A method and system for hierarchical safety control of a fuel cell system

Abstract

The present application belongs to hydrogen energy rail vehicle power system technical field, provide a kind of hierarchical safety control method and system of fuel cell system, including the following steps: real-time acquisition fuel cell system's stack state parameters and vehicle operating condition information;Stack state parameters and vehicle operating condition information are compared with corresponding preset threshold respectively;According to the comparison result, the current state mode of fuel cell system is determined as normal working mode, compensation mode, early warning mode or alarm mode;The hierarchical control strategy corresponding to the current mode is executed.The present application realizes the fundamental change from after-the-fact passive protection to before-the-fact active prevention;Precise distinction between operating condition fluctuation and fault symptom, dynamic response and stack safety are considered, a hierarchical progressive safety architecture is built, and a closed-loop control mechanism is formed.

Description

Technical Field

[0001] This invention belongs to the technical field of hydrogen energy rail vehicle power system, and in particular relates to a graded safety control method and system for a fuel cell system. Background Technology

[0002] Currently, the control methods for fuel cell systems applied to rail vehicles mainly employ energy management-based control strategies. This approach first determines the target output power of the fuel cell system based on driver commands and the state of charge (SOC) of the battery. For gas supply control, it uses power-based control of hydrogen and air supply to maintain a preset hydrogen-oxygen excess coefficient. Simultaneously, this scheme triggers an alarm and implements shutdown protection measures when serious faults such as low voltage or excessive differential pressure are detected. However, the aforementioned existing technical solutions have the following drawbacks in practical applications: Firstly, the scheme adopts a post-event protection logic, which only triggers shutdown after serious faults such as low voltage or excessive differential pressure occur. It cannot actively identify and intervene in early abnormal stages such as membrane dryness, flooding, and excessive differential pressure, which often leads to minor problems evolving into irreversible stack damage.

[0003] Secondly, the control mode of this scheme is simplistic, adjusting the gas supply only according to power demand, and cannot effectively distinguish between fluctuations in normal vehicle acceleration, deceleration, and hill climbing conditions and abnormal signs inside the fuel cell stack. During rapid acceleration, the delayed air supply can easily lead to oxygen starvation, while the lack of targeted monitoring results in a delayed response to gradual risks.

[0004] Third, the solution lacks a tiered and progressive safety architecture, triggering a shutdown immediately upon detecting an anomaly. In rail transit scenarios, frequent sudden shutdowns can easily cause vehicles to break down on the line, severely disrupting line operations and failing to provide limp-home functionality such as reduced power operation while ensuring safety. Summary of the Invention

[0005] This invention aims to address the problems of existing fuel cell control methods for hydrogen-powered rail vehicles, which employ post-event protection logic and cannot proactively intervene in early abnormal stages such as membrane dryness, flooding, and excessive pressure differential. Furthermore, the single control mode makes it difficult to distinguish between normal power fluctuations and potential fault signs, leading to oxygen starvation during acceleration and a delayed response to progressive risks. Additionally, the lack of a tiered safety architecture means that direct shutdown in abnormal situations can easily cause vehicle breakdowns on the line, disrupting operational order. Therefore, this invention provides a tiered safety control method and system for fuel cell systems, resolving the aforementioned issues of failing to balance dynamic response and stack safety.

[0006] To achieve the above-mentioned objectives, the present invention provides a graded safety control method for a fuel cell system, characterized by comprising the following steps: Real-time acquisition of fuel cell stack status parameters and vehicle operating condition information: Stack status parameters include the minimum voltage Umin of each individual cell, the anode-cathode voltage difference ΔP of each individual cell, and the high-frequency impedance R of the stack. HFR At least one of them, the high-frequency impedance R of the fuel cell stack HFR Used to reflect the dry and wet state of the proton exchange membrane in fuel cells; vehicle operating condition information includes the vehicle power demand change rate p; The fuel cell stack status parameters and vehicle operating condition information are compared with the corresponding preset thresholds. Based on the comparison results, the current state mode of the fuel cell system is determined as normal working mode, compensation mode, early warning mode or alarm mode. Execute a hierarchical control strategy corresponding to the current state mode of the fuel cell system.

[0007] Furthermore, the minimum voltage U of a single cell min The corresponding preset thresholds include the voltage warning threshold U. warn The preset threshold corresponding to the anode-cathode voltage difference ΔP of a single cell includes the voltage difference warning threshold ΔP. warn High-frequency impedance R of the fuel cell stack HFR The corresponding preset thresholds include the membrane dryness warning threshold R. dry_1 and flood warning threshold R flood_1 The preset threshold corresponding to the vehicle power demand change rate p is p. high ; The determination condition for the normal working mode is that the following conditions are met simultaneously: The rate of change in power demand did not exceed the limit: p <p high ; Voltage normal: U min >U warn ; Normal pressure difference: ΔP < ΔP warn ; Impedance normal: R flood_1 <R HFR <R dry_1 .

[0008] Furthermore, the compensation mode is a state where the power demand change rate p exceeds a threshold, but the stack state parameters are normal.

[0009] Furthermore, the minimum voltage U of a single cell min The corresponding preset thresholds include the voltage warning threshold U. warn The preset threshold corresponding to the anode-cathode voltage difference ΔP of a single cell includes the voltage difference warning threshold ΔP. warn High-frequency impedance R of the fuel cell stack HFR The corresponding preset thresholds include the membrane dryness warning threshold R. dry_1 and flood warning threshold R flood_1The preset threshold corresponding to the vehicle power demand change rate p is p. high ; The determination condition for the compensation mode is that the following conditions are met simultaneously: Power demand change rate exceeds limit: p ≥ p high ; Voltage normal: U min >U warn ; Normal pressure difference: ΔP < ΔP warn ; Impedance normal: R flood_1 < R HFR < R dry_1 .

