Safety control method and system for electric fork truck

Abstract

The application discloses a kind of electric fork truck safety control method and system, safety controller VCU is connected with motor controller MCU, method is executed by VCU, comprising: in response to whole machine safety function is triggered, SS2 safety function activation instruction is sent to MCU, whether MCU has sent SOS activation feedback is monitored;In response to receiving SOS activation feedback, whether MCU has sent active hill descent request is monitored;In response to receiving active hill descent request, SS2 safety function reset instruction is sent to MCU, and motor speed monitored by MCU feedback;In response to the motor speed feedback by MCU exceeds the upper limit of set safety hill descent speed, activate audible and visual alarm signal, and send the state of exceeding safety hill descent speed to MCU.The application realizes the functional safety control of electric fork truck without electronic parking brake, avoids the safety risk caused by manual operation, and at the same time, maintains the integrity and compliance of functional safety.

Description

Technical Field

[0001] This invention belongs to the field of electric forklift control technology, specifically relating to an electric forklift safety control method and system. Background Technology

[0002] After the safety functions of an electric forklift are triggered, the common safe states are STO and SS2, and the final stable safe state is achieved by relying on the electronic parking brake. However, due to cost considerations, ordinary forklifts do not have external electronic brakes; instead, active parking brakes are typically used instead, placing some responsibility for the machine's safety on the driver. This design often means that after the safety functions are triggered, the machine cannot automatically enter a stable safe state (parking brake state) and driver intervention is still required to keep it stationary. However, the driver's reaction and state introduce certain risks to the design of the functional safety control system.

[0003] Furthermore, there is a significant difference between Safety Toll Collection (STO) and Safety Safe Operation (SS2). Electric forklifts, especially those carrying heavy loads, often pose a risk when the safety function triggers STO. In this state, the motor enters a servo mode, causing the entire machine to coast. If the driver reacts slowly and fails to brake in time, it can easily lead to a collision. This risk is exacerbated on slopes. Therefore, many manufacturers have mandated that the motor controller should not enter STO unless the entire machine cannot be electromagnetically braked using the motor and motor controller.

[0004] After the safety function is triggered, the motor controller enters SS2, which provides a significant safety boost compared to entering STO. However, considering the impact of the slope, an unacceptable residual risk remains. Without driver intervention to release the SS2 or a shutdown and restart, the entire machine will remain in a state of energy consumption and stall to resist gravity-induced descent. Prolonged failure to release SS2 could lead to more dangerous situations such as motor overheating and burnout, or even loss of control of the entire machine. In this situation, allowing the machine to actively roll downhill is the correct choice. However, the active roll-down function involves many standard signals and logic, making it impossible to implement as a safety function; therefore, it must remain a standard function. SS2 is a general safety sub-function with clearly defined logic, and its modification is prohibited. Therefore, unless the safety controller VCU sends a signal to release the SS2 state of the motor controller MCU, it is forbidden to exit once entered. If the motor controller manufacturer claims that its product's internal logic can release SS2 based on the active roll-down situation, then the product no longer meets the requirements of the SS2 sub-function, but rather another similar SS2 safety sub-function (such as SS2_Ramp). However, most MCU component manufacturers do not typically meet such niche requirements. Safety subfunction SS2 has a higher priority and safety than the active ramp function. If the active ramp function is to change the state of SS2, a comprehensive analysis and safeguards must be provided from a functional safety perspective.

[0005] In summary, relying solely on the safety sub-functions of the motor controller to achieve the overall machine's safety functions, without considering actual operating conditions, often results in the overall machine's safety functions failing to achieve the expected results. Because the priority of active slope-off is much lower than SS2, and the active slope-off request is a standard signal, canceling SS2 based on the active slope-off signal would severely impact the safety integrity of SS2, failing to meet the certification requirements for motor controller SS2. Therefore, it is necessary to consider the method of canceling SS2 upon active slope-off request, the impact of mis-cancellation, and continuous monitoring after cancellation to ensure the functional safety integrity of the entire machine and the motor controller, and to eliminate logical defects in the designed electrical control system on slopes. If the relationship between active slope-off and overall machine safety functions is not properly handled, at best, the integrity of functional safety will be compromised, the designed electrical control system will have defects, and the declared product will face compliance challenges in actual use after being launched on the market. At worst, it could lead to loss of control of the construction machinery, causing serious accidents, making the functional safety design deviate from its purpose, and significantly increasing the risk to the machine. Summary of the Invention

[0006] To address the shortcomings of existing technologies, this invention provides a safety control method and system for electric forklifts, which achieves functional safety control of electric forklifts without electronic parking brakes, avoids safety risks caused by manual operation, and maintains the integrity and compliance of functional safety.

[0007] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0008] In a first aspect, a safety control method for an electric forklift is provided, wherein a safety controller (VCU) is communicatively connected to a motor controller (MCU). The method is executed by the safety controller (VCU) and includes: in response to the overall machine safety function being triggered, continuously sending an SS2 safety function activation command to the motor controller (MCU) and monitoring whether the motor controller (MCU) sends an SOS activation feedback; in response to receiving an SOS activation feedback from the motor controller (MCU), monitoring whether the motor controller (MCU) sends an active ramp request; in response to receiving an active ramp request from the motor controller (MCU), continuously sending an SS2 safety function reset command to the motor controller (MCU) and monitoring the motor speed fed back by the motor controller (MCU) after the motor controller (MCU) executes active ramp control; in response to the motor speed fed back by the motor controller (MCU) exceeding the set safe ramp speed limit, activating an audible and visual alarm signal and sending a status indicating that the safe ramp speed has been exceeded to the motor controller (MCU).

