HK1093120B - Firstout shutdown tracing for fuel processor control system - Google Patents

Description

First-out shutdown tracking for fuel processor control systems

Technical Field

The present invention relates to the operation of fuel processors and, more particularly, to the identification of a first-out shutdown condition in a fuel processor.

Background

Fuel cell technology is an alternative energy source to the more traditional energy sources that utilize fossil fuel combustion. Fuel cells generally use fuel and hydrogen to produce electricity, water, and heat. More specifically, fuel cells are powered by redox reactions to provide significant advantages in terms of cleanliness and efficiency over other forms of electricity generation. Generally, fuel cells use hydrogen as the fuel and oxygen as the oxidant. Power generation is proportional to the rate of consumption of the reactants.

One notable downside to inhibiting the wider use of fuel cells is the poor basis for the diffusion of hydrogen. Hydrogen has a relatively low volumetric energy density and is more difficult to store and transport than the hydrocarbons commonly used in most power generation systems. One way to overcome this difficulty is to use a "fuel processor" or reformer to convert hydrocarbons into a hydrogen-rich gas stream, a hydroxyl fuel, such as natural gas, liquefied petroleum gas, gasoline, and petroleum, that can be used as a feed to a fuel cell. In order to be used as fuel for most fuel cells, a reforming process is required, and the current technology employs a multi-step process in which an initial reforming process is combined with some refining processes. The initial treatment is almost always steam reforming ("SR"), autothermal reforming ("ATR"), catalytic partial oxidation ("CPOX"), or non-catalytic partial oxidation ("POX"). The refinery process typically includes a combination of desulfurization, high temperature water gas shift, low temperature water gas shift, selective CO oxidation, or methanation of CO. Alternative processes include hydrogen separation membrane reactors and filters.

Thus, while many types of fuels may be used, some of which are blended with fossil fuels, the ideal fuel is hydrogen. If the fuel is hydrogen, for example, the combustion is very clean and, as a practical matter, only water remains after heat dissipation and/or consumption and after electrical consumption. Most readily available fuels (e.g., natural gas, propane, and gasoline), and even less commonly used fuels (e.g., methanol and ethanol), include hydrogen in their molecular structure. Some fuel cell supply devices therefore use a "fuel processor" to process the specific combustion to produce a relatively pure hydrogen stream that is used to fuel the fuel cell.

Some fuel processor designs are typically very complex. Generally, in order to generate hydrogen for a fuel cell, a plurality of subsystems are coordinated in an intricate and complex manner. For example, a fuel processor may mix water, air, and fuel together and reform the mixture. Thus, the fuel processor may contain separate subsystems for delivering water, air and fuel to the mixing subsystem that generates the process feed gas. The amounts, pressures and temperatures of water, air, fuel and process feed gas are controlled during the mixing process to achieve the desired process feed gas composition and to provide for reforming the process feed gas. The mixing subsystem then delivers the process feed gas to the reforming subsystem in a controlled manner. The reforming process itself constitutes several smaller processes, each of which may be carried out at different temperatures and pressures.

Any of these quantities, pressures, temperatures, etc. may produce error conditions in the operation of the fuel processor for a number of reasons. Some of these error conditions may warrant stopping the fuel processor operation until the error condition can be corrected, i.e., "shutdown". Fuel processors typically include monitoring these types of parameters regarding error conditions and shutting down the fuel processor. At the time of the operation stop, the operator or the serviceman finds out the cause of the operation stop, eliminates the problem, and then restores the fuel processor to the operation.

The complex design of fuel processors frequently causes failure problems in such situations. A single shutdown error condition often triggers a shutdown. This condition is called "first out". However, the first-out effect is typically propagated quickly through the fuel processor, causing other operational error conditions. Thus, by the time the fuel processor is shut down, there may already be many shutdown error conditions. The operator or service person must then laboriously look at all these errors in order to fix which is the first-out in order to eliminate the problem. The process of determining which out-of-service error condition is the first-out may be lengthy and costly.

Disclosure of Invention

The present invention is directed to solving or at least reducing at least one of the problems set forth above.

A method and apparatus for determining which condition in a fuel processor caused a shutdown of the fuel processor is disclosed. Generally, a device generates a plurality of shutdown initiator signals, each of which corresponds to one of a plurality of shutdown conditions and indicates whether such a condition is present. Some of the shutdown initiator signals are read within a predetermined window. At least one of the read shutdown initiator signals indicates that a corresponding first shutdown condition exists and identifies the corresponding first shutdown condition as a first out. The device variously includes a controller configured in a computing device programmed to perform such a method and a program storage medium encoded with instructions that, when executed, use such a method.

Drawings

The invention may be more fully understood by reference to the following description taken in conjunction with the accompanying drawings, in which like reference numerals identify like elements, and in which:

FIG. 1 illustrates one embodiment of a fuel processor assembled and operated in accordance with the present invention;

FIGS. 2A-2B illustrate in detail the anode tailgas oxidizer and autothermal reformer of the fuel processor of FIG. 1;

FIGS. 3A and 3B conceptually illustrate a computing device as may be used in implementing one embodiment of the present invention;

FIG. 4 illustrates, in block diagram form, a FIFO block and a plurality of shutdown initiator signals provided in one embodiment of the present invention;

FIG. 5 depicts the internal structure of the first-out function block, including the selection component and the initiation component, first shown in FIG. 4;

FIGS. 6A and 6B illustrate the readout logic of the select unit first shown in FIG. 5; and

fig. 7 depicts the internal logic that first represents the initiating component in fig. 5.

While the invention is susceptible to various modifications and alternative forms, specific embodiments have been shown by way of example in the drawings and have been described in detail herein. It should be understood, however, that the description herein of specific embodiments is not intended to limit the invention to the particular forms disclosed, but on the contrary, the intention is to cover all modifications, equivalents, and alternatives falling within the spirit and scope of the invention as defined by the appended claims.

Detailed Description

Illustrative embodiments of the invention are described below. In the interest of clarity, not all features of an actual implementation are described in this specification. It will of course be appreciated that in the development of any such actual embodiment, numerous implementation-specific decisions must be made to achieve the developers' specific goals, such as compliance with system-related and business-related constraints, which will vary from one implementation to another. Moreover, it will be appreciated that such a development effort, even if complex and time-consuming, would be a routine undertaking for those of ordinary skill in the art having the benefit of this disclosure.

FIG. 1 illustrates one embodiment of an apparatus 100 constructed and operative in accordance with the present invention. The apparatus 100 includes a fuel processor 101, a fuel cell 103, and a computing device 105. In the illustrated embodiment, the fuel cell 103 is a proton exchange membrane ("PEM") type fuel cell, but other types of fuel cells may be used. The invention is not limited by the implementation of fuel cell 103, and more specifically, in the illustrated embodiment, fuel processor 101 includes subsystems designed in a standard configuration, namely:

an autothermal reformer ("ATR") 102 that previously generates an oxidation-reduction reaction to reform the fuel input to the fuel processor 101 into a reformed gas for the fuel cell 103;

an oxidizer ("Ox"), which in the illustrated embodiment is an anode tailgas oxidizer ("ATO") 104, the anode tailgas oxidizer ("ATO") 104 mixing the gas stream, fuel, and air to form a fuel mixture that is delivered to the ATR102 as a process feed gas;

a fuel subsystem 106, the fuel subsystem 106 delivering an input fuel (natural gas in the illustrated embodiment) to the oxidizer 104 for mixing into the process feed gas delivered to the ATR 102;

a water subsystem 108, the water subsystem 108 delivering water to the oxidizer 104 for mixing into the process feed gas delivered to the ATR 102;

an air subsystem 110, the air subsystem 110 delivering air to the oxidizer 104 for mixing into the process feed gas delivered to the ATR 102; and

a thermal subsystem 112, the thermal subsystem 112 controlling the temperature within the ATR102 in a manner further described in the following aspects.

It should be noted that any hydrocarbon may be used as the fuel. The specific implementation of ATR20 and oxidizer 104 is illustrated in fig. 2A, 2B.

