtained by performing two measurements by ammeter A located on the negative DC bus.

[0032] In another embodiment, the first and second measurement results may include two physical measurement values ​​obtained by measuring the same object (eg, the same physical parameter) by two different sensors. Figure 2 Two voltage sensors are used to respectively measure the output voltage of the fuel cell stack 11 (ie, the voltage between the positive and negative electrodes of the fuel cell stack 11 ) to obtain two voltage measurement values ​​V_s1 and V_s2 .

[0033] In yet another embodiment, the first and second measurement results may include two physical measurement values ​​obtained by measuring two physical parameters that should theoretically be equal. For example, a voltage measurement value Vin obtained by measuring the voltage on the input side of the contactor 22, and a voltage measurement value Vout obtained by measuring the voltage on the output side of the contactor 22. It should be understood that "two physical parameters that should theoretically be equal" are considered to be the same object. In other words, according to embodiments of the present invention, "the same object" includes two physical parameters that should theoretically be equal.

[0034] In yet another embodiment, the first and second measurement results may include a physical measurement value obtained by sensor measurement and a "virtual measurement value" obtained by model calculation. In other words, one of the first and second measurement results is measured by the sensor, and the other is calculated by the model. For example, in the example where the same object is the output voltage of the fuel cell stack 11, it is also possible to implement: one of the first and second measurement results is a measured voltage value V_s1 or V_s2 measured by the voltage sensor, and the other is a calculated value of the output voltage of the fuel cell stack 11 obtained by calculation of the fuel cell stack model.

[0035] It should be understood that the calculated value obtained based on the model calculation can be understood as a virtual measurement value, that is, it is not measured by a sensor but calculated by a model that can be regarded as a virtual sensor.

[0036] According to an embodiment of the present invention, the measurement objects of each of the multiple sets of redundant measurement results can be different. For example, the multiple sets of redundant measurement results include redundant measurement results of the output voltage of the fuel cell stack, redundant measurement results of the temperature of the fuel cell stack, and redundant measurement results of the current on the positive DC bus.

[0037] At block 304 , each set of redundant measurement results is subjected to fault level detection to obtain one or more fault level signals.

[0038] According to an embodiment of the present invention, a general level fault is defined, that is, a fault in which the fuel cell system can still operate for a period of time after the fault occurs, and a soft shutdown mode for the general level fault is defined.

[0039] For example, multiple fault levels corresponding to different fault severities are pre-set for various faults that may occur in the fuel cell system 100, for example, four fault levels. The above-mentioned general level fault corresponds to fault level 2, fault level 1 is a fault level less severe than the general level fault, and fault levels 3 and 4 are fault levels more severe than the general level fault.

[0040] According to an embodiment of the present invention, general level faults may include one or more of the following: 1) one of the first and second measurement results indicates a short circuit to ground; 2) one of the first and second measurement results indicates a short circuit to the high-voltage battery; 3) a communication signal (e.g., a CAN signal) in the fuel cell system 100 is transmitted in timeout, for example, a heartbeat signal transmitted at a predetermined frequency between the fuel cell control unit 12 and the DCDC control unit 23 is transmitted in timeout.

[0041] Figure 4 3 is a flow chart of a method 400 for implementing one implementation of the fault level detection in block 304. The method 400 may be executed by the DCDC control unit 23 or by the controller of the fuel cell system 100.

[0042] The method 400 is described below by taking the DCDC control unit 23 performing fault level detection on a set of redundant measurement results as an example.

[0043] See also Figure 4 At block 402 , the DCDC control unit 23 receives a set of redundant measurements, such as, for example, two voltage measurements V_s1 and V_s2 of the output voltage of the fuel cell stack.

[0044] At block 404, the DCDC control unit 23 performs a measurement value range rationality check on each of the first and second measurement results in the set of redundant measurement results. Specifically, the control unit 23 checks whether the measurement value ranges of the first and second measurement results are within a predetermined range. For example, the output voltage of the fuel cell stack has a predetermined voltage range. If the voltage measurement value of the fuel cell stack output voltage is within the predetermined range, the rationality check passes. Conversely, if the voltage measurement value of the fuel cell stack output voltage is outside the predetermined range, the rationality check fails.

[0045] It should be understood that, according to embodiments of the present application, a corresponding measurement range is preset for different measurement objects. For example, for the temperature of the fuel cell stack, a temperature range is preset, i.e., a predetermined temperature range.