[0009] Furthermore, it also includes: in response to not receiving an active ramp request from the motor controller MCU, monitoring whether the motor controller MCU has executed the STO program; if the STO program has been executed, restarting and resetting; in response to the motor controller MCU not executing the STO program, determining whether the conditions for triggering the whole machine safety function are met; in response to meeting the conditions for triggering the whole machine safety function, determining whether the speed fed back by the motor controller MCU is 0, and simultaneously monitoring whether the gear is reset; in response to the speed fed back by the motor controller MCU being 0, monitoring whether the accelerator pedal and gear are reset; in response to the speed fed back by the motor controller MCU not being 0, monitoring whether the accelerator pedal is reset; in response to the gear being reset, monitoring whether the active ramp speed function is turned off; in response to the accelerator pedal and gear being reset, or the accelerator pedal being reset, or the active ramp speed function being turned off, continuously sending the SS2 safety function reset command to the motor controller MCU.

[0010] Furthermore, the safety controller VCU is also configured with a standard VCU program, including: powering on and performing a self-test; in response to passing the self-test, receiving and processing the overall machine status signal, sending a torque or speed command to the motor controller MCU, and simultaneously monitoring whether the overall machine safety function is triggered; in response to the overall machine safety function being triggered, sending a torque or speed command reset signal to the motor controller MCU.

[0011] Secondly, a safety control method for an electric forklift is provided, wherein a safety controller (VCU) is communicatively connected to a motor controller (MCU). The method is executed by the motor controller (MCU) and includes: in response to receiving an SS2 safety function activation command sent by the safety controller (VCU), continuously monitoring whether the motor deceleration state meets the set deceleration logic; if the set deceleration logic is met, monitoring whether the motor remains stationary after the motor speed is less than a set speed threshold; in response to the motor remaining stationary after the motor speed is less than the set speed threshold, feeding back SOS activation to the safety controller (VCU) and continuously monitoring whether the safety controller (VCU) sends an SS2 safety function reset command; in response to receiving an SS2 safety function reset command sent by the safety controller (VCU), deactivating the SS2 safety state and monitoring whether the safety controller (VCU) sends a state indicating that the motor speed exceeds the safe ramp speed; in response to receiving a state indicating that the motor speed exceeds the safe ramp speed sent by the safety controller (VCU), monitoring whether the safety controller (VCU) sends an SS2 safety function activation command.

[0012] Furthermore, the deceleration logic includes: decelerating to 0 within a specified time or decelerating to 0 at a specified slope.

[0013] Furthermore, the static state refers to the motor's angle change being within a set range.

[0014] Furthermore, when the motor deceleration state does not meet the set deceleration logic, the STO program is executed.

[0015] Furthermore, if the motor does not remain stationary after its speed falls below the set speed threshold, the STO procedure is executed.

[0016] Furthermore, the motor controller MCU is also configured with a standard MCU program, including: powering on and performing a self-test; in response to passing the self-test, executing the FOC algorithm to perform torque or speed control, and monitoring whether an SS2 safety function activation command sent by the safety controller VCU is received; in response to receiving the SS2 safety function activation command sent by the safety controller VCU, performing deceleration and braking, and determining whether the speed is less than a set threshold; in response to the speed being less than the set threshold, maintaining a stationary position, and monitoring whether the active slope condition is met; in response to meeting the active slope condition, sending an active slope request to the safety controller VCU, and monitoring whether the SS2 safety function is deactivated; in response to the SS2 safety function being deactivated, performing active slope control, and determining whether the motor speed exceeds the safe slope speed; if it exceeds the safe slope speed, determining whether an SS2 safety function activation command sent by the safety controller VCU is received.

[0017] Thirdly, an electric forklift safety control system includes a safety controller (VCU) and a motor controller (MCU). The safety controller (VCU) is communicatively connected to the motor controller (MCU). The safety controller (VCU) is configured to perform the following operations: in response to the overall machine safety function being triggered, continuously sending an SS2 safety function activation command to the motor controller (MCU) and monitoring whether the motor controller (MCU) sends an SOS activation feedback; in response to receiving an SOS activation feedback from the motor controller (MCU), monitoring whether the motor controller (MCU) sends an active ramp request; in response to receiving an active ramp request from the motor controller (MCU), continuously sending an SS2 safety function reset command to the motor controller (MCU) and monitoring the motor speed fed back by the motor controller (MCU) after the motor controller (MCU) executes active ramp control; in response to the motor speed fed back by the motor controller (MCU) exceeding the set safe ramp speed limit, activating an audible and visual alarm signal and sending a signal to the motor controller (MCU). The motor controller MCU is configured to perform the following operations in response to receiving an SS2 safety function activation command from the safety controller VCU: continuously monitor whether the motor deceleration state meets the set deceleration logic; if the set deceleration logic is met, monitor whether the motor remains stationary after the motor speed is less than the set speed threshold; in response to the motor remaining stationary after the motor speed is less than the set speed threshold, send feedback to the safety controller VCU that SOS has been activated, and continuously monitor whether the safety controller VCU has sent an SS2 safety function reset command; in response to receiving an SS2 safety function reset command from the safety controller VCU, deactivate the SS2 safety state, and monitor whether the safety controller VCU has sent a state indicating that the motor speed exceeds the safe slope speed; in response to receiving a state indicating that the motor speed exceeds the safe slope speed from the safety controller VCU, monitor whether the safety controller VCU has sent an SS2 safety function activation command.

[0018] Compared with the prior art, the beneficial effects achieved by the present invention are as follows:

[0019] (1) The present invention communicates with the motor controller MCU through the safety controller VCU. The safety controller VCU responds to the triggering of the whole machine safety function by continuously sending the SS2 safety function activation command to the motor controller MCU and monitoring whether the motor controller MCU sends SOS activation feedback. Upon receiving the SOS activation feedback sent by the motor controller MCU, it monitors whether the motor controller MCU sends an active ramp request. Upon receiving the active ramp request sent by the motor controller MCU, it continuously sends the SS2 safety function reset command to the motor controller MCU and monitors the motor speed fed back by the motor controller MCU after the motor controller MCU performs active ramp control. If the motor speed fed back by the motor controller MCU exceeds the set safe ramp speed limit, it activates the audible and visual alarm signal and sends the status of exceeding the safe ramp speed to the motor controller MCU. This realizes the functional safety control of electric forklifts without electronic parking brakes, avoids the safety risks caused by manual operation, and at the same time maintains the integrity and compliance of functional safety.

