Battery thermal management safety shielding control method based on physical thermal model forward verification

Abstract

The application provides a battery thermal management safety shielding control method based on a physical thermal model forward check, which comprises the following steps: constructing a current effective cooling capacity state; reading a shrinkage according to the state and a future cycle number to form a forward safety shielding condition; converting an original cooling action into an equivalent heat exchange intensity, recursively predicting future cycle temperatures by using a physical thermal model, and comparing the temperatures with the shielding condition item by item to calculate a thermal safety remaining amount and a forward check result; if the check passes, the original action is issued; if the check does not pass, a safety action covering the gap is selected from an executable safety action sequence corresponding to the current capacity according to the thermal safety gap; if there is no such action, the maximum available action is issued and a request for reducing the battery heating load is sent. The method realizes forward safety check and autonomous protection of cooling control. The application enables the safety shielding layer to release a safe original action and replace a risky action, and simultaneously requests to reduce the battery heating load when the cooling side cannot cover the gap.

Description

Technical Field

[0001] This invention belongs to the technical field of battery thermal management, and particularly relates to a battery thermal management safety shielding control method based on forward verification of physical thermal models. Background Technology

[0002] Under conditions of fast charging, high-rate discharging, prolonged hill climbing, high-temperature environments, and rapid changes in the cooling load of battery branches, the heat generated by the cells, the heat carrying capacity of the coolant, and the response state of the cooling actuators will change simultaneously. The battery thermal management system needs to regulate the coolant circulation and the flow capacity of the battery branches through actuators such as water pumps and battery branch valves to control the maximum battery temperature and the temperature difference between the cells and the surface. In existing battery thermal management solutions, traditional rule-based control usually adjusts the action based on the current temperature, temperature difference, or preset calibration table. The cooling intensity is increased only when the battery temperature approaches the threshold. This method is convenient for engineering implementation, but it does not adequately consider the thermal inertia of the battery, the heat accumulation in the cells, and the lag in the cooling action response. It is easy to encounter situations where the current temperature is still within an acceptable range, but the future temperature or the temperature difference between the cells and the surface already has a continuous upward trend. In recent years, model predictive control, intelligent control, and reinforcement learning control have been applied to battery thermal management to balance energy consumption, comfort, and temperature control effectiveness. Upper-level intelligent controllers can output raw cooling control actions based on multi-objective strategies, but these outputs are usually nominal. Whether these nominal actions can be translated into actual heat dissipation capacity of the battery branch depends on engineering factors such as the thermal performance of the coolant inlet and outlet, the actual operating status of the water pump, and the actual opening degree of the battery branch valves. For example, during the later stages of fast charging or under high-load discharge conditions, the upper-level intelligent controller may output weaker cooling actions to reduce energy consumption. Furthermore, if the actual operating status of the water pump, the flow state of the battery branch valves, or the thermal performance of the coolant are lower than expected, even if the nominal cooling action seems sufficient, the actual cooling capacity obtained by the battery branch may be insufficient. Existing methods often directly apply upper-level actions for execution or rely solely on fixed maximum temperature thresholds and fixed core-to-surface temperature difference thresholds for safety judgment. This makes it difficult to translate the true effective capacity of the current cooling chain into a dynamic safety boundary before execution, leading to a disconnect between safety verification and actual cooling capacity. Especially when the battery thermal system has a significant lag, the original cooling action may not cause the temperature to exceed the limit in the current cycle, but in the next few control cycles, the maximum temperature or the temperature difference between the core and the surface may exceed the range that the current cooling capacity can control.

[0003] Therefore, in engineering, a safety shielding control method is needed to be set between the upper-level intelligent controller and the lower-level cooling actuator. Before the original cooling control action is issued, a forward safety shielding condition is formed based on the current effective cooling capacity of the battery branch, and the future thermal state trajectory is predicted by combining the battery physical thermal model. High-risk original cooling control actions are then allowed, shielded, or replaced from the execution layer. Summary of the Invention

[0004] The purpose of this invention is to propose a battery thermal management safety shielding control method and system based on forward verification of physical thermal models to solve the above-mentioned problems.

[0005] To achieve the above objectives, this invention provides a battery thermal management safety shielding control method based on forward verification of a physical thermal model, comprising the following steps:

[0006] S1. The battery thermal management safety shielding layer reads vehicle-side operating data directly related to battery branch heat dissipation in each control cycle and constructs the current effective cooling capacity status; the current effective cooling capacity status includes low effective cooling capacity, medium effective cooling capacity and high effective cooling capacity.

[0007] S2. Read the corresponding contraction amount according to the current effective cooling capacity status and the future control cycle number, and form a forward safety shielding condition;

[0008] S3. Obtain the original cooling control action output by the controller and convert it into the equivalent heat transfer intensity of the battery branch; combine the equivalent heat transfer intensity with the battery's highest temperature and the core-to-surface temperature difference in the current control cycle, and use the battery physical thermal model to recursively predict the battery's highest temperature and the core-to-surface temperature difference in future control cycles according to the control cycle.

[0009] Based on the battery's highest temperature and the temperature difference between the core and the surface of the battery in each future control cycle, the thermal safety margin is calculated and the forward verification result is generated by comparing it with the forward safety shielding conditions cycle by cycle and item by item.

[0010] S4. If the forward verification result is passed, the original cooling control action is sent to the actuator as the final cooling action; if the forward verification result is failed, the thermal safety gap is determined according to the thermal safety margin, and a safe cooling action with a recovery margin that can cover the thermal safety gap is selected from the executable safe cooling action sequence corresponding to the current effective cooling capacity state as the final cooling action.

[0011] If no effective cooling action can cover the thermal safety gap, the maximum available cooling action will be issued as the final cooling action, and a request to reduce the battery heat load will be sent.

[0012] Furthermore, the vehicle-side operating data includes the battery's maximum temperature, the temperature difference between the core and the surface, the coolant inlet temperature, the coolant outlet temperature, the actual water pump speed, and the actual opening degree of the battery branch valves.

[0013] Furthermore, the effective cooling capacity state is determined based on the coolant heat carrying capacity level corresponding to the coolant temperature difference generated by the coolant inlet temperature and coolant outlet temperature, the water pump delivery level corresponding to the actual speed of the water pump, and the valve channel level corresponding to the actual opening degree of the battery branch valve, and the lowest of the three is taken as the current effective cooling capacity state.

[0014] Furthermore, S2 specifically refers to:

[0015] Based on the current effective cooling capacity status and the future control cycle number, query the maximum temperature safe contraction table and the core surface temperature difference safe contraction table to obtain the maximum temperature safe contraction amount and the core surface temperature difference safe contraction amount corresponding to each future control cycle.

