A safety drive circuit of an electric forklift main contactor

Abstract

The application discloses a kind of safety driving circuit of electric fork truck main contactor, specifically relates to electric fork truck safety control technical field, including: MCU control unit, including hardware architecture and the microcontroller of different model;NAND gate control circuit, the output end of two microcontrollers is respectively connected to the input end;Power drive circuit, its input end is connected to NAND gate output end;Main contactor coil circuit, its output end is connected to the other input end of power drive circuit;Current detection circuit, its input end is connected to the output end of power drive circuit;Overcurrent protection circuit, its input end is connected to the output end of current detection circuit, and the output end is connected to the input end of power drive circuit;State acquisition circuit, its input end is connected to the common node between coil circuit and power drive circuit;Two state feedback circuits, the input end of both is connected to the output end of state acquisition circuit, and the output end is respectively connected to the input end of two microcontrollers.The application solves the problem by hardware interlock, independent hardware overcurrent protection and double-way feedback.

Description

Technical Field

[0001] This invention relates to the field of electric forklift safety control technology, and more specifically, to a safety drive circuit for an electric forklift main contactor. Background Technology

[0002] Electric forklifts are powered by batteries, and the main contactor, connected in series in the high-voltage power circuit, is the core safety component controlling the on / off state of the high-voltage circuit and enabling emergency shutdown. A typical existing main contactor drive circuit uses a single MCU control architecture: the MCU outputs a single switch control signal, which, via a drive circuit (such as a MOSFET or IGBT), controls the on / off state of the main contactor coil; simultaneously, a sampling resistor detects the coil current, which is then sent to the MCU via an ADC for overcurrent detection and protection; status feedback typically uses a single digital signal to send the status of the contactor auxiliary contacts or coil voltage back to the MCU for fault diagnosis. This architecture is simple and low-cost, and is widely used in conventional electric forklifts.

[0003] However, the aforementioned single-MCU drive architecture suffers from a critical technical problem: an extremely high risk of single-point failure. When the sole MCU crashes, the program malfunctions, I / O ports fail, or the ADC malfunctions, not only may the drive control signals become uncontrollable (contactors may fail to disconnect properly or engage abnormally), but overcurrent protection and fault diagnosis functions will also be completely lost. Because the control system cannot recognize the MCU's own fault state, nor can it independently trigger a safety shutdown when the MCU fails, the entire drive circuit fails to meet the diagnostic coverage and fault tolerance requirements of the PLD performance level in the ISO 13849-1 standard.

[0004] To address the aforementioned deficiencies, this invention proposes a safety drive circuit for the main contactor of an electric forklift as a further improvement. This circuit completely eliminates the potential for single-point failures at the hardware architecture level, reduces the fault response time from milliseconds to microseconds, significantly improves diagnostic coverage, and effectively avoids common-cause failures. Consequently, the drive circuit of the main contactor of the electric forklift fully meets the functional safety level of PLd in the ISO 13849-1 standard. Summary of the Invention

[0005] In order to overcome the above-mentioned defects of the prior art, embodiments of the present invention provide a safety drive circuit for the main contactor of an electric forklift to solve the problems mentioned in the background art.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a safety drive circuit for the main contactor of an electric forklift, the circuit comprising: The MCU control unit includes at least two microcontrollers with different hardware architectures and models; the multiple microcontrollers are bidirectionally connected to each other. The NAND gate control circuit has multiple input terminals that are electrically connected to the output terminals of multiple microcontrollers of the MCU control unit. A power drive circuit, wherein one input terminal of the power drive circuit is electrically connected to the output terminal of the NAND gate control circuit; The main contactor coil circuit, wherein the output terminal of the main contactor coil circuit is electrically connected to the other input terminal of the power drive circuit; A current detection circuit, wherein the input terminal of the current detection circuit is electrically connected to the output terminal of the power drive circuit; An overcurrent protection circuit is provided, wherein the input and output terminals of the overcurrent protection circuit are electrically connected to the output terminal of the current detection circuit and the input terminal of the power drive circuit, respectively. A status acquisition circuit, wherein the input terminal of the status acquisition circuit is electrically connected to the common node between the main contactor coil circuit and the power drive circuit; The input terminals of the multiple state feedback circuits are electrically connected to the output terminals of the state acquisition circuit, and the output terminals of the multiple state feedback circuits are respectively electrically connected to the input terminals of the multiple microcontrollers of the MCU control unit.

[0007] Furthermore, the MCU control unit includes: a first microcontroller MCU1 and a second microcontroller MCU2; the first microcontroller MCU1 and the second microcontroller MCU2 are bidirectionally connected via a CAN bus. The output terminals of the first microcontroller MCU1 and the second microcontroller MCU2 are electrically connected to the two input terminals of the NAND gate control circuit, respectively.

[0008] Furthermore, the NAND gate control circuit includes: a NAND gate chip, a current-limiting resistor R3, and a pull-up resistor R1; The output terminal of the NAND gate chip is electrically connected to the input terminal of the power drive module through a current-limiting resistor R3, and the common node between the current-limiting resistor R3 and the input terminal of the power drive module is electrically connected to the first power supply terminal through a pull-up resistor R1.