[0020] (2) The present invention can achieve a stable safety state of the whole machine after triggering the safety function in the slope scenario without adding an electronic parking brake and without compromising the safety integrity of the motor controller SS2, thus ensuring the safety of the whole machine. Attached Figure Description

[0021] Figure 1 This is a schematic diagram of the main process of the safety control method for electric forklifts in a ramp scenario in an embodiment of the present invention;

[0022] Figure 2 This is a schematic diagram of the reset logic during the execution of SS2 in this embodiment of the invention;

[0023] Figure 3 This is a structural block diagram of the electric forklift safety control system in an embodiment of the present invention. Detailed Implementation

[0024] The present invention will be further described below with reference to the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and should not be used to limit the scope of protection of the present invention.

[0025] Example 1

[0026] First, this invention provides supplementary information on functional safety industry practices, which are recognized best practices and mandatory rules, and form the basis of the innovation of this invention:

[0027] 1) Standard signals must not be altered to change safety signals:

[0028] Components that have passed safety certification are generally divided into safety components and standard components. Safety components perform safety functions, typically protective functions affecting driver safety. Their underlying software, application software, and hardware have all undergone functional safety certification, enabling them to identify their own faults and ensure safety. Standard components perform standard functions, including all functions other than safety functions.

[0029] Whether it's a safety controller (VCU) or a motor controller (MCU), the safety variables or instructions in their safety programs are stored in memory with safety measures (such as ECC), and changes or tampering with their signals can be identified and corrected. Standard variables or instructions in their safety programs, as well as variables or instructions in standard programs, are not stored in memory with safety measures. Under the influence of voltage stress, thermal stress, mechanical stress, electromagnetic radiation, or high-energy particle radiation, charge may change, causing incorrect transmission of variables or instructions.

[0030] Therefore, from a functional safety perspective, standard variables or instructions can generally be read but are prohibited from being written to safety variables or instructions, while safety variables or instructions can be read from and written to standard variables or instructions. To protect the safety integrity of safety functions, it is strictly prohibited to modify safety signals using standard signals in the safety or standard sections, unless a safety analysis proves that it has no impact on safety functions.

[0031] 2) MCU security sub-function logic:

[0032] The industry trend is that the certification of overall machine functional safety relies on the support of components that have passed functional safety certification. As the controller of the forklift drive unit, the MCU directly controls the motor and plays an important role in human safety, so it must undergo functional safety certification.

[0033] 3) Triggering and resetting of the safety sub-function of the motor controller MCU:

[0034] The activation of the safety sub-function of the motor controller MCU is determined by a combination of safety commands from the VCU and internal safety commands within the MCU (such as SS2 causing STO). If either condition is met, the motor controller MCU immediately activates the safety sub-function. The overall VCU monitors the overall machine's state to determine whether safety functions are triggered, such as overspeeding or loss of control. Once a safety function is triggered, its safety status depends on the activation of the MCU's safety sub-function.

[0035] The reset of the safety sub-function of the motor controller MCU is determined by a combination of safety commands from the VCU and internal safety commands within the MCU. Both conditions must be met simultaneously for the safety sub-function to be reset. Therefore, when the VCU sends a safety sub-function activation command, the MCU is prohibited from changing the activation state of its own safety sub-function unless the VCU changes the activation command.

[0036] VCU security commands typically include:

[0037] (1) The safety program of the safety VCU sends a secure CAN message to the MCU safety program to activate the safety sub-function. For example, message 000 represents the status command of STO, SS2, and SMT. Each bit is set to 1 to indicate that the corresponding safety sub-function is activated, and set to 0 to indicate that the corresponding safety sub-function is not activated or is reset. They can be activated at the same time, but the safety sub-functions have corresponding priorities.

[0038] (2) The safety VCU controls the state of the MCU safety section ports through secure hardwired control. For example, it is deactivated when powered on and activated when powered off, following the power-off safety principle. It is generally only used for the activation and reset of the STO safety sub-function.

[0039] The feedback methods for the safety status of an MCU generally include:

[0040] The MCU sends a secure CAN message to the VCU safety section to provide feedback on the status of the safety sub-functions. For example, message 0000 indicates the feedback status of STO, SS2, SOS, and SMT. Each bit set to 1 indicates that the corresponding safety sub-function has been activated, and set to 0 indicates that the corresponding safety sub-function has not been activated.

[0041] 4) The conditions for the motor controller MCU to actively slide downhill are:

[0042] (1) The motor controller MCU detects that the speed command from the VCU is 0;

[0043] (2) The motor controller MCU detects that the actual speed of the motor is less than a certain threshold;

[0044] (3) The motor controller MCU detects that the current on the three-phase lines of the motor exceeds a certain threshold;

[0045] (4) Other conditions.

[0046] Based on the aforementioned industry rules, this invention provides a safety control method for electric forklifts, wherein a safety controller (VCU) is communicatively connected to a motor controller (MCU), and the method is executed by the safety controller (VCU), including:

[0047] In response to the triggering of the overall machine safety function, it continuously sends the SS2 safety function activation command to the motor controller MCU and monitors whether the motor controller MCU sends SOS activation feedback;

[0048] In response to receiving an SOS activation feedback from the motor controller MCU, monitor whether the motor controller MCU has sent an active slope request;

[0049] In response to receiving the active ramp request sent by the motor controller MCU, it continuously sends the SS2 safety function reset command to the motor controller MCU, and monitors the motor speed fed back by the motor controller MCU after the motor controller MCU executes the active ramp control;

[0050] In response to feedback from the motor controller MCU that the motor speed exceeds the set safe ramp speed limit, an audible and visual alarm signal is activated, and the status of exceeding the safe ramp speed is sent to the motor controller MCU.