[0016] The maximum temperature usable boundary is obtained by subtracting the maximum temperature safe shrinkage amount from the inherent safety upper limit of the battery's maximum temperature, and the core surface temperature difference usable boundary is obtained by subtracting the core surface temperature difference safe shrinkage amount from the inherent safety upper limit of the core surface temperature difference, thus generating a forward safety shielding condition.

[0017] Furthermore, the maximum temperature safety shrinkage and the core-surface temperature difference safety shrinkage are determined during the calibration phase:

[0018] Under different effective cooling conditions, the battery pack was subjected to fast charging, high-rate discharge, or thermal recovery conditions after continuous hill climbing. The changing trends of the battery's highest temperature and the temperature difference between the core and the surface under safe cooling action were recorded over multiple future control cycles. Based on the advance reserve required when the thermal state approaches the inherent safety limit, a shrinkage table was formed that changes with the future control cycle number.

[0019] Furthermore, the original cooling control action output by the controller is converted into the equivalent heat transfer intensity of the battery branch, specifically as follows:

[0020] The process is accomplished by a pre-calibrated action heat exchanger in the thermal management controller. The action heat exchanger is established by a battery pack thermal bench test. During the test, different combinations of water pump speeds and different battery branch valve openings are applied to record the changes in the battery's maximum temperature, core-surface temperature difference, and coolant inlet temperature. Each action combination is then mapped to an equivalent heat exchange intensity.

[0021] Furthermore, the recursive prediction of the battery physical thermal model is based on the energy balance relationship of the equivalent thermal network. Taking the battery's highest temperature and the core-to-surface temperature difference in the current control cycle as the initial state, the model adds the temperature rise caused by the battery's equivalent heat generation, the heat transfer cooling determined by the difference between the equivalent heat transfer intensity and the current temperature relative to the coolant inlet temperature, and the thermal inertia term that continues the temperature rise trend of the previous cycle, to obtain the predicted highest temperature and predicted core-to-surface temperature difference for each future control cycle. The thermal inertia term is used to enable the model to express the engineering phenomenon that the battery temperature continues along the original trend for a short time when the cooling action just changes.

[0022] Furthermore, the calculation method for the thermal safety margin is as follows:

[0023] For each future control cycle, calculate the difference between the available maximum temperature boundary and the predicted maximum temperature, and the difference between the available core surface temperature difference boundary and the predicted core surface temperature difference. Take the minimum value among all differences as the thermal safety margin.

[0024] The forward verification result is passed when the thermal safety margin is greater than or equal to zero, and it fails when it is less than zero.

[0025] Furthermore, the executable safety cooling action sequence is arranged from weakest to strongest cooling intensity, and each safety cooling action is a combination of the target pump speed and the target opening degree of the battery branch valve; under the current effective cooling capacity state, the corresponding safety cooling action is substituted into the battery physical thermal model to calculate the minimum safety margin that can be increased relative to the forward safety shielding condition within the forward window. This recovery margin and the thermal safety gap form a coverage relationship under the same forward safety shielding condition.

[0026] Furthermore, the step of selecting a safe cooling action from the sequence of executable safe cooling actions corresponding to the current effective cooling capacity state, where the recovery margin can cover the thermal safety gap, as the final cooling action and issuing it, specifically involves:

[0027] The recovery margin and thermal safety gap of each safe cooling action are compared in order of increasing cooling intensity. The first safe cooling action with a recovery margin not less than the thermal safety gap is selected as the final cooling action to maintain low cooling energy consumption while meeting thermal safety constraints.

[0028] The beneficial technical effects of the present invention are at least as follows:

[0029] The main improvement of this invention lies in establishing the pre-execution safety judgment in battery thermal management based on the current effective cooling capacity state, and completing the forward safety shielding of the original cooling control action of the upper-level intelligent controller through a physical thermal model. Specifically, the safety shielding layer first uses the battery's highest temperature, the temperature difference between the core and the surface, the coolant inlet state, the coolant outlet state, the actual operating state of the water pump, and the actual opening degree of the battery branch valves to determine the effective cooling capacity state that the current battery cooling link can form, thus shifting the basis of safety verification from nominal cooling action to the actual heat dissipation capacity of the battery branch. Subsequently, the safety shielding layer invokes the corresponding safety contraction boundary according to the effective cooling capacity state, transforming the battery's inherent maximum temperature limit and the core-surface temperature difference limit into forward safety shielding conditions for several future control cycles, so that the safety boundary tightens in advance when the cooling capacity is weak, and expands according to the calibrated boundary when the cooling capacity is strong. After the upper-level intelligent controller outputs the original cooling control action, the safety shield layer converts this action into heat transfer input in the physical thermal model. Based on the equivalent thermal network, it predicts the future maximum battery temperature trajectory and the core-to-surface temperature difference trajectory. Then, it compares the predicted trajectory with the forward safety shielding conditions cycle by cycle to form the forward verification result and the remaining thermal safety margin. When the original cooling control action meets the forward safety shielding conditions, the safety shield layer sends it down to the water pump and battery branch valves for execution. When the original cooling control action triggers safety shielding, the safety shield layer selects a safe cooling action that can cover the gap from the currently executable safe cooling action sequence based on the thermal safety gap and the current effective cooling capacity status, and sends it down. When the safe cooling action sequence cannot cover the thermal safety gap, the safety shield layer sends down the maximum available cooling action and simultaneously requests a reduction in battery heat load. Therefore, this invention continuously transmits the effective cooling capacity formed by the heat performance of the coolant, the actual operating state of the water pump, and the state of the battery branch valve channel to the safety boundary generation, forward verification of the physical thermal model, and final action issuance process. This ensures that the energy consumption optimization actions of the upper-level intelligent controller are always constrained by the battery thermal safety boundary, thereby solving the problems of inconsistency between nominal cooling actions and actual cooling capacity, insufficient foresight of fixed threshold verification, and lack of execution layer hard safety shielding for high-risk intelligent control actions.

[0030] The aforementioned safety shielding layer is positioned between the upper-level intelligent controller and the water pump controller and battery branch valve controller. It does not alter the training method or optimization objective of the upper-level intelligent controller, nor does it rely on the upper-level intelligent controller to interpret its internal decision-making process. Instead, it only receives the raw cooling control actions output by the upper-level intelligent controller. A deterministic forward verification of the physical thermal model is performed before the action is issued. Unless otherwise specified, temperature, temperature difference, temperature safety shrinkage, and thermal safety margin are expressed in degrees Celsius or equivalent degrees Celsius, the actual pump speed is expressed in revolutions per minute, the actual valve opening is expressed as a percentage or dimensionless opening, and the number of control cycles and action numbers are dimensionless. The grade table, safety shrinkage table, action heat exchange table, recovery margin table, number of forward verification cycles, and minimum protection actions are all written in during the battery pack bench test, vehicle calibration, or thermal management controller calibration stages, and are not temporarily generated by the upper-level intelligent controller during operation. Attached Figure Description

[0031] The present invention will be further described with reference to the accompanying drawings, but the embodiments in the drawings do not constitute any limitation on the present invention. For those skilled in the art, other drawings can be obtained based on the following drawings without creative effort.

[0032] Figure 1 This is a schematic diagram of the steps and structure of the battery thermal management safety shielding control method based on forward verification of a physical thermal model according to the present invention.

[0033] Figure 2 This is a schematic diagram of the highest battery temperature and the temperature difference between the core and the surface corresponding to the safety shielding layer in an embodiment of the present invention. Detailed Implementation

[0034] Embodiments of the present invention are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention.

[0035] In one or more embodiments, such as Figure 1 As shown, a battery thermal management safety shielding control method based on forward verification of a physical thermal model is disclosed. The method includes the following steps:

[0036] S1. The battery thermal management safety shielding layer reads vehicle-side operating data directly related to battery branch heat dissipation in each control cycle and constructs the current effective cooling capacity status; the current effective cooling capacity status includes low effective cooling capacity, medium effective cooling capacity and high effective cooling capacity.

[0037] Specifically, the battery thermal management safety shielding layer reads vehicle-side operating data directly related to battery branch heat dissipation during each control cycle, including the battery's maximum temperature. Core temperature difference Coolant inlet temperature Coolant outlet temperature Actual pump speed Actual opening degree of battery branch valve .in, The temperature is generated by the battery management system based on the temperature collection points inside the battery pack, and the highest temperature value participating in thermal management control within the current control cycle is taken. The cell surface temperature difference estimation module in the battery management system is formed based on the cell thermal model and surface temperature acquisition values, and is used to represent the degree of heat accumulation inside the cell relative to the surface. The temperature is collected by a coolant temperature sensor located at the inlet of the battery cooling branch, which is used to indicate the state of the coolant before it enters the battery heat exchange area; The temperature is collected by a coolant temperature sensor located at the outlet of the battery cooling branch, which is used to indicate the state of the coolant after it flows through the battery heat exchange area; The coolant circulation status is reported by the water pump controller during the current control cycle. The battery branch valve controller reports the current control cycle's status, indicating the channel status of coolant entering the battery branch. The safety shield first... and Determine if the current battery has entered the preset thermal concern zone; if both are in a normal thermal state, determine the current effective cooling capacity status. Set to the standard effective cooling capacity level corresponding to the subsequent safety shrinkage table, preferably the medium effective cooling capacity state; when or When entering the preset heat-concerned zone, the current effective cooling capacity status is determined based on the coolant's heat-carrying performance, the water pump's delivery status, and the valve channel status.

[0038] After reading the above data, the security shield first performs timestamp and validity checks. If , , , , or If any data exceeds the allowed holding time of the current control cycle, or if the sensor diagnostic flag is invalid, that data will not be used as the current valid value in the high-level cooling capacity determination; for data directly related to safety boundaries, such as maximum temperature, core-surface temperature difference, and coolant temperature, the safety shield layer will use the conservative value of the previous valid cycle or enter a low effective cooling capacity state; if the actual pump speed or valve opening is missing, the safety shield layer will set the corresponding level table output to a low level. If a negative value or abnormal abrupt change occurs that is significantly inconsistent with the current battery heating condition, the safety shielding layer will not interpret it as a high heat carrying capacity. Instead, it will be recorded as a coolant heat carrying anomaly and treated as a low heat carrying capacity. determination.

[0039] In some embodiments, after entering the cooling capacity determination, the safety shielding layer first determines based on... and The difference can be queried from the pre-calibrated coolant heat rating table. The heat transfer grade of the coolant is obtained; then according to... Query the pre-calibrated water pump delivery rating table To obtain the pump delivery rating; and based on Query the pre-defined valve channel class table The valve channel level is obtained. , and All of these were formed during the bench testing or vehicle calibration phase, among which The battery is classified into levels based on the correlation between the temperature change of the coolant before and after flowing through the battery branch and the battery temperature rise suppression effect. The pumps are classified according to the correspondence between their actual operating status and the circulation capacity of the battery branch. The battery branch valves are classified into levels based on the correspondence between their actual opening and the current carrying capacity of the battery branch. The three level tables output the same ordered level numbering system, with the level numbers arranged from weakest to strongest: low effective cooling capacity, medium effective cooling capacity, and high effective cooling capacity. This ensures that the lowest effective cooling capacity represents the component in the cooling chain that limits battery heat dissipation. The safety shielding layer determines the current effective cooling capacity status according to the cooling chain constraints.

[0040] ;

[0041] in, This represents the current effective cooling capacity status, and is the discrete state output in this step; This indicates the temperature data output by the temperature sensor on the outlet side of the battery cooling branch during the current control cycle. This indicates the temperature data output by the temperature sensor at the inlet side of the battery cooling branch during the current control cycle. This indicates the actual operating data reported by the pump controller during the current control cycle; This indicates the actual opening data reported by the battery branch valve controller in the current control cycle; The table indicates the heat rating of the coolant, by The level is determined by the calibration interval it is in; The water pump delivery rating table is represented by... The level is determined by the calibration interval it is in; The valve channel level table is represented by... The rating is determined by the calibration range. During fast charging or high-load discharging, if the actual water pump speed is at a high rating and the actual opening of the battery branch valve is at a high rating, but the change between the coolant outlet and inlet falls into a low heating rating, then... Take the lowest effective cooling capacity setting; if the coolant heating grade and water pump delivery grade are high, but the actual opening degree of the battery branch valve is at a low level, then The valve channel level is still used to determine the current effective cooling capacity. This approach ensures that the current effective cooling capacity is determined by the component in the cooling chain that actually limits battery heat dissipation.

[0042] Understandably, in terms of dimensions, This refers to the coolant temperature difference, expressed in degrees Celsius. For rotational speed, For valve opening, the three factors are converted into the same set of discrete level numbers through their respective level tables before the lower value operation is performed. Therefore, there is no issue of directly adding or weighting temperature, speed and opening. , and The grade boundary is determined by the calibration data of the same vehicle model or the same battery thermal management system, and corresponds to the version number of the safety shrinkage table in step two, so that... Use the same calibration caliber as subsequent safety boundaries. If the coolant inlet temperature... It has entered the high inlet temperature range calibrated by the thermal management controller, even It has a high heat transfer rating, and the safety shielding layer will also The output is limited to a medium or low level, with the specific limit level determined by the inlet temperature degradation table; this inlet temperature degradation table is consistent with... Formed during the same calibration phase, this system is designed to avoid misjudging the battery branch's strong and effective cooling capacity under high inlet temperature conditions.

[0043] This step outputs the current effective cooling capacity status. It can be calibrated as low effective cooling capacity, medium effective cooling capacity, and high effective cooling capacity, or divided into more discrete levels according to the calibration requirements of the vehicle's thermal management system. It is updated according to changes in the current battery thermal state, coolant thermal performance, water pump actual operating status, and battery branch valve actual channel status.

[0044] S2. Read the corresponding contraction amount according to the current effective cooling capacity status and the future control cycle number, and form a forward safety shielding condition.

[0045] Specifically, the initial basis for this step is derived from the boundary constraint concept commonly used in battery thermal safety control, namely, the predicted thermal state should be within the inherent safety upper limit of the battery; this application introduces a method based on this constraint... The determined boundary contraction amount causes the inherent safety upper limit to form different forward usable boundaries under different cooling capacity states. Specifically, the battery's inherent maximum temperature upper limit and the cell-to-surface temperature difference upper limit are given by the battery pack thermal safety calibration, representing the basic boundaries allowed by battery materials, structure, and system safety strategies; the safety contraction amount is obtained during bench testing or vehicle calibration, used to represent the safety margin that needs to be reserved in advance when the current cooling capacity is insufficient. This is how... It inherits the engineering source of the battery thermal safety boundary and enables the actual cooling link capability obtained in step one to enter the forward verification process of the subsequent original cooling control action.

[0046] In some embodiments, the security shield is read during the current control cycle. Subsequently, the maximum temperature safety contraction sequence and the core-surface temperature difference safety contraction sequence corresponding to this state are retrieved from the thermal management controller. The safety contraction sequence is formed during the calibration phase: under low, medium, and high effective cooling capacity states, the battery pack is subjected to fast charging, high-rate discharging, and thermal recovery conditions after continuous ramping, respectively. The changing trends of the battery's maximum temperature and core-surface temperature difference under safe cooling actions are recorded over multiple future control cycles. Based on the advance reservation required when the thermal state approaches the inherent safety upper limit, a contraction table that changes with the future control cycle number is formed. During operation, the safety shielding layer only considers the current effective cooling capacity state. The corresponding contraction amount is read from the future control cycle number, and the following forward safety shielding conditions are formed:

[0047] ;

[0048] in, This indicates the forward safety shielding conditions output in this step; This indicates that the prediction obtained from the battery physical thermal model in the subsequent third step... The highest battery temperature in a future control cycle; This indicates that the prediction obtained from the battery physical-thermal model in the subsequent third step... The core temperature difference of a future control cycle; Indicates the current effective cooling capacity status. Next, the The maximum safe shrinkage amount corresponding to each future control cycle is read from the maximum safe shrinkage table. Indicates the current effective cooling capacity status. Next, the The core temperature difference safety shrinkage amount corresponding to each future control cycle is read from the core temperature difference safety shrinkage meter. This indicates the inherent safe upper limit of the battery's maximum temperature, which is given by the battery pack thermal safety calibration. This indicates the inherent safe upper limit of the temperature difference between the core and the surface, which is given by the battery pack thermal safety calibration. This indicates the number of future control cycles covered by the forward check, configured by the thermal management controller. The above constraints are in basic boundary form. Based on this deduction, this application rewrites it as follows: This is equivalent to tightening the subsequent available boundary to The deduction maintains the comparison relationship between the left and right sides for the same type of thermal state quantities. The highest temperature term is only compared with the highest temperature boundary, the core-surface temperature difference term is only compared with the core-surface temperature difference boundary, and the safe shrinkage amount has the same physical properties as the corresponding thermal state.

[0049] Current verification cycle When changes occur, the security shield reads the current... The corresponding shrinkage sequence; if the calibration table only covers a shorter period, the excess portion is based on the shrinkage amount of the last calibrated period or a more conservative shrinkage amount. The maximum temperature safety shrinkage amount only applies to the maximum temperature prediction term, and the core-surface temperature difference safety shrinkage amount only applies to the core-surface temperature difference prediction term. The two are not normalized and weighted, nor are they combined into a single comprehensive temperature fraction, thus avoiding the mixing of boundaries between different thermal safety meanings.

[0050] In some embodiments, in a set of fast charging mid-to-late stage calibration data, step one outputs Forward verification cycle number in low effective cooling capacity state Configured as Battery's inherent safety limit for maximum temperature Pick The inherent safe upper limit of temperature difference between the core and the watch. Pick The thermal management controller queries the safety contraction table under low effective cooling capacity conditions to obtain... , , They are respectively , , , , , They are respectively , , Therefore, in the first , No. , No. Within the future control cycle, the predictions obtained in step three are as follows: Each needs to not exceed , , The predicted Each needs to not exceed , , If the same vehicle outputs step one under stable cooling conditions... For a high-efficiency cooling capacity, the safety shrinkage gauge can provide a smaller shrinkage amount, for example... , , They are respectively , , The corresponding usable boundaries for the highest future temperatures are as follows: , , The above calculations result in different forward availability boundaries for the same inherent safety upper limit under different cooling capacity states. The subsequent step three simply requires substituting the predicted trajectory into... This will give you a result indicating whether the original cooling control action meets the safety shielding conditions.

[0051] This step outputs the forward safety shield condition. This condition includes the future. The predicted trajectory of the battery's highest temperature and the predicted trajectory of the core-surface temperature difference within each control cycle need to meet the contraction boundary, and the contraction amount is determined by the output of step one. Direct decision. It varies depending on the current effective cooling capacity.

[0052] S3. Obtain the original cooling control action output by the controller and convert it into the equivalent heat transfer intensity of the battery branch; combine the equivalent heat transfer intensity with the battery's highest temperature and the core-to-surface temperature difference in the current control cycle, and use the battery physical thermal model to recursively predict the battery's highest temperature and the core-to-surface temperature difference in future control cycles according to the control cycle.

[0053] Based on the battery's highest temperature and the temperature difference between the core and the surface in each future control cycle, the thermal safety margin is calculated and forward verification results are generated by comparing the forward safety shielding conditions cycle by cycle and item by item.

