A method for testing a battery management system safety function

Abstract

This application provides a testing method for the safety functions of a battery management system (BMS). This method is applied to a HIL simulation testing platform and includes: responding to user operation by determining fault triggering conditions set by the user according to a selected functional safety objective; setting corresponding initial parameters for the BMS based on the fault triggering conditions corresponding to the functional safety objective, so that the BMS can simulate the operating conditions corresponding to the fault triggering conditions, and determining the operating state of the BMS under the operating conditions, thereby achieving functional safety testing of the BMS. Through this testing method, various operating conditions can be simulated by flexibly configuring model parameters and changing different variables in real time, and the operating state of the BMS under different operating conditions can be monitored.

Description

Technical Field

[0001] This application relates to the field of battery management system technology, and more specifically, to a test method for the safety functions of a battery management system. Background Technology

[0002] In recent years, with the continuous advancement of new energy vehicle technology, the complexity of automotive electronic hardware and software has gradually increased, and the risks from system failures and random hardware failures are also increasing. In particular, the power battery system involves high voltage and high current. Once a failure occurs, it can easily cause short circuits, explosions, fires, etc., resulting in huge economic losses and casualties. Therefore, in the software architecture, it is necessary to focus on the analysis and design of fault protection strategies. This part is defined in detail in the ISO26262 standard.

[0003] Furthermore, with the development of electronic control systems for new energy vehicles and the continuous improvement of the ISO26262 functional safety system, vehicle fault protection strategies have become an important part of software development, especially for battery management systems, which are more difficult and risky to test. Therefore, how to conduct safe and efficient testing of battery systems has become an indispensable part of the vehicle development process. Summary of the Invention

[0004] In view of this, the purpose of this application is to provide a test method for the safety functions of a battery management system. By using the host computer of the HIL simulation test platform to simulate different fault conditions of the battery management system in real time, the correctness of the functional safety fault protection strategy of the battery management system is verified through test result analysis, and the superiority of HIL testing is demonstrated.

[0005] In a first aspect, embodiments of this application provide a testing method for the safety functions of a battery management system. The testing method is applied to a HIL simulation testing platform and includes:

[0006] In response to user operation, determine the fault triggering conditions set by the user according to the selected functional safety target; wherein, the functional safety target is any one of single cell overvoltage ASILC, single cell undervoltage ASILC, overcurrent ASILC, overtemperature ASILC, total voltage overvoltage ASILC, or total voltage undervoltage ASILC, and the fault triggering conditions include the fault triggering time corresponding to the functional safety target and the cell parameter threshold.

[0007] Based on the fault triggering conditions corresponding to the functional safety objectives, corresponding initial parameters are set for the battery management system (BMS) to enable the BMS to simulate the operating conditions corresponding to the fault triggering conditions and to determine the operating status of the BMS under the operating conditions, thereby achieving functional safety testing of the BMS. Specifically, when the functional safety objective is overvoltage ASILC of a single cell, the initial parameter is the maximum value of the single cell voltage; when the functional safety objective is undervoltage ASILC of a single cell, the initial parameter is the minimum value of the single cell voltage; when the functional safety objective is overcurrent ASILC, the initial parameter is current; when the functional safety objective is overtemperature ASILC, the initial parameter is temperature; when the functional safety objective is total voltage overvoltage ASILC, the initial parameter is total voltage; and when the functional safety objective is total voltage undervoltage ASILC, the initial parameter is total voltage.

[0008] Furthermore, when the functional safety target is the overvoltage ASILC of the single cell, the functional safety test of the battery management system is performed through the following steps:

[0009] The maximum voltage of the individual battery cell is set to be less than a first preset voltage so that the battery management system is in normal working condition.

[0010] Send a charging command to the battery management system to put the battery management system into a charging state, and set the maximum value of the cell voltage to be greater than or equal to the first preset voltage and less than the first voltage threshold.

[0011] Determine whether the battery management system has triggered an overvoltage fault alarm within a first preset time period. If not, the test is considered to have failed, and the functional safety test is stopped.

[0012] If the battery management system issues an overvoltage fault alarm within the first preset time of overvoltage, it is determined that the battery management system sent a request to stop charging within the second preset time of overvoltage.

[0013] If the battery management system sends the request to stop charging within the second preset time of overvoltage, it is determined whether the battery management system has entered a safe state within the fourth preset time of overvoltage. If not, the test is considered to have failed and the functional safety test is stopped.

[0014] If the battery management system does not send the request to stop charging within the second preset time of overvoltage, it is determined whether the battery management system has issued an overvoltage fault alarm within the third preset time of overvoltage. If not, the test is considered to have failed and the functional safety test is stopped.

[0015] If the battery management system triggers the overvoltage fault alarm within the third preset overvoltage time, it is determined whether the battery management system disconnects the main positive and negative relays within the fifth preset overvoltage time and enters the safe state. If not, the test is considered to have failed and the functional safety test is stopped.

[0016] If the battery management system enters the safe state within the fourth preset time of overvoltage, or if the battery management system disconnects the main positive and negative relays within the fifth preset time of overvoltage, then the maximum value of the single cell voltage is set to be greater than the first voltage threshold, and the request to stop charging sent by the battery management system is not responded to. It is then determined whether the battery management system has completed the overvoltage judgment within the sixth preset time of overvoltage, and whether the battery management system has disconnected the main positive and negative relays within the fifth preset time of overvoltage; wherein, the sixth preset time of overvoltage is the sum of the first preset time of overvoltage, the second preset time of overvoltage, and the third preset time of overvoltage;

[0017] If the battery management system completes the overvoltage judgment within the sixth preset time of overvoltage and disconnects the main positive and main negative relays within the fifth preset time of overvoltage, then the battery management system is considered to have passed the functional safety test.

[0018] If the battery management system fails to complete the overvoltage judgment within the sixth preset time period and fails to disconnect the main positive and main negative relays within the fifth preset time period, the test is considered to have failed and the functional safety test is stopped.

[0019] Furthermore, when the functional safety target is undervoltage ASILC of the individual battery cell, the functional safety test of the battery management system is performed through the following steps:

[0020] The minimum voltage of the individual battery cell is set to be greater than a second preset voltage so that the battery management system is in normal working condition.

[0021] Send a discharge command to the battery management system to put the battery management system into a discharge state, and set the minimum voltage of the individual cell to be greater than or equal to the second voltage threshold and less than the second preset voltage;

[0022] Determine whether the battery management system has issued an undervoltage fault alarm within a first preset time period. If not, the test is considered to have failed, and the functional safety test is stopped.

[0023] If the battery management system issues an undervoltage fault alarm within the first preset undervoltage time, then determine whether the battery management system sends a request to stop discharging within the second preset undervoltage time.

[0024] If the battery management system sends the request to stop discharging within the second preset time of undervoltage, it is determined whether the battery management system has entered a safe state within the fourth preset time of undervoltage. If not, the test is considered to have failed and the functional safety test is stopped.

[0025] If the battery management system does not send the request to stop discharging within the second preset time of undervoltage, it is determined whether the battery management system has issued an over- or undervoltage fault alarm within the third preset time of undervoltage. If not, the test is considered to have failed and the functional safety test is stopped.

[0026] If the battery management system triggers the over- or under-voltage fault alarm within the third preset time of under-voltage, it is determined whether the battery management system disconnects the main positive and negative relays within the fifth preset time of under-voltage and enters the safe state. If not, the test is considered to have failed and the functional safety test is stopped.

[0027] If the battery management system enters the safe state within the fourth preset time of undervoltage, or if the battery management system disconnects the main positive and negative relays within the fifth preset time of undervoltage, then the minimum voltage of the individual cell is set to be greater than the third voltage threshold, and the request to stop discharging sent by the battery management system is not responded to. It is then determined whether the battery management system has completed the over- or undervoltage judgment within the sixth preset time of undervoltage, and whether the battery management system has disconnected the main positive and negative relays within the fifth preset time of undervoltage; wherein, the sixth preset time of undervoltage is the sum of the first preset time of undervoltage, the second preset time of undervoltage, and the third preset time of undervoltage;

[0028] If the battery management system completes the over / under voltage judgment within the sixth preset time of undervoltage and disconnects the main positive and main negative relays within the fifth preset time of undervoltage, then the battery management system is considered to have passed the functional safety test.

[0029] If the battery management system fails to complete the over / under voltage judgment within the sixth preset time of undervoltage and fails to disconnect the main positive and main negative relays within the fifth preset time of undervoltage, the test is considered to have failed and the functional safety test is stopped.

[0030] Furthermore, when the functional safety target is the overcurrent ASILC, the battery management system is subjected to functional safety testing through the following steps:

[0031] The current is set to a preset current so that the battery management system is in normal working condition.

[0032] Send a charge / discharge command to the battery management system so that the battery management system charges or discharges based on the charge / discharge command, and set the current to be greater than a first current threshold or the current to be less than a second current threshold;

[0033] Determine whether the battery management system has triggered an overcurrent fault alarm within a first preset time period. If not, the test is considered to have failed, and the functional safety test is stopped.

[0034] If the battery management system issues an overcurrent fault alarm within the first preset time of overcurrent, it is determined whether the battery management system sends a stop discharge request or a stop charging request within the second preset time of overcurrent. If not, the test is considered to have failed, and the functional safety test is stopped.

[0035] If the battery management system sends the stop discharge request or the stop charging request within the second preset time of overcurrent, it is determined whether the battery management system disconnects the main circuit relay within the third preset time of overcurrent. If not, the test is considered to have failed and the functional safety test is stopped.