[0051] The method is executed by the motor controller MCU and includes:

[0052] In response to receiving the SS2 safety function activation command sent by the safety controller VCU, the motor deceleration state is continuously monitored to see if the set deceleration logic is met. If the set deceleration logic is met, the motor is monitored to see if it remains stationary after the motor speed is less than the set speed threshold.

[0053] In response to the motor speed remaining stationary after falling below the set speed threshold, the system sends a message to the safety controller VCU indicating that SOS has been activated and continuously monitors whether the safety controller VCU sends an SS2 safety function reset command.

[0054] In response to receiving the SS2 safety function reset command sent by the safety controller VCU, the SS2 safety state is deactivated, and the safety controller VCU is monitored to see if the motor speed exceeds the safe ramp speed.

[0055] In response to receiving a message from the safety controller VCU indicating that the motor speed exceeds the safe ramp speed, monitor whether the safety controller VCU sends an SS2 safety function activation command.

[0056] This invention combines Figure 1 , Figure 3 This document provides a more detailed explanation of the functional safety control process for electric forklifts operating on ramps without electronic parking brakes. Black lines represent task flows, green dashed lines represent signal transmissions that comply with functional safety, and red dashed lines represent signal transmissions that violate functional safety. Yellow-filled boxes represent safety-related procedures. Yellow boxes filled with red lines represent safety-related procedures affected by standard signals and require close attention. Green-filled boxes represent standard-related procedures.

[0057] I. The standard VCU program configured in the safety controller (VCU) is as follows:

[0058] VB1: Power on and complete self-test. After self-test, execute VB2.

[0059] VB2. Based on the overall machine status and driver operation, the safety controller VCU receives sensor signals, processes them, and sends torque or speed commands to the MCU standard program configured in the motor controller MCU, and then executes VB3.

[0060] VB3: Monitor whether the overall safety function of the VCU safety program configured in the safety controller VCU is triggered. If it is, execute VB4; otherwise, execute VB2.

[0061] In VB4, the torque or speed command sent to the MCU standard program is 0.

[0062] II. The VCU safety program configured in the safety controller (VCU) is as follows:

[0063] VA1: Power on and complete self-test. After self-test, execute VA2.

[0064] VA2 executes security function logic, monitors the overall system status, and then executes VA3;

[0065] VA3. Based on the overall machine status (speed, gear, acceleration, etc.), determine whether the overall machine safety function is triggered. If yes, execute VA4; otherwise, execute VA2.

[0066] VA4. In response to the triggering of the overall machine safety function, continuously send the SS2 safety function activation command to the motor controller MCU, that is, set the SS2 command to 1, and continuously send it to the MCU safety program configured in the motor controller MCU, and then execute VA5.

[0067] VA5: Monitor whether the MCU security program has sent an SOS activation feedback. If yes, execute VA6; otherwise, continue executing VA5.

[0068] VA6: In response to receiving the SOS activation feedback sent by the motor controller MCU, monitor whether the MCU standard program has sent an active slope request. If yes, execute VA7; otherwise, continue executing VA6.

[0069] VA7. In response to receiving the active slope request sent by the motor controller MCU, continuously send the SS2 safety function reset instruction to the motor controller MCU, that is, set the SS2 instruction to 0 and continue to send it, and then execute VA8.

[0070] VA8: After the MCU standard program configured in the motor controller MCU executes the active slope control, the MCU safety program feeds back the motor speed, and then executes VA9.

[0071] VA9: Monitor whether the motor speed fed back by the MCU safety program exceeds the threshold (the set upper limit of the safe ramp speed). If yes, execute VA10; otherwise, continue to execute VA8.

[0072] VA10 and VCU safety program control lights and buzzer alarm, and send a status indicating that the safe slope speed has been exceeded, and then execute VA4.

[0073] III. The MCU safety program configured in the motor controller MCU is as follows:

[0074] MA1: Power on and complete self-test. After self-test, execute MA2.

[0075] MA2 receives MCU sub-function trigger and reset commands sent by the safety controller VCU, and executes MA3;

[0076] MA3 monitors whether the VCU security controller has sent the SS2 security function activation command, that is, whether the SS2 command sent by the VCU security program is set to 1. If yes, then execute MA4; otherwise, execute MA2.

[0077] MA4: In response to receiving the SS2 safety function activation command sent by the safety controller VCU, i.e., the SS2 command is set to 1, continuously monitor whether the motor deceleration status meets the set deceleration logic. That is, after a certain threshold time, continuously monitor whether the motor deceleration is normal (decelerating to near 0 within a specified time or decelerating to near 0 at a specified slope). If the deceleration is normal and meets the set deceleration logic, then execute MA5; if the deceleration is abnormal and does not meet the set deceleration logic, then execute MA6.

[0078] MA5: Monitor whether the motor remains stationary (angle change within a certain range) after the motor speed is lower than the set speed threshold. If yes, execute MA7; otherwise, execute MA6.

[0079] MA6: Execute STO safety function, the entire machine loses power and can only glide;

[0080] MA7: In response to the motor speed remaining stationary after falling below the set speed threshold, send a message to the VCU safety program to indicate that SOS has been activated, and execute MA8.

[0081] MA8 monitors whether the VCU security program has sent an SS2 security function reset command. If yes, execute MA9; otherwise, continue executing MA8.

[0082] MA9: In response to receiving the SS2 safety function reset command sent by the safety controller VCU, the SS2 safety sub-function is deactivated, that is, the monitoring of whether the motor angle and speed change according to the SS2 sub-function is stopped, and MA10 is executed.