[0054] Specifically, obtain forward security shielding conditions And use it for the original cooling control actions output by the upper-level AI intelligent controller. Pre-execution verification. It already includes the current effective cooling capacity status. Determined maximum temperature safe shrinkage Core and watch temperature difference safety shrinkage amount The inherent safety limit of the battery's maximum temperature. Inherent safety limit for temperature difference between the core and the watch. and the number of forward check coverage cycles The security shield is read during the current control cycle. Then, it simultaneously reads the data provided by the upper-level AI intelligent controller. and will Equivalent heat transfer intensity converted to battery branch This conversion is accomplished through a pre-calibrated action heat transfer table within the thermal management controller. This table was established through battery pack thermal bench testing, in which different combinations of water pump speeds and battery branch valve openings were applied, recording the changes in the battery's maximum temperature, the temperature difference between the core and the surface, and the coolant inlet temperature. Each action combination was then mapped to an equivalent heat transfer intensity. In this way, the original actions provided by the upper-level AI intelligent controller have been converted into heat transfer inputs usable by the physical thermal model before entering forward validation.

[0055] Understandably, the forward prediction formula in this step originates from the energy balance relationship of the equivalent thermal network. The battery pack is represented as internal cell thermal nodes, cell surface thermal nodes, and coolant heat transfer boundaries. Cell heating causes the maximum temperature and cell-to-surface temperature difference to rise, while coolant heat transfer causes the maximum temperature and cell-to-surface temperature difference to fall. Battery thermal inertia causes the current temperature rise trend to continue for a short period. After discretizing this energy balance relationship according to the control cycle, a recursive prediction relationship for the battery's maximum temperature and cell-to-surface temperature difference is obtained. This application adds a thermal inertia retention term to the recursive relationship, enabling the model to express the engineering phenomenon that the battery temperature continues along its original trend for a short period when the cooling action has just changed. During recursive initialization, Take the predicted maximum battery temperature during the current control cycle. , Take the predicted core temperature difference value of the current control cycle. In the first recursive period, Take the highest battery temperature provided by the battery management system in the previous control cycle. Take the core temperature difference from the previous control cycle. The safety shielding layer predicts the future thermal trajectory using the following formula:

[0056] ;

[0057] in, Indicates the first Predicted maximum battery temperature for one future control cycle; Indicates the first Predicted core temperature difference for each future control cycle; Indicates the first The battery equivalent heat generation for each future control cycle is calculated by the battery management system based on the battery current, internal resistance calibration table and charge / discharge state, and expanded in the forward window in conjunction with the upper-level power request sequence. In the implementation that only provides the power request for the current control cycle, the forward window is maintained at the current equivalent heat generation. Indicates the original cooling control action The corresponding equivalent heat transfer intensity can be obtained from the action heat transfer table; This indicates the inlet temperature of the battery cooling branch, using the current sampled value of the inlet temperature sensor from step one; This represents the coefficient indicating the influence of the battery's equivalent heat generation on the increase in maximum temperature. This represents the coefficient indicating the influence of equivalent heat transfer intensity on the decrease in maximum temperature. This represents the coefficient indicating the influence of the battery's equivalent heat generation on the increase in the temperature difference between the core and the surface. This represents the coefficient indicating the influence of equivalent heat transfer intensity on the recovery of the core-surface temperature difference. This represents the coefficient of thermal inertia retention. , , , and All parameters were calibrated through battery pack hot bench tests under different heating intensities, cooling actions, and action switching conditions. The heating term, heat transfer term, and thermal inertia retention term are all expressed as increments or decrements of the corresponding thermal state in the recursive calculations. In this formula, the heating term is used to deduce the impact of increased internal battery heat on temperature and the temperature difference between the core and surface; the heat transfer term is used to deduce the suppressive effect of the current original cooling control action on the thermal state; and the thermal inertia retention term is used to deduce the continuation effect of the temperature rise trend from the previous cycle on the next cycle.

[0058] Understandably, the coefficients in the above recursive formula are all calibrated after discretization based on the controller's sampling period. Specifically, and This represents the maximum temperature increment and the core-surface temperature difference increment caused by the equivalent heat generation of the battery within a control cycle, in degrees Celsius. It represents the maximum temperature drop caused by heat exchange within a control cycle, expressed in degrees Celsius. This represents the amount of core-surface temperature difference recovery caused by heat exchange within one control cycle, expressed in degrees Celsius. This is a dimensionless thermal inertia retention coefficient, the value of which is determined by experimental fitting. If the upper-level intelligent controller outputs a future action sequence, the safety shield layer queries the sequence according to the future period. If the upper-level intelligent controller only outputs the action of the current cycle, then the corresponding action will be retained within the forward window. This step will be repeated in the next control cycle.

[0059] Predicted and Then, the safety shielding layer substitutes the predicted trajectory into the result obtained in step two. To facilitate direct release or shielding in step four, this step converts the maximum temperature constraint and core-to-surface temperature difference constraint into thermal safety margin. And by thermal safety surplus Obtain the forward verification result :

[0060] ;

[0061] ;

[0062] in, The remaining thermal safety margin is determined by the minimum of the highest temperature remaining boundary and the core-surface temperature difference remaining boundary in each future control cycle. This indicates the result of the forward validation. Indicates the original cooling control action Meets the requirements for forward safety shielding. express Triggering security shielding; This indicates the inherent safe upper limit of the battery's maximum temperature in step two; This indicates the inherent safe upper limit of the core-meter temperature difference in step two; This indicates the current effective cooling capacity status in step two. and future control cycle number The maximum safe shrinkage amount at the specified temperature; In step two, the... and The core watch temperature difference safety shrinkage amount obtained from the query; This represents the number of forward verification coverage cycles in step two. This formula is derived from the constraint form in step two: Rewritten as ,Will Rewritten as Then, take the minimum residual among all future control cycles and the two types of thermal safety constraints as... .when When the value is non-negative, the predicted trajectory satisfies the following conditions throughout the entire forward window. ;when When the value is negative, at least one future control cycle in the predicted trajectory crosses the contraction boundary formed in step two.

[0063] Understandable. Instead of a weighted average of the maximum temperature risk and the core-to-surface temperature difference risk, the minimum value of all individual remaining boundaries is used to represent the constraint margin that first triggers the safety shield condition. Since both the maximum temperature margin and the core-to-surface temperature difference margin are expressed as a difference in degrees Celsius, the minimum value is only used to identify the tightest constraint and the gap size; step four still retains the constraint type that triggers this minimum value so as to distinguish between the maximum temperature risk and the core-to-surface temperature difference risk in the operation record.

[0064] In some embodiments, during the later stages of continuous fast charging, the output of step two is... The available maximum temperature boundaries for the next three control cycles are given as follows: , , The available boundaries for core temperature difference are respectively , , The upper-level AI intelligent controller outputs energy-efficient power. Then, the action heat exchanger gives... In the lower range, the safety shielding layer is calculated according to the above recursive relationship. , , They are respectively , , , , , They are respectively , , When substituting into the thermal safety margin calculation, the highest temperature margin for the first future control cycle is: The remaining temperature difference of the core is The maximum temperature remaining for the second future control cycle is The remaining temperature difference of the core is The maximum temperature remaining for the third future control cycle is The remaining temperature difference of the core is The minimum value among all remaining quantities is ,therefore Negative value Pick Step four involves intercepting the original cooling control action based on this. If under the same operating conditions... To accommodate more robust battery branch cooling, the heat exchanger provides the following information: If the predicted trajectories obtained through recursion are all below the corresponding available boundaries, then... For non-negative values, Pick Step four involves sending the original cooling control action down for execution.