[0036] If the battery management system disconnects the main circuit relay within the third preset time of overcurrent, it is determined whether the battery management system has entered a safe state within the fourth preset time of overcurrent. If not, the test is considered to have failed and the functional safety test is stopped.

[0037] If so, the battery management system is considered to have passed the functional safety test.

[0038] Furthermore, when the functional safety target is the over-temperature ASILC, the battery management system is subjected to the functional safety test through the following steps:

[0039] The temperature is set to a preset temperature so that the battery management system is in normal working condition.

[0040] The temperature is set to be greater than a first temperature threshold or less than a second temperature threshold, and it is determined whether the battery management system has triggered an over-temperature fault alarm within a first preset time. If not, the test is considered to have failed and the functional safety test is stopped.

[0041] If the battery management system issues an over-temperature fault alarm within the first preset time of over-temperature, then it is determined whether the battery management system sends a stop discharge request or a stop charging request within the second preset time of over-temperature and the cooling system is activated. If not, the test is considered to have failed and the functional safety test is stopped.

[0042] If the battery management system sends the stop discharge request or the stop charging request within the second preset time of over-temperature and starts the cooling system, then it is determined whether the battery management system disconnects the main circuit relay within the third preset time of over-temperature. If not, the test is considered to have failed and the functional safety test is stopped.

[0043] If the battery management system disconnects the main circuit relay within the third preset time of over-temperature, it is determined whether the battery management system has entered a safe state within the fourth preset time of over-temperature. If not, the test is considered to have failed and the functional safety test is stopped.

[0044] If so, the battery management system is considered to have passed the functional safety test.

[0045] Furthermore, when the functional safety target is the total voltage overvoltage ASILC, the battery management system is subjected to the functional safety test through the following steps:

[0046] The total pressure is set to a first preset total pressure value so that the battery management system is in normal working condition.

[0047] The total pressure is set to be greater than the first total pressure threshold, and it is determined whether the battery management system has issued a total pressure overvoltage fault alarm within a first preset time period. If not, the test is considered to have failed and the functional safety test is stopped.

[0048] If the battery management system issues a total voltage overvoltage fault alarm within the first preset time of total voltage overvoltage, then it is determined whether the battery management system sends a stop charging request within the second preset time of total voltage overvoltage. If not, the test is considered to have failed and the functional safety test is stopped.

[0049] If the battery management system sends the stop charging request within the second preset time of total voltage overvoltage, then it is determined whether the battery management system disconnects the main circuit relay within the third preset time of total voltage overvoltage. If not, the test is considered to have failed and the functional safety test is stopped.

[0050] If the battery management system disconnects the main circuit relay within the third preset time of total voltage overvoltage, it is determined whether the battery management system has entered a safe state within the fourth preset time of total voltage overvoltage. If not, the test is considered to have failed and the functional safety test is stopped.

[0051] If so, the battery management system is considered to have passed the functional safety test.

[0052] Furthermore, when the functional safety target is the total voltage undervoltage ASILC, the functional safety test of the battery management system is performed through the following steps:

[0053] The total pressure is set to a second preset total pressure value so that the battery management system is in normal working condition.

[0054] The total voltage is set to be less than the second total voltage threshold, and it is determined whether the battery management system has issued a total voltage undervoltage fault alarm within a first preset time period. If not, the test is considered to have failed and the functional safety test is stopped.

[0055] If the battery management system issues a total voltage undervoltage fault alarm within the first preset time of total voltage undervoltage, then it is determined whether the battery management system sends a stop charging request within the second preset time of total voltage undervoltage. If not, the test is considered to have failed and the functional safety test is stopped.

[0056] If the battery management system sends the stop charging request within the second preset time of total voltage undervoltage, then it is determined whether the battery management system disconnects the main circuit relay within the third preset time of total voltage undervoltage. If not, the test is considered to have failed and the functional safety test is stopped.

[0057] If the battery management system disconnects the main circuit relay within the third preset time of total voltage undervoltage, it is determined whether the battery management system has entered a safe state within the fourth preset time of total voltage overvoltage. If not, the test is considered to have failed and the functional safety test is stopped.

[0058] If so, the battery management system is considered to have passed the functional safety test.

[0059] Secondly, embodiments of this application also provide a HIL simulation test platform, which is used to perform a test method for the safety functions of a battery management system. The HIL simulation test platform includes:

[0060] The functional safety target determination module is used to determine the fault triggering conditions set by the user according to the selected functional safety target in response to the user operation; wherein, the functional safety target is any one of single cell overvoltage ASILC, single cell undervoltage ASILC, overcurrent ASILC, overtemperature ASILC, total voltage overvoltage ASILC, or total voltage undervoltage ASILC, and the fault triggering conditions include the fault triggering time corresponding to the functional safety target and the cell parameter threshold.

[0061] The functional safety testing module is used to set corresponding initial parameters for the battery management system based on the fault triggering conditions corresponding to the functional safety target, so that the battery management system can simulate the operating conditions corresponding to the fault triggering conditions and determine the operating status of the battery management system under the operating conditions, thereby realizing functional safety testing of the battery management system; wherein, when the functional safety target is the single cell overvoltage ASILC, the initial parameter is the maximum value of the single cell voltage; when the functional safety target is the single cell undervoltage ASILC, the initial parameter is the minimum value of the single cell voltage; when the functional safety target is the overcurrent ASILC, the initial parameter is the current; when the functional safety target is the overtemperature ASILC, the initial parameter is the temperature; when the functional safety target is the total voltage overvoltage ASILC, the initial parameter is the total voltage; and when the functional safety target is the total voltage undervoltage ASILC, the initial parameter is the total voltage.

[0062] Thirdly, embodiments of this application also provide an electronic device, including: a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the memory via the bus. When the machine-readable instructions are executed by the processor, the steps of the test method for the safety function of the battery management system as described above are performed.

[0063] Fourthly, embodiments of this application also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the test method for the safety functions of the battery management system as described above.

[0064] This application provides a method for testing the safety functions of a battery management system (BMS). By utilizing a host computer on a HIL simulation testing platform to simulate different fault conditions of the BMS in real time, the correctness of the BMS functional safety fault protection strategy is verified through test result analysis. This also demonstrates the superiority of HIL testing. Furthermore, using the HIL simulation testing platform to verify the BMS not only saves costs and significantly shortens the ECU development cycle, but also allows for flexible configuration of model parameters, real-time changes to different variables to simulate various operating conditions, and monitoring of the BMS's operating status under different conditions. This method is superior to traditional testing methods.

[0065] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0066] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0067] Figure 1 A flowchart illustrating a test method for the safety functions of a battery management system provided in this application embodiment;

[0068] Figure 2 This is a schematic diagram of a test sequence for HIL test cases when the functional safety objective is single cell overvoltage ASILC, provided in an embodiment of this application.

[0069] Figure 3 This is a schematic diagram of the structure of a HIL simulation test platform provided in an embodiment of this application;

[0070] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0071] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of this application. Based on the embodiments of this application, every other embodiment obtained by those skilled in the art without inventive effort falls within the scope of protection of this application.

[0072] First, the applicable scenarios for this application will be introduced. This application can be applied to the field of battery management system technology.

[0073] In recent years, with the continuous advancement of new energy vehicle technology, the complexity of automotive electronic hardware and software has gradually increased, and the risks from system failures and random hardware failures are also increasing. In particular, the power battery system involves high voltage and high current. Once a failure occurs, it can easily cause short circuits, explosions, fires, etc., resulting in huge economic losses and casualties. Therefore, in the software architecture, it is necessary to focus on the analysis and design of fault protection strategies. This part is defined in detail in the ISO26262 standard.

[0074] Furthermore, with the development of electronic control systems for new energy vehicles and the continuous improvement of the ISO26262 functional safety system, vehicle fault protection strategies have become an important part of software development, especially for battery management systems, which are more difficult and risky to test. Therefore, how to conduct safe and efficient testing of battery systems has become an indispensable part of the vehicle development process.

[0075] Based on this, the embodiments of this application provide a test method for the safety functions of a battery management system. By flexibly configuring model parameters and changing different variables in real time, various operating conditions can be simulated, and the operating status of the battery management system under different operating conditions can be monitored.

[0076] Please see Figure 1 , Figure 1 This is a flowchart illustrating a testing method for the safety functions of a battery management system provided in this application embodiment. The testing method provided in this application embodiment is applied to the HIL simulation test platform. The HIL simulation test platform is a hardware-in-the-loop test platform, an integrated simulation test experimental platform for intelligent vehicles. The HIL platform aims to develop, test, verify, and demonstrate systems such as intelligent cockpits, human-machine interfaces (HMIs), user experience testing, autonomous driving testing, and driver / pedestrian psychological testing for intelligent vehicles. The HIL hardware system consists of a battery management system and a LABCAR cabinet. The battery management system is the one for which the HIL simulation test platform performs functional tests. The BMS battery system, commonly known as a battery nanny or battery manager, is mainly used for intelligent management and maintenance of each battery cell, preventing overcharging and over-discharging, extending battery life, and monitoring battery status. The LABCAR cabinet consists of a main processor, function boards, and internal signal conditioning circuitry. The main processor performs real-time calculations on the model and interacts with the controller through different functional I / O boards and signal conditioning units. The HIL system model mainly includes an I / O model, a battery model, and other auxiliary models. The I / O model primarily handles the matching between the cabinet hardware interfaces and signals. The battery model, through parameter configuration, can simulate the charging, discharging, temperature, and SOC characteristics of a real battery pack. The auxiliary models mainly consist of simulation logic models that interact with the battery management system, such as the VCU and charger models. Before starting testing, all wiring harnesses of the HIL cabinet and battery management system are correctly connected. The HIL system supplies low-voltage power to the BMS, and then simulates the control command sequence according to the vehicle's power-on and power-off process, ensuring the BMS is in a normal working state without any faults.

