Fuel cell system and method for monitoring a gas tank system
Patent Information
- Application Number
- EP2023790612
- Authority / Receiving Office
- EP · EP
- Patent Type
- Applications
- Current Assignee / Owner
- Priority Date
- 2022-11-07
- Filing Date
- 2023-10-16
- Publication Date
- 2025-09-17
AI Technical Summary
Existing fuel cell systems face challenges in quickly and reliably detecting leaks in the high-pressure pipe system, which can lead to the leakage of gaseous fuel into the environment, especially during operation.
A method involving a first valve device to close and record pressure curves in the high-pressure line system, calculating a theoretical actual mass flow using the ideal gas equation, and comparing it with the fuel mass flow requirement to generate error signals for leak detection, allowing for continuous monitoring and quick identification of leaks.
Enables reliable and efficient leak detection during any system state, including operation, by maintaining system operation and triggering appropriate responses such as warning signals or emergency modes based on detected leaks.
Smart Images
Figure 1.1
Abstract
Description
[0001] Description
[0002] title and method for monitoring a
[0003] Technical area
[0004] The present invention relates to a fuel cell system, in particular for a vehicle, a method for monitoring a gas tank system, which can be used, for example, in a fuel cell system.
[0005] State of the art
[0006] Fuel cells are increasingly being used as energy converters, including in vehicles, to convert chemical energy stored in a fuel, such as hydrogen, together with oxygen, directly into electrical energy. Fuel cells have an anode, a cathode, and an electrolytic membrane arranged between the anode and cathode. Oxidation of the fuel occurs at the anode, and reduction of the oxygen occurs at the cathode.
[0007] The fuel is typically supplied to the fuel cell via a piping system from a tank in which the gaseous fuel is stored at high pressure. A separating or shut-off valve is usually provided between the tank and a high-pressure section of the piping system. The high-pressure section is also typically connected to a section of the piping connected to the fuel cell via a pressure regulator or flow control device.
[0008] Leaks can occur particularly in the high-pressure section of the piping system, e.g., due to leaky valves or damage to the piping system. To minimize the release of gaseous fuel into the environment, it is desirable to detect such leaks as quickly and reliably as possible.
[0009] US 7,127,937 B2 discloses a method for detecting a leak in a fuel cell system, wherein, upon shutting down a fuel cell, a first and a second isolation valve are closed to isolate a supply line from a fuel tank through the first isolation valve and from the fuel cell through the second isolation valve. After the valves are closed, the pressure in the supply line is recorded and stored. Before restarting the fuel cell, with the isolation valves closed, the pressure in the supply line is recorded again and compared with the stored value to determine whether a leak exists if a pressure difference exists.
[0010] Disclosure of the invention
[0011] Against this background, the present invention provides a method for monitoring a gas tank system having the features of claim 1 and a fuel cell system having the features of claim 7.
[0012] According to a first aspect of the invention, a method for monitoring a gas tank system comprises determining a fuel mass flow requirement of a consumer system, such asone or more fuel cells, closing a first valve device to interrupt a gas supply from a tank into a high-pressure line system that connects the tank to the consumer system, detecting a pressure profile in the high-pressure line system with the first valve device closed, in particular by means of a pressure sensor, determining a theoretical actual mass flow in the high-pressure line system based on the detected pressure profile, comparing the theoretical actual mass flow in the high-pressure line system with the determined fuel mass flow requirement of the consumer system, and generating an error signal by a control device if the theoretical actual mass flow deviates from the fuel mass flow requirement by more than a threshold value. According to a second aspect of the invention, a fuel cell system, which e.g.can be provided for use in a vehicle, a consumer system with a fuel cell arrangement and a gas tank system with a tank for storing gas, in particular hydrogen, a high-pressure line system connected to the consumer system, a first valve device which can be switched between an open state in which it connects the tank to the high-pressure line system and a closed state in which it separates the tank from the high-pressure line system, a pressure sensor for detecting a pressure in the high-pressure line system and a control device which is connected to the first valve device, to the pressure sensor and to the consumer system in a signal-conducting manner and is designed to cause the fuel cell system to carry out a method according to the first aspect of the invention.
[0013] One idea underlying the invention is to close a first valve device or an isolating valve device arranged between the tank and the high-pressure line system when a known mass flow to be delivered from the high-pressure line system to the consumer system is present and to record the pressure curve that occurs after the closure in order to determine a theoretical actual mass flow. For example, a pressure gradient can be derived from the pressure curve and, with the aid of the ideal gas equation and a mass balance of the high-pressure line system, a theoretical mass flow leaving the high-pressure line system can be calculated. If this theoretical mass flow is compared with the known mass flow requirement of the consumer system, the presence of a leak can be inferred, e.g. if the theoretical mass flow deviates from the mass flow requirement by more than a threshold value.
[0014] An advantage of the invention is that the leak test can be performed in virtually any system condition, especially during operation. Since the high-pressure line system has a certain volume and thus contains a certain volume of gas, operation of the consumer system can be maintained even during a brief interruption of the fuel supply from the tank with the first valve closed. The leak test can thus be performed quickly and easily, allowing leaks to be reliably detected, especially during operation.
[0015] The features and advantages disclosed herein in connection with one aspect of the invention are also disclosed for the respective other aspects. In particular, the control device can initiate all method steps and carry out various steps itself, such as steps for determining values based on measured physical quantities. For example, the control device can have a computing unit, such as a CPU, an ASIC, an FPGA or the like, and a data memory, in particular a non-volatile data memory such as a flash memory, an SD memory or the like, which is readable by the computing unit. The data memory can store software that is executable by the computing unit in order to cause the system to carry out the steps of the method.
[0016] Advantageous embodiments and further developments emerge from the further subclaims and from the description with reference to the figures of the drawing.
[0017] According to some embodiments, it can be provided that the generation of the error signal by the control device comprises generating a first error signal that indicates the presence of a leak in the first valve device if the theoretical actual mass flow is less than the fuel mass flow requirement by more than the threshold value. For example, the computing unit of the control device can write a first error entry into the data memory with the information that a leak in the first valve device is suspected. Concluding a leak in the first valve device if the theoretical actual mass flow is less than the fuel mass flow requirement is possible because, in this case, gas is still supplied from the tank into the high-pressure line system despite the first valve device being closed.Consequently, the measured pressure in the high-pressure line system will not drop as much as would be the case if the first valve device were tightly closed, and the theoretical actual mass flow will decrease accordingly.
[0018] According to some embodiments, it can be provided that the generation of the first error signal comprises writing an entry into a data memory (62) if the theoretical actual mass flow is less than the fuel mass flow requirement by more than a first threshold value, and comprises outputting a warning signal and / or initiating emergency operation by the control device (6) if the theoretical actual mass flow is less than the fuel mass flow requirement by more than a second threshold value. If a high leakage mass flow from the tank through the first valve device into the high-pressure line system is thus determined, e.g. by forming the difference between the theoretical actual mass flow and the mass flow requirement, the control device can output a warning signal, e.g. in the form of an optical and / or acoustic signal.Optionally, an emergency operating mode of the consumer system can also be activated or another alternative reaction triggered by the error signal. In the event that only a small leakage mass flow from the tank through the first valve device into the high-pressure line system is detected, it may be sufficient to write a corresponding error entry to the data memory of the control device.
[0019] According to some embodiments, it can be provided that the generation of the error signal by the control device comprises generating a second error signal which indicates the presence of a leak in the high-pressure line system or a medium-pressure line system connected to the high-pressure line system if the theoretical actual mass flow is greater than the fuel mass flow requirement by more than the threshold value. If the theoretical actual mass flow is greater than the fuel mass flow requirement, i.e. if more fuel is discharged from the high-pressure line system with the first valve device closed than the consumer system is known to require, the detected pressure in the high-pressure line system drops faster than expected. From this, it can be concluded that the gas is escaping from the high-pressure line system via other routes in the form of a leakage mass flow.According to some embodiments, it can be provided that generating the second error signal comprises writing an entry into a data memory and / or outputting a warning signal and / or initiating emergency operation if the theoretical actual mass flow is greater than the fuel mass flow requirement by more than a first threshold value, and initiating a safe operating state, e.g. by closing the first valve devices, if the theoretical actual mass flow is greater than the fuel mass flow requirement by more than a second threshold value. If the leakage mass flow is large, the control device can thus, for example, switch at least the first valve device to its closed state. If only a smaller leakage mass flow escapes, an error can be written to the data memory of the control device.
[0020] According to some embodiments, the method may further comprise detecting a pressure in a medium-pressure line system of the consumer system, which is connected to the high-pressure line system via a flow control device, wherein the generation of the error signal by the control device comprises generating a third error signal indicating the presence of a leak in the flow control device if the theoretical actual mass flow is greater than the fuel mass flow requirement by more than the threshold value and the pressure detected in the medium-pressure line system is greater than a medium-pressure threshold value. In particular, a pressure relief valve may be provided in the medium-pressure line system, which opens when a predetermined pressure is reached in order to release gas from the medium-pressure line system into the environment.If the theoretical actual mass flow is greater than the fuel mass flow requirement, i.e. if more fuel is removed from the high-pressure line system when the first valve device is closed than the consumer system is known to require, the detected pressure in the high-pressure line system drops faster than expected. It can be concluded from this that the gas is escaping from the high-pressure line system via other routes in the form of a leakage mass flow. If it is also known that there is high pressure in the medium-pressure line system, e.g. a pressure above a limit value, there is a possibility that the pressure relief valve will open when a certain amount of gas flows into it from the high-pressure system. In this case, it can be concluded that an increased mass flow through the second valve device is due to a leak that connects the high-pressure and medium-pressure line systems.
[0021] According to some embodiments, it can be provided that determining the fuel mass flow requirement of the consumer system comprises determining an electrical voltage of the fuel cell arrangement and calculating the fuel mass flow requirement based on the electrical voltage, e.g. using a calculation model that links the electrical voltage to the fuel mass flow. The calculation model can, for example, have been determined empirically, wherein the fuel mass flow is correlated with the electrical voltage and optionally further physical variables, such as the temperature of the fuel cell. The calculation model can be present as a functional relationship and / or in the form of a characteristic map. The fuel mass flow requirement can also be determined in another way, e.g. via control parameters of a metering valve connected to a fuel inlet of the consumer system.
[0022] According to some embodiments, the gas tank system may include a flow control device that can be switched between an open state and a closed state for connecting the high-pressure line system to the consumer system. For example, if the theoretical actual mass flow is greater than the first upper threshold, the control device may also switch the flow control device to the closed state. If the theoretical actual mass flow is less than the fuel mass flow requirement, i.e., if there is a leak in the first valve device, the second valve device may optionally be switched to the closed position or actuated such that the flow through the second valve device is reduced.The flow control device can generally be configured to vary a flow rate and thus a mass flow from the high-pressure line system into the consumer system. Analogously, the pressure at which the gas flows from the high-pressure line system into the consumer system can also be varied by the flow control device. Therefore, the flow control device can also be referred to as a pressure regulator. The flow control device can optionally have a second valve device, e.g., in the form of a switchable solenoid valve, which can be switched between the open and closed states.
[0023] According to some embodiments, it can be provided that the first valve device has a switchable solenoid valve that can be switched between the open state and the closed state.
[0024] According to some embodiments, it can be provided that the high-pressure line system has a supply connection for connecting a refueling system, wherein the supply connection is closed by a check valve against the escape of gas from the high-pressure line system.
[0025] The invention is explained below with reference to the figures of the drawings. The figures show:
[0026] Fig. 1 is a schematic representation of a hydraulic circuit diagram of a fuel cell system according to an embodiment of the invention; and
[0027] Fig. 2 is a flowchart of a method according to an embodiment of the invention.
[0028] In the figures, the same reference symbols denote identical or functionally identical components, unless otherwise stated.
[0029] Fig. 1 shows a schematic diagram of a fuel cell system 200 which can be used, for example, in a vehicle. The fuel cell system 200 comprises a gas tank system 100 and a consumer system 205. As shown only schematically in Fig. 1, the consumer system 205 has a fuel cell arrangement 210. The fuel cell arrangement 210 has at least one fuel cell, but preferably a plurality of fuel cells connected electrically in series, which are designed to convert chemical energy stored in a gaseous fuel, such as hydrogen, together with oxygen directly into electrical energy. As further shown schematically in Fig. 1, the fuel cell arrangement 210 has a fuel supply connection 211, via which gaseous fuel can be supplied to the fuel cell arrangement 210, in particular to an anode of the at least one fuel cell.
[0030] The gas tank system 100 is explained below by way of example with reference to the fuel cell system 200. However, the invention is not limited thereto; rather, the gas tank system 100 and the associated methods M can also be used in combination with other consumer systems, such as gas engines or the like.
[0031] As shown schematically in Fig. 1, the gas tank system 100 comprises a tank 1, a high-pressure line system 2, a first valve device 3, a pressure regulator or flow control device 5, a first pressure sensor 4, an optional second pressure sensor 7, and a control device 6. Optionally, the gas tank system 100 may further comprise a refueling connection or supply connection 20.
[0032] Tank 1 is designed to store gas, in particular hydrogen. For example, tank 1 can be configured to store gas at a pressure of up to 800 bar.
[0033] The high-pressure line system 2 can in particular have a connecting line 21 and optionally a supply line 22, as is shown schematically and purely by way of example in Fig. 1. The connecting line 21 connects the tank 1 to the consumer system 205. The first valve device 3 can, for example, have a switchable solenoid valve 3 that can be switched between a closed state and an open state. In general, the first valve device 3 can be switched between a closed state and an open state. As shown schematically in Fig. 1, the valve device 3 is arranged between the tank 1 and the high-pressure line system 2, in particular between the tank 1 and the connecting line 21. In the open state, the first valve device 3 connects the tank 1 to the high-pressure line system 2. In the closed state, the first valve device 3 separates the tank 1 and the high-pressure line system 2 from one another.
[0034] The flow control device 5 can also be switched between a closed state and an open state. For example, the flow control device 5 can have a switchable solenoid valve as a second valve device, which can be switched between a closed state and an open state. In general, the flow control device 5 can be designed to vary a gas flow or mass flow and / or a gas pressure. As schematically shown in Fig. 1, the flow control device 5 is arranged between the consumer system 205 and the high-pressure line system 2, in particular between the consumer system 205 and the connecting line 21. In the open state, the flow control device 5 connects the consumer system 205 to the high-pressure line system 2. In the closed state, the flow control device 5 separates the consumer system 205 and the high-pressure line system 2 from one another.
[0035] The supply line 22 is connected to the supply connection 20, which can be designed, for example, as a plug-in connection for a tank nozzle. As shown in Fig. 1, a check valve 8 can be arranged in the supply line 22, which closes the supply connection 20 against the escape of gas from the high-pressure line system 2.
[0036] The high-pressure line system 2 forms a gas receiving volume, so that a quantity of gas stored therein can be withdrawn from the high-pressure line system 2 when the first valve device 3 is closed. If gas is withdrawn from the high-pressure line system 2 when the first valve device 3 is closed, e.g. by the consumer system 210 via the
[0037] Flow control device 5, the pressure in the high-pressure line system 2 drops.
[0038] As shown in Fig. 1, the first pressure sensor 4 is connected to the high-pressure line system 2 and configured to detect a pressure in the high-pressure line system 2. The optional second pressure sensor 7 is connected to a medium-pressure line system 9, which connects the flow control device 5 to the fuel supply connection 211 of the fuel cell arrangement 210. The second pressure sensor 7 is thus configured to detect the pressure in the medium-pressure line system 9. As further schematically shown in Fig. 1, a pressure relief valve 10 can be provided in the medium-pressure line system 9, which opens to release gas into the environment when the pressure in the medium-pressure line system 9 exceeds a limit value.
[0039] The control device 6 is shown only schematically as a block in Fig. 1 and is implemented as an electronic control device 6. As shown by way of example in Fig. 1, the control device 6 can have a computing unit 61, such as a CPU, an ASIC, an FPGA or the like, and a data memory 62, in particular a non-volatile data memory such as a flash memory, an SD memory or the like, which is readable by the computing unit. As shown schematically in Fig. 1, the control device 6 is connected in a signal-conducting manner to the first and second valve devices 3, 5, to the pressure sensors 4, 7 and to the consumer system 205, in particular to the fuel cell arrangement 210. The signal-conducting connection can be implemented, for example, in a wired manner, e.g. via a fieldbus system, or via a wireless connection, e.g. via WiFi or the like.
[0040] The control device 6 is configured to cause the fuel cell system 200 to execute the method M shown in Fig. 2. For example, software executable by the computing unit 61 can be stored in the data memory 62 to cause the system 200 to execute the method M. In a first step M1, the control device 6 determines a fuel mass flow requirement of the consumer system 205. For example, the control device 6 can receive an electrical voltage currently generated by the fuel cell arrangement 210 as an input variable and, based thereon, calculate the fuel mass flow requirement of the consumer system 205, e.g., with the aid of a calculation model stored in the data memory 62, which can, for example, contain an empirically determined characteristic map or an empirically determined calculation function.In principle, other options for determining the fuel mass flow requirement are also conceivable. During step M1, the consumer system 205 is preferably supplied with a mass flow greater than zero from tank 1. However, the invention is not limited to this, but can also be implemented when the mass flow requirement of the consumer system 205 is zero.
[0041] In step M2, the first valve device 3 is closed to interrupt the gas supply from the tank 1 to a high-pressure line system 2. For example, the control device 6 can output a control signal to the first valve device 3 to switch it to its closed state.
[0042] In step M3, a pressure curve in the high-pressure line system 2 is detected or recorded by means of the first pressure sensor 4 when the first valve device 3 is closed, e.g. over a predetermined period of time, which can be between 0.5 seconds and 5 seconds, for example.
[0043] In the optional step M31, a pressure in the medium-pressure line system 9 is detected by means of the second pressure sensor 7, in particular while the first valve device 3 is closed.
[0044] In step M4, the control device 6 determines a theoretical actual mass flow in the high-pressure line system 2 based on the detected pressure curve. For example, the control device 6 can calculate a pressure gradient from the pressure curve and, using the ideal gas equation and a mass balance across the high-pressure line system 2, calculate the theoretical mass flow discharged from the high-pressure line system 2, assuming that no leakage flows occur.
[0045] In step M5, the control device 6 compares the calculated theoretical actual mass flow with the determined fuel mass flow requirement of the consumer system 205. In a sealed high-pressure line system 2 in which no significant leakage flows occur, the theoretical actual mass flow would correspond to the determined fuel mass flow requirement, apart from measurement and calculation inaccuracies. If the theoretical actual mass flow deviates from the fuel mass flow requirement by more than a threshold value, as shown in Fig. 2 by the symbol "+", the method proceeds to step M6. The threshold value can, in particular, take into account the previously mentioned measurement and calculation inaccuracies. If the theoretical actual mass flow deviates from the fuel mass flow requirement by less than the threshold value, as shown in Fig. 2 by the symbol
[0046] If leakage flows occur, the method proceeds to step M7. Optionally, in step M5, a comparison is also made between the pressure in the medium-pressure line system 9 detected in step M31 and a medium-pressure threshold value.
[0047] In step M5, a difference between the theoretical actual mass flow and the mass flow requirement can be calculated. This difference or the amount of the difference can then be compared with the threshold value to check whether the amount of the difference exceeds the threshold value. If the theoretical actual mass flow is less than the fuel mass flow requirement by more than the threshold value, it can be concluded that there is a leak or a leak in the first valve device 3, since in this case, even when the first valve device 3 is closed, gas flows from the tank 1 into the high-pressure line system 2. Consequently, with a constant actual mass flow withdrawal by the consumer system 205, the pressure gradient when the valve 3 is closed is lower than would be the case if the valve 3 were to close tightly.Conversely, the presence of a leak in the high-pressure line system 2 can be concluded, in which more gas escapes from the high-pressure line system 2 than expected, if the theoretical actual mass flow is greater than the fuel mass flow requirement by more than the threshold value.
[0048] In step M7, the control device 6 can switch the first valve device 2 back to the open position.
[0049] In step M6, however, i.e., in the case of a leakage mass flow, the control device 6 generates an error signal. The error signal can generally be output, for example, as a warning signal and / or the error signal can generate an error entry in the data memory 62. It is also conceivable that the error signal causes the control device 6 to output a control signal, for example, to actuate the first valve device 3 and / or the flow control device 5.
[0050] The generation of the error signal in step M6 can, for example, comprise generating a first error signal which indicates the presence of a leak in the first valve device 3 if the theoretical actual mass flow is less than the fuel mass flow requirement by more than the threshold value, as explained above. In this case, the control device 6 can, in particular, output a warning signal in step M6, e.g. in the form of an acoustic and / or optical signal, if the theoretical actual mass flow is less than a lower threshold value or if the theoretical actual mass flow is less than the fuel mass flow requirement by more than a second threshold value. Alternatively or additionally, in this case, emergency operation of the consumer system 205 can be activated by the control device 6, e.g. by outputting the error signal as a control signal to the fuel cell arrangement 205 in order to deactivate it.If the theoretical actual mass flow is greater than a further lower threshold value and less than the above-mentioned lower threshold value, or if the theoretical actual mass flow is less than the fuel mass flow requirement by more than a first threshold value, the computing unit 61 can, for example, use the second error signal to write an entry into the data memory 62, in particular with the content that a leak is present in the first valve device 3. Alternatively or additionally, the control device 6 can generate a second error signal in step M6, which indicates the presence of a leak in the high-pressure line system 2 or the medium-pressure line system 9 if the theoretical actual mass flow is greater than the fuel mass flow requirement by more than the threshold value.In particular, the generation of the second error signal can comprise the output of a control signal by the control device 6 in order to block fuel withdrawal from the tank 1 and / or the high-pressure line system 2. In particular, if the theoretical actual mass flow is greater than a first upper threshold value or if the theoretical actual mass flow is greater than the fuel mass flow requirement by more than a second threshold value, a safe operating state can be initiated. In this case, a high leakage mass flow is assumed and the control device 6 can, for example, switch the first valve device 3 and optionally additionally the flow control device 5 to the closed state. If the theoretical actual mass flow is greater than a further upper threshold value and less than the aforementioned upper threshold value orIf the theoretical actual mass flow exceeds the fuel mass flow requirement by more than a first threshold value, this corresponds to a case in which only a relatively small leakage mass flow is present. In this case, the computing unit 61 can use the second error signal to write a corresponding entry into a data memory 62, for example, indicating that a leak is present in the high-pressure line system 2, and / or issue a warning signal and / or initiate emergency operation.
[0051] Furthermore, the generation M6 of the error signal can also include the generation of a third error signal indicating the presence of a leak in the flow control device 5 if the theoretical actual mass flow is greater than the fuel mass flow requirement by more than the threshold value, and if it is determined in step M5 that the pressure detected in step M31 in the medium-pressure line system 9 is greater than the medium-pressure threshold value. In this case, it is to be expected that the flow control device 5 allows more mass flow to pass through than would be expected at the respective degree of opening of the second valve device 5, and consequently opens the pressure relief valve 10 due to the high pressure in the medium-pressure line system 9.
[0052] Although the present invention has been explained above using exemplary embodiments, it is not limited thereto but can be modified in a variety of ways. In particular, combinations of the above embodiments are also conceivable.
Claims
Claims 1. A method (M) for monitoring a gas tank system (100), comprising: Determining (M1) a fuel mass flow requirement of a consumer system (205); Closing (M2) a first valve device (3) to interrupt a gas supply from a tank (1) into a high-pressure line system (2) connecting the tank (1) to the consumer system (205); Detecting (M3) a pressure curve in the high-pressure line system (2) with the first valve device (3) closed; Determining (M4) a theoretical actual mass flow in the high-pressure line system (2) based on the detected pressure profile; comparing (M5) the theoretical actual mass flow in the high-pressure line system (2) with the determined fuel mass flow requirement of the consumer system (205); and generating (M6) an error signal by a control device (6) if the theoretical actual mass flow deviates from the fuel mass flow requirement by more than a threshold value.
2. Method (M) according to claim 1, wherein the generation (M6) of the error signal by the control device (6) comprises generating a first error signal indicating the presence of a leak in the first valve device (3) when the theoretical actual mass flow is less than the fuel mass flow requirement by more than the threshold value 3. Method (M) according to claim 2, wherein generating the first error signal comprises writing an entry into a data memory (62) if the theoretical actual mass flow is less than a first threshold value than the fuel mass flow requirement, and outputting a warning signal and / or initiating an emergency driving mode by the control device (6) when the theoretical actual mass flow is less than the fuel mass flow requirement by more than a second threshold value. Method (M) according to one of the preceding claims, wherein the generation (M6) of the error signal by the control device (6) comprises generating a second error signal indicating the presence of a leak in the high-pressure line system (2) or a medium-pressure line system (9) connected to the high-pressure line system (2) when the theoretical actual mass flow is greater than the fuel mass flow requirement by more than the threshold value.Method (M) according to claim 4, wherein generating the second error signal comprises writing an entry into a data memory (62) and / or outputting a warning signal and / or initiating an emergency driving mode if the theoretical actual mass flow is greater than the fuel mass flow requirement by more than a first threshold value, and initiating a safe operating state by, for example, closing the first valve devices if the theoretical actual mass flow is greater than the fuel mass flow requirement by more than a second threshold value.Method (M) according to one of the claims, additionally comprising: detecting (M31) a pressure in a medium-pressure line system (9) of the consumer system (205), which is connected to the high-pressure line system (2) via a flow control device (5); wherein the generation (M6) of the error signal by the control device (6) comprises generating a third error signal which indicates the presence of a leak in the flow control device (5) if the theoretical actual mass flow is greater than the fuel mass flow requirement by more than the threshold value and the pressure detected in the medium-pressure line system (9) is greater than a medium-pressure threshold value. A fuel cell system (200), comprising: a consumer system (205) with a fuel cell arrangement (210); a gas tank system (100) with a tank (1) for storing gas, in particular hydrogen, a high-pressure line system (2) connected to the consumer system (205), a first valve device (3) which can be switched between an open state, in which it connects the tank (1) to the high-pressure line system (2), and a closed state, in which it separates the tank (1) from the high-pressure line system (2), a pressure sensor (4) for detecting a pressure in the high-pressure line system (2), and a control device (6) which is connected to the first valve device (3), to the pressure sensor (4), and to the consumer system (205) in a signal-conducting manner and is configured to cause the fuel cell system (200) to carry out a method (M) according to one of the preceding claims.Fuel cell system (200) according to claim 7, wherein the gas tank system (100) has a flow control device (5) which can be switched between an open state and a closed state for connecting the high-pressure line system (2) to the consumer system (205). Fuel cell system (200) according to claim 7 or 8, wherein the first valve device (3) comprises a switchable solenoid valve which can be switched between the open state and the closed state.