[0065] This step outputs the forward verification result. and thermal safety margin . Proceed directly to step four, which determines whether the original cooling control action should be issued and executed. Step four is used to differentiate the strength of the current boundary violation risk and determine the intensity of the safety cooling action. Through this step, the forward safety shielding conditions established in step two are finalized. The raw cooling control actions are specifically applied to the output of the upper-level AI intelligent controller. The above forms the physical thermal model verification results before the actuator is issued.

[0066] S4. If the forward verification result is passed, the original cooling control action is sent to the actuator as the final cooling action; if the forward verification result is failed, the thermal safety gap is determined according to the thermal safety margin, and a safe cooling action with a recovery margin that can cover the thermal safety gap is selected from the executable safe cooling action sequence corresponding to the current effective cooling capacity state as the final cooling action.

[0067] If no effective cooling action can cover the thermal safety gap, the maximum available cooling action will be issued as the final cooling action, and a request to reduce the battery heat load will be sent.

[0068] Specifically, step four receives the forward verification result output from step three. and thermal safety margin And convert the two into the final cooling action that the actuator can perform. . Indicates the original cooling control action Whether the forward security check passes This indicates the future predicted trajectory relative to the forward safety shielding condition. The minimum thermal safety margin. The safety shield is read during the current control cycle. and Then, simultaneously read the current effective cooling capacity status obtained in step one. and call from the thermal management controller with The corresponding currently executable safe cooling action sequence The sequence is arranged from weakest to strongest cooling intensity. Each action is a combination of the target water pump setting and the target opening degree of the battery branch valve, and is called from the preset safety action library by the thermal management controller based on the current allowable water pump setting, the allowable opening degree of the battery branch valve, and the vehicle's thermal management calibration boundaries. The safety shielding layer simultaneously reads and... Corresponding recovery margin table ,in Indicates the current effective cooling capacity status. Next, the Each safe cooling action represents a thermal safety gap that can be compensated for in the current cycle. The initial source is the concept of minimum satisfiable action selection in discrete safety control. The calibration process adopts the battery physical-thermal model in step three and the forward safety shielding condition in step two: during the bench or vehicle calibration stage, different Each safe cooling action under the level Substitute each element into the battery physical-thermal model and calculate its relative temperature within the forward window. The minimum safety margin that can be increased is determined, and this result is recorded in the corresponding recovery margin table. Therefore, and A gap coverage relationship is formed under the same forward security shielding conditions.

[0069] Current verification result for At that time, step three has already yielded the thermal safety margin. This explains the original cooling control action. The predicted trajectory in the future The forward safety shielding condition is met within each control cycle. The safety shielding layer will As the final cooling action The data is then sent to the water pump controller and the battery branch valve controller.

[0070] Current verification result for At that time, step three has already been obtained. The safety shielding layer will As a current thermal security gap, and in The first safe cooling action with a recovery margin not less than the gap is selected in order of cooling intensity from weakest to strongest. This selection formula is derived from the minimum satisfaction principle on the discrete ordered action set: first use... This indicates the boundary gap that needs compensation, and then the first action that satisfies this requirement is found in the set of executable actions corresponding to the current effective cooling capacity state. The action number is used to transform the continuous risk quantity in step three into an executable discrete action selection result.

[0071] ;

[0072] in, Indicates the selected safety cooling action sequence number; Indicates the action number in the safety cooling action sequence; Indicates the current effective cooling capacity status. Next The recovery margin corresponding to each safe cooling action is read from the recovery margin table, which is formed during the bench or vehicle calibration stage by the battery physical thermal model in step three and the forward safety shielding conditions in step two. This indicates the remaining thermal safety output from step three. express The Middle A safe cooling action, specifically a combination of the target speed of the water pump and the target opening degree of the battery branch valve; Indicates the current effective cooling capacity status. The current executable safe cooling action sequence is used. If multiple actions meet the conditions, the action with the lowest cooling intensity that can cover the gap is selected; if no safe cooling action number that meets the conditions can be found in the current executable safe cooling action sequence... Then it enters the maximum available cooling action branch.

[0073] In some embodiments, the safety shielding layer is based on thermal safety margin. and the selected safe cooling action sequence number Forming the final cooling action And under the maximum available cooling action branch, a request to reduce battery heat load is generated. :

[0074] ;

[0075] in, This indicates the final cooling action output and actually issued in this step; This indicates a request to reduce the battery's heat load. This indicates that a request to reduce battery heat load will not be sent. This indicates that a request to reduce the battery heat load is being sent to the vehicle controller. This indicates the original cooling control action output by the upper-level AI intelligent controller in the current control cycle; This represents the forward verification result output in step three; This indicates the safe cooling action determined by the previous formula; This indicates the pre-calibrated maximum available cooling action, specifically the combination of the highest water pump speed and the maximum battery branch valve opening allowed by the current thermal management system. The formula consists of three processing branches with execution layer safety shielding: if the verification passes, the original action is allowed; if the verification fails but a safety action that can cover the gap is found, the corresponding safety action is issued; if the verification fails and the backup branch is triggered, the maximum available cooling action is issued and a request to reduce battery heat load is sent. At this time, the vehicle controller executes a protection strategy that reduces the charging rate or limits the discharge power, so that the final treatment acts on both the cooling side and the battery heating side.

[0076] In some embodiments, under a set of continuous fast charging conditions, step three yields... , Step 1 yields The current thermal safety gap is due to a low effective cooling capacity. The safety shield reads the currently executable safety cooling action sequence under low effective cooling capacity conditions. ,in For water pumps at low to medium speeds and valves at medium openings, restore margin. ; For medium-speed water pumps and larger valve openings, restore margin. ; To accommodate high-speed water pumps and large valve openings, restore margin. .because and All less than , Not less than ,therefore The safety shielding layer will As The command was sent to the water pump controller and the battery branch valve controller, and ordered... If step three yields... The safety shielding layer directly As Issued and ordered If under the same fast charging condition However, under conditions of low effective cooling capacity, the maximum recovery margin in the current sequence of safe cooling actions is still [missing information]. The safety shielding layer will As Issued and ordered The vehicle controller reduces the battery's heat load.

