Functional Safety SEooC Design for Hydrogen Fuel Cell Control Units in Automotive Applications

The rise of global investments in hydrogen energy technologies for mobility is driving the development of new Fuel Cell Electric Vehicles (FCEVs) based on Proton Exchange Membrane Fuel Cells (PEMFCs). However, hydrogen's high flammability and dispersion risks pose unique safety challenges in hydrogen-based technologies, especially in the uncontrolled environments of automotive applications. To ensure safe operation of PEMFC-based FCEVs, several electrical and electronic elements are required to control and monitor PEMFC operation. One key element ensuring PEMFC safety is the Fuel Cell Control Unit (FCCU). This specific Electronic Control Unit (ECU) manages the actuators and sensors that ensure an appropriate fuel dosage into the PEMFC while keeping its operation within safe ranges. This paper presents the elicitation process of generic FCCU requirements for achieving functional safety. The process follows the Safety Element out of Context (SEooC) design approach as defined in the ISO 26262 standard, a well-established method for developing generic safety requirements that can be reused across multiple real-world applications once their contextual assumptions are validated. In line with the ISO 26262 standard, the requirements elicitation in this paper begins by identifying the potential hazards in the hydrogen conversion process. Following this, safety requirements for preventing those hazards are derived and propagated through the V-model design, from the vehicle level down to the FCCU system. Consequently, this paper contributes to enriching the discussion on PEMFC operation hazards, accelerating the development of safer FCCU designs and, more broadly, fostering innovation in hydrogen fuel cell technologies for emerging automotive applications.