[0046] At block 406, a fault level for the set of redundant measurements is determined based on the results of the plausibility check. The determination includes: if neither the first nor the second measurement passes the plausibility check, a more severe fault than the general level fault is determined to have occurred, e.g., a fault of fault level 3 or 4, and a fault level signal indicative of the severe level fault is obtained; if the check results in one of the first and second measurements passing the check and the other failing the check, a general level fault is determined to have occurred, e.g., a fault of fault level 2, and a fault level signal indicative of the general level fault is obtained; and if both the first and second measurements pass the plausibility check, the method 400 proceeds to block 408.

[0047] At block 408, the measurement values of the first and second measurements are compared to obtain a difference between the two measurement values. If the difference between the measurement values is less than or equal to a difference threshold, a general level fault is determined to have occurred, and a fault level signal indicative of the general level fault is obtained. If the difference between the measurement values is greater than the difference threshold, a more severe fault than the general level fault is determined to have occurred, and a fault level signal indicative of the severe level fault is obtained.

[0048] It should be understood that the difference threshold described above is preset and can be adjusted based on a specific application scenario. The smaller the difference threshold, the higher the frequency of emergency shutdown of the fuel cell system (i.e., a very small measurement difference will result in emergency shutdown of the fuel cell system); conversely, the larger the difference threshold, the lower the frequency of emergency shutdown of the fuel cell system (i.e., a larger measurement difference will result in emergency shutdown of the fuel cell system).

[0049] The fault level detection as described in the method 400 is performed for each set of redundant measurements to obtain one or more fault level signals.

[0050] Returning to Figure 3 , the method 300 proceeds to block 306. At block 306, it is determined whether the most severe fault in the fuel cell system 100 is a general level fault based on the one or more fault level signals.

[0051] In one embodiment, the determining step in block 306 includes determining whether at least one of the one or more fault level signals indicates a general level fault and determining whether one of the one or more fault level signals indicates a fault more severe than the general level fault. In the case where the first determination is positive and the second determination is negative (i.e., the determination is that at least one of the one or more fault level signals indicates a general level fault and none of the one or more fault level signals indicates a fault more severe than the general level fault), it is determined that the most severe fault in the fuel cell system is a general level fault.

[0052] In block 308, when it is determined that the most severe fault in the fuel cell system is the general level fault, the fuel cell system 100 is controlled to operate in a soft shutdown mode. In the soft shutdown mode, the fuel cell 10 charges the high voltage battery 200 of the vehicle through the DCDC converter 20 for a first predetermined time duration or a second predetermined time duration greater than the first predetermined time duration, and then shuts down the fuel cell system 100. In other words, in the soft shutdown mode, the fuel cell system 100 will continue to operate for a period of time before shutting down, rather than shutting down immediately.

[0053] In one embodiment, the first predetermined time duration is predetermined based on one or more of: 1) a time duration required for the fuel cell 10 to power down normally; and 2) a required energy for the vehicle to safely stop or travel to a safe area in limp home mode, and a charging time duration required for the high voltage battery to be charged by the fuel cell stack to reach the required energy. The first predetermined time duration can be taken as the greater of the two time durations, so that both the normal powering down of the fuel cell and the safe stopping or traveling of the vehicle to a safe area can be satisfied.

[0054] In one embodiment, different types of general level faults allow the fuel cell system to continue operating for different time durations, and the second predetermined time duration can be equal to the shortest of the different time durations, or a value shorter than the shortest time duration (e.g., the second predetermined time duration is equal to 85% of the shortest time duration). For example, the fuel cell system 100 can tolerate 3s for a sample short to power and 5s for a sample short to high voltage battery. In this case, the second predetermined time duration is equal to the shortest time duration of 3s or a time duration of 2.5s shorter than 3s. In this way, the fuel cell system 100 can be ensured to tolerate different types of general level faults.

[0055] In addition, the result of the determination in block 306 can also be that one or more of the fault level signals contains a signal indicating a fault more serious than the general level fault, in which case the fuel cell system 100 is immediately shut down. The result of the determination in block 306 can also be that each of the one or more fault level signals indicates a fault less serious than the general level fault, in which case the fuel cell system 100 is normally operated and a prompt message indicating a minor fault is generated.

[0056] Figure 5 is a flowchart of a method 500 for implementing the control of the fuel cell system 100 to operate in the soft shutdown mode in block 308. The method 500 can be performed by the DCDC control unit 23, can also be performed by the DCDC control unit 23 and the fuel cell control unit 12 together, and can also be performed by a controller of the fuel cell system.

[0057] In the following, the method 500 is described by way of example with the DCDC control unit 23 and the fuel cell control unit 12 together implementing the method 500.

[0058] Referring to Figure 5 In block 502, the DCDC control unit 23 generates general level fault information. For example, a flag bit indicating the general level fault is set to true in a message transmitted between the DCDC control unit 23 and the fuel cell control unit 12 at a predetermined frequency. For example, the default value of the flag bit is 0. Setting the flag bit to 1 means that the most serious fault in the fuel cell system 100 is the general level fault.