[0083] MA10 monitors whether the VCU safety program has sent a status indicating that the motor speed exceeds the safe sloping speed. If so, MA3 is executed; otherwise, MA10 is executed.

[0084] IV. The standard MCU program configured in the motor controller MCU is as follows:

[0085] MB1: Power on and complete self-test. After self-test, execute MB2.

[0086] MB2 responds to the instructions of the VCU standard program, executes the FOC algorithm, performs torque or speed control, and executes MB3;

[0087] MB3: Determine whether the SS2 instruction sent by the VCU security program is set to 1. If it is, execute MB4; otherwise, execute MB2.

[0088] MB4: Execute the FOC algorithm to decelerate and brake, and then execute MB5;

[0089] MB5: Determine if the motor speed has decelerated to below a specific threshold. If yes, execute MB6; otherwise, execute MB4.

[0090] MB6: Execute the FOC algorithm to stall the motor, keep it stationary, and then execute MB7;

[0091] MB7. Has the monitoring met the conditions for active slope reduction? If yes, proceed to MB8; otherwise, continue with MB6.

[0092] MB8: Continuously send active slope request to the VCU safety program and execute MB9;

[0093] MB9. Has the SS2 security status in the monitoring MCU security program been deactivated? If yes, execute MB10; otherwise, remain static.

[0094] MB10: Execute the FOC algorithm for active slope control, and then execute MB11.

[0095] MB11: Monitor whether the VCU safety program sends a status indicating that the safe ramp speed has been exceeded. If so, execute MB3; otherwise, continue executing MB11.

[0096] This invention combines Figure 2 , Figure 3This document provides a more detailed explanation of the reset procedure following a functional safety trigger in a ramp scenario for electric forklifts without electronic parking brakes. Black lines represent the task flow, green dashed lines represent signal transmission conforming to functional safety, and red dashed lines represent signal transmission violating functional safety. Yellow-filled boxes represent safety-related procedures. Yellow boxes filled with red lines represent safety-related procedures affected by standard signals and require close attention. Green-filled boxes represent standard-related procedures.

[0097] V. The standard VCU program configured in the safety controller VCU is as follows:

[0098] FVB1: Power on and complete self-test. After self-test, execute FVB2.

[0099] FVB2: Based on the overall machine status and driver operation, the safety controller VCU receives sensor signals, processes them, sends torque or speed commands to the MCU standard program, and then executes FVB3.

[0100] FVB3: Monitor whether the security functions in the VCU security program are triggered. If so, execute FVB4; otherwise, execute FVB2.

[0101] FVB4 sends a torque or speed command of 0 to the MCU standard program and executes FVB5;

[0102] FVB5: Monitor whether the overall security function in the VCU security program has been reset. If so, execute FVB2; otherwise, execute FVB4.

[0103] VI. The VCU safety program configured in the safety controller (VCU) is as follows:

[0104] FVA1: Power on and complete self-test. After self-test, execute FVA2.

[0105] FVA2: Execute the safety function logic, monitor the overall system status, and then execute FVA3;

[0106] FVA3: Based on the overall machine status (speed, gear, acceleration, etc.), determine whether the safety function is triggered. If yes, execute FVA4; otherwise, execute FVA2.

[0107] FVA 4 and SS2 instructions are set to 1 and continuously sent to the MCU security program, and then FVA 5 is executed;

[0108] FVA5: Monitor whether an active ramp request signal has been received from the MCU standard program. If yes, execute FVA6; otherwise, execute FVA14.

[0109] FVA6: Monitor whether the received signal from the MCU indicates that the STO has been executed. If yes, execute FVA7; otherwise, execute FVA8.

[0110] FVA7 can only be reset by rebooting;

[0111] FVA8: Based on the overall machine status (speed, gear, acceleration, etc.), determine whether the safety function is not being triggered. If so, execute FVA9; otherwise, execute FVA5.

[0112] FVA9: Monitor whether the received MCU feedback speed is 0. If it is, execute FVA 10; otherwise, execute FVA 11.

[0113] FVA10: Monitor whether the accelerator pedal and gear position have been reset. If so, execute FVA 12; otherwise, execute FVA 5.

[0114] FVA11: Monitor whether the accelerator pedal has been reset. If it has, execute FVA 12; otherwise, execute FVA 5.

[0115] The FVA 12 and SS2 instructions are set to 0 and continuously sent to the MCU security program, and then FVA 13 is executed;

[0116] FVA13, complete machine safety function reset, then execute FVA 2, and send the complete machine safety function reset status to the VCU standard program;

[0117] FVA 14 and SS2 instructions are set to 0 and continuously sent to the MCU security program, and then FVA 15 is executed;

[0118] FVA15: Monitor whether the received signal from the MCU indicates that the STO has been executed. If yes, execute FVA 7; otherwise, execute FVA 16.

[0119] FVA16: Based on the overall machine status (speed, gear, acceleration, etc.), determine whether the safety function is no longer being triggered. If so, execute FVA 17; otherwise, continue executing FVA 16.

[0120] FVA17: Check if the accelerator pedal has been reset. If it has, execute FVA 18. If not, continue executing FVA17.

[0121] FVA18: Disable the safety function of VCU monitoring the active slope speed, and then execute FVA 12.

[0122] VII. The MCU safety program configured in the motor controller MCU is as follows:

[0123] FMA1: Power on and complete self-test. After self-test, execute FMA2.

[0124] FMA2: Receive MCU sub-function trigger and reset instructions sent by VCU, and execute FMA3;

[0125] FMA3: Determine if the SS2 instruction sent by the VCU security program is set to 1. If yes, execute FMA4; otherwise, execute FMA2.