[0077] like Figure 1 As shown in the embodiments of this application, the testing method provided includes:

[0078] S101, in response to user operation, determine the fault triggering conditions set by the user according to the selected functional safety objective.

[0079] Here, automotive functional safety refers to preventative measures to ensure the normal operation of various automotive functions. In the automotive electronics industry functional safety standard ISO 26262, functional safety is defined as the avoidance of unreasonable risks caused by electrical / electronic system failures. The ISO 26262 standard (Road Vehicle Functional Safety Standard) covers all safety-related applications in automotive electrical and electronic development, and outlines all safety-related activities throughout the entire automotive lifecycle. Starting from requirements, the standard proposes corresponding functional safety requirements, including conceptual design, hardware and software design, final production, and operation, covering the entire automotive lifecycle to ensure that functional failures of safety-related electronic products do not cause hazards. Functional safety is classified into different levels based on the severity of the failure. For example, the ISO 26262 standard classifies automotive functions into four ASIL (Safety Integrity Level): A, B, C, and D. A is the lowest safety level, and D is the highest. This application primarily provides the following functional safety objectives: individual cell overvoltage ASILC, individual cell undervoltage ASILC, overcurrent ASILC, overtemperature ASILC, total voltage overvoltage ASILC, or total voltage undervoltage ASILC. Fault triggering conditions refer to the fault thresholds set by the user based on the functional safety objective they wish to test. Here, fault triggering conditions may include the fault triggering time corresponding to the functional safety objective and cell parameter thresholds.

[0080] Regarding step S101 above, in specific implementation, after the battery management system is operating normally, the user determines the functional safety target and ASIL level to be tested, and sets the fault triggering conditions for the functional safety target on the host computer of the HIL simulation test platform. The HIL simulation test platform responds to the user's operation and determines the fault triggering conditions set by the user based on the selected functional safety target.

[0081] S102, based on the fault triggering conditions corresponding to the functional safety target, set corresponding initial parameters for the battery management system so that the battery management system can simulate the operating conditions corresponding to the fault triggering conditions and determine the operating status of the battery management system under the operating conditions, so as to realize the functional safety test of the battery management system.

[0082] Regarding step S102 above, in specific implementation, the battery management system is set with corresponding initial parameters based on the fault triggering conditions corresponding to the functional safety target, so that the battery management system can simulate the working conditions corresponding to the fault triggering conditions and determine the operating status of the battery management system under the working conditions, so as to realize the functional safety test of the battery management system.

[0083] Here, according to the embodiments provided in this application, when the functional safety target is single cell overvoltage ASILC, the initial parameter is the maximum value of the single cell voltage; when the functional safety target is single cell undervoltage ASILC, the initial parameter is the minimum value of the single cell voltage; when the functional safety target is overcurrent ASILC, the initial parameter is current; when the functional safety target is overtemperature ASILC, the initial parameter is temperature; when the functional safety target is total voltage overvoltage ASILC, the initial parameter is total voltage; and when the functional safety target is total voltage undervoltage ASILC, the initial parameter is total voltage.

[0084] Specifically, the battery management system includes a BMS master control board, BMS slave control boards, and daisy-chain channels. The BMS master control board and BMS slave control boards communicate with each other via daisy-chain channels. The BMS slave control boards collect battery voltage and temperature information from the battery management system and send this information to the BMS master control board via the daisy-chain channels. The BMS master control board then performs corresponding functional control based on the received battery voltage and temperature information. This functional control can include relay control, fault protection, and charge / discharge control. In practical implementation, the HIL simulation test platform is mainly used to detect whether the BMS master control board performs the corresponding functional control based on the received information.

[0085] Please see Figure 2 , Figure 2 This is a schematic diagram of a HIL test case sequence provided in an embodiment of this application when the functional safety objective is single cell overvoltage ASILC. According to... Figure 2 The test sequence shown, and the test method provided in this application embodiment, when the functional safety target is the overvoltage ASILC of the single cell, perform the functional safety test on the battery management system through the following steps:

[0086] Step 1021: Set the maximum voltage of the single cell to be less than a first preset voltage so that the battery management system is in normal working condition.

[0087] Here, the first preset voltage can be set to 4.25V, and this application does not make a specific limitation on it.

[0088] Regarding step 1021 above, in specific implementation, the system parameters of the HIL simulation test platform are set, and the maximum value of the single cell voltage in the initial parameters is set to be less than the first preset voltage. For example, please refer to... Figure 2 Set the maximum voltage of a single cell, Vmax, to be less than 4.25V, so that the battery management system is in normal working condition.

[0089] Step 1022: Send a charging command to the battery management system to put the battery management system into a charging state, and set the maximum value of the cell voltage to be greater than or equal to the first preset voltage and less than the first voltage threshold.

[0090] Here, the first voltage threshold can be set to 4.35V, but this application does not make specific limitations on it.

[0091] Regarding step 1022 above, in specific implementation, the HIL simulation test platform sends a charging command to the battery management system to put the battery management system into a charging state, and sets the maximum value of the single cell voltage to be greater than or equal to a first preset voltage and less than a first voltage threshold. For example, please refer to... Figure 2 Set the maximum voltage of a single cell to 4.25 ≤ Vmax < 4.35V.

[0092] Step 1023: Determine whether the battery management system has triggered an overvoltage fault alarm within the first preset overvoltage time. If not, the test is considered to have failed, and the functional safety test is stopped.

[0093] Step 1024: If the battery management system issues an overvoltage fault alarm within the first preset overvoltage time period, it is determined that the battery management system sends a request to stop charging within the second preset overvoltage time period.

[0094] Regarding steps 1023-1024 above, in specific implementation, after the battery management system is in the charging state, the HIL simulation test platform determines whether the battery management system has issued an overvoltage fault alarm within the first preset overvoltage time. If the battery management system does not issue an overvoltage fault alarm within the first preset overvoltage time, the test is considered to have failed, and the functional safety test is stopped. If the battery management system issues an overvoltage fault alarm within the first preset overvoltage time, then step 1024 is executed, and it is determined that the battery management system has sent a request to stop charging within the second preset overvoltage time. If so, then step 1025 is executed.

[0095] Step 1025: If the battery management system sends the request to stop charging within the second preset time of overvoltage, then determine whether the battery management system has entered a safe state within the fourth preset time of overvoltage. If not, the test is considered to have failed, and the functional safety test is stopped.

[0096] Step 1026: If the battery management system does not send the request to stop charging within the second preset time of overvoltage, then determine whether the battery management system has issued an overvoltage fault alarm within the third preset time of overvoltage. If not, the test is considered to have failed, and the functional safety test is stopped.

[0097] Regarding steps 1025 and 1026 above, in specific implementation, when the battery management system sends a request to stop charging within the second preset overvoltage time, the HIL simulation test platform determines whether the battery management system has entered a safe state within the fourth preset overvoltage time. If not, the test is considered a failure, and the functional safety test is stopped. If yes, then step S208 is executed. If the battery management system does not send a request to stop charging within the second preset overvoltage time, then step 1026 above is executed, and the HIL simulation test platform determines whether the battery management system has issued an overvoltage fault alarm within the third preset overvoltage time. If not, the test is considered a failure, and the functional safety test is stopped. If yes, then step 1027 is executed.

[0098] Step 1027: If the battery management system triggers the overvoltage fault alarm within the third preset overvoltage time, determine whether the battery management system disconnects the main positive and negative relays within the fifth preset overvoltage time and enters the safe state. If not, the test is considered to have failed, and the functional safety test is stopped.

[0099] Regarding step 1027 above, in specific implementation, if the battery management system issues an overvoltage fault alarm within the third preset overvoltage time period, the HIL simulation test platform determines whether the battery management system disconnects the main positive and negative relays and enters a safe state within the fifth preset overvoltage time period. If not, the test is considered a failure, and the functional safety test is stopped. If yes, then step S208 is executed. Here, the safe state mainly includes the relay state being open, the relay power supply being disconnected, and the latching state.

[0100] Step 1028: If the battery management system enters the safe state within the fourth preset time of overvoltage, or if the battery management system disconnects the main positive and negative relays within the fifth preset time of overvoltage, then the maximum value of the single cell voltage is set to be greater than the first voltage threshold, and the battery management system does not respond to the request to stop charging sent by the battery management system. It is determined whether the battery management system has completed the overvoltage judgment within the sixth preset time of overvoltage, and whether the battery management system has disconnected the main positive and negative relays within the fifth preset time of overvoltage.

[0101] The sixth preset time for overpressure is the sum of the first preset time for overpressure, the second preset time for overpressure, and the third preset time for overpressure.