[0010] Furthermore, the preset threshold corresponding to the lowest voltage Umin of a single cell includes a voltage warning threshold U. warn and voltage alarm threshold U fault The preset threshold corresponding to the anode-cathode voltage difference ΔP of a single cell includes the voltage difference warning threshold ΔP. warn and differential pressure alarm threshold ΔP fault High-frequency impedance R of the fuel cell stack HFR The corresponding preset thresholds include the membrane dryness warning threshold R. dry_1 Membrane dryness alarm threshold R dry_2 Flood warning threshold R flood_1 and flood alarm threshold R flood_2 ; The determination condition for the warning mode is that at least one of the following conditions is met: Low voltage: U fault ≤U min warn ; Large pressure difference: ΔP warn ≤ΔP<ΔP fault ; Symptoms of membrane dryness: R dry_1 ≤R HFR < R dry_2 ; Flood signs: R flood_2 < R HFR < R flood_1 .

[0011] Furthermore, the minimum voltage U of a single cell min The corresponding preset thresholds include the voltage alarm threshold U. fault The preset threshold corresponding to the anode-cathode voltage difference ΔP of a single cell includes the voltage difference alarm threshold ΔP. fault High-frequency impedance R of the fuel cell stack HFR The corresponding preset thresholds include the membrane dryness alarm threshold R. dry_2 ​and flood alarm threshold R flood_2 ; The alarm mode is determined by satisfying at least one of the following conditions: Voltage is severely low: U min ≤ U fault ; The pressure difference is too large: ΔP ≥ ΔP fault ; Severe membrane dryness: R HFR ≥ R dry_2 ; Severe flooding: R HFR ≤ R flood_2 .

[0012] Furthermore, the control strategies corresponding to the compensation mode include: increasing the excess air coefficient and simultaneously increasing the hydrogen supply.

[0013] Furthermore, the control strategy corresponding to the alarm mode is to execute an emergency shutdown protection procedure, including: closing the hydrogen inlet main valve and opening the vent valve to vent hydrogen from the pipeline; starting the nitrogen purging system and introducing nitrogen into the anode; disconnecting the fuel cell high-voltage contactor to achieve electrical isolation and sending a red audible and visual alarm to the vehicle's driver's cab and the remote monitoring center.

[0014] Furthermore, the control strategies corresponding to the early warning mode include: implementing targeted active intervention measures based on the stack state parameters that trigger the early warning; and sending a power limitation request to the vehicle controller to reduce the maximum output power limit of the fuel cell system.

[0015] Furthermore, proactive intervention measures include instructing the air compressor to increase its speed to increase oxygen supply if triggered by low voltage.

[0016] Furthermore, proactive intervention measures include: if triggered by a large pressure difference, adjusting the opening of the cathode outlet back pressure valve to reduce the pressure difference between the anode and cathode.

[0017] Furthermore, proactive intervention measures include reducing airflow or increasing humidification of the cathode inlet humidifier if triggered by membrane dryness symptoms.

[0018] Furthermore, proactive intervention measures include: if triggered by flooding symptoms, opening the pulse purge valve of the anode hydrogen exhaust line to remove accumulated liquid in the flow channel through pulsed exhaust.

[0019] Furthermore, the above steps are repeated cyclically to form a closed loop for continuous operation, which dynamically updates the state mode and dynamically adjusts the control strategy.

[0020] A graded safety control system for a fuel cell system, used to implement the above-mentioned graded safety control method, includes: Information Acquisition Module: Used for real-time acquisition of fuel cell stack status parameters and vehicle operating condition information. Stack status parameters include the minimum voltage Umin of each individual cell, the anode-cathode voltage difference ΔP of each individual cell, and the high-frequency impedance R of the stack. HFR At least one of them, the high-frequency impedance R of the fuel cell stack HFR Used to reflect the dry and wet state of the proton exchange membrane in fuel cells; vehicle operating condition information includes the vehicle power demand change rate p; Comparison module: used to compare the fuel cell stack status parameters and vehicle operating condition information with the corresponding preset thresholds respectively; Status mode determination module: used to determine the current status mode of the fuel cell system as normal operation mode, compensation mode, early warning mode or alarm mode based on the comparison results; Execution module: Used to execute the hierarchical control strategy corresponding to the current state mode of the fuel cell system.

[0021] Furthermore, the information acquisition module includes a voltage monitoring instrument, an anode-cathode inlet-outlet differential pressure sensor, and an AC impedance monitoring unit, which are used to acquire the minimum voltage Umin of a single cell, the anode-cathode differential pressure ΔP, and the high-frequency impedance RHFR of the battery stack in real time, respectively; it also includes an operating condition identification unit, which communicates with the vehicle control unit to acquire the power demand change rate p in real time.

[0022] Furthermore, the preset threshold corresponding to the lowest voltage Umin of a single cell includes a voltage warning threshold U. warn The preset threshold corresponding to the anode-cathode voltage difference ΔP of a single cell includes the voltage difference warning threshold ΔP. warn High-frequency impedance R of the fuel cell stack HFR The corresponding preset thresholds include the membrane dryness warning threshold R. dry_1 and flood warning threshold R flood_1 The preset threshold corresponding to the vehicle power demand change rate p is p. high ; The determination condition for the normal working mode is that the following conditions are met simultaneously: The rate of change in power demand did not exceed the limit: p <p high ; Voltage normal: U min >U warn ; Normal pressure difference: ΔP < ΔP warn ; Impedance normal: R flood_1 <R HFR <R dry_1 .

[0023] Furthermore, the compensation mode is a state where the power demand change rate p exceeds a threshold, but the stack state parameters are normal.

[0024] Furthermore, the preset threshold corresponding to the lowest voltage Umin of a single cell includes a voltage warning threshold U. warn The preset threshold corresponding to the anode-cathode voltage difference ΔP of a single cell includes the voltage difference warning threshold ΔP. warn High-frequency impedance R of the fuel cell stack HFR The corresponding preset thresholds include the membrane dryness warning threshold R. dry_1 and flood warning threshold R flood_1 The preset threshold corresponding to the vehicle power demand change rate p is p. high ; The determination condition for the compensation mode is that the following conditions are met simultaneously: Power demand change rate exceeds limit: p ≥ p high ; Voltage normal: U min >U warn ; Normal pressure difference: ΔP < ΔP warn ; Impedance normal: R flood_1 < R HFR < R dry_1 .

[0025] Furthermore, the preset threshold corresponding to the lowest voltage Umin of a single cell includes a voltage warning threshold U. warn and voltage alarm threshold U fault The preset threshold corresponding to the anode-cathode voltage difference ΔP of a single cell includes the voltage difference warning threshold ΔP. warn and differential pressure alarm threshold ΔP fault High-frequency impedance R of the fuel cell stack HFR The corresponding preset thresholds include the membrane dryness warning threshold R. dry_1 Membrane dryness alarm threshold R dry_2 Flood warning threshold R flood_1 and flood alarm threshold R flood_2 ; The determination condition for the warning mode is that at least one of the following conditions is met: Low voltage: U fault ≤U min warn ; Large pressure difference: ΔP warn ≤ΔP<ΔP fault ; Symptoms of membrane dryness: R dry_1 ≤R HFR < R dry_2 ; Flood signs: R flood_2 < R HFR < R flood_1 . ​

[0026] Furthermore, the preset threshold corresponding to the lowest voltage Umin of a single cell includes a voltage alarm threshold U. fault The preset threshold corresponding to the anode-cathode voltage difference ΔP of a single cell includes the voltage difference alarm threshold ΔP. fault High-frequency impedance R of the fuel cell stack HFR The corresponding preset thresholds include the membrane dryness alarm threshold R. dry_2 and flood alarm threshold R flood_2 ; The alarm mode is determined by satisfying at least one of the following conditions: Voltage is severely low: U min ≤ U fault ; The pressure difference is too large: ΔP ≥ ΔP fault ; Severe membrane dryness: R HFR ≥ R dry_2 ; Severe flooding: R HFR ≤ R flood_2 .

[0027] Furthermore, the control strategies corresponding to the compensation mode include: a high excess air coefficient, and a simultaneous increase in hydrogen supply.

[0028] Furthermore, the control strategy corresponding to the alarm mode is to execute an emergency shutdown protection procedure, including: closing the hydrogen inlet main valve and opening the vent valve to vent hydrogen from the pipeline; starting the nitrogen purging system and introducing nitrogen into the anode; disconnecting the fuel cell high-voltage contactor to achieve electrical isolation and sending a red audible and visual alarm to the vehicle's driver's cab and the remote monitoring center.

[0029] Furthermore, the control strategies corresponding to the early warning mode include: implementing targeted active intervention measures based on the stack state parameters that trigger the early warning; and sending a power limitation request to the vehicle controller to reduce the maximum output power limit of the fuel cell system.

[0030] Furthermore, proactive intervention measures include instructing the air compressor to increase its speed to increase oxygen supply if triggered by low voltage.

[0031] Furthermore, proactive intervention measures include: if triggered by a large pressure difference, adjusting the opening of the cathode outlet back pressure valve to reduce the pressure difference between the anode and cathode.

[0032] Furthermore, proactive intervention measures include reducing airflow or increasing humidification of the cathode inlet humidifier if triggered by membrane dryness symptoms.

[0033] Furthermore, proactive intervention measures include: if triggered by flooding symptoms, opening the pulse purge valve of the anode hydrogen exhaust line to remove accumulated liquid in the flow channel through pulsed exhaust.

[0034] Compared with the prior art, the present invention has the following advantages and advancements: (1) Proactive prevention of potential problems with electric propulsion Existing technologies rely on shutdown protection after severe faults such as low voltage and excessive differential pressure, which cannot prevent early anomalies such as membrane dryness and flooding from evolving into irreversible stack damage. This invention innovatively constructs a real-time monitoring system based on three core state variables: minimum voltage of individual cells, anode-cathode voltage difference, and high-frequency impedance. This system can comprehensively perceive the stack's health status from three dimensions: electrochemical, mechanical stress, and hydrothermal management. It provides a precise data foundation for proactive intervention and proactively prevents problems from occurring.

[0035] (2) It accurately distinguishes between operating condition fluctuations and fault symptoms, taking into account both dynamic response and stack safety. This invention introduces the power demand change rate as a key judgment parameter for the first time, and divides the operating status into four progressive levels: normal operation, compensation, early warning, and alarm. In compensation mode, the system increases the excess air coefficient in advance through dynamic feedforward air supply, accurately solving the oxygen starvation problem under high power loading and ensuring the vehicle's power response performance. At the same time, this mechanism avoids unnecessary early warnings or shutdowns triggered by fluctuations in normal operating conditions, ensuring the accuracy of the control strategy and the operational efficiency of the vehicle.

[0036] (3) A hierarchical and progressive security architecture was constructed. This invention establishes a complete hierarchical and progressive chain. In early warning mode, differentiated proactive interventions are implemented for different causes of failure, and power is limited to 50%, allowing the vehicle to continue traveling to the next station or maintenance point in limp mode. This design, while ensuring the safety of the fuel cell stack, minimizes sudden shutdowns caused by minor anomalies, and refines safety control through hierarchical intervention, significantly improving the availability of fuel cell systems in rail vehicle applications and the reliability of line operation.

[0037] (4) A closed-loop control mechanism has been formed This invention establishes a complete closed-loop control process through continuous status monitoring and dynamic mode updates. The system can adjust the control strategy in real time based on the latest status and verify the effect after intervention until the status returns to normal or is upgraded to the next safety level. This mechanism ensures that the fuel cell system can execute the most appropriate control actions at any time, achieving proactive safety management of the entire life cycle of the fuel cell stack, around the clock. Attached Figure Description

[0038] Figure 1A logic block diagram for a graded safety control method for fuel cell systems; Figure 2 A schematic diagram of the sensor arrangement in a fuel cell system; Figure 3 This is a flowchart of a graded safety control method for a hydrogen rail vehicle fuel cell system based on multi-parameter fusion. Detailed Implementation

[0039] To better understand the purpose, structure, and function of this invention, the following detailed description of a graded safety control method and system for a fuel cell system, in conjunction with the accompanying drawings, is provided.

[0040] Example 1 Reference Figures 1 to 3 As shown, the method in this embodiment specifically includes the following steps: Step 1: Real-time acquisition of fuel cell stack status parameters and vehicle operating condition information.

[0041] The logical relationship of the graded safety control method for fuel cell systems is referenced. Figure 1 The arrangement of each sensor is as follows: Figure 2 As shown: the voltage monitoring instrument is connected in parallel across each individual cell of the fuel cell stack; the differential pressure sensor is installed in the anode inlet and cathode outlet pipelines respectively; the AC impedance monitoring unit is connected to the proton exchange membrane fuel cell stack.

[0042] During the operation of the fuel cell system, the controller acquires the following three types of core status parameters and operating condition information in real time: The voltage values ​​of each individual cell in the fuel cell stack are collected by a voltage monitoring device, and the minimum voltage U of each individual cell is calculated. min This parameter is used to evaluate the uniformity of electrochemical reactions in the individual cells within the fuel cell stack. Excessively low voltage indicates insufficient reactant supply in localized areas (such as oxygen starvation) or decreased catalyst activity; in severe cases, it may lead to reverse polarity and irreversible damage.

[0043] The pressure difference ΔP between the anode and cathode inlets and outlets is collected by differential pressure sensors installed at the anode inlet and cathode outlet. This parameter is used to assess the mechanical stress state across the proton exchange membrane. Excessive pressure difference can cause the membrane to experience tensile or compressive stress, which, if exceeded, may lead to membrane tearing or perforation, posing a safety risk of direct mixing of hydrogen and oxygen.

[0044] The high-frequency impedance (RHFR) of the fuel cell stack is measured using an AC impedance monitoring unit. This parameter reflects the dry / wet state of the proton exchange membrane in the fuel cell. Excessive impedance indicates that the membrane is in a "dry" state, resulting in decreased proton conductivity and increased ohmic polarization; excessively low impedance indicates a "flooded" phenomenon inside the stack, where liquid water blocks the gas diffusion layer channels, hindering the reach of reactant gases to the catalyst layer.

[0045] The power demand change rate p is read from the vehicle control unit to characterize the vehicle's operating conditions.

[0046] Based on the real-time data collected by the voltage monitoring instrument, differential pressure sensor and AC impedance monitoring unit, the system can accurately obtain three sets of core state parameters: the minimum voltage of a single cell, the differential pressure between the anode and cathode inlet and outlet, and the high-frequency impedance of the stack, providing an accurate data basis for subsequent graded control and active intervention.

[0047] Step 2: Compare the fuel cell stack status parameters and vehicle operating condition information with the corresponding preset thresholds.

[0048] The voltage monitoring instrument monitors voltage, the differential pressure sensor monitors the inlet and outlet pressure difference, and the AC impedance detection unit monitors impedance. Different warning and alarm values ​​are set for these three functions, as shown in Table 1. Table 1: Parameter Comparison Table In the table above, U fault warn ;ΔP warn < Δp fault ;R dry_1 < Rdry_2 ;R flood_2 < R flood_1 .

[0049] The controller compares the fuel cell stack status parameters and vehicle operating condition information collected in step 1 with the corresponding preset thresholds. The comparison results will be used as input conditions for subsequent mode determination.

[0050] Step 3: Based on the comparison results, determine the current state mode of the fuel cell system as normal operation mode, compensation mode, early warning mode, or alarm mode.

[0051] (1) Normal working mode The system is considered to be in normal working mode when all of the following conditions are met simultaneously: The rate of change in power demand did not exceed the limit: p < p high ; Voltage normal: U min > U warn ; Normal pressure difference: ΔP < ΔP warn ; Impedance normal: R flood_1 < RHFR < R dry_1 .

[0052] (2) Compensation Model The system determines the compensation mode when all of the following conditions are met simultaneously: ​Power demand change rate exceeds limit: p ≥ p high ; Voltage normal: U min > U warn ; Normal pressure difference: ΔP < ΔP warn ; Impedance normal: R flood_1 < RHFR < R dry_1 .

[0053] The compensation mode is when the power demand change rate p exceeds a threshold, but the stack condition parameters are normal. (3) Early warning mode The system will enter warning mode when any of the following conditions are met: Low voltage: U fault ≤ U min < U warn ; Large pressure difference: ΔP warn ≤ ΔP < ΔP fault ; Symptoms of membrane dryness: R dry_1 ≤ RHFR < R dry_2 ; Flood signs: R flood_2 < RHFR < R flood_1 .

[0054] Trigger threshold: U warn Typical value 0.6V, U fault Typical value 0.3V; ΔP warn Typical value 30 kPa, ΔP fault Typical value 40 kPa; R dry_1 Typical value 150mΩcm 2 ,R dry_2 Typical value 200mΩcm 2 ;R flood_1 Typical value 50mΩcm 2 ,R flood_2 Typical value 30mΩcm 2 .

[0055] (4) Alarm Mode The system is in alarm mode when any of the following conditions are met: Voltage is severely low: U min ≤ U fault ; The pressure difference is too large: ΔP ≥ ΔP fault ; Severe membrane dryness: RHFR ≥ R dry_2 ; Severe flooding: RHFR ≤ R flood_2 .

[0056] Step 4: Execute the hierarchical control strategy corresponding to the current mode. Based on the operating mode determined in step 3, the controller executes a differentiated control strategy: (1) Control strategy under normal working mode The hydrogen injection valve and air compressor are controlled according to a preset economic excess coefficient curve to maintain a suitable excess air coefficient, ensuring the fuel cell stack operates at its optimal efficiency point. No power limiting is applied, and no alarms are triggered.

[0057] (2) Control strategy under compensation mode Increase the excess air coefficient and simultaneously increase the hydrogen supply to prevent oxygen starvation during rapid acceleration or uphill climbing. No alarm will be triggered; the system will automatically switch back to normal operating mode once the pressure (p) returns to the normal range.

[0058] (3) Control strategy under early warning mode The system performs two actions simultaneously: Action A: Execute targeted proactive intervention measures based on the stack status parameters that triggered the early warning.

[0059] The controller executes targeted corrective measures based on the specific parameter type that triggers the warning: If triggered by low voltage, it instructs the air compressor to increase its speed to increase oxygen supply.

[0060] If triggered by a large pressure difference, adjust the opening of the cathode outlet back pressure valve to reduce the pressure difference between the cathode and anode.

[0061] If triggered by membrane dryness symptoms, reduce the airflow or increase the humidification output of the cathode inlet humidifier.

[0062] If triggered by signs of flooding, the pulse purge valve of the anode hydrogen exhaust line is opened to remove the liquid accumulated in the flow channel through pulsed exhaust.

[0063] Action B: Send a power limit request to the vehicle controller to reduce the maximum output power limit of the fuel cell system.

[0064] The controller sends a power limiting request to the vehicle controller, limiting the maximum output power of the fuel cell system to 50% of its rated power. This measure allows the vehicle to continue driving in "limp mode" to the next station or maintenance point, avoiding breakdowns on the line. Simultaneously, a yellow warning signal is sent to the driver's cab to alert the driver to an early anomaly in the fuel cell stack.

[0065] If, after active intervention, the relevant parameters recover to the normal threshold range within 30 seconds, the system will automatically exit the warning mode and switch back to the normal working mode; if the parameters fail to recover within 30 seconds or further deteriorate to the alarm threshold, the system will switch to alarm mode.

[0066] (4) Control strategy under alarm mode The system executes an emergency shutdown protection procedure, which includes the following sub-steps: Close the main hydrogen inlet valve and open the vent valve to release hydrogen from the pipeline. Start the nitrogen purging system and introduce nitrogen gas into the anode; Electrical isolation is achieved by disconnecting the high-voltage contactor of the fuel cell. Send a red audible and visual alarm to the driver's cab and the remote monitoring center. The system is locked in alarm mode and can only be restarted after manual reset.

[0067] In alarm mode, the system enters a locked state, and the fuel cell system can only be restarted after maintenance personnel complete the fault diagnosis and manual reset on site.

[0068] Step 5: Closed-loop monitoring and dynamic model update After completing the control action in step 4, the controller executes step 1 to re-acquire status parameters and complete the closed-loop control process. This closed loop continues to run, ensuring that the system status mode is dynamically updated, enabling real-time response to changes in the fuel cell stack status and dynamic adjustment of the control strategy. Example

[0069] This embodiment provides a system architecture for implementing the hierarchical security control method of Embodiment 1.

[0070] The system includes the following functional modules: Information Acquisition Module: Used for real-time acquisition of fuel cell stack status parameters and vehicle operating condition information. Stack status parameters include the minimum voltage Umin of each individual cell, the anode-cathode voltage difference ΔP of each individual cell, and the high-frequency impedance R of the stack. HFR At least one of them, the high-frequency impedance R of the fuel cell stack HFR Used to reflect the dry and wet state of the proton exchange membrane in fuel cells; vehicle operating condition information includes the vehicle power demand change rate p; Comparison module: used to compare the fuel cell stack status parameters and vehicle operating condition information with the corresponding preset thresholds respectively; Status mode determination module: used to determine the current status mode of the fuel cell system as normal operation mode, compensation mode, early warning mode or alarm mode based on the comparison results; Execution module: Used to execute the hierarchical control strategy corresponding to the current state mode of the fuel cell system.

[0071] The information acquisition module includes a voltage monitoring instrument, a cathode and anode inlet and outlet differential pressure sensors, and an AC impedance monitoring unit, which are used to acquire the minimum voltage Umin of a single cell, the cathode and anode differential pressure ΔP, and the high-frequency impedance RHFR of the battery stack in real time, respectively; it also includes an operating condition identification unit, which communicates with the vehicle control unit to acquire the power demand change rate p in real time.

[0072] The above two embodiments of this application achieve improvements over the prior art through the following core technical means: Method 1: Construct a real-time monitoring system based on three core state variables: minimum voltage of a single cell, voltage difference between anode and cathode, and high-frequency impedance.

[0073] By fusing multiple sensors, including a voltage monitor, differential pressure sensor, and AC impedance monitoring unit, the system achieves comprehensive sensing of the fuel cell stack's electrochemical state, mechanical stress state, and water balance state. This approach enables the system to capture early signs of anomalies such as membrane dryness, flooding, and excessive differential pressure in real time, shifting the fault identification window from after a fault occurs to the early stages of anomaly detection. This provides a precise data foundation for proactive intervention, thereby achieving a fundamental shift from post-event protection to pre-event prevention.

[0074] Method 2: Introduce the power demand change rate as a judgment parameter to divide the system operating status into four progressive levels: normal operation, compensation, early warning, and alarm.

[0075] By distinguishing between the rate of change in power demand and the internal state parameters of the fuel cell stack, this method accurately identifies the essential difference between fluctuations in normal operating conditions and potential fault symptoms. When the vehicle accelerates rapidly or climbs a hill, the system enters compensation mode instead of warning mode, avoiding false alarms caused by fluctuations in operating conditions; when abnormalities occur in the internal parameters of the fuel cell stack, the system enters warning mode, ensuring that early risks are not missed. This distinction makes the control strategy more targeted and precise.

[0076] Method 3: Implement differentiated gas supply control strategies at each level.

[0077] In compensation mode, dynamic feedforward air supply is employed to increase the excess air coefficient in advance and simultaneously increase the hydrogen supply. This effectively solves the oxygen starvation problem caused by delayed air supply during rapid acceleration in existing technologies, ensuring the vehicle's power response performance. In warning mode, differentiated active interventions are implemented for different causes (oxygenation for low voltage, pressure regulation for large pressure difference, humidification for dry membrane, and purging for water flooding), while limiting power to 50% to achieve limp-home operation. This approach precisely corrects anomalies through cause-oriented control and avoids line breakdowns caused by direct shutdown due to minor anomalies, maintaining vehicle availability while ensuring stack safety. In alarm mode, emergency shutdown protection is implemented (fuel cut-off, nitrogen purging, and electrical isolation). This ensures maximum protection of personnel and equipment safety in the event of severe faults such as near-reverse polarity or membrane tearing.

[0078] Method 4: Adopt a closed-loop control process.

[0079] Through continuous status monitoring and dynamic mode updates, this approach achieves all-weather active safety protection for the fuel cell stack, ensuring that the system can execute the most appropriate control strategy based on the latest status at any time, forming a complete closed loop from risk identification to intervention and effect verification.

[0080] In summary, this application, through the systematic integration of the aforementioned core technologies, solves the three major problems of delayed post-event protection, confusion between operating conditions and faults, and lack of graded protection in existing technologies, thereby achieving a synergistic improvement in the safety, reliability, and availability of fuel cell systems.

[0081] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Those skilled in the art can make various improvements and modifications without departing from the spirit and principles of the invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A graded safety control method for a fuel cell system, characterized in that, Includes the following steps: Real-time acquisition of fuel cell stack status parameters and vehicle operating condition information: Stack status parameters include the minimum voltage U of each individual cell. min The voltage difference between the anode and cathode of a single cell, ΔP, and the high-frequency impedance of the stack, R. HFR At least one of them, the high-frequency impedance R of the fuel cell stack HFR Used to reflect the dry and wet state of the proton exchange membrane in fuel cells; vehicle operating condition information includes the vehicle power demand change rate p; The fuel cell stack status parameters and vehicle operating condition information are compared with the corresponding preset thresholds. Based on the comparison results, the current state mode of the fuel cell system is determined as normal working mode, compensation mode, early warning mode or alarm mode. Execute a hierarchical control strategy corresponding to the current state mode of the fuel cell system.

2. The graded safety control method for a fuel cell system according to claim 1, characterized in that, The lowest voltage U of a single cell min The corresponding preset thresholds include the voltage warning threshold U. warn The preset threshold corresponding to the anode-cathode voltage difference ΔP of a single cell includes the voltage difference warning threshold ΔP. warn High-frequency impedance R of the fuel cell stack HFR The corresponding preset thresholds include the membrane dryness warning threshold R. dry_1 and flood warning threshold R flood_1 The preset threshold corresponding to the vehicle power demand change rate p is p. high ; The determination condition for the normal working mode is that the following conditions are met simultaneously: The rate of change in power demand did not exceed the limit: p <p high ; Voltage normal: U min >U warn ; Normal pressure difference: ΔP < ΔP warn ; Impedance normal: R flood_1 <R HFR <R dry_1 .

3. The graded safety control method for a fuel cell system according to claim 1, characterized in that, The compensation mode is the state where the power demand change rate p exceeds the threshold, but the stack state parameters are normal.

4. The graded safety control method for a fuel cell system according to claim 3, characterized in that, The lowest voltage U of a single cell min The corresponding preset thresholds include the voltage warning threshold U. warn The preset threshold corresponding to the anode-cathode voltage difference ΔP of a single cell includes the voltage difference warning threshold ΔP. warn High-frequency impedance R of the fuel cell stack HFR The corresponding preset thresholds include the membrane dryness warning threshold R. dry_1 and flood warning threshold R flood_1 The preset threshold corresponding to the vehicle power demand change rate p is p. high ; The determination condition for the compensation mode is that the following conditions are met simultaneously: Power demand change rate exceeds limit: p ≥ p high ; Voltage normal: U min >U warn ; Normal pressure difference: ΔP < ΔP warn ; Impedance normal: R flood_1 < R HFR < R dry_1 .

5. The graded safety control method for a fuel cell system according to claim 1, characterized in that, The lowest voltage U of a single cell min The corresponding preset thresholds include the voltage warning threshold U. warn and voltage alarm threshold U fault The preset threshold corresponding to the anode-cathode voltage difference ΔP of a single cell includes the voltage difference warning threshold ΔP. warn and differential pressure alarm threshold ΔP fault High-frequency impedance R of the fuel cell stack HFR The corresponding preset thresholds include the membrane dryness warning threshold R. dry_1 Membrane dryness alarm threshold R dry_2 Flood warning threshold R flood_1 and flood alarm threshold R flood_2 ; The determination condition for the warning mode is that at least one of the following conditions is met: Low voltage: U fault ≤U min warn ;​ Large pressure difference: ΔP warn ≤ΔP<ΔP fault ; Signs of membrane dryness: R dry_1 ≤R HFR < R dry_2 ; Flood signs: R flood_2 < R HFR < R flood_1 .

6. The graded safety control method for a fuel cell system according to claim 1, characterized in that, The lowest voltage U of a single cell min The corresponding preset thresholds include the voltage alarm threshold U. fault The preset threshold corresponding to the anode-cathode voltage difference ΔP of a single cell includes the voltage difference alarm threshold ΔP. fault High-frequency impedance R of the fuel cell stack HFR The corresponding preset thresholds include the membrane dryness alarm threshold R. dry_2 and flood alarm threshold R flood_2 ; The alarm mode is determined by satisfying at least one of the following conditions: Voltage is severely low: U min ≤ U fault ; The pressure difference is too large: ΔP ≥ ΔP fault ; Severe membrane dryness: R HFR ≥ R dry_2 ; Severe flooding: R HFR ≤ R flood_2 .

7. The graded safety control method for a fuel cell system according to claim 1, characterized in that, The control strategies corresponding to the compensation mode include: increasing the excess air coefficient and simultaneously increasing the hydrogen supply.

8. The graded safety control method for a fuel cell system according to claim 1, characterized in that, The control strategy corresponding to the alarm mode is to execute the emergency shutdown protection procedure, including: closing the hydrogen inlet main valve, opening the vent valve to vent the hydrogen in the pipeline; starting the nitrogen purging system and introducing nitrogen into the anode; disconnecting the fuel cell high-voltage contactor to achieve electrical isolation, and sending a red audible and visual alarm to the vehicle's driver's cab and the remote monitoring center.

9. The graded safety control method for a fuel cell system according to claim 1, characterized in that, The control strategies corresponding to the early warning mode include: implementing targeted active intervention measures based on the stack status parameters that trigger the early warning; and sending a power limitation request to the vehicle controller to reduce the maximum output power limit of the fuel cell system.

10. A graded safety control method for a fuel cell system according to claim 9, characterized in that, Active intervention measures include instructing the air compressor to increase its speed to increase oxygen supply if triggered by low voltage.

11. A graded safety control method for a fuel cell system according to claim 9, characterized in that, Active intervention measures include: if triggered by excessive pressure difference, adjusting the opening of the cathode outlet back pressure valve to reduce the pressure difference between the anode and cathode.

12. The graded safety control method for a fuel cell system according to claim 9, characterized in that, Proactive interventions include reducing airflow or increasing humidification of the cathode inlet humidifier if triggered by membrane dryness symptoms.

13. A graded safety control method for a fuel cell system according to claim 9, characterized in that, Active intervention measures include: if triggered by flooding symptoms, opening the pulse purge valve of the anode hydrogen exhaust line to remove the liquid accumulated in the flow channel through pulsed exhaust.

14. The graded safety control method for a fuel cell system according to claim 1, characterized in that, The steps of claim 1 are executed repeatedly to form a closed loop for continuous operation, thereby dynamically updating the state mode and dynamically adjusting the control strategy.

15. A graded safety control system for a fuel cell system, used to implement the graded safety control method for a fuel cell system according to any one of claims 1-14, characterized in that, include: Information Acquisition Module: Used for real-time acquisition of fuel cell stack status parameters and vehicle operating condition information. Stack status parameters include the minimum voltage Umin of each individual cell, the anode-cathode voltage difference ΔP of each individual cell, and the high-frequency impedance R of the stack. HFR At least one of them, the high-frequency impedance R of the fuel cell stack HFR Used to reflect the dry and wet state of the proton exchange membrane in fuel cells; vehicle operating condition information includes the vehicle power demand change rate p; Comparison module: used to compare the fuel cell stack status parameters and vehicle operating condition information with the corresponding preset thresholds respectively; Status mode determination module: used to determine the current status mode of the fuel cell system as normal operation mode, compensation mode, early warning mode or alarm mode based on the comparison results; Execution module: Used to execute the hierarchical control strategy corresponding to the current state mode of the fuel cell system.

16. A graded safety control system for a fuel cell system according to claim 15, characterized in that, The information acquisition module includes a voltage monitoring instrument, a differential pressure sensor at the anode and cathode inlet / outlet, and an AC impedance monitoring unit, which are used to acquire the minimum voltage U of a single cell in real time. min It also includes the anode-cathode voltage difference ΔP, the high-frequency impedance of the fuel cell stack RHFR, and a working condition identification unit that communicates with the vehicle control unit to obtain the power demand change rate p in real time.

