结论：保护功能平时不工作，所以只能靠主动验证
电池管理系统的保护功能有个特点：正常使用中它们从不动作。 电池不过充、不过放、不过流、温度正常，保护就一直待命。
这意味着使用中无法确认这些功能是否有效。保护电路是否真的会在阈值处动作、动作之后系统行为是否正确，只能通过主动制造条件来验证。这也是为什么这部分验证不能省。
应当验证的保护项
| 保护功能 | 防止什么 | 触发条件 |
|---|---|---|
| 过充保护 | 充电过量导致析锂、热失控 | 单体或组电压超上限 |
| 过放保护 | 深度放电损坏电芯 | 电压低于下限 |
| 充电过流 | 充电电流过大 | 电流超设定值 |
| 放电过流 | 负载异常或短路 | 电流超设定值 |
| 短路保护 | 外部短路 | 电流瞬时超限 |
| 高温保护 | 高温下继续充放电 | 温度超上限 |
| 低温充电保护 | 低温充电导致析锂 | 温度低于充电允许下限 |
| 单体压差保护 | 电芯不一致加剧 | 压差超设定值 |
倒数第二行容易被忽略。 低温下充电会导致锂在负极析出，这个损伤是累积且不可逆的，而且从外部表现看不出来。北方冬季使用的产品尤其要关注这项保护是否可靠。
验证方法
每项保护的验证思路都是：制造触发条件，确认保护动作，确认动作后的系统行为。
电压类保护通过外部可控电源逐步改变电压，接近阈值时观察动作点，记录实际动作电压与设定值的偏差。
电流类保护通过可调负载逐步增大电流，记录动作点与动作时间。短路保护还要验证响应速度足够快。
温度类保护在温箱中改变环境温度，或者直接对温度传感器施加信号，观察保护动作。建议两种方式都做——改变环境温度验证的是整体行为，给传感器信号验证的是逻辑本身。
压差保护通过对单体施加不同负载造成压差，观察均衡功能与保护动作。
动作之后的行为同样要验证
保护动作了，不等于问题解决了。还要确认：
动作后系统进入什么状态，是切断输出还是降功率；有没有给使用者明确的提示；条件恢复后能否自动恢复，还是需要人工复位；如果需要复位，复位方式使用者能否操作。
自动恢复的设计要小心。 如果保护动作后条件恢复就自动恢复，可能出现反复触发——温度降一点恢复、一用又超温、再保护，这种循环对电池不好，对使用者体验也差。通常需要设置回差或者延时。
多重保护的配合
完整的电池系统通常有多层保护：电芯级的保护、BMS 的电子保护、以及物理保护（保险丝、热熔断）。
验证时要确认层次关系正确：正常情况下由较软的保护先动作（BMS 电子保护，可恢复），只有在前一层失效时才由较硬的保护动作（保险丝，不可恢复）。
如果顺序反了，一次普通的过流就会熔断保险丝，产品直接不能用，售后成本很高。
还要验证的是：BMS 失效时物理保护是否仍然有效。这是最后一道防线，不能依赖 BMS 本身。
与整车安全的衔接
电池保护动作会影响整车行为。需要验证的衔接点包括：
保护动作切断输出时，轮椅是否安全停止而不是失控；低电量保护前是否有足够的预警，让使用者有时间返回；保护动作的信息是否传递给控制器并显示给使用者。
低电量预警这一项对实际使用影响很大。 保护动作是硬性的，电量到了就切断；如果没有提前预警，使用者可能在户外突然失去动力。
验证记录的要求
这类验证的记录应当包含：设定的保护阈值、实际测得的动作点、动作时间、动作后的系统状态、恢复条件与方式。
实测动作点与设定值的偏差值得单独关注。 偏差过大说明检测电路精度不足或者标定有问题，即使这次动作了，在其他条件下未必可靠。
与充电器的配合验证
电池保护不能只在电池侧验证，还要与充电器配合起来看。需要确认的包括：充电器的输出特性与 BMS 的保护阈值是否匹配；充电结束的判定由谁主导；使用非配套充电器时保护是否仍然有效。
最后一项在实际中很重要。 使用者的配套充电器丢失或损坏后，很可能就近找一个接口相同的替代。如果此时保护不起作用，后果可能很严重。设计上应当考虑这种情形，至少在接口或通信上做区分。
数据记录与追溯
部分 BMS 具备数据记录功能，能保存历史的电压、温度、充放电次数等。这项功能在质量追溯时价值很大：出现电池问题时，能看到此前的使用历史，判断是产品缺陷还是使用不当。
如果产品有这个能力，验证时应当确认数据记录的准确性与可读取性，并在售后流程里规定怎么调取。
保护参数的可配置性
部分 BMS 的保护参数可以通过软件配置。这带来灵活性，也带来风险：参数被改到不安全的值。
验证时应当确认：参数修改是否有权限保护；可配置范围本身是否安全（即范围的边界值仍然能保护电池）；修改是否留痕可追溯。只验证出厂默认值，覆盖不到参数被修改后的状态。
我们的做法
做电池系统验证时，我们会按保护项逐条做，记录实际动作点而不只判断有没有动作。动作点的数值是判断设计裕度的依据，只知道保护功能存在，不知道它在什么条件下动作，用处有限。
对于低温环境使用的产品，建议把低温充电保护单独做透——这项保护失效造成的损伤不可见、累积、且影响安全，值得多花一点验证成本。
有需要可以把电池系统方案和保护参数设定发过来一起设计验证，或者直接联系：132 4819 8029。检测能力见服务介绍，产品分类见电动轮椅检测与代步车检测，联系方式见联系我们。
English version
Conclusion. Battery management protection functions share a characteristic: in normal use they never operate. As long as the pack is not overcharged, over-discharged, over-current or hot, protection simply waits. That means ordinary use cannot confirm whether these functions work. Whether the protection circuit actually operates at its threshold, and whether system behaviour afterwards is correct, can only be established by creating the conditions deliberately. This is why this part of verification cannot be skipped.
Protections to verify. Overcharge protection prevents lithium plating and thermal runaway, triggered by cell or pack voltage above a limit. Over-discharge protection prevents cell damage from deep discharge. Charge over-current and discharge over-current protections respond to current above set values. Short-circuit protection responds to an instantaneous current excursion. High-temperature protection prevents charging or discharging when hot. Low-temperature charge protection prevents lithium plating when charging below the permitted temperature. Cell voltage difference protection responds to growing imbalance.
Low-temperature charge protection is easily overlooked. Charging below the permitted temperature causes lithium to plate on the anode, damage that is cumulative, irreversible and invisible from outside. Products used in cold winters deserve particular attention to whether this protection is reliable.
Verification methods. For voltage protections, use a controllable supply to approach the threshold gradually, observe the operating point, and record the deviation between measured and set values. For current protections, increase current with an adjustable load and record operating point and response time; short-circuit protection also needs its speed verified. For temperature protections, change ambient temperature in a chamber and also apply signals directly to the sensor, since the first verifies overall behaviour while the second verifies the logic itself. For imbalance protection, create a voltage difference by loading cells unevenly and observe balancing and protection behaviour.
Behaviour after operation. Protection operating does not mean the matter is resolved. Confirm what state the system enters, whether output is cut or power derated; whether the user receives a clear indication; whether recovery is automatic when conditions return or requires manual reset; and whether the user can perform that reset. Automatic recovery needs care: if protection clears as soon as conditions improve, repeated cycling can occur, with temperature falling slightly, use resuming, the limit being exceeded again and protection operating once more. That cycle is bad for the battery and poor for the user, so hysteresis or a delay is usually needed.
Layered protection. A complete battery system usually has several layers: cell-level protection, electronic protection in the BMS, and physical protection such as fuses or thermal cut-outs. Verify that the hierarchy operates in the right order, with the recoverable electronic protection acting first and the irreversible physical protection acting only if the earlier layer fails. If the order is inverted, an ordinary over-current event blows a fuse and the product becomes unusable, which is expensive in service. Also verify that physical protection still works if the BMS itself fails, since that is the last line of defence and cannot depend on the BMS.
Integration with vehicle safety. Protection operation affects vehicle behaviour. Verify that when output is cut the chair stops safely rather than behaving unpredictably; that adequate warning precedes low-voltage protection so the user has time to return; and that protection events are communicated to the controller and displayed. Low-charge warning matters considerably in practice, because protection is absolute once the threshold is reached and a user without warning may lose drive while outdoors.
Records. Record the configured threshold, the measured operating point, the response time, the resulting system state, and the recovery condition and method. The deviation between measured and configured operating point deserves attention in its own right: a large deviation indicates inadequate sensing accuracy or calibration, and protection that operated on this occasion may not be reliable under other conditions.
How we handle it. We work through the protections item by item and record actual operating points rather than simply whether protection occurred, because the operating point is what indicates design margin. Knowing a protection exists without knowing where it acts is of limited use. For products used in cold climates we suggest examining low-temperature charge protection thoroughly, since failure there produces invisible, cumulative and safety-relevant damage.
Send us the battery system design and protection settings and we will design the verification. Phone or WeChat: +86 132 4819 8029.