Fig. 2A depicts one embodiment of the oxidizer 104. Oxidizer 104 receives fuel, water and air through feedthroughs AT02, AT04, AT05, AT07 from fuel subsystem 106, water subsystem 108, air subsystem 110 and ATR12, respectively, through check valves via transfer lines 213, 227, 223, 240. The reformate gas feed AT05 is from a water separation system (discussed below) in combination with the ATR 102. Off-gas from the anode (not shown) of the fuel cell 103 is returned to a water separator 248 (shown in fig. 2B), the water separator 248 separates water, which is discharged to a drain tank 219 (also shown in fig. 2B) via a solenoid valve and supplied to the oxidizer 104 via a line 229. The fuel, air and dehydrated anode return are then mixed in mixer 252 before being placed in oxidizer 104 storage container 254. The resulting mixture is then heated by an electric heater 256.

Still referring to fig. 2A, the oxidizer 104 receives fuel, water, and air from the fuel subsystem 106, the water subsystem 108, and the air subsystem through feedthroughs AT01, AT06, AT03 above the transfer lines 211, 242, and 225. The transfer lines 211 and 242 are protected by check valves 226. Water received on transfer lines 211 and 242 enters sealed coil 258. The heated air and fuel in the storage vessel 254 heats the contents of the sealed coils 258, 260, which are then mixed in the mixer 262 and supplied to the ATR102 via the feed ATR2 above the transfer line 264. The oxidizer 104 is vented from an outlet through a transfer line 265 to an exhaust 263.

FIG. 2B depicts one implementation of the ATR 102. The ATR102 includes steps 282a-282e that include a plurality of heat exchangers 278 and electric heaters 256. Wherein each heat exchanger 278 receives temperature controlled water from the thermal subsystem 112 above transfer lines 270-273 and returns the temperature controlled water to the thermal subsystem 112 above transfer line 276 and feed TS 1. The exception is the heat exchanger 278 in preferential oxidizer (PrOx)286, which heat exchanger 278 receives (not shown) from thermal subsystem 112 above transfer line 274 and returns it to water separator 248. Note that in the illustrated embodiment, air is supplied to the anode power supply of the fuel cell from the water separator 248. The byproducts of the ATR102 operation are returned to the oxidizer 104 and to the PrOx286 via the burst disk 284 in the transfer line 250 and the feed AT 07. The illustrated embodiment also includes a burst disk 284 that bursts when the ATR102 is overpressurized, causing the material within the ATR102 to be dumped to the oxidizer 104 via transfer line 240 and feed AT 07.

One specific device 300 of the computing device 105 first shown in fig. 1 is illustrated in fig. 3A and 3B. The apparatus 300 is rack-mounted, but rack-mounting is not necessarily required in all embodiments. In fact, the condition of any given device is not critical to the practice of the invention. Computing device 300 may be configured as a desktop personal computer, computer workstation, notebook or laptop computer, embedded processor, or the like.

The computing device 300 illustrated in fig. 3A and 3B includes a processor 305 in communication with a memory 310 over a bus system 315. The memory 310 may include a hard disk and/or random access memory ("RAM") and/or removable storage such as a floppy magnetic disk 317 and an optical disk 320. The memory 310 is encoded with a data structure 325, an operating system 330, user interface software 335, and application programs 365 that store the data sets obtained as discussed above. The user interface software 335 and the display 340, in combination, are configured as a user interface 345. The user interface 345 may include peripheral I/O devices such as a keypad or keyboard 350, a mouse 355, or a joystick 360. The processor 305 runs under the control of an operating system 330, which operating system 330 may be virtually any operating system known in the art. The application 365 is invoked by the operating system 330 at power-up, reset, or both, depending on the operating system's execution. In the illustrated embodiment, the application 365 is used to perform certain processes of the present invention in a manner described more fully below. It should be noted that peripheral I/O devices can be used to provide a remote emergency shutdown switch for fuel processor 100.

Returning to FIG. 1, as previously described, the monitor signal of the present invention displays the status of the fuel processor 101 to determine if an out-of-service condition has occurred and, if so, to identify a first-out-of-service condition. In general, conventionally, the fuel processor 101 generates a plurality of shutdown initiator signals, each of which corresponds to one of a plurality of shutdown conditions and indicates whether the condition is present. The computing device 105 reads the shutdown initiator signal in a predetermined window. If an end-of-run error condition occurs, the computing device detects at least one of the read end-of-run cause signals within a predetermined time window, indicating that the corresponding first end-of-run condition occurred. The computing device 105 then identifies the corresponding first shutdown condition as a first out.