[0126] FMA4: After a certain threshold time, continuously monitor whether the motor deceleration is normal (decelerate to near 0 within a specified time or decelerate to near 0 at a specified slope). If the deceleration is normal, execute FMA5; if the deceleration is abnormal, execute FMA6.

[0127] FMA5: Monitor whether the motor remains stationary (angle change within a certain range) after the speed is less than a certain threshold. If yes, execute FMA 7; otherwise, execute FMA 6.

[0128] FMA6: Execute the STO safety function, the entire machine loses power and can only glide;

[0129] FMA7 monitors whether the SS2 instruction sent by the VCU security program is set to 0 (reset SS2). If it is, FMA8 is executed; otherwise, FMA7 is executed.

[0130] FMA8 disables the SS2 safety sub-function, meaning it stops monitoring whether the motor's angle and speed change according to the SS2 sub-function, and then executes FMA 2.

[0131] 8. The standard MCU program configured in the motor controller MCU is as follows:

[0132] FMB1: Power on and complete self-test. After self-test, execute FMB2.

[0133] FMB2 responds to the instructions of the VCU standard program, executes the FOC algorithm, performs torque or speed control, and executes FMB3;

[0134] FMB3: Determine if the SS2 instruction sent by the VCU security program is set to 1. If yes, execute FMB4; otherwise, execute FMB2.

[0135] FMB4, execute the FOC algorithm to decelerate and brake, and then execute FMB5;

[0136] FMB5: Determine if the motor speed has decelerated to below a specific threshold. If yes, execute FMB6; otherwise, execute FMB4.

[0137] FMB6: Execute the FOC algorithm to stall the motor, keep it stationary, and then execute FMB7;

[0138] FMB7: Monitor whether the MCU security program has disabled the SS2 sub-function. If yes, execute FMB 2; otherwise, execute FMB 6.

[0139] Figure 1 , Figure 2 In the diagram, there is one red dashed line representing a signal transmission that violates functional safety. Figure 2 Not marked, and Figure 1 (The sources are consistent). The following analysis of the impact on safety functions and safety status demonstrates how this application ensures the functional safety integrity of the whole machine, as shown in Table 1.

[0140] Table 1: Functional Safety Integrity Analysis

[0141]

[0142] The meanings of the technical terms used in this invention are summarized as follows:

[0143] 1. Functional safety: The part of overall safety related to the electrical control system, which depends on the proper functioning of electrical / electronic / programmable electronic safety-related systems and other risk mitigation measures.

[0144] 2. Safety Functions: These are machine functions whose failure would immediately increase risk, such as the machine accelerating or moving beyond requested speeds, or maintaining power after a person leaves their seat. The development process for safety functions controls both systemic and random hardware failures to achieve the appropriate safety level.

[0145] 3. Overall Safety Functions: Safety functions that the entire machine needs to perform at the angle. These include inputs (switches, angle sensors, etc.), logic (VCU), and outputs (solenoid valves, MCU, etc.).

[0146] 4. Safety sub-functions: To support the realization of the overall machine's safety functions, the motor controller MCU must have safety functions, such as the safety functions specified in IEC 61800-5-2, STO, SBC, SS1, SS2, SOS, SLA, SAR, SLS, SSR, SLT, STR, SDI, SSM, SMT, etc. Among them, STO, SBC, SS1, SS2, and SLS are most relevant to engineering machinery.

[0147] 5. Safety Status: When the system malfunctions or faces potential danger, in order to prevent accidents or mitigate their consequences, the system should be switched to a safety-friendly state (the basic safety status for construction machinery is to stop. If this is not possible, loss of power and mechanical braking are also acceptable).

[0148] 6. Systemic Failure: A failure with a identifiable cause, which can only be eliminated by modifying the design or manufacturing process, operating procedures, documentation, or other relevant factors. Examples include errors caused by designers or flawed processes.

[0149] 7. Random hardware failure: Failure in hardware caused by one or more possible degradation mechanisms that occurs at random times. Examples include short circuits, open circuits, and offsets in resistors, capacitors, and inductors, and infinite loops in integrated circuits.

[0150] 8. Security Integrity: The probability that a security-related system will successfully perform its specified security functions within a specified time period and under specified conditions.

[0151] 9. STO Safety Sub-function: No rotational (or motion-generating) power is applied to the motor. The electric drive system does not supply energy to the motor capable of generating torque (or force-generating in a linear motor). The entire machine coasts after entering STO.

[0152] 10. SS2 Safety Sub-function: Electric drive system either

[0153] a) Start and control the motor deceleration rate within the set limits to stop the motor, and activate the SOS function when the motor speed falls below a specific limit; if deceleration fails, execute STO. Alternatively...

[0154] b) Within the set limits, start and monitor the motor deceleration rate to stop the motor, and activate the SOS function when the motor speed falls below a specific limit; monitor for deceleration failure and execute STO; or

[0155] c) Initiate motor deceleration and activate the SOS function after a specific application delay.

[0156] 11. SOS: The SOS function prevents the motor from deviating from the stop position by more than a specified amount. The electric drive system provides power to the motor to enable it to resist external forces. If the motor speed or position is detected to exceed the limit, STO is executed.

[0157] 12. SMT: This function ensures that the motor temperature will not exceed the set upper limit. If the motor temperature is detected to exceed the limit, STO will be executed.

[0158] 13. Security Software: Software that performs security functions and can detect random hardware failures and mitigate systemic failures. For example, code running within a security chip, following a specific development process, and undergoing static analysis, code review, and testing.

[0159] 14. Standard software: Programs that run in the ordinary core of the controller, which are generally related to the functions and performance of the whole machine.

[0160] 15. Safety Signals: Signals that ensure safety integrity. Appropriate safety measures must be adopted for the generation and transmission of safety signals.

[0161] a) The measures adopted in the initial generation phase include:

[0162] ① Take measures to avoid random hardware failures and systemic failures, ensuring signal accuracy and safety. Common measures include using redundant signal acquisition methods, monitoring the accuracy of the power supply voltage, dynamic characteristic analysis, considering component precision, and addressing latency issues.

