Hydrogen Fuel Cell Safety

The hazard sits in a different place. A lithium pack can enter thermal runaway from an internal defect: the danger lives inside the store, needs no leak and no outside air, and once started it feeds itself. Hydrogen behind a tank wall is inert, and becomes hazardous only through a specific sequence of release, then mixing with air into the flammable window, then ignition. Every link of that sequence can be attacked by design, which is why the fastest-acting safety elements on a fuel cell vehicle are valves rather than cooling circuits, and why the guide is organised around contain, detect, prevent accumulation and react in time.

Because the usual escape hatch is unavailable. Arguing a lower controllability class normally leans on the driver noticing and reacting, and hydrogen is colorless, odorless and announced only by the E/E system whose failure is under analysis. It cannot be odorized either: the sulfur-bearing compounds used for natural gas would poison the platinum catalyst, and the road-vehicle fuel specification holds total sulfur to a very low limit for exactly that reason. There is no human lookout in the loop, so detection is entirely an E/E function and the leak family of hazardous events carries the highest controllability class throughout.

Four facts spoil the reflex. Closing every valve does not remove the hydrogen already in the pipes, it seals it in at pressure next to whatever fault triggered the shutdown. The stack is damaged by abrupt endings, so a safe state that costs stack life on every false alarm is one the organization will be pressured to stop using. Dilution needs power, because exhaust hydrogen stays below its limits only while cathode air is flowing, and compartment ventilation is an active function precisely when everything else is being switched off. And loss of propulsion is itself a hazardous event in traffic. The guide answers with a graded ladder rather than an off switch.

A surprising amount of the hydrogen system is deliberately not E/E. The tank shell, the thermally activated pressure relief device, the excess flow limiter, the check valves and the pressure regulator are mechanical, qualified by test under the certification regime, and immune to software faults by construction. The E/E system wraps around that mechanical core: it senses, decides and commands, and its malfunctioning behaviour is what functional safety analyses. The in-tank shutoff valve is the instructive hybrid, commanded electrically but closed by a spring, so its safe direction survives a dead controller.

Sight of the cell that is being destroyed. Hundreds of cells sit electrically in series, so the stack current is forced through the healthiest and the sickest alike, and a starved cell driven in reverse corrodes its own anode support. The guide works the arithmetic: one cell collapsing from its normal operating voltage into reversal moves the stack total by a fraction of a percent, comfortably inside ordinary load ripple, while the minimum cell voltage falls off a cliff within seconds. Total voltage measurement is blind to the dying cell, which is the entire justification for per-cell or cell-pair monitoring hardware.

It runs 14 chapters: the fuel physics that sets the agenda, a system tour with the pressure cascade and three item boundary options, the electrochemistry and seven ways ordinary operation hurts a stack, the split between certification evidence and functional safety evidence, a HARA with seven safety goals and an exposure profile across an operating day, the sensing chain and its blind spots, the valves and shutoff paths, safe states as a six-rung ladder with a trade chart, the mode machine with start-up leak check, freeze start and crash timeline, an interactive fault and state simulator, the coordination of stack and buffer battery, dependent failures with a quantified reaction chain, refuelling and service and the service life calendar, and a worked leakage warning and shutoff function traced from goal to evidence. Ratings, latencies and thresholds are labelled illustrative unless a public source is named.