[0059] In block 504, the general level fault information is sent to the fuel cell control unit 12. For example, the message containing the flag bit indicating the general level fault as true is sent to the fuel cell control unit 12. At the same time, a timer is triggered (turned on) to start timing. The timer can be implemented in the form of a counter.

[0060] In block 506, the fuel cell control unit 12 receives the general level fault information.

[0061] In block 508, the fuel cell control unit 12, in response to receiving the general level fault information (for example, recognizing that the flag bit indicating the general level fault in the received message is true), controls the fuel cell stack 11 to continue operating until the timing of the timer reaches a first predetermined time length, to provide power to the high-voltage battery 200 through the DCDC converter 20 within the first predetermined time length, thereby charging the high-voltage battery 200.

[0062] In block 510, when the timing of the timer reaches the first predetermined time length, the fuel cell control unit 12 sends a shutdown request to the DCDC control unit 23.

[0063] At block 512, the DCDC control unit 23 receives the shutdown request and controls the DCDC converter to shut down in response to the shutdown request. At this time, the fuel cell system 100 stops charging the high-voltage battery 200.

[0064] In another case, the DCDC control unit 23 does not receive the shutdown request from the fuel cell control unit 12 when the timer counts up to the first predetermined length of time. The reason why the shutdown request is not received can be a communication failure between the two control units. The present application does not limit the reason. In this case, the method 500 proceeds to block 514.

[0065] At block 514, the DCDC control unit 23 controls the fuel cell system 100 to continue operating until the timer counts up to a second predetermined length of time, to continue charging the high-voltage battery 200 by the DCDC converter 20.

[0066] At block 516, the DCDC control unit 23 controls the DCDC converter to shut down when the timer counts up to the second predetermined length of time. At this time, the fuel cell system 100 stops charging the high-voltage battery 200.

[0067] It should be appreciated that after shutting down the DCDC converter 20, the DCDC control unit 23 can control the contactor 23 to open, thereby cutting off the power supply circuit. The advantage of doing so is that cutting off the power supply circuit is performed in a situation where there is no large current in the circuit, whereby the contactor 23 does not need to employ a switching device that can withstand a large current shutdown.

[0068] According to an embodiment of the present application, there is also provided a controller of the fuel cell system 100. The controller can perform the above-described methods 300-500.

[0069] According to an embodiment of the present application, there is also provided a machine-readable storage medium storing executable instructions that, when executed, cause one or more processors to perform the above-described methods 300-500.

[0070] According to an embodiment of the present application, there is also provided a computer program product comprising computer executable instructions that, when executed, cause one or more processors to perform the above-described methods 300-500.

[0071] According to an embodiment of the present application, there is also provided a computer program product comprising computer executable instructions that, when executed, cause one or more processors to perform the above-described method 300.

[0072] It is to be understood that the processors can be implemented using electronic hardware, computer software, or any combination thereof. Whether such processors are implemented as hardware or software depends upon the particular applications and general design constraints imposed on the system. As an example, any of the processors given in the present disclosure, any portion of the processors, or any combination of the processors can be implemented as a microprocessor, a microcontroller, a digital signal processor (DSP), a field programmable gate array (FPGA), a programmable logic device (PLD), a state machine, gated logic, discrete hardware circuits, and other suitable processing components configured to perform the various functions described throughout the present disclosure. The functions of the various processors given in the present disclosure, any portion of the processors, or any combination of the processors can be implemented as software executed by a microprocessor, a microcontroller, a DSP, or other suitable platform.

[0073] It is to be understood that software shall be broadly interpreted to mean instructions, instruction sets, code, code segments, program code, programs, subprograms, software modules, applications, software applications, software packages, routines, subroutines, objects, runtimes, processes, functions, etc. The software can reside on a computer-readable medium. The computer-readable medium can include, for example, memory such as a magnetic storage device (e.g., hard disk, floppy disk, magnetic strips), an optical disk, a smart card, a flash device, a random access memory (RAM), a read-only memory (ROM), a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (EEPROM), a register, or a removable disk. Although memory is shown separate from the processors in the various aspects given in the present disclosure, the memory can also be internal to the processors (e.g., cache or registers).

[0074] Although some embodiments have been described above, these are only given as examples and are not intended to limit the scope of the application. The following claims and their equivalents are intended to encompass all modifications, substitutions, and alterations within the scope and spirit of the present application.