[0163] b) Measures adopted in the intermediate generation stage include:

[0164] ① Signal generated by the preceding safety signal.

[0165] ②The signal is generated by the preceding safety signal and the preceding standard signal, but the preceding safety signal plays a decisive role in the generation of the signal.

[0166] c) The measures adopted during the transfer phase include:

[0167] ① The data is transmitted via redundant hardwired connections, and all peripherals of the controller must be redundant.

[0168] ② Transmission is carried out through a bus protocol with security measures. You can develop your own security protocol or adopt a common security protocol.

[0169] 16. Unsafe signals: Signals whose generation and transmission processes lack measures to ensure safety integrity, and signals for which no measures are taken to prevent random hardware failures and systemic failures. When performing functional safety design, it is necessary to analyze the impact of unsafe signal failures and tampering on safety functions.

[0170] 17. Active Slope Roll: An integrated function in the motor controller. To prevent the motor from overheating and being damaged due to prolonged stationary position on a slope, the motor controller actively controls the motor to slowly roll downhill. In engineering practice, the active slope roll function is entirely determined by the motor controller based on the speed command from the VCU and the actual motor speed; it generally does not require receiving slope roll commands from the VCU.

[0171] 18. Electronic parking brake function: The implementation of the parking brake does not completely depend on the operator's actions. The controller can detect the condition trigger according to the set logic and then automatically implement the braking.

[0172] 19. Active parking brake function: The implementation of the parking brake depends on the operator's actions, such as pure hydraulic and mechanical braking.

[0173] Example 2

[0174] Based on the electric forklift safety control method provided in Embodiment 1, this embodiment provides an electric forklift safety control system, including a safety controller VCU and a motor controller MCU. The safety controller VCU is communicatively connected to the motor controller MCU, and the safety controller VCU is configured to perform the following operations:

[0175] In response to the triggering of the overall machine safety function, it continuously sends the SS2 safety function activation command to the motor controller MCU and monitors whether the motor controller MCU sends SOS activation feedback;

[0176] In response to receiving an SOS activation feedback from the motor controller MCU, monitor whether the motor controller MCU has sent an active slope request;

[0177] In response to receiving the active ramp request sent by the motor controller MCU, it continuously sends the SS2 safety function reset command to the motor controller MCU, and monitors the motor speed fed back by the motor controller MCU after the motor controller MCU executes the active ramp control;

[0178] In response to the motor speed exceeding the set safe ramp speed limit fed back by the motor controller MCU, an audible and visual alarm signal is activated, and the status of exceeding the safe ramp speed is sent to the motor controller MCU.

[0179] The motor controller MCU is configured to perform the following operations:

[0180] In response to receiving the SS2 safety function activation command sent by the safety controller VCU, the motor deceleration state is continuously monitored to see if the set deceleration logic is met. If the set deceleration logic is met, the motor is monitored to see if it remains stationary after the motor speed is less than the set speed threshold.

[0181] In response to the motor speed remaining stationary after falling below the set speed threshold, the system sends a message to the safety controller VCU indicating that SOS has been activated and continuously monitors whether the safety controller VCU sends an SS2 safety function reset command.

[0182] In response to receiving the SS2 safety function reset command sent by the safety controller VCU, the SS2 safety state is deactivated, and the safety controller VCU is monitored to see if the motor speed exceeds the safe ramp speed.

[0183] In response to receiving a message from the safety controller VCU indicating that the motor speed exceeds the safe ramp speed, monitor whether the safety controller VCU sends an SS2 safety function activation command.

[0184] In this invention, the safety controller (VCU) is installed inside the machine and is used for input detection, logic judgment, and output control. The safety controller must meet functional safety certification. The motor controller (MCU) is installed inside the machine and is used to respond to VCU requests, controlling the torque (torque mode) or speed (speed mode) of the drive motor to enable the machine to move. The motor controller (M1) on new energy construction machinery needs to be certified according to IEC 61508 or IEC 13849-1 series standards to ensure its functional safety compliance. Forklifts generally use speed control mode. A buzzer is installed outside the machine to audibly alert surrounding personnel that the new energy construction machinery is in a dangerous state, preventing them from approaching and causing harm. An alarm light is installed on the outside of the machine in a conspicuous location to visually alert surrounding personnel that the new energy construction machinery is in a dangerous state, preventing them from approaching and causing harm. The service brake pedal is installed inside the machine for service braking. The accelerator pedal is installed inside the machine for acceleration and resetting safety functions. The accelerator pedal must be functional safety certified or have redundant analog inputs; VCU cross-verification can prove the correctness of the signal. The gear position controller is installed inside the unit and is used for gear selection and resetting safety functions. The gear position controller must be functionally safe or have three redundant DI inputs (forward, reverse, and neutral), and VCU cross-checking can verify the correctness of the signals.

[0185] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0186] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0187] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0188] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0189] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of the present invention without departing from the spirit and scope of the claims. All of these forms are within the protection scope of the present invention.

Claims

1. A safety control method for an electric forklift, characterized in that, The safety controller VCU is communicatively connected to the motor controller MCU. The method is executed by the safety controller VCU and includes: In response to the triggering of the overall machine safety function, it continuously sends the SS2 safety function activation command to the motor controller MCU and monitors whether the motor controller MCU sends SOS activation feedback; In response to receiving an SOS activation feedback from the motor controller MCU, monitor whether the motor controller MCU has sent an active slope request; In response to receiving the active ramp request sent by the motor controller MCU, it continuously sends the SS2 safety function reset command to the motor controller MCU, and monitors the motor speed fed back by the motor controller MCU after the motor controller MCU executes the active ramp control; In response to feedback from the motor controller MCU that the motor speed exceeds the set safe ramp speed limit, an audible and visual alarm signal is activated, and the status of exceeding the safe ramp speed is sent to the motor controller MCU.