[0009] Furthermore, the power drive circuit includes: a power MOSFET, a filter capacitor C2, a gate drive resistor R4, a pull-up resistor R2, a comparator, and a feedback capacitor C1; The output of the NAND gate chip is electrically connected to the first input of the comparator through a current-limiting resistor R3; the output of the comparator is electrically connected to the gate G of the power MOSFET through a gate drive resistor R4; the common node between the output of the comparator and the gate drive resistor R4 is also electrically connected to the pull-up resistor R2 and the feedback capacitor C1, respectively, and the other end of the pull-up resistor R2 is electrically connected to the second power supply terminal; the other end of the feedback capacitor C1 is electrically connected to the second input of the comparator; the drain D of the power MOSFET is electrically connected to the output of the main contactor coil circuit and the filter capacitor C2, respectively, and the other end of the filter capacitor C2 is connected to GND; the source S of the power MOSFET is electrically connected to the input of the current detection circuit.

[0010] Furthermore, the main contactor coil circuit includes: a main contactor coil K1 and a freewheeling diode D1; One end of the main contactor coil K1 and the cathode of the freewheeling diode D1 are both electrically connected to the power supply COIL_RETURN terminal; the common node between the filter capacitor C2 and the drain D of the power MOSFET is also electrically connected to the other end of the main contactor coil K1 and the anode of the freewheeling diode D1.

[0011] Furthermore, the current detection circuit includes: a sampling resistor R11, a low-pass filter resistor R8, and a capacitor C6; The source S of the power MOSFET is electrically connected to the sampling resistor R11 and the low-pass filter resistor R8, respectively; the other end of the sampling resistor R11 is connected to GND; the other end of the low-pass filter resistor R8 is connected to GND through capacitor C6.

[0012] Furthermore, the overcurrent protection circuit includes: an NPN transistor Q2, a pull-up resistor R6, and a capacitor C5; The base B of the NPN transistor Q2 is electrically connected to the common node between the low-pass filter resistor R8 and the capacitor C6; the collector C of the NPN transistor Q2 is electrically connected to the pull-up resistor R6 and the capacitor C5 respectively, and the other end of the pull-up resistor R6 is electrically connected to the first power supply terminal; the other end of the capacitor C5 and the emitter E of the NPN transistor Q2 are both connected to GND; the common node between the collector C of the NPN transistor Q2, the pull-up resistor R6 and the capacitor C5 is electrically connected to the common node between the feedback capacitor C1 and the second input terminal of the comparator.

[0013] Furthermore, the status acquisition circuit includes: voltage divider resistor R5, voltage divider resistor R9, filter capacitor C4, and clamping diode D3; The common node between the filter capacitor C2, the drain D of the power MOSFET, one end of the main contactor coil K1, and the anode of the freewheeling diode D1 is also electrically connected to one end of the voltage divider resistor R5. The other end of the voltage divider resistor R5 is electrically connected to one end of the voltage divider resistor R9, one end of the filter capacitor C4, and the anode of the clamping diode D3, respectively. The other ends of the voltage divider resistor R9 and the filter capacitor C4 are both connected to GND. The cathode of the clamping diode D3 is electrically connected to the clamping power supply terminal. The common node between the voltage divider resistor R5, the voltage divider resistor R9, the filter capacitor C4, and the anode of the clamping diode D3 is electrically connected to the input terminal of the state feedback circuit.

[0014] Furthermore, the state feedback circuit includes: a first isolation buffer U5A and a second isolation buffer U5B; The input terminals of the first isolation buffer U5A and the second isolation buffer U5B are both electrically connected to the common node between the anodes of the voltage divider resistor R5, the voltage divider resistor R9, the filter capacitor C4, and the clamping diode D3; the output terminals of the first isolation buffer U5A and the second isolation buffer U5B are respectively electrically connected to the input terminals of the first microcontroller MCU1 and the second microcontroller MCU2.

[0015] Furthermore, it also includes: a power supply decoupling capacitor C3; one end of the power supply decoupling capacitor C3 is electrically connected to the comparator power supply input terminal and the second power supply terminal respectively; the other end of the power supply decoupling capacitor C3 is connected to GND.

[0016] The technical effects and advantages of this invention are as follows: 1. Compared with existing technologies, this invention completely eliminates the risk of single-point failure at the system level through an architecture design that utilizes at least two microcontrollers with different hardware architectures and models within the MCU control unit, hardware interlocking of the NAND gate control circuit, an overcurrent protection circuit independent of the MCU, and dual-channel status feedback and redundant acquisition. The NAND gate requires all microcontrollers to output valid signals simultaneously to drive the main contactor; if any microcontroller fails to output an abnormal signal due to self-test failure, program crash, or I / O port failure, the drive signal is immediately cut off at the hardware level. Simultaneously, the pure hardware overcurrent protection circuit can achieve microsecond-level forced shutdown without relying on any microcontroller, and the dual-channel status feedback provides independent diagnostic information for each microcontroller, supporting cross-validation. Calculations show that the mean time to safety (MTTFd) of this invention is ≥10 years, and the average diagnostic coverage (DCavg) is ≥90%, fully meeting the compliance requirements of the PLd functional safety level and Cat2 architecture in ISO 13849-1 standard, significantly outperforming existing single-MCU or dual-MCU solutions of the same model.

[0017] 2. Compared with existing technologies, by setting up bidirectional communication between the first and second microcontrollers via a CAN bus, real-time exchange of self-test status and diagnostic results can be achieved, enabling collaborative fault judgment and redundant heartbeat monitoring, avoiding unilateral misjudgment. Current-limiting resistors and pull-up resistors are set in the NAND gate control circuit to ensure the stability of the logic level and driving capability. The power drive circuit uses a comparator-driven power MOSFET, combