针对燃料电池商用车 VCU 与 BMS 通信中断引发的过充、过放及热失控风险，基于 ISO 26262开展危害分析与风险评估，提出一种分层级整车控制策略。该策略集成关键信号超时检测、可跛行 / 立即下电两级分级响应、场景化处置及融合母线电压积分与附件功率估算的 SOC 预估模型，并设计热管理容错与恢复确认机制。实车验证表明，故障检测时间为 300ms，SOC 预估误差在 5% 以内，各工况下跛行里程为 7.6~19.5km，电堆停机时间为 2.7~3.2s。该策略在保障功能安全的同时保留了跛行能力，为燃料电池商用车通信故障防护提供了工程参考。

Aiming at the risks of overcharge, overdischarge and thermal runaway induced by the communication interruption between VCU and BMS of fuel cell commercial vehicles, this paper conducts hazard analysis and risk assessment based on the ISO 26262 standard, and proposes a hierarchical vehicle control strategy. The strategy integrates critical signal timeout detection, two-level graded response of limp-home mode and immediate power-off, and scenario-based processing methods. Meanwhile, it adopts an SOC estimation model combining bus voltage integration and accessory power estimation, and designs a fault tolerance and recovery confirmation mechanism for thermal management system. Real vehicle verification results show that the fault detection time is 300ms, the SOC estimation error is within 5%, the limp-home mileage under various working conditions ranges from 7.6km to 19.5km, and the stack shutdown time is 2.7s to 3.2s. The proposed strategy ensures vehicle functional safety while retaining the limp-home capability, which provides a valuable engineering reference for communication fault protection of fuel cell commercial vehicles.