[0102] Regarding step 1028 above, in specific implementation, if the battery management system enters a safe state within the fourth preset overvoltage time, or if the battery management system disconnects the main positive and negative relays within the fifth preset overvoltage time, the HIL simulation test platform sets the maximum value of the individual cell voltage to be greater than the first voltage threshold, for example, setting the maximum value of the individual cell voltage Vmax > 4.35. Furthermore, the HIL simulation test platform does not respond to the battery management system's request to stop charging. The HIL simulation test platform determines whether the battery management system has completed the overvoltage judgment within the sixth preset overvoltage time, and whether the battery management system has disconnected the main positive and negative relays within the fifth preset overvoltage time. If yes, then proceed to step 1029 below; otherwise, proceed to step 1030 below.

[0103] Step 1029: If the battery management system completes the overvoltage judgment within the sixth preset time of overvoltage and disconnects the main positive and main negative relays within the fifth preset time of overvoltage, then the battery management system is considered to have passed the functional safety test.

[0104] Step 1030: If the battery management system fails to complete the overvoltage judgment within the sixth preset time of overvoltage and fails to disconnect the main positive and main negative relays within the fifth preset time of overvoltage, the test is considered to have failed and the functional safety test is stopped.

[0105] Regarding steps 1029-1030 above, in specific implementation, if the battery management system completes the overvoltage judgment within the sixth preset overvoltage time and disconnects the main positive and main negative relays within the fifth preset overvoltage time, then the battery management system is considered to have passed the functional safety test. If the battery management system fails to complete the overvoltage judgment within the sixth preset overvoltage time and fails to disconnect the main positive and main negative relays within the fifth preset overvoltage time, then the test is considered to have failed, and the functional safety test is stopped.

[0106] Furthermore, as an optional implementation, when the functional safety target is undervoltage ASILC of the individual battery cell, the functional safety test of the battery management system is performed through the following steps:

[0107] (1) Set the minimum voltage of the single cell to be greater than the second preset voltage so that the battery management system is in normal working condition.

[0108] Here, the second preset voltage can be set to 2.5V, and this application does not specifically limit it.

[0109] Regarding step (1) above, in specific implementation, the system parameters of the HIL simulation test platform are set, and the minimum value of the cell voltage in the initial parameters is set to be greater than the second preset voltage. For example, the minimum value of the cell voltage Vmin is set to be greater than 2.5V, so that the battery management system is in normal working condition.

[0110] (2) Send a discharge command to the battery management system to put the battery management system in a discharge state, and set the minimum voltage of the single cell to be greater than or equal to the second voltage threshold and less than the second preset voltage.

[0111] Here, the second voltage threshold can be set to 2.2V, but this application does not make specific limitations on this.

[0112] Regarding step (2) above, in specific implementation, the HIL simulation test platform sends a discharge command to the battery management system to put the battery management system into a discharge state, and sets the minimum voltage of a single cell to be greater than or equal to a second voltage threshold and less than a second preset voltage. For example, the minimum voltage of a single cell is set to 2.2 ≤ Vmin < 2.5V.

[0113] (3) Determine whether the battery management system has issued an undervoltage fault alarm within the first preset time of undervoltage. If not, the test is considered to have failed and the functional safety test is stopped.

[0114] (4) If the battery management system alarms under the first preset time of undervoltage, then determine whether the battery management system sends a request to stop discharging during the second preset time of undervoltage.

[0115] Regarding steps (3)-(4) above, in specific implementation, after the battery management system is in a discharging state, the HIL simulation test platform determines whether the battery management system has issued an undervoltage fault alarm within the first preset undervoltage time. If the battery management system does not issue an undervoltage fault alarm within the first preset undervoltage time, the test is considered to have failed, and the functional safety test is stopped. If the battery management system issues an undervoltage fault alarm within the first preset undervoltage time, then step (4) above is executed, and it is determined that the battery management system has sent a request to stop charging within the second preset undervoltage time. If so, then step (5) below is executed.

[0116] (5) If the battery management system sends the request to stop discharging within the second preset time of undervoltage, it is determined whether the battery management system has entered a safe state within the fourth preset time of undervoltage. If not, the test is considered to have failed and the functional safety test is stopped.

[0117] (6) If the battery management system does not send the request to stop discharging within the second preset time of undervoltage, it is determined whether the battery management system has issued an overvoltage or undervoltage fault alarm within the third preset time of undervoltage. If not, the test is considered to have failed and the functional safety test is stopped.

[0118] Regarding steps (5)-(6) above, in specific implementation, when the battery management system sends a request to stop charging within the second preset time of undervoltage, the HIL simulation test platform determines whether the battery management system has entered a safe state within the fourth preset time of undervoltage. If not, the test is considered a failure, and the functional safety test is stopped. If the battery management system does not send a request to stop charging within the second preset time of undervoltage, then step (6) above is executed. The HIL simulation test platform determines whether the battery management system has issued an overvoltage fault alarm within the third preset time of undervoltage. If not, the test is considered a failure, and the functional safety test is stopped. If so, then step (7) below is executed.

[0119] (7) If the battery management system alarms the over- or under-voltage fault within the third preset time of under-voltage, it is determined whether the battery management system disconnects the main positive and negative relays within the fifth preset time of under-voltage and enters the safe state. If not, the test is considered to have failed and the functional safety test is stopped.

[0120] Regarding step (7) above, in specific implementation, if the battery management system issues an over- or under-voltage fault alarm within the third preset under-voltage time, the HIL simulation test platform determines whether the battery management system disconnects the main positive and negative relays and enters a safe state within the fifth preset under-voltage time. If not, the test is considered to have failed, and the functional safety test is stopped. If yes, then the following step (8) is executed.

[0121] (8) If the battery management system enters the safe state within the fourth preset time of undervoltage, or if the battery management system disconnects the main positive and negative relays within the fifth preset time of undervoltage, then the minimum voltage of the single cell is set to be greater than the third voltage threshold, and the battery management system does not respond to the request to stop discharging sent by the battery management system. It is determined whether the battery management system has completed the over- and undervoltage judgment within the sixth preset time of undervoltage, and whether the battery management system has disconnected the main positive and negative relays within the fifth preset time of undervoltage.

[0122] The sixth preset time for undervoltage is the sum of the first preset time for undervoltage, the second preset time for undervoltage, and the third preset time for undervoltage.

[0123] Regarding step (8) above, in specific implementation, if the battery management system enters a safe state within the fourth preset time of undervoltage, or if the battery management system disconnects the main positive and negative relays within the fifth preset time of undervoltage, the HIL simulation test platform sets the minimum voltage of a single cell to be less than the second voltage threshold, for example, setting the minimum voltage of a single cell Vmax < 2.2V. Furthermore, the HIL simulation test platform does not respond to the battery management system's request to stop charging. The HIL simulation test platform determines whether the battery management system has completed the over / undervoltage judgment within the sixth preset time of undervoltage, and whether the battery management system has disconnected the main positive and negative relays within the fifth preset time of undervoltage. If yes, then step S209 is executed; otherwise, step S210 is executed.

[0124] (9) If the battery management system completes the over- or under-voltage judgment within the sixth preset time of under-voltage and disconnects the main positive and main negative relays within the fifth preset time of under-voltage, then the battery management system is considered to have passed the functional safety test.

[0125] (10) If the battery management system fails to complete the over- or under-voltage judgment within the sixth preset time of under-voltage and fails to disconnect the main positive and main negative relays within the fifth preset time of under-voltage, the test is considered to have failed and the functional safety test is stopped.

[0126] Furthermore, as an optional implementation, when the functional safety target is the overcurrent ASILC, the functional safety test of the battery management system is performed through the following steps:

[0127] A: Set the current to a preset current so that the battery management system is in normal working condition.

[0128] Here, the preset current can be set to 0, and this application does not impose specific limitations on this.

[0129] Regarding step A above, in specific implementation, the system parameters of the HIL simulation test platform are set, and the current in the initial parameters is set to a preset current, for example, the current is set to 0, so that the battery management system is in normal working condition.

[0130] B: Send a charge / discharge command to the battery management system so that the battery management system can charge or discharge based on the charge / discharge command, and set the current to be greater than a first current threshold or the current to be less than a second current threshold.

[0131] Here, the first current threshold can be set to 300A, and the second current threshold can be set to -300A. This application does not make specific limitations on this.

[0132] Regarding step B above, in specific implementation, a charge / discharge command is sent to the battery management system so that the battery management system can charge or discharge based on the charge / discharge command, and the current is set to be greater than a first current threshold or less than a second current threshold. Here, the current I can be set to be greater than 300A or less than -300A.

[0133] C: Determine whether the battery management system has triggered an overcurrent fault alarm within the first preset time period. If not, the test is considered to have failed, and the functional safety test is stopped.

[0134] D: If the battery management system issues an overcurrent fault alarm within the first preset time of overcurrent, then determine whether the battery management system sends a stop discharge request or a stop charging request within the second preset time of overcurrent. If not, the test is considered to have failed, and the functional safety test is stopped.

[0135] E: If the battery management system sends the stop discharge request or the stop charging request within the second preset time of overcurrent, it is determined whether the battery management system disconnects the main circuit relay within the third preset time of overcurrent. If not, the test is considered to have failed, and the functional safety test is stopped.

[0136] F: If the battery management system disconnects the main circuit relay within the third preset time of overcurrent, it is determined whether the battery management system has entered a safe state within the fourth preset time of overcurrent. If not, the test is considered to have failed, and the functional safety test is stopped.

[0137] G: If so, the battery management system is considered to have passed the functional safety test.