2. The electric forklift safety control method according to claim 1, characterized in that, Also includes: In response to the absence of an active ramp request from the motor controller MCU, monitor whether the motor controller MCU has executed the STO program. If the STO program has been executed, restart and reset. In response to the motor controller MCU not executing the STO program, determine whether the conditions for triggering the whole machine safety function are met; In response to the conditions for triggering the whole machine safety function, it is determined whether the speed fed back by the motor controller MCU is 0, and at the same time, it is monitored whether the gear is reset; In response to the motor controller MCU feedback that the speed is 0, monitor whether the accelerator pedal and gear position have been reset; In response to the motor controller MCU feedback that the speed is not 0, monitor whether the accelerator pedal has been reset; In response to gear reset, monitor whether the active slope speed function is turned off; In response to accelerator pedal and gear reset, or accelerator pedal reset, or active coasting speed function deactivated, continuously send SS2 safety function reset command to motor controller MCU.

3. The electric forklift safety control method according to claim 1, characterized in that, The safety controller (VCU) is also configured with standard VCU procedures, including: Power on and perform self-test; In response to a successful self-test, the system receives and processes the overall machine status signal, sends torque or speed commands to the motor controller MCU, and simultaneously monitors whether the overall machine safety functions are triggered. In response to the activation of the overall safety function, a torque or speed command is sent to the motor controller MCU to set the torque or speed to 0.

4. A safety control method for an electric forklift, characterized in that, The safety controller VCU is communicatively connected to the motor controller MCU, and the method is executed by the motor controller MCU, including: In response to receiving the SS2 safety function activation command sent by the safety controller VCU, the motor deceleration state is continuously monitored to see if the set deceleration logic is met. If the set deceleration logic is met, the motor is monitored to see if it remains stationary after the motor speed is less than the set speed threshold. In response to the motor speed remaining stationary after falling below the set speed threshold, the system sends a message to the safety controller VCU indicating that SOS has been activated and continuously monitors whether the safety controller VCU sends an SS2 safety function reset command. In response to receiving the SS2 safety function reset command sent by the safety controller VCU, the SS2 safety state is deactivated, and the safety controller VCU is monitored to see if the motor speed exceeds the safe ramp speed. In response to receiving a message from the safety controller VCU indicating that the motor speed exceeds the safe ramp speed, monitor whether the safety controller VCU sends an SS2 safety function activation command.

5. The electric forklift safety control method according to claim 4, characterized in that, The deceleration logic is set to either decelerate to 0 within a specified time or decelerate to 0 at a specified slope.

6. The electric forklift safety control method according to claim 4, characterized in that, The static state refers to the motor's angle change being within a set range.

7. The electric forklift safety control method according to claim 4, characterized in that, When the motor deceleration state does not meet the set deceleration logic, the STO program is executed.

8. The electric forklift safety control method according to claim 4, characterized in that, If the motor does not remain stationary after its speed falls below the set speed threshold, the STO program will be executed.

9. The electric forklift safety control method according to claim 4, characterized in that, The motor controller MCU is also configured with a standard MCU program, including: Power on and perform self-test; In response to a successful self-test, the FOC algorithm is executed to perform torque or speed control, and the system monitors whether the SS2 safety function activation command is received from the safety controller VCU. In response to receiving the SS2 safety function activation command sent by the safety controller VCU, deceleration braking is performed, and it is determined whether the speed is less than the set threshold. In response to a speed less than a set threshold, it remains stationary and monitors whether the conditions for active slope slippage have been met; In response to the achievement of active slope conditions, an active slope request is sent to the safety controller VCU, and the SS2 safety function is monitored to see if it is deactivated. In response to the SS2 safety function being deactivated, active slope control is executed, and it is determined whether the motor speed exceeds the safe slope speed. If it exceeds the safe slope speed, it is determined whether the SS2 safety function activation command sent by the safety controller VCU has been received.

10. A safety control system for an electric forklift, characterized in that, It includes a safety controller (VCU) and a motor controller (MCU), wherein the safety controller (VCU) is communicatively connected to the motor controller (MCU), and the safety controller (VCU) is configured to perform the following operations: In response to the triggering of the overall machine safety function, it continuously sends the SS2 safety function activation command to the motor controller MCU and monitors whether the motor controller MCU sends SOS activation feedback; In response to receiving an SOS activation feedback from the motor controller MCU, monitor whether the motor controller MCU has sent an active slope request; In response to receiving the active ramp request sent by the motor controller MCU, it continuously sends the SS2 safety function reset command to the motor controller MCU, and monitors the motor speed fed back by the motor controller MCU after the motor controller MCU executes the active ramp control; In response to the motor speed exceeding the set safe ramp speed limit fed back by the motor controller MCU, an audible and visual alarm signal is activated, and the status of exceeding the safe ramp speed is sent to the motor controller MCU. The motor controller MCU is configured to perform the following operations: In response to receiving the SS2 safety function activation command sent by the safety controller VCU, the motor deceleration state is continuously monitored to see if the set deceleration logic is met. If the set deceleration logic is met, the motor is monitored to see if it remains stationary after the motor speed is less than the set speed threshold. In response to the motor speed remaining stationary after falling below the set speed threshold, the system sends a message to the safety controller VCU indicating that SOS has been activated and continuously monitors whether the safety controller VCU sends an SS2 safety function reset command. In response to receiving the SS2 safety function reset command sent by the safety controller VCU, the SS2 safety state is deactivated, and the safety controller VCU is monitored to see if the motor speed exceeds the safe ramp speed. In response to receiving a message from the safety controller VCU indicating that the motor speed exceeds the safe ramp speed, monitor whether the safety controller VCU sends an SS2 safety function activation command.

Images