Fig. 4 illustrates, in block diagram form, a first-out function block 400 and a plurality of shutdown initiator signals 402 provided in one embodiment of the present invention. The shutdown initiator signals 402 are Boolean signals and each of the shutdown initiator signals 402 corresponds to a condition that can cause a shutdown. The shutdown initiator signal 402 can be generated in a conventional manner. In the illustrated embodiment, 30 shutdown initiator signals, named S1-S30 in sequence, are monitored. Any number of shutdown initiator signals may be monitored in theory. Thus, the present invention is not limited by the number of detected shutdown initiator signals. However, as will be appreciated by the skilled artisan, there are practical limits on the number. Most devices always monitor no more than about 30 detonators. The cause signals 402 monitored in the illustrated embodiment are identified in table 1 below, the definition of which is also included in table 1.

TABLE 1 first-out signal

Signal	Signal name	Signal definition
			S1	Low_NgInlet_Pressure	Surrogate fuel pressure from fuel subsystem 106 to oxidizer 104
S2	High_NgInlet_Pressure	High fuel pressure from fuel subsystem 106 to oxidizer 104
			S3	High_Tgc_Bottom_Temperature	High oxidizer 104 heating temperature
S4	High_Tgc_Mid_Temperature	High oxidizer 104 mid-bed temperature
			S5	High_Tgc_UpMid_Temperature	High ATO Upper bed temperature
S6	High_Tgc_Top_Temperature	High ATO Top bed temperature

S7	High_Tgc_Shell_Temperature	High ATO top case temperature of the external surface of oxidizer 104
			S8	High_ATR_Inlet_Temperature	High temperature above the entrance to the ATR102 in section 282a
S9	High_ATR_Exit_Temperature	High temperature above the exit of the ATR102 in exit section 282d
			S10	High_PrOx_Exit_Temperature	High temperature above the exit from PrOx286
S11	High_ZnOBed_Outlet_Temperature	High temperature above the outlet from the zinc oxide bed
			S12	High_Reactor_Shell_Temperature	High temperature within the reactor shell of the ATR102
S13	Low_Rfmt_Delivery_Pressure	Low pressure for delivery of reformate to fuel cell 103
			S14	Low_ATO_Temperature	Low temperature for oxidizer 104
S15	ATO_LightOff_Failed	The ATO light source is turned off when the time relay is over, i.e., no catalytic reaction occurs for a sufficient period of time to track the incorporation of the catalytic component
			S16	High_Shift_Temperature	High temperatures for mobile processes in bed 282d in ATR102
S17	Control_EStop	Emergency switch started by remote control
			S18	Emergency_Stop_Switch	Stop switch for rotary emergency
S19	Control_Stop_Switch	Rotation control stop switch
			S20	PowerOff	Cutting off power to the system
S21	Gas_Detected_InCabinet	Detecting gas within a housing of a fuel process 100
			S22	Panel_Stop_Switch	Stop switch on rotary control panel
S23	Signal 23	Retention

S24	Signal 24	Retention
			S25	Signal 25	Retention
S26	Signal 26	Retention
			S27	Signal 27	Retention
S28	Signal 28	Retention
			S29	Signal 29	Retention
S30	Signal 30	Retention

The shutdown initiator signal 402 is scanned every 50 milliseconds or so. The precise interval between scans is a function of the speed of the handler and therefore does not limit the scope of the invention. The 50 millisecond period is a function of the operating frequency of the processor 305 (shown in fig. 3B) and determines the predetermined window within which each scan occurs. Thus, in the illustrated embodiment, the processor 305 reads all the shutdown initiator signals 402 within a 50 millisecond window every 50 milliseconds.

If the shutdown initiator signal 402 given at the time of scanning is "ON", this indicates that the corresponding shutdown condition is present and that the system is to be shut down. During the scan, FIFO function block 400 identifies the condition corresponding to any one of the shutdown initiator signals as the FIFO condition. It should be noted that in some cases more than one shutdown initiator signal may be "ON" within the same scan. In such a case, even if a plurality of fifo conditions may occur, the condition corresponding to one of the shutdown initiator signals 402 that is "ON" is recognized as fifo. However, information about other "ON" shutdown initiator signals 402 is also retained for recorded analysis. While identifying and recording multiple first-out conditions may not identify only a single first-out as desired, it may still be preferable to identify neither a single first-out or even as many as 30 first-outs. Thus, the present invention is not limited to identifying only a single first-out condition. As a corollary, however, it is often desirable to use a higher operating frequency processor, and as a result, it is often desirable to generate scans more frequently.

Fig. 5 depicts the internal structure of the first-out functional block 400 first shown in fig. 4, including a selection section 500, an enable section 502, and a plurality of registers 506, the registers 506 registering the output of the selection section 500 until reset. During scanning the selection component 500 receives some of the input shutdown initiator signals 402 and "selects" one (or more) of the input shutdown initiator signals, if any, to be active "ON". The start section 502 suspends the selection section 500 until the system is reset when the operation stop cause signal 402 is detected as "ON". The structure and operation of the selection means 500 and the activation means 502 are illustrated in fig. 6A and 6B and in fig. 7, respectively.

Fig. 6A and 6B illustrate the readout logic of the selection unit 500 first shown in fig. 5. The FO _ NOT _ ACTIVE signal in the activation section 502 as shown in fig. 5 has increased by the shutdown initiator signal 402 shown in fig. 6A. The shutdown initiator signal 402 is then summed by the adder 602. The sum is inverted and output as the signal NO _ SID _ ACTIVE shown in fig. 5 to the and gate 508 to indicate whether some of the plurality of shutdown initiator signals 402 indicate that a shutdown condition has occurred. The comparator 604 then indicates whether the sum is greater than 1 (meaning there is more than one shutdown condition), and this indication is input to a function block 606.

Fig. 6B is a conceptualized state diagram for the function block 606 first shown in fig. 6A. In state S1, if SELECT (i.e., the comparison result) is 0, the function block 606 starts reading the operation stop cause signal 402, and if none of the operation stop cause signals 402 from among the plurality of operation stop cause signals 402 indicates that an operation stop error condition has occurred, the function block 606 goes to state S7 and passes the operation stop cause signal 402 as an output. If any one of the shutdown initiator signals 402 indicates that a shutdown error condition has occurred, the shutdown error condition is flagged as a first out and the remaining shutdown initiator signals 402 are passed.

It is possible that two or more shutdown initiator signals may be searched for that indicate a shutdown error condition because the first-out effect can propagate to create additional shutdown error conditions in the same scan. This is indicated when SELECT is 1 (i.e., the sum of the operation stop cause signals 402 is > 1). The function block 606 reads through the shutdown initiator signal 402 to see which phase of the shutdown initiator signal 402 indicates that a shutdown error condition has occurred. The function block 606 reads signals in states S2 and S3 and identifies the first shutdown initiator signal 402 indicating that a corresponding shutdown error condition has occurred as a "first out". The function block then continues to read some of the remaining shutdown initiator signals 402 indicating that their corresponding shutdown errors have also occurred through states S5 and S6. The information from these shutdown initiator signals 402 is also retained, but they are not labeled "first out". It should be noted that such an algorithm does not necessarily detect active first-out, but such an algorithm reduces the number of shutdown error conditions that must be reviewed as first-out.

FIG. 7 depicts the internal logic of initiating component 502 first shown in FIG. 5. The or function block 702 detects the FO _ NOT _ ACTIVE signal and turns off the FO _ NOT _ ACTIVE signal whenever any one of the registers 506 registers a valuable FO _ NOT _ ACTIVE signal, thus holding the last stall signal value until reset. The second or function block 704 asserts the shutdown initiation signal S2 in the form of a text message "high natural gas inlet pressure to initiate system shutdown".

Returning to FIG. 5, each shutdown initiator signal 402 has a corresponding register 506. Each register contains a set-reset flip-flop that registers the first-out signal generated by selection unit 500. Even if the ON signal occurs falsely, the register 506 locks the ON signal and then fades out. For example, for a spike in the pressure in the container, the shutdown initiator signal is ON whenever it is, and then OFF immediately. Without the register 506, the selection unit 500 would discard the activation signal after it fades away, thus losing information that the operator may only read some time after the activation signal appears.

Returning now to fig. 4, the logic 404 that the state of the fifo function block 400 may be reset is also shown. Once the first-out condition is detected, first-out function block 400 remains in this state via logic 404 until reset. Logic 404 includes elements 406, 408 representing hit crossing and propagation delay, respectively. The logic circuit 404 receives a "RESET" signal 410 from, for example, a RESET switch (not shown). S-R flip-flop 412 registers the RESET signal and outputs the RESET signal to enable component 400 through its non-inverting output. The terminator 414 terminates the inverted output.

The functionality of selection component 500 can be implemented as long as first-out function block 400 is not locked and is waiting to be reset. The illustrated embodiment enables this functionality by multiplying FO _ NOT _ ACTIVE received on line 504. The FO _ NOT _ ACTIVE signal is generated by enable component 502, which enable component 502 receives the first-out status of each respective condition in an input manner from register 506. If at least one of the shutdown indicator signals is "ON" during the scan, this shutdown indicator signal 402 is transmitted by the selection component 500 through the register 506 to the startup component 502 and then turned off until the reset signal 410 first shown in fig. 4 is received.

Some elements in fig. 4, 5, 6A, 6B, and 7 are described in units of "functional blocks", "flip-flops", and other logic circuits. These elements may be implemented in hardware in some embodiments. However, persons skilled in the art having benefit of the present disclosure should appreciate that functionality may often be implemented in either hardware or software. This choice may be due to design constraints, economic constraints, or personal preferences of the designer. In the illustrated embodiment, these elements are implemented in code that mimics the operation of logic circuitry. Thus, for the illustrated embodiment, a reference to a "function block" or "trigger" is a reference to a code set or code section in, for example, an application 365 (shown in FIG. 3B) that mimics the functionality of a hardware element such as this. However, some alternative embodiments may decide to implement this functionality in the field in hardware as initially described.

Thus, at least some aspects of the present invention will generally be implemented as software on a suitably programmed computing device, such as the computing apparatus 300 of fig. 3A, 3B. Some instructions may be encoded on, for example, the memory 310, the floppy disk 317, and/or the optical disk 320. Accordingly, in one aspect, the invention includes a computing device programmed to perform the method of the invention. In another aspect, the invention includes a program storage device encoded with instructions that, when executed by a computing apparatus, perform the method of the invention.

Several portions of the detailed description are presented herein in terms of software implemented processes that operate on expressions of symbols included within data bits of memory of a computing system or computing device. These descriptions and representations are the means used by those skilled in the art to most effectively convey the substance of their work to others skilled in the art. The process and operation require the implementation of controlled physical parameters. Usually, though not necessarily, these parameters take the form of electrical, magnetic, or optical signals capable of being stored, transferred, combined, compared, and otherwise manipulated. It has proven convenient at times, principally for reasons of common usage, to refer to these signals as bits, values, elements, symbols, characters, terms, numbers, or the like.

It should be borne in mind, however, that all of these and similar terms are to be associated with the equivalent physical parameters and are merely convenient labels applied to these parameters. Throughout the present disclosure, if not specifically stated to be approximate or otherwise, these descriptions refer to the operation and process of an electronic device that manipulates and transforms data representing physical (electronic, magnetic, or optical) parameters within the electronic device's memory into data similarly representing physical parameters within the memory or within a transmission or display device. Some typical terms that represent such a description are, without limitation, the terms "processing," "computing," "calculating," "determining," "displaying," and the like.

The particular embodiments disclosed above are illustrative only, as the invention may be modified and practiced in different but equivalent manners apparent to those skilled in the art having the benefit of the teachings herein. Furthermore, no limitations are intended to the details of construction or design herein shown, other than as described in the claims below. It is therefore evident that the particular embodiments disclosed above may be altered or modified and all such variations are considered within the scope and spirit of the invention. Accordingly, the specification is sought to be protected as set forth in the following claims.

Claims (34)

1. A method for determining which condition in a fuel processor has caused a shutdown of the fuel processor, comprising:

generating a plurality of shutdown initiator signals, each shutdown initiator signal corresponding to one of a plurality of shutdown conditions and indicating whether such a condition exists;

reading out the operation stop cause signal within a predetermined time window;

detecting at least a first one of the read shutdown initiator signals within a predetermined time window, indicating that a corresponding first shutdown condition has occurred; and

the corresponding first shutdown condition is identified as a first out.

2. The method of claim 1, wherein the shutdown initiator signal comprises a signal indicative of at least one of an undesirable temperature, an undesirable pressure, and an undesirable concentration.