Claims

1. A method for controlling a fuel cell system, the fuel cell system being provided on a vehicle and including a fuel cell and a DCDC converter, the method comprising: obtaining one or more fault level signals, each fault level signal indicating a severity of a fault in the fuel cell system; determining whether a most severe fault in the fuel cell system is a general level fault based on the one or more fault level signals, wherein the general level fault refers to a fault after which the fuel cell system is able to continue operating for a period of time; and controlling the fuel cell system to operate in a soft shutdown mode when the most severe fault in the fuel cell system is determined to be the general level fault, wherein in the soft shutdown mode, the fuel cell charges a high voltage battery of the vehicle through the DCDC converter for a first predetermined time duration or a second predetermined time duration that is greater than the first predetermined time duration, and then shuts down the fuel cell system.

2. The method of claim 1, further comprising: obtaining one or more sets of redundant measurements, each set of redundant measurements including a first measurement and a second measurement of a same object in the fuel cell system; and performing fault level detection on the one or more sets of redundant measurements to obtain the one or more fault level signals.

3. The method of claim 2, wherein: the first and second measurements are two physical measurements obtained by a same sensor measuring the same object; the first and second measurements are two physical measurements obtained by two different sensors measuring the same object; or one of the first and second measurements is a physical measurement obtained by a sensor measuring the same object, and the other is a virtual measurement obtained by a model calculating the same object. performing fault level detection on the one or more sets of redundant measurements includes, for each set of redundant measurements:

4. The method of claim 2 or 3, wherein, performing a range plausibility check on the first and second measurements, respectively; in a case where one of the first and second measurements passes the plausibility check and the other fails the plausibility check, determining the general level fault based on the set of redundant measurements; and in a case where both the first and second measurements fail the plausibility check, determining a fault more severe than the general level fault based on the set of redundant measurements. in a case where both the first and second measurements pass the plausibility check, further performing: comparing the measurements of the first and second measurements to obtain a difference in measurements; 5. The method of claim 4, wherein, in a case where the difference in measurements is less than or equal to a difference threshold, determining the general level fault based on the set of redundant measurements; and in a case where the difference in measurements is greater than the difference threshold, determining a fault more severe than the general level fault based on the set of redundant measurements.

6. The method of any one of claims 1-5, controlling the fuel cell system to operate in the soft shutdown mode includes: ​ ​ ​ sending a message containing the general level fault information to a fuel cell control unit while triggering a timer to start timing so that the fuel cell system continues to operate for the first predetermined time length.

7. The method of claim 6, wherein, controlling the fuel cell system to operate in the soft shutdown mode further comprises: determining whether a shutdown request from the fuel cell control unit is received when the timer is timed for the first predetermined time length; controlling the DCDC converter to shut down when it is determined that the shutdown request is received; and controlling the fuel cell system to continue to operate until the timer is timed for the second predetermined time length when it is determined that the shutdown request signal is not received, and controlling the DCDC converter to shut down.

8. The method of any one of claims 1-7, wherein, the first predetermined time length is predetermined based on one or more of: a time length required for the fuel cell to be normally powered off; and a required charging time length for the high voltage battery to be charged by the fuel cell so that a remaining energy of the high voltage battery reaches a required energy for the vehicle to be safely parked or driven to a safe area, and a required energy of the vehicle to be driven in a limp home mode.

9. The method of any one of claims 1-8, wherein, different types of general level faults allow different time lengths for the fuel cell system to continue to operate; and wherein the second predetermined time length is predetermined based on a shortest time length among the different time lengths.

10. The method of any one of claims 1-9, wherein, determining whether the most serious fault in the fuel cell system is a general level fault based on the one or more fault level signals comprises: determining whether at least one signal indicating a general level fault is contained in the one or more fault level signals; determining whether a signal indicating a more serious fault than the general level fault is contained in the one or more fault level signals; determining that the most serious fault in the fuel cell system is a general level fault when the first determination result is positive and the second determination result is negative.

11. A fuel cell system for a vehicle, comprising: a fuel cell; a DCDC converter coupled to the fuel cell and configured to be able to transfer electrical energy output by the fuel cell to a high voltage battery of the vehicle; and a DCDC control unit included in or communicatively connected to the DCDC converter and configured to perform the method of any one of claims 1-10.

12. The fuel cell system of claim 11, further comprising a fuel cell control unit included in or communicatively connected to the fuel cell, and the fuel cell control unit is further communicatively connected to the DCDC control unit. the DCDC converter is coupled between the fuel cell and the high voltage battery of the vehicle and configured to transfer electrical energy output by the fuel cell to the high voltage battery.

13. The fuel cell system of claim 11 or 12, wherein, 14. A machine-readable storage medium storing executable instructions that, when executed, cause one or more processors to perform the method of any one of claims 1-10.

15. A computer program product comprising computer executable instructions that, when executed, cause one or more processors to perform the method of any one of claims 1-10. ​

Images