[0077] This step outputs the final cooling action. And when the minimum protection branch is triggered, a request to reduce the battery heat load will be output simultaneously. . Output from step three and and the result obtained in step one The decision is jointly determined and then issued by the safety shielding layer to the water pump controller and battery branch valve controller for execution. Through this process, the forward verification result formed in step three is implemented as actuator action, completing the release, shielding, or replacement of the original cooling control action of the upper-level AI intelligent controller.

[0078] In one complete embodiment, the battery is in the later stage of continuous fast charging, and step one is based on... , and After querying the corresponding level table, we can obtain... The state is characterized by low effective cooling capacity; step two is in , , Under the condition of low effective cooling capacity, the safety contraction table is read to obtain the maximum temperature available boundary for the next three cycles. , , and the usable boundary of core temperature difference , , Step 3: The energy-saving output from the upper-level intelligent controller... This is converted to a lower equivalent heat transfer intensity, and the predicted value is obtained. , , They are respectively , , , , , They are respectively , , Thus we obtain , Step four reads the safety action sequence under low effective cooling capacity conditions, because... Able to cover Thermal safety gaps, selection As and keep In this embodiment, Entering the security boundary generation, Entering the forward validation of the physical thermal model, and When entering the final action selection, the variables before and after have a clear source and destination.

[0079] Furthermore, in the above embodiment, the safety shielding layer records the forward calculation results for the next three control cycles. As shown in Table 1, under the original operation, the highest temperature exceeds the current available boundary in the second and third cycles, respectively. and The core temperature difference exceeded the current usable boundary in the second and third cycles, respectively. and Therefore, the minimum thermal safety margin is And trigger shielding. After safety shielding, the selected third safety cooling action adjusts the maximum temperature prediction trajectory to... , and The core temperature difference prediction trajectory has been adjusted to , and The minimum thermal safety margin for the next three control cycles will be determined by... Increase to The results indicate that the safety shielding layer does not simply increase cooling intensity, but rather selects the minimum feasible action to cover the forward safety gap based on the forward safety gap; the third action is sufficient to cover the gap. When the gap is filled, higher intensity actions are no longer selected, thus balancing thermal safety and cooling energy consumption.

[0080] Table 1

[0081]

[0082] Depend on Figure 2 As can be seen, the original action begins to approach and cross the safety contraction boundary in the second future cycle, resulting in a more obvious maximum temperature exceedance and core-surface temperature difference exceedance in the third cycle; the shielded trajectory remains within the corresponding safety contraction boundary in all three prediction cycles, and does not directly push the cooling action to its maximum intensity. This embodiment can correspondingly explain how the boundary generated in step two enters the forward verification in step three, how the safety gap obtained in step three enters the action selection in step four, and the output of step four. How to change the subsequent observable thermal state.

[0083] This method can be executed by a safety shielding module installed in a thermal management controller, battery management system, or domain controller. This module may include a data access unit, an effective cooling capacity determination unit, a safety contraction boundary generation unit, an action heat transfer conversion unit, a physical thermal model forward prediction unit, a safety action selection unit, and an execution dispatch unit. The data access unit is used to read data from the battery management system, water pump controller, valve controller, and coolant temperature sensor; the effective cooling capacity determination unit is used to generate... The safety shrinkage boundary generation unit is used to form The action heat exchange conversion unit is used to convert... Convert to The forward prediction unit of the physical thermal model is used to generate... , , and The safety action selection unit is used to generate... and The execution dispatch unit is used to send action or power limiting requests to the water pump controller, battery branch valve controller, and vehicle controller. These units can be implemented by the processor calling program instructions from memory and communicate with the battery management system and thermal management actuators via the vehicle bus.

[0084] Through the above processing, the present invention has at least the following technical effects: First, it converts the cooling fluid heat-carrying performance, the actual operating state of the water pump, and the actual valve opening degree into... First, it bases the security boundary on the actual current cooling link capabilities rather than nominal actions; second, it uses... First, the future safety boundary is narrowed to proactively shield high-risk energy-saving actions when cooling capacity is insufficient. Second, the maximum temperature and core-to-surface temperature difference are predicted forward using a physical thermal model, enabling actions that are not currently exceeding limits but may exceed them in the future to be identified before execution. Third, thermal safety gaps and sequences of executable safety actions are selected. This allows the safety shielding layer to both allow safe, original actions and replace risky actions, while simultaneously requesting a reduction in battery heat load when the gap cannot be covered on the cooling side.

[0085] This invention can be a method, apparatus, system, and / or computer program product. The computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for performing various aspects of the invention.

[0086] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0087] Although embodiments of the invention have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and variations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the claims and their equivalents.

[0088] The various illustrative logic blocks, modules, and circuits described in conjunction with the embodiments disclosed herein can be implemented or performed using a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. The general-purpose processor may be a microprocessor, but in alternatives, it may be any conventional processor, controller, microcontroller, or state machine. The processor may also be implemented as a combination of computing devices, such as a combination of a DSP and a microprocessor, multiple microprocessors, one or more microprocessors cooperating with a DSP core, or any other such configuration.

[0089] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be embodied directly in hardware, in a software module executed by a processor, or in a combination of both. The software module may reside in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art. An exemplary storage medium is coupled to a processor such that the processor can read and write information to / from the storage medium. In an alternative, the storage medium may be integrated into the processor. The processor and storage medium may reside in an ASIC. The ASIC may reside in a user terminal. In an alternative, the processor and storage medium may reside as discrete components in the user terminal.

[0090] In one or more exemplary embodiments, the described functionality may be implemented in hardware, software, firmware, or any combination thereof. If implemented in software as a computer program product, the functionality may be stored or transmitted as one or more instructions or code on or through a computer-readable medium. A computer-readable medium includes both computer storage media and communication media, encompassing any medium that facilitates the transfer of a computer program from one location to another. A storage medium may be any available medium accessible to a computer. By way of example and not limitation, such a computer-readable medium may include RAM, ROM, EEPROM, CD-ROM or other optical disc storage, disk storage or other magnetic storage devices, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and is accessible to a computer. Any connection is also legitimately referred to as a computer-readable medium. For example, if the software is transmitted from a website, server, or other remote source using coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwave, then the coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwave are included in the definition of a medium. As used in this article, disk and disc include compact discs (CDs), laser discs, optical discs, digital multi-purpose discs (DVDs), floppy disks, and Blu-ray discs. Disks typically reproduce data magnetically, while discs reproduce data optically using lasers. Combinations of these should also be included within the scope of computer-readable media.