3. The method of claim 1, wherein the shutdown initiator signal comprises a signal indicative of at least one of: low fuel pressure, high anode tail gas oxidizer heater temperature, high anode tail gas oxidizer inlet temperature, high anode tail gas oxidizer mid-bed temperature, high anode tail gas oxidizer top housing temperature, high autothermal reformer inlet temperature, high autothermal reformer outlet temperature, high preferential oxidizer outlet temperature, high zinc oxide bed outlet temperature, high autothermal reformer reactor housing internal temperature, low pressure for delivery of process feed gas to the autothermal reformer, low temperature for the anode tail gas oxidizer, time relay to time off anode tail gas oxidizer light source, high temperature for the moving process, starting a remote emergency switch, pressing an emergency stop switch, pressing a control stop switch, cutting power to the system, detecting gas in the autothermal reformer housing, and pressing a stop switch on the control panel.

4. The method of claim 1, wherein the detection of a first one of the read shutdown initiator signals indicating that a corresponding first shutdown condition has occurred includes determining that the first shutdown initiator signal is "ON".

5. The method of claim 1, further comprising disabling detection of additional shutdown initiator signals within a subsequent predetermined time window indicating that additional shutdown conditions have occurred.

6. The method of claim 1, further comprising detecting a second one of the shutdown initiator signals within a predetermined time window indicating that a corresponding second shutdown condition has occurred.

7. The method of claim 6, further comprising storing information that a second shutdown condition has occurred.

8. The method of claim 1, further comprising at least one of storing information that the first shutdown condition has occurred and displaying that the first shutdown condition has occurred.

9. The method of any one of claims 1 to 8, programmed in a computer and stored as a program in a memory.

10. An apparatus for determining which condition in a fuel processor has caused a shutdown of the fuel processor, comprising:

means for generating a plurality of shutdown initiator signals, each shutdown initiator signal corresponding to one of a plurality of shutdown conditions and indicating whether such a condition exists;

means for reading out the shutdown initiator signal within a predetermined time window;

means for detecting within a predetermined time window that at least a first one of the read shutdown initiator signals indicates that a corresponding shutdown condition has occurred; and

means for identifying a corresponding first shutdown condition as a first out.

11. The apparatus of claim 10, wherein the shutdown initiator signals include signals indicative of at least one of an undesirable temperature, an undesirable pressure, and an undesirable concentration.

12. The apparatus of claim 10, wherein the shutdown initiator signal comprises a signal indicative of at least one of: low fuel pressure, high anode tail gas oxidizer heater temperature, high anode tail gas oxidizer inlet temperature, high anode tail gas oxidizer mid-bed temperature, high anode tail gas oxidizer top shell temperature, high autothermal reformer inlet temperature, high autothermal reformer outlet temperature, high preferential oxidizer outlet temperature, high zinc oxide bed outlet temperature, high autothermal reformer reactor housing temperature, low pressure for process feed gas to the autothermal reformer, low temperature for anode tailgas oxidizer, time relay to time off anode tailgas oxidizer light source, high temperature for moving process, starting remote emergency switch, pressing emergency stop switch, pressing control stop switch, cutting power to system, detecting gas in autothermal reformer housing and pressing stop switch on control panel.

13. The apparatus of claim 10, wherein the means for detecting a first one of the read shutdown initiator signals that indicates that a corresponding first shutdown condition has occurred comprises determining that the first shutdown initiator signal is "ON".

14. The apparatus of claim 10, further comprising means for disabling detection of a further shutdown initiator signal indicating that a further shutdown condition has occurred within a subsequent predetermined time window.

15. The apparatus of claim 10, further comprising means for detecting within a predetermined time window a second one of the shutdown initiator signals indicating that a corresponding second shutdown condition has occurred.

16. The apparatus of claim 15, further comprising means for storing information that a second shutdown condition has occurred.

17. The apparatus of claim 10, further comprising at least one of means for storing information that the first shutdown condition has occurred and means for displaying that the first shutdown condition has occurred.