[0138] For steps C-G above, firstly, it is determined whether the battery management system (BMS) issued an overcurrent fault alarm within the first preset overcurrent time. If not, the test is considered failed, and the functional safety test is stopped. If yes, it is determined whether the BMS sent a stop-discharge request or a stop-charge request within the second preset overcurrent time. If not, the test is considered failed, and the functional safety test is stopped. If yes, it is determined whether the BMS disconnected the main circuit relay within the third preset overcurrent time. If not, the test is considered failed, and the functional safety test is stopped. If yes, it is determined whether the BMS entered a safe state within the fourth preset overcurrent time. If not, the test is considered failed, and the functional safety test is stopped. If yes, the BMS is considered to have passed the functional safety test.

[0139] Furthermore, as an optional implementation, when the functional safety target is the over-temperature ASILC, the battery management system is subjected to functional safety testing through the following steps:

[0140] a: Set the temperature to a preset temperature so that the battery management system is in normal working condition.

[0141] Here, the preset temperature can be 25 degrees Celsius, and this application does not make a specific limitation on it.

[0142] Regarding step a above, in specific implementation, the system parameters of the HIL simulation test platform are set, and the temperature in the initial parameters is set to a preset temperature, for example, 25 degrees Celsius, so that the battery management system is in normal working condition.

[0143] b: Set the temperature to be greater than a first temperature threshold or less than a second temperature threshold, and determine whether the battery management system has triggered an over-temperature fault alarm within a first preset time. If not, the test is considered to have failed, and the functional safety test is stopped.

[0144] Here, the first temperature threshold can be set to 60 degrees Celsius, and the second temperature threshold can be set to -20 degrees Celsius. This application does not make specific limitations on this.

[0145] Regarding step b above, in specific implementation, the temperature is set to be greater than a first temperature threshold or less than a second temperature threshold; for example, the temperature is set to be greater than 60 degrees Celsius or less than -20 degrees Celsius. It is then determined whether the battery management system has triggered an over-temperature fault alarm within a first preset time period. If not, the test is considered a failure, and the functional safety test is stopped. If yes, then proceed to step c below.

[0146] c: If the battery management system issues an over-temperature fault alarm within the first preset time of over-temperature, then determine whether the battery management system sends a stop-discharge request or a stop-charging request within the second preset time of over-temperature and start the cooling system. If not, the test is considered to have failed and the functional safety test is stopped.

[0147] d: If the battery management system sends the stop discharge request or the stop charging request within the second preset time of over-temperature and starts the cooling system, then determine whether the battery management system disconnects the main circuit relay within the third preset time of over-temperature. If not, the test is considered to have failed and the functional safety test is stopped.

[0148] e: If the battery management system disconnects the main circuit relay within the third preset time of over-temperature, then determine whether the battery management system has entered a safe state within the fourth preset time of over-temperature. If not, the test is considered to have failed, and the functional safety test is stopped.

[0149] f: If so, the battery management system is considered to have passed the functional safety test.

[0150] Regarding steps c-f above, in specific implementation, if the battery management system (BMS) issues an over-temperature fault alarm within a first preset over-temperature time, it is determined whether the BMS sends a stop-discharge request or a stop-charging request within a second preset over-temperature time and activates the cooling system. If not, the test is considered a failure, and the functional safety test is stopped. If yes, it is determined whether the BMS disconnects the main circuit relay within a third preset over-temperature time. If not, the test is considered a failure, and the functional safety test is stopped. If yes, it is determined whether the BMS enters a safe state within a fourth preset over-temperature time. If not, the test is considered a failure, and the functional safety test is stopped. If yes, the BMS is considered to have passed the functional safety test.

[0151] Furthermore, as an optional implementation, when the functional safety target is the total voltage overvoltage ASILC, the battery management system is subjected to the functional safety test through the following steps:

[0152] I: Set the total pressure to a first preset total pressure value so that the battery management system is in normal working condition.

[0153] Here, the first preset total voltage value can be set to 355V, and this application does not make a specific limitation on it.

[0154] In specific implementation of step I above, the total voltage in the initial parameters is set to the first preset total voltage value, for example, the total voltage is set to 355V, so that the battery management system is in normal working condition.

[0155] II: Set the total pressure to be greater than the first total pressure threshold, and determine whether the battery management system has triggered a total pressure overvoltage fault alarm within a first preset time period. If not, the test is considered to have failed, and the functional safety test is stopped.

[0156] III: If the battery management system issues a total voltage overvoltage fault alarm within the first preset time of total voltage overvoltage, then determine whether the battery management system sends a stop charging request within the second preset time of total voltage overvoltage. If not, the test is considered to have failed, and the functional safety test is stopped.

[0157] IV: If the battery management system sends the stop charging request within the second preset time of total voltage overvoltage, then determine whether the battery management system disconnects the main circuit relay within the third preset time of total voltage overvoltage. If not, the test is considered to have failed, and the functional safety test is stopped.

[0158] V: If the battery management system disconnects the main circuit relay within the third preset time of total voltage overvoltage, then determine whether the battery management system has entered a safe state within the fourth preset time of total voltage overvoltage. If not, the test is considered to have failed, and the functional safety test is stopped.

[0159] VI: If so, the battery management system is considered to have passed the functional safety test.

[0160] Here, the first total voltage threshold can be set to 403V, ​​and this application does not make specific limitations on this.

[0161] For steps II-VI above, in specific implementation, firstly, the total voltage is set to be greater than a first total voltage threshold, for example, a total voltage greater than 403V. Then, it is determined whether the battery management system has issued a total voltage overvoltage fault alarm within a first preset time period. If not, the test is considered a failure, and the functional safety test is stopped. If yes, it is determined whether the battery management system has sent a stop charging request within a second preset time period. If not, the test is considered a failure, and the functional safety test is stopped. If yes, it is determined whether the battery management system has disconnected the main circuit relay within a third preset time period. If not, the test is considered a failure, and the functional safety test is stopped. If yes, it is determined whether the battery management system has entered a safe state within a fourth preset time period. If not, the test is considered a failure, and the functional safety test is stopped. If yes, the battery management system is considered to have passed the functional safety test.

[0162] Furthermore, as an optional implementation, when the functional safety target is the total voltage undervoltage (ASILC), the functional safety test of the battery management system is performed through the following steps:

[0163] i: Set the total pressure to a second preset total pressure value so that the battery management system is in normal working condition.

[0164] Here, the second preset total voltage value can be set to 355V, and this application does not make a specific limitation on this.

[0165] In specific implementation of step I above, the total voltage in the initial parameters is set to the second preset total voltage value, for example, the total voltage is set to 355V, so that the battery management system is in normal working condition.

[0166] ii: Set the total voltage to be less than the second total voltage threshold, and determine whether the battery management system has issued a total voltage undervoltage fault alarm within the first preset time of total voltage undervoltage. If not, the test is considered to have failed, and the functional safety test is stopped.

[0167] iii: If the battery management system issues a total voltage undervoltage fault alarm within the first preset time of total voltage undervoltage, then determine whether the battery management system sends a stop charging request within the second preset time of total voltage undervoltage. If not, the test is considered to have failed, and the functional safety test is stopped.

[0168] iv: If the battery management system sends the stop charging request within the second preset time of total voltage undervoltage, then determine whether the battery management system disconnects the main circuit relay within the third preset time of total voltage undervoltage. If not, the test is considered to have failed, and the functional safety test is stopped.

[0169] v: If the battery management system disconnects the main circuit relay within the third preset time of total voltage undervoltage, then determine whether the battery management system has entered a safe state within the fourth preset time of total voltage overvoltage. If not, the test is considered to have failed and the functional safety test is stopped.

[0170] vi: If so, the battery management system is considered to have passed the functional safety test.

[0171] Here, the second total voltage threshold can be set to 200V, and this application does not make specific limitations on this.

[0172] For steps ii-vi above, in specific implementation, firstly, the total voltage is set to be less than a second total voltage threshold, for example, the total voltage is set to be less than 200V. Then, it is determined whether the battery management system has issued a total voltage undervoltage fault alarm within a first preset time period. If not, the test is considered to have failed, and the functional safety test is stopped. If yes, it is determined whether the battery management system has sent a stop charging request within a second preset time period. If not, the test is considered to have failed, and the functional safety test is stopped. If yes, it is determined whether the battery management system has disconnected the main circuit relay within a third preset time period. If not, the test is considered to have failed, and the functional safety test is stopped. If yes, it is determined whether the battery management system has entered a safe state within a fourth preset time period of total voltage overvoltage. If not, the test is considered to have failed, and the functional safety test is stopped. If yes, the battery management system is considered to have passed the functional safety test.

[0173] This application provides a method for testing the safety functions of a battery management system. The HIL simulation test platform determines the fault triggering conditions set by the user according to the selected functional safety target, and sets the corresponding initial parameters of the battery management system based on the fault triggering conditions corresponding to the functional safety target, so that the battery management system can simulate the working conditions corresponding to the fault triggering conditions, and judge the operating status of the battery management system under the working conditions, so as to realize the functional safety test of the battery management system.

[0174] The battery management system (BMS) safety function testing method provided in this application utilizes the HIL simulation testing platform to simulate different fault conditions of the BMS in real time. Through test result analysis, the correctness of the BMS functional safety fault protection strategy is verified, demonstrating the superiority of HIL testing. Furthermore, using the HIL simulation testing platform to verify the BMS not only saves costs and significantly shortens the ECU development cycle, but also allows for flexible configuration of model parameters, real-time changes to different variables to simulate various operating conditions, and monitoring of the BMS's operating status under different conditions, making it superior to traditional testing methods.