[0091] The prior description of this disclosure is provided to enable any person skilled in the art to make or use this disclosure. Various modifications to this disclosure will be apparent to those skilled in the art, and the general principles defined herein may be applied to other variations without departing from the spirit or scope of this disclosure. Therefore, this disclosure is not intended to be limited to the examples and designs described herein, but should be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A battery thermal management safety shielding control method based on forward verification of a physical thermal model, characterized in that, Includes the following steps: S1. The battery thermal management safety shielding layer reads vehicle-side operating data directly related to battery branch heat dissipation in each control cycle and constructs the current effective cooling capacity status; the current effective cooling capacity status includes low effective cooling capacity, medium effective cooling capacity and high effective cooling capacity. S2. Read the corresponding contraction amount according to the current effective cooling capacity status and the future control cycle number, and form a forward safety shielding condition; S3. Obtain the original cooling control action output by the controller and convert it into the equivalent heat transfer intensity of the battery branch; combine the equivalent heat transfer intensity with the battery's highest temperature and the core-to-surface temperature difference in the current control cycle, and use the battery physical thermal model to recursively predict the battery's highest temperature and the core-to-surface temperature difference in future control cycles according to the control cycle. Based on the battery's highest temperature and the temperature difference between the core and the surface of the battery in each future control cycle, the thermal safety margin is calculated and the forward verification result is generated by comparing it with the forward safety shielding conditions cycle by cycle and item by item. S4. If the forward verification result is passed, the original cooling control action is sent to the actuator as the final cooling action; if the forward verification result is failed, the thermal safety gap is determined according to the thermal safety margin, and a safe cooling action with a recovery margin that can cover the thermal safety gap is selected from the executable safe cooling action sequence corresponding to the current effective cooling capacity state as the final cooling action. If no effective cooling action can cover the thermal safety gap, the maximum available cooling action will be issued as the final cooling action, and a request to reduce the battery heat load will be sent.

2. The battery thermal management safety shielding control method based on forward verification of a physical thermal model according to claim 1, characterized in that, The vehicle-side operating data includes the battery's maximum temperature, the temperature difference between the core and the surface, the coolant inlet temperature, the coolant outlet temperature, the actual water pump speed, and the actual opening degree of the battery branch valves.

3. The battery thermal management safety shielding control method based on forward verification of a physical thermal model according to claim 2, characterized in that, The effective cooling capacity state is determined based on the coolant heat carrying capacity level corresponding to the coolant temperature difference generated by the coolant inlet temperature and coolant outlet temperature, the water pump delivery level corresponding to the actual speed of the water pump, and the valve channel level corresponding to the actual opening degree of the battery branch valve. The lowest of the three is taken as the current effective cooling capacity state.

4. The battery thermal management safety shielding control method based on forward verification of a physical thermal model according to claim 1, characterized in that, Specifically, S2 is: Based on the current effective cooling capacity status and the future control cycle number, query the maximum temperature safe contraction table and the core surface temperature difference safe contraction table to obtain the maximum temperature safe contraction amount and the core surface temperature difference safe contraction amount corresponding to each future control cycle. The maximum temperature usable boundary is obtained by subtracting the maximum temperature safe shrinkage amount from the inherent safety upper limit of the battery's maximum temperature, and the core surface temperature difference usable boundary is obtained by subtracting the core surface temperature difference safe shrinkage amount from the inherent safety upper limit of the core surface temperature difference, thus generating a forward safety shielding condition.

5. The battery thermal management safety shielding control method based on forward verification of a physical thermal model according to claim 4, characterized in that, The maximum temperature safety shrinkage and the core-surface temperature difference safety shrinkage are determined during the calibration phase: Under different effective cooling conditions, the battery pack was subjected to fast charging, high-rate discharge, or thermal recovery conditions after continuous hill climbing. The changing trends of the battery's highest temperature and the temperature difference between the core and the surface under safe cooling action were recorded over multiple future control cycles. Based on the advance reserve required when the thermal state approaches the inherent safety limit, a shrinkage table was formed that changes with the future control cycle number.

6. The battery thermal management safety shielding control method based on forward verification of a physical thermal model according to claim 1, characterized in that, The original cooling control action output by the controller is converted into the equivalent heat transfer intensity of the battery branch, specifically: The process is accomplished by a pre-calibrated action heat exchanger in the thermal management controller. The action heat exchanger is established by a battery pack thermal bench test. During the test, different combinations of water pump speeds and different battery branch valve openings are applied to record the changes in the battery's maximum temperature, core-surface temperature difference, and coolant inlet temperature. Each action combination is then mapped to an equivalent heat exchange intensity.

7. The battery thermal management safety shielding control method based on forward verification of a physical thermal model according to claim 1, characterized in that, The recursive prediction of the battery physical thermal model is based on the energy balance relationship of the equivalent thermal network. The highest battery temperature and the core-to-surface temperature difference in the current control cycle are used as the initial state. The model then adds the temperature rise caused by the equivalent heat generation of the battery, the heat transfer cooling determined by the difference between the equivalent heat transfer intensity and the current temperature relative to the coolant inlet temperature, and the thermal inertia term that continues the temperature rise trend of the previous cycle, to obtain the predicted highest temperature and predicted core-to-surface temperature difference for each future control cycle. The thermal inertia term is used to enable the model to express the engineering phenomenon that the battery temperature continues along the original trend for a short time when the cooling action just changes.

8. The battery thermal management safety shielding control method based on forward verification of a physical thermal model according to claim 1, characterized in that, The calculation method for the thermal safety margin is as follows: For each future control cycle, calculate the difference between the available maximum temperature boundary and the predicted maximum temperature, and the difference between the available core surface temperature difference boundary and the predicted core surface temperature difference. Take the minimum value among all differences as the thermal safety margin. The forward verification result is passed when the thermal safety margin is greater than or equal to zero, and it fails when it is less than zero.

9. The battery thermal management safety shielding control method based on forward verification of a physical thermal model according to claim 1, characterized in that, The executable safety cooling action sequence is arranged from weakest to strongest cooling intensity. Each safety cooling action is a combination of the target pump speed and the target opening degree of the battery branch valve. Under the current effective cooling capacity, the recovery margin is calculated by substituting the corresponding safety cooling action into the battery physical thermal model and calculating the minimum safety margin that can be increased relative to the forward safety shielding condition within the forward window. This recovery margin and the thermal safety gap form a coverage relationship under the same forward safety shielding condition.

10. The battery thermal management safety shielding control method based on forward verification of a physical thermal model according to claim 1, characterized in that, The step of selecting a safe cooling action from the sequence of executable safe cooling actions corresponding to the current effective cooling capacity state, where the recovery margin can cover the thermal safety gap, as the final cooling action to be issued is as follows: The recovery margin and thermal safety gap of each safe cooling action are compared in order of increasing cooling intensity. The first safe cooling action with a recovery margin not less than the thermal safety gap is selected as the final cooling action to maintain low cooling energy consumption while meeting thermal safety constraints.

Images