17. A graded safety control system for a fuel cell system according to claim 15, characterized in that, The lowest voltage U of a single cell min The corresponding preset thresholds include the voltage warning threshold U. warn The preset threshold corresponding to the anode-cathode voltage difference ΔP of a single cell includes the voltage difference warning threshold ΔP. warn High-frequency impedance R of the fuel cell stack HFR The corresponding preset thresholds include the membrane dryness warning threshold R. dry_1 and flood warning threshold R flood_1 The preset threshold corresponding to the vehicle power demand change rate p is p. high ; The determination condition for the normal working mode is that the following conditions are met simultaneously: The rate of change in power demand did not exceed the limit: p <p high ; Voltage normal: U min >U warn ; Normal pressure difference: ΔP < ΔP warn ; Impedance normal: R flood_1 <R HFR <R dry_1 .

18. A graded safety control system for a fuel cell system according to claim 15, characterized in that, The compensation mode is the state where the power demand change rate p exceeds the threshold, but the stack state parameters are normal.

19. A graded safety control system for a fuel cell system according to claim 15, characterized in that, The lowest voltage U of a single cell min The corresponding preset thresholds include the voltage warning threshold U. warn The preset threshold corresponding to the anode-cathode voltage difference ΔP of a single cell includes the voltage difference warning threshold ΔP. warn High-frequency impedance R of the fuel cell stack HFR The corresponding preset thresholds include the membrane dryness warning threshold R. dry_1 and flood warning threshold R flood_1 The preset threshold corresponding to the vehicle power demand change rate p is p. high ; The determination condition for the compensation mode is that the following conditions are met simultaneously: Power demand change rate exceeds limit: p ≥ p high ; Voltage normal: U min >U warn ; Normal pressure difference: ΔP < ΔP warn ; Impedance normal: R flood_1 < R HFR < R dry_1 .

20. A graded safety control system for a fuel cell system according to claim 15, characterized in that, The lowest voltage U of a single cell min The corresponding preset thresholds include the voltage warning threshold U. warn and voltage alarm threshold U fault The preset threshold corresponding to the anode-cathode voltage difference ΔP of a single cell includes the voltage difference warning threshold ΔP. warn and differential pressure alarm threshold ΔP fault High-frequency impedance R of the fuel cell stack HFR The corresponding preset thresholds include the membrane dryness warning threshold R. dry_1 Membrane dryness alarm threshold R dry_2 Flood warning threshold R flood_1 and flood alarm threshold R flood_2 ; The determination condition for the warning mode is that at least one of the following conditions is met: Low voltage: U fault ≤U min warn ;​ Large pressure difference: ΔP warn ≤ΔP<ΔP fault ; Signs of membrane dryness: R dry_1 ≤R HFR < R dry_2 ; Flood signs: R flood_2 < R HFR < R flood_1 .

21. A graded safety control system for a fuel cell system according to claim 15, characterized in that, The lowest voltage U of a single cell min The corresponding preset thresholds include the voltage alarm threshold U. fault The preset threshold corresponding to the anode-cathode voltage difference ΔP of a single cell includes the voltage difference alarm threshold ΔP. fault High-frequency impedance R of the fuel cell stack HFR The corresponding preset thresholds include the membrane dryness alarm threshold R. dry_2 and flood alarm threshold R flood_2 ; The alarm mode is determined by satisfying at least one of the following conditions: Voltage is severely low: U min ≤ U fault ; The pressure difference is too large: ΔP ≥ ΔP fault ; Severe membrane dryness: R HFR ≥ R dry_2 ; Severe flooding: R HFR ≤ R flood_2 .

22. A graded safety control system for a fuel cell system according to claim 15, characterized in that, The control strategies corresponding to the compensation mode include: a high excess air coefficient and a simultaneous increase in hydrogen supply.

23. A graded safety control system for a fuel cell system according to claim 15, characterized in that, The control strategy corresponding to the alarm mode is to execute the emergency shutdown protection procedure, including: closing the hydrogen inlet main valve, opening the vent valve to vent the hydrogen in the pipeline; starting the nitrogen purging system and introducing nitrogen into the anode; disconnecting the fuel cell high-voltage contactor to achieve electrical isolation, and sending a red audible and visual alarm to the vehicle's driver's cab and the remote monitoring center.

24. A graded safety control system for a fuel cell system according to claim 15, characterized in that, The control strategies corresponding to the early warning mode include: implementing targeted active intervention measures based on the stack status parameters that trigger the early warning; and sending a power limitation request to the vehicle controller to reduce the maximum output power limit of the fuel cell system.

25. A graded safety control system for a fuel cell system according to claim 24, characterized in that, Active intervention measures include instructing the air compressor to increase its speed to increase oxygen supply if triggered by low voltage.

26. A graded safety control system for a fuel cell system according to claim 24, characterized in that, Active intervention measures include: if triggered by excessive pressure difference, adjusting the opening of the cathode outlet back pressure valve to reduce the pressure difference between the anode and cathode.

27. A graded safety control system for a fuel cell system according to claim 24, characterized in that, Proactive interventions include reducing airflow or increasing humidification of the cathode inlet humidifier if triggered by membrane dryness symptoms.

28. A graded safety control system for a fuel cell system according to claim 24, characterized in that, Active intervention measures include: if triggered by flooding symptoms, opening the pulse purge valve of the anode hydrogen exhaust line to remove the liquid accumulated in the flow channel through pulsed exhaust.

Images