[0175] Please see Figure 3 , Figure 3 This is a schematic diagram of the structure of a HIL simulation test platform provided in an embodiment of this application. Figure 3 As shown, the HIL simulation test platform 300 includes:

[0176] The functional safety target determination module 301 is used to determine the fault triggering conditions set by the user according to the selected functional safety target in response to the user operation; wherein, the functional safety target is any one of single cell overvoltage ASILC, single cell undervoltage ASILC, overcurrent ASILC, overtemperature ASILC, total voltage overvoltage ASILC, or total voltage undervoltage ASILC, and the fault triggering conditions include the fault triggering time corresponding to the functional safety target and the cell parameter threshold.

[0177] The functional safety test module 302 is used to set corresponding initial parameters for the battery management system based on the fault triggering conditions corresponding to the functional safety target, so that the battery management system can simulate the operating conditions corresponding to the fault triggering conditions and determine the operating status of the battery management system under the operating conditions, thereby realizing functional safety testing of the battery management system; wherein, when the functional safety target is the single cell overvoltage ASILC, the initial parameter is the maximum value of the single cell voltage; when the functional safety target is the single cell undervoltage ASILC, the initial parameter is the minimum value of the single cell voltage; when the functional safety target is the overcurrent ASILC, the initial parameter is the current; when the functional safety target is the overtemperature ASILC, the initial parameter is the temperature; when the functional safety target is the total voltage overvoltage ASILC, the initial parameter is the total voltage; and when the functional safety target is the total voltage undervoltage ASILC, the initial parameter is the total voltage.

[0178] Furthermore, when the functional safety target is the overvoltage ASILC of the single cell, the functional safety test module 302 performs the functional safety test on the battery management system through the following steps:

[0179] The maximum voltage of the individual battery cell is set to be less than a first preset voltage so that the battery management system is in normal working condition.

[0180] Send a charging command to the battery management system to put the battery management system into a charging state, and set the maximum value of the cell voltage to be greater than or equal to the first preset voltage and less than the first voltage threshold.

[0181] Determine whether the battery management system has triggered an overvoltage fault alarm within a first preset time period. If not, the test is considered to have failed, and the functional safety test is stopped.

[0182] If the battery management system issues an overvoltage fault alarm within the first preset time of overvoltage, it is determined that the battery management system sent a request to stop charging within the second preset time of overvoltage.

[0183] If the battery management system sends the request to stop charging within the second preset time of overvoltage, it is determined whether the battery management system has entered a safe state within the fourth preset time of overvoltage. If not, the test is considered to have failed and the functional safety test is stopped.

[0184] If the battery management system does not send the request to stop charging within the second preset time of overvoltage, it is determined whether the battery management system has issued an overvoltage fault alarm within the third preset time of overvoltage. If not, the test is considered to have failed and the functional safety test is stopped.

[0185] If the battery management system triggers the overvoltage fault alarm within the third preset overvoltage time, it is determined whether the battery management system disconnects the main positive and negative relays within the fifth preset overvoltage time and enters the safe state. If not, the test is considered to have failed and the functional safety test is stopped.

[0186] If the battery management system enters the safe state within the fourth preset time of overvoltage, or if the battery management system disconnects the main positive and negative relays within the fifth preset time of overvoltage, then the maximum value of the single cell voltage is set to be greater than the first voltage threshold, and the request to stop charging sent by the battery management system is not responded to. It is then determined whether the battery management system has completed the overvoltage judgment within the sixth preset time of overvoltage, and whether the battery management system has disconnected the main positive and negative relays within the fifth preset time of overvoltage; wherein, the sixth preset time of overvoltage is the sum of the first preset time of overvoltage, the second preset time of overvoltage, and the third preset time of overvoltage;

[0187] If the battery management system completes the overvoltage judgment within the sixth preset time of overvoltage and disconnects the main positive and main negative relays within the fifth preset time of overvoltage, then the battery management system is considered to have passed the functional safety test.

[0188] If the battery management system fails to complete the overvoltage judgment within the sixth preset time period and fails to disconnect the main positive and main negative relays within the fifth preset time period, the test is considered to have failed and the functional safety test is stopped.

[0189] Furthermore, when the functional safety target is undervoltage ASILC of the individual battery cell, the functional safety test module 302 performs the functional safety test on the battery management system through the following steps:

[0190] The minimum voltage of the individual battery cell is set to be greater than a second preset voltage so that the battery management system is in normal working condition.

[0191] Send a discharge command to the battery management system to put the battery management system into a discharge state, and set the minimum voltage of the individual cell to be greater than or equal to the second voltage threshold and less than the second preset voltage;

[0192] Determine whether the battery management system has issued an undervoltage fault alarm within a first preset time period. If not, the test is considered to have failed, and the functional safety test is stopped.

[0193] If the battery management system issues an undervoltage fault alarm within the first preset undervoltage time, then determine whether the battery management system sends a request to stop discharging within the second preset undervoltage time.

[0194] If the battery management system sends the request to stop discharging within the second preset time of undervoltage, it is determined whether the battery management system has entered a safe state within the fourth preset time of undervoltage. If not, the test is considered to have failed and the functional safety test is stopped.

[0195] If the battery management system does not send the request to stop charging within the second preset time of undervoltage, it is determined whether the battery management system has issued an over- or undervoltage fault alarm within the third preset time of undervoltage. If not, the test is considered to have failed and the functional safety test is stopped.

[0196] If the battery management system triggers the over- or under-voltage fault alarm within the third preset time of under-voltage, it is determined whether the battery management system disconnects the main positive and negative relays within the fifth preset time of under-voltage and enters the safe state. If not, the test is considered to have failed and the functional safety test is stopped.

[0197] If the battery management system enters the safe state within the fourth preset time of undervoltage, or if the battery management system disconnects the main positive and negative relays within the fifth preset time of undervoltage, then the minimum voltage of the individual cell is set to be greater than the third voltage threshold, and the request to stop discharging sent by the battery management system is not responded to. It is then determined whether the battery management system has completed the over- or undervoltage judgment within the sixth preset time of undervoltage, and whether the battery management system has disconnected the main positive and negative relays within the fifth preset time of undervoltage; wherein, the sixth preset time of undervoltage is the sum of the first preset time of undervoltage, the second preset time of undervoltage, and the third preset time of undervoltage;

[0198] If the battery management system completes the over / under voltage judgment within the sixth preset time of undervoltage and disconnects the main positive and main negative relays within the fifth preset time of undervoltage, then the battery management system is considered to have passed the functional safety test.

[0199] If the battery management system fails to complete the over / under voltage judgment within the sixth preset time of undervoltage and fails to disconnect the main positive and main negative relays within the fifth preset time of undervoltage, the test is considered to have failed and the functional safety test is stopped.

[0200] Furthermore, when the functional safety target is the overcurrent ASILC, the functional safety test module 302 performs the functional safety test on the battery management system through the following steps:

[0201] The current is set to a preset current so that the battery management system is in normal working condition.

[0202] Send a charge / discharge command to the battery management system so that the battery management system charges or discharges based on the charge / discharge command, and set the current to be greater than a first current threshold or the current to be less than a second current threshold;

[0203] Determine whether the battery management system has triggered an overcurrent fault alarm within a first preset time period. If not, the test is considered to have failed, and the functional safety test is stopped.

[0204] If the battery management system issues an overcurrent fault alarm within the first preset time of overcurrent, it is determined whether the battery management system sends a stop discharge request or a stop charging request within the second preset time of overcurrent. If not, the test is considered to have failed, and the functional safety test is stopped.

[0205] If the battery management system sends the stop discharge request or the stop charging request within the second preset time of overcurrent, it is determined whether the battery management system disconnects the main circuit relay within the third preset time of overcurrent. If not, the test is considered to have failed and the functional safety test is stopped.

[0206] If the battery management system disconnects the main circuit relay within the third preset time of overcurrent, it is determined whether the battery management system has entered a safe state within the fourth preset time of overcurrent. If not, the test is considered to have failed and the functional safety test is stopped.

[0207] If so, the battery management system is considered to have passed the functional safety test.

[0208] Furthermore, when the functional safety target is the over-temperature ASILC, the functional safety test module 302 performs the functional safety test on the battery management system through the following steps:

[0209] The temperature is set to a preset temperature so that the battery management system is in normal working condition.

[0210] The temperature is set to be greater than a first temperature threshold or less than a second temperature threshold, and it is determined whether the battery management system has triggered an over-temperature fault alarm within a first preset time. If not, the test is considered to have failed and the functional safety test is stopped.

[0211] If the battery management system issues an over-temperature fault alarm within the first preset time of over-temperature, then it is determined whether the battery management system sends a stop discharge request or a stop charging request within the second preset time of over-temperature and the cooling system is activated. If not, the test is considered to have failed and the functional safety test is stopped.

[0212] If the battery management system sends the stop discharge request or the stop charging request within the second preset time of over-temperature and starts the cooling system, then it is determined whether the battery management system disconnects the main circuit relay within the third preset time of over-temperature. If not, the test is considered to have failed and the functional safety test is stopped.

[0213] If the battery management system disconnects the main circuit relay within the third preset time of over-temperature, it is determined whether the battery management system has entered a safe state within the fourth preset time of over-temperature. If not, the test is considered to have failed and the functional safety test is stopped.

[0214] If so, the battery management system is considered to have passed the functional safety test.

[0215] Furthermore, when the functional safety target is the total voltage overvoltage ASILC, the functional safety test module 302 performs the functional safety test on the battery management system through the following steps:

[0216] The total pressure is set to a first preset total pressure value so that the battery management system is in normal working condition.