18. An apparatus, comprising:

a fuel processor; and

the control system is used for controlling the system,

the control system is capable of:

generating a plurality of shutdown initiator signals, each shutdown initiator signal corresponding to one of a plurality of shutdown conditions and indicating whether such a condition exists;

reading out the shutdown initiator signal within a predetermined time window;

detecting at least a first one of the read shutdown initiator signals within a predetermined time window, indicating that a corresponding first shutdown condition has occurred; and

the corresponding first shutdown condition is identified as a first out.

19. The apparatus of claim 18, wherein the fuel processor comprises:

an autothermal reformer capable of reforming a mixture of fuel, air, and steam;

an anode tailgas oxidizer capable of mixing fuel, air and steam into a gas to form a process feed gas and delivering the process feed gas to the autothermal reformer;

a fuel subsystem capable of delivering fuel to the anode tail gas oxidizer subsystem;

a water subsystem capable of delivering water to the anode tail gas oxidizer subsystem;

an air subsystem capable of delivering air to the anode tail gas oxidizer subsystem; and

a thermal subsystem capable of controlling the operating temperature of the autothermal reformer and the anode tail gas oxidizer.

20. The apparatus of claim 18, wherein the shutdown initiator signal comprises a signal indicative of at least one of an undesirable temperature, an undesirable pressure, and an undesirable concentration.

21. The apparatus of claim 18, wherein the shutdown initiator signal comprises a signal indicative of at least one of: low fuel pressure, high anode tail gas oxidizer heater temperature, high anode tail gas oxidizer inlet temperature, high anode tail gas oxidizer mid-bed temperature, high anode tail gas oxidizer top shell temperature, high autothermal reformer inlet temperature, high autothermal reformer outlet temperature, high preferential oxidizer outlet temperature, high zinc oxide bed outlet temperature, high autothermal reformer reactor housing temperature, low pressure for process feed gas to the autothermal reformer, low temperature for anode tailgas oxidizer, time relay to time off anode tailgas oxidizer light source, high temperature for moving process, starting remote emergency switch, pressing emergency stop switch, pressing control stop switch, cutting power to system, detecting gas in autothermal reformer housing and pressing stop switch on control panel.

22. The apparatus of claim 18, wherein the detection of a first one of the read shutdown initiator signals indicating that a corresponding first shutdown condition has occurred includes determining that the first shutdown initiator signal is "ON".

23. The apparatus of claim 18, wherein the control system is further capable of disabling detection of an additional shutdown initiator signal indicating that an additional shutdown condition has occurred during a subsequent predetermined time window.

24. The apparatus of claim 23, wherein the control system is further capable of detecting a second one of the shutdown initiator signals within a predetermined time window indicating that a corresponding second shutdown condition has occurred.

25. The apparatus of claim 24, wherein the control system further allows for storage of information that the second shutdown condition has occurred.

26. The apparatus of claim 18, wherein the control system further allows at least one of storing information that the first shutdown condition has occurred and displaying that the first shutdown condition has occurred.

27. The apparatus of claim 18, wherein the control system includes a computing device programmed to detect the sensed shutdown initiator signal indicating that the corresponding first shutdown condition has occurred and to identify the corresponding first shutdown condition as a first out.

28. The apparatus of claim 18, wherein the control system comprises:

means for detecting at least a first one of the read shutdown initiator signals indicating that the corresponding shutdown condition has occurred within a predetermined time window; and

means for identifying a corresponding first shutdown condition as a first out.

29. The apparatus according to claim 28, wherein at least one of the detecting means and the identifying means is implemented in hardware.

30. Apparatus according to claim 28, wherein at least one of the detecting means and the identifying means is implemented in software.

31. The apparatus of claim 18, wherein the control system comprises:

a first-out function capable of receiving the shutdown initiator signals and determining whether any of the shutdown initiator signals indicates that a first-out error condition has occurred; and

for resetting of the first-out function.

32. The apparatus of claim 31, wherein the first-out function comprises:

a selection unit capable of selecting which of the operation stop cause signals indicates that a first-out error condition has occurred;

a set of latches capable of registering any shutdown initiator signal indicating that a first-out error condition has occurred; and

and a start-up section capable of deactivating the selection section until receiving the reset signal when the stored cause signal indicating that the first-out error condition has occurred is received from the latch group.

33. The apparatus of claim 31, wherein at least one of the function block and the reset is implemented in hardware.

34. The apparatus of claim 31, wherein at least one of the function block and the reset is implemented in software.