[0217] The total pressure is set to be greater than the first total pressure threshold, and it is determined whether the battery management system has issued a total pressure overvoltage fault alarm within a first preset time period. If not, the test is considered to have failed and the functional safety test is stopped.

[0218] If the battery management system issues a total voltage overvoltage fault alarm within the first preset time of total voltage overvoltage, then it is determined whether the battery management system sends a stop charging request within the second preset time of total voltage overvoltage. If not, the test is considered to have failed and the functional safety test is stopped.

[0219] If the battery management system sends the stop charging request within the second preset time of total voltage overvoltage, then it is determined whether the battery management system disconnects the main circuit relay within the third preset time of total voltage overvoltage. If not, the test is considered to have failed and the functional safety test is stopped.

[0220] If the battery management system disconnects the main circuit relay within the third preset time of total voltage overvoltage, it is determined whether the battery management system has entered a safe state within the fourth preset time of total voltage overvoltage. If not, the test is considered to have failed and the functional safety test is stopped.

[0221] If so, the battery management system is considered to have passed the functional safety test.

[0222] Furthermore, when the functional safety target is the total voltage undervoltage ASILC, the functional safety test module 302 performs the functional safety test on the battery management system through the following steps:

[0223] The total pressure is set to a second preset total pressure value so that the battery management system is in normal working condition.

[0224] The total voltage is set to be less than the second total voltage threshold, and it is determined whether the battery management system has issued a total voltage undervoltage fault alarm within a first preset time period. If not, the test is considered to have failed and the functional safety test is stopped.

[0225] If the battery management system issues a total voltage undervoltage fault alarm within the first preset time of total voltage undervoltage, then it is determined whether the battery management system sends a stop charging request within the second preset time of total voltage undervoltage. If not, the test is considered to have failed and the functional safety test is stopped.

[0226] If the battery management system sends the stop charging request within the second preset time of total voltage undervoltage, then it is determined whether the battery management system disconnects the main circuit relay within the third preset time of total voltage undervoltage. If not, the test is considered to have failed and the functional safety test is stopped.

[0227] If the battery management system disconnects the main circuit relay within the third preset time of total voltage undervoltage, it is determined whether the battery management system has entered a safe state within the fourth preset time of total voltage overvoltage. If not, the test is considered to have failed and the functional safety test is stopped.

[0228] If so, the battery management system is considered to have passed the functional safety test.

[0229] Please see Figure 4 , Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 4 As shown, the electronic device 400 includes a processor 410, a memory 420, and a bus 430.

[0230] The memory 420 stores machine-readable instructions executable by the processor 410. When the electronic device 400 is running, the processor 410 communicates with the memory 420 via the bus 430. When the machine-readable instructions are executed by the processor 410, they can perform the operations described above. Figure 1 The steps of the test method for the safety function of the battery management system in the method embodiment shown are described in detail in the method embodiment, and will not be repeated here.

[0231] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, can perform the above-described actions. Figure 1 The steps of the test method for the safety function of the battery management system in the method embodiment shown are described in detail in the method embodiment, and will not be repeated here.

[0232] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0233] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the shown or discussed mutual couplings, direct couplings, or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0234] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0235] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0236] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a processor-executable, non-volatile, computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0237] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. In addition, the terms "first", "second", "third", etc. are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0238] Finally, it should be noted that the above-described embodiments are merely specific implementations of this application, used to illustrate the technical solutions of this application, and not to limit them. The scope of protection of this application is not limited thereto. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features, within the scope of the technology disclosed in this application. Such modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be covered within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A test method for the safety functions of a battery management system, characterized in that, The test method is applied to the HIL simulation test platform, and the test method includes: In response to user operation, determine the fault triggering conditions set by the user according to the selected functional safety target; wherein, the functional safety target is any one of single cell overvoltage ASILC, single cell undervoltage ASILC, overcurrent ASILC, overtemperature ASILC, total voltage overvoltage ASILC, or total voltage undervoltage ASILC, and the fault triggering conditions include the fault triggering time corresponding to the functional safety target and the cell parameter threshold. Based on the fault triggering conditions corresponding to the functional safety targets, corresponding initial parameters are set for the battery management system (BMS) to enable the BMS to simulate the operating conditions corresponding to the fault triggering conditions and to determine the operating status of the BMS under the operating conditions, thereby achieving functional safety testing of the BMS. Specifically, when the functional safety target is overvoltage ASILC of a single battery cell, the initial parameter is the maximum voltage of the single battery cell; when the functional safety target is undervoltage ASILC of a single battery cell, the initial parameter is the minimum voltage of the single battery cell; when the functional safety target is overcurrent ASILC, the initial parameter is current; when the functional safety target is overtemperature ASILC, the initial parameter is temperature; when the functional safety target is total voltage overvoltage ASILC, the initial parameter is total voltage; and when the functional safety target is total voltage undervoltage ASILC, the initial parameter is total voltage. When the functional safety target is the overvoltage ASILC of the single cell, the functional safety test of the battery management system is performed through the following steps: The maximum voltage of the individual battery cell is set to be less than a first preset voltage so that the battery management system is in normal working condition. Send a charging command to the battery management system to put the battery management system into a charging state, and set the maximum value of the cell voltage to be greater than or equal to the first preset voltage and less than the first voltage threshold. Determine whether the battery management system has triggered an overvoltage fault alarm within the first preset time period. If not, the test is considered to have failed, and the functional safety test is stopped. If the battery management system issues an overvoltage fault alarm within the first preset time of overvoltage, it is determined that the battery management system sent a request to stop charging within the second preset time of overvoltage. If the battery management system sends the request to stop charging within the second preset time of overvoltage, it is determined whether the battery management system has entered a safe state within the fourth preset time of overvoltage. If not, the test is considered to have failed and the functional safety test is stopped. If the battery management system does not send the request to stop charging within the second preset time of overvoltage, it is determined whether the battery management system has issued an overvoltage fault alarm within the third preset time of overvoltage. If not, the test is considered to have failed and the functional safety test is stopped. If the battery management system triggers the overvoltage fault alarm within the third preset overvoltage time, it is determined whether the battery management system disconnects the main positive and negative relays within the fifth preset overvoltage time and enters the safe state. If not, the test is considered to have failed and the functional safety test is stopped. If the battery management system enters the safe state within the fourth preset time of overvoltage, or if the battery management system disconnects the main positive and negative relays within the fifth preset time of overvoltage, then the maximum value of the single cell voltage is set to be greater than the first voltage threshold, and the request to stop charging sent by the battery management system is not responded to. It is then determined whether the battery management system has completed the overvoltage judgment within the sixth preset time of overvoltage, and whether the battery management system has disconnected the main positive and negative relays within the fifth preset time of overvoltage; wherein, the sixth preset time of overvoltage is the sum of the first preset time of overvoltage, the second preset time of overvoltage, and the third preset time of overvoltage; If the battery management system completes the overvoltage judgment within the sixth preset time of overvoltage and disconnects the main positive and main negative relays within the fifth preset time of overvoltage, then the battery management system is considered to have passed the functional safety test. If the battery management system fails to complete the overvoltage judgment within the sixth preset time period and fails to disconnect the main positive and main negative relays within the fifth preset time period, the test is considered to have failed and the functional safety test is stopped.

2. The test method according to claim 1, characterized in that, When the functional safety target is undervoltage ASILC of the individual battery cell, the functional safety test of the battery management system is performed through the following steps: The minimum voltage of the individual battery cell is set to be greater than a second preset voltage so that the battery management system is in normal working condition. Send a discharge command to the battery management system to put the battery management system into a discharge state, and set the minimum voltage of the individual cell to be greater than or equal to the second voltage threshold and less than the second preset voltage; Determine whether the battery management system has issued an undervoltage fault alarm within the first preset undervoltage time. If not, the test is considered to have failed, and the functional safety test is stopped. If the battery management system issues an undervoltage fault alarm within the first preset undervoltage time, then determine whether the battery management system sends a request to stop discharging within the second preset undervoltage time. If the battery management system sends the request to stop discharging within the second preset time of undervoltage, it is determined whether the battery management system has entered a safe state within the fourth preset time of undervoltage. If not, the test is considered to have failed and the functional safety test is stopped. If the battery management system does not send the request to stop discharging within the second preset time of undervoltage, it is determined whether the battery management system has issued an over- or undervoltage fault alarm within the third preset time of undervoltage. If not, the test is considered to have failed and the functional safety test is stopped. If the battery management system triggers the over- or under-voltage fault alarm within the third preset time of under-voltage, it is determined whether the battery management system disconnects the main positive and negative relays within the fifth preset time of under-voltage and enters the safe state. If not, the test is considered to have failed and the functional safety test is stopped. If the battery management system enters the safe state within the fourth preset time of undervoltage, or if the battery management system disconnects the main positive and negative relays within the fifth preset time of undervoltage, then the minimum voltage of the individual cell is set to be greater than the third voltage threshold, and the request to stop discharging sent by the battery management system is not responded to. It is then determined whether the battery management system has completed the over- or undervoltage judgment within the sixth preset time of undervoltage, and whether the battery management system has disconnected the main positive and negative relays within the fifth preset time of undervoltage; wherein, the sixth preset time of undervoltage is the sum of the first preset time of undervoltage, the second preset time of undervoltage, and the third preset time of undervoltage; If the battery management system completes the over / under voltage judgment within the sixth preset time of undervoltage and disconnects the main positive and main negative relays within the fifth preset time of undervoltage, then the battery management system is considered to have passed the functional safety test. If the battery management system fails to complete the over / under voltage judgment within the sixth preset time of undervoltage and fails to disconnect the main positive and main negative relays within the fifth preset time of undervoltage, the test is considered to have failed and the functional safety test is stopped.

3. The test method according to claim 1, characterized in that, When the functional safety target is the overcurrent ASILC, the functional safety test of the battery management system is performed through the following steps: The current is set to a preset current so that the battery management system is in normal working condition. Send a charge / discharge command to the battery management system so that the battery management system charges or discharges based on the charge / discharge command, and set the current to be greater than a first current threshold or the current to be less than a second current threshold; Determine whether the battery management system has triggered an overcurrent fault alarm within a first preset time period. If not, the test is considered to have failed, and the functional safety test is stopped. If the battery management system issues an overcurrent fault alarm within the first preset time of overcurrent, it is determined whether the battery management system sends a stop discharge request or a stop charging request within the second preset time of overcurrent. If not, the test is considered to have failed, and the functional safety test is stopped. If the battery management system sends the stop discharge request or the stop charging request within the second preset time of overcurrent, it is determined whether the battery management system disconnects the main circuit relay within the third preset time of overcurrent. If not, the test is considered to have failed and the functional safety test is stopped. If the battery management system disconnects the main circuit relay within the third preset time of overcurrent, it is determined whether the battery management system has entered a safe state within the fourth preset time of overcurrent. If not, the test is considered to have failed and the functional safety test is stopped. If so, the battery management system is considered to have passed the functional safety test.

4. The test method according to claim 1, characterized in that, When the functional safety target is the excessively high temperature (ASILC), the functional safety test of the battery management system is performed through the following steps: The temperature is set to a preset temperature so that the battery management system is in normal working condition. The temperature is set to be greater than a first temperature threshold or less than a second temperature threshold, and it is determined whether the battery management system has triggered an over-temperature fault alarm within a first preset time. If not, the test is considered to have failed and the functional safety test is stopped. If the battery management system issues an over-temperature fault alarm within the first preset time of over-temperature, then it is determined whether the battery management system sends a stop discharge request or a stop charging request within the second preset time of over-temperature and the cooling system is activated. If not, the test is considered to have failed and the functional safety test is stopped. If the battery management system sends the stop discharge request or the stop charging request within the second preset time of over-temperature and starts the cooling system, then it is determined whether the battery management system disconnects the main circuit relay within the third preset time of over-temperature. If not, the test is considered to have failed and the functional safety test is stopped. If the battery management system disconnects the main circuit relay within the third preset time of over-temperature, it is determined whether the battery management system has entered a safe state within the fourth preset time of over-temperature. If not, the test is considered to have failed and the functional safety test is stopped. If so, the battery management system is considered to have passed the functional safety test.

5. The test method according to claim 1, characterized in that, When the functional safety target is the total voltage overvoltage ASILC, the functional safety test of the battery management system is performed through the following steps: The total pressure is set to a first preset total pressure value so that the battery management system is in normal working condition. The total pressure is set to be greater than the first total pressure threshold, and it is determined whether the battery management system has issued a total pressure overvoltage fault alarm within a first preset time period. If not, the test is considered to have failed and the functional safety test is stopped. If the battery management system issues a total voltage overvoltage fault alarm within the first preset time of total voltage overvoltage, then it is determined whether the battery management system sends a stop charging request within the second preset time of total voltage overvoltage. If not, the test is considered to have failed and the functional safety test is stopped. If the battery management system sends the stop charging request within the second preset time of total voltage overvoltage, then it is determined whether the battery management system disconnects the main circuit relay within the third preset time of total voltage overvoltage. If not, the test is considered to have failed and the functional safety test is stopped. If the battery management system disconnects the main circuit relay within the third preset time of total voltage overvoltage, it is determined whether the battery management system has entered a safe state within the fourth preset time of total voltage overvoltage. If not, the test is considered to have failed and the functional safety test is stopped. If so, the battery management system is considered to have passed the functional safety test.

6. The test method according to claim 1, characterized in that, When the functional safety target is the total voltage undervoltage ASILC, the functional safety test of the battery management system is performed through the following steps: The total pressure is set to a second preset total pressure value so that the battery management system is in normal working condition. The total voltage is set to be less than the second total voltage threshold, and it is determined whether the battery management system has issued a total voltage undervoltage fault alarm within a first preset time period. If not, the test is considered to have failed and the functional safety test is stopped. If the battery management system issues a total voltage undervoltage fault alarm within the first preset time of total voltage undervoltage, then it is determined whether the battery management system sends a stop charging request within the second preset time of total voltage undervoltage. If not, the test is considered to have failed and the functional safety test is stopped. If the battery management system sends the stop charging request within the second preset time of total voltage undervoltage, then it is determined whether the battery management system disconnects the main circuit relay within the third preset time of total voltage undervoltage. If not, the test is considered to have failed and the functional safety test is stopped. If the battery management system disconnects the main circuit relay within the third preset time of total voltage undervoltage, it is determined whether the battery management system has entered a safe state within the fourth preset time of total voltage overvoltage. If not, the test is considered to have failed and the functional safety test is stopped. If so, the battery management system is considered to have passed the functional safety test.

7. A HIL simulation test platform, characterized in that, The HIL simulation test platform is used to perform the test method for the safety function of the battery management system as described in any one of claims 1-6. The HIL simulation test platform includes: The functional safety target determination module is used to determine the fault triggering conditions set by the user according to the selected functional safety target in response to the user operation; wherein, the functional safety target is any one of single cell overvoltage ASILC, single cell undervoltage ASILC, overcurrent ASILC, overtemperature ASILC, total voltage overvoltage ASILC, or total voltage undervoltage ASILC, and the fault triggering conditions include the fault triggering time corresponding to the functional safety target and the cell parameter threshold. The functional safety testing module is used to set corresponding initial parameters for the battery management system based on the fault triggering conditions corresponding to the functional safety target, so that the battery management system can simulate the operating conditions corresponding to the fault triggering conditions and determine the operating status of the battery management system under the operating conditions, thereby realizing functional safety testing of the battery management system; wherein, when the functional safety target is the single cell overvoltage ASILC, the initial parameter is the maximum value of the single cell voltage; when the functional safety target is the single cell undervoltage ASILC, the initial parameter is the minimum value of the single cell voltage; when the functional safety target is the overcurrent ASILC, the initial parameter is the current; when the functional safety target is the overtemperature ASILC, the initial parameter is the temperature; when the functional safety target is the total voltage overvoltage ASILC, the initial parameter is the total voltage; when the functional safety target is the total voltage undervoltage ASILC, the initial parameter is the total voltage. Wherein, when the functional safety target is the overvoltage ASILC of the single cell, the functional safety test module performs the functional safety test on the battery management system through the following steps: The maximum voltage of the individual battery cell is set to be less than a first preset voltage so that the battery management system is in normal working condition. Send a charging command to the battery management system to put the battery management system into a charging state, and set the maximum value of the cell voltage to be greater than or equal to the first preset voltage and less than the first voltage threshold. Determine whether the battery management system has triggered an overvoltage fault alarm within the first preset time period. If not, the test is considered to have failed, and the functional safety test is stopped. If the battery management system issues an overvoltage fault alarm within the first preset time of overvoltage, it is determined that the battery management system sent a request to stop charging within the second preset time of overvoltage. If the battery management system sends the request to stop charging within the second preset time of overvoltage, it is determined whether the battery management system has entered a safe state within the fourth preset time of overvoltage. If not, the test is considered to have failed and the functional safety test is stopped. If the battery management system does not send the request to stop charging within the second preset time of overvoltage, it is determined whether the battery management system has issued an overvoltage fault alarm within the third preset time of overvoltage. If not, the test is considered to have failed and the functional safety test is stopped. If the battery management system triggers the overvoltage fault alarm within the third preset overvoltage time, it is determined whether the battery management system disconnects the main positive and negative relays within the fifth preset overvoltage time and enters the safe state. If not, the test is considered to have failed and the functional safety test is stopped. If the battery management system enters the safe state within the fourth preset time of overvoltage, or if the battery management system disconnects the main positive and negative relays within the fifth preset time of overvoltage, then the maximum value of the single cell voltage is set to be greater than the first voltage threshold, and the request to stop charging sent by the battery management system is not responded to. It is then determined whether the battery management system has completed the overvoltage judgment within the sixth preset time of overvoltage, and whether the battery management system has disconnected the main positive and negative relays within the fifth preset time of overvoltage; wherein, the sixth preset time of overvoltage is the sum of the first preset time of overvoltage, the second preset time of overvoltage, and the third preset time of overvoltage; If the battery management system completes the overvoltage judgment within the sixth preset time of overvoltage and disconnects the main positive and main negative relays within the fifth preset time of overvoltage, then the battery management system is considered to have passed the functional safety test. If the battery management system fails to complete the overvoltage judgment within the sixth preset time period and fails to disconnect the main positive and main negative relays within the fifth preset time period, the test is considered to have failed and the functional safety test is stopped.

8. An electronic device, characterized in that, include: The device includes a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the memory via the bus. The machine-readable instructions are executed by the processor to perform the steps of the test method for the safety functions of the battery management system as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, performs the steps of the test method for the safety function of the battery management system as described in any one of claims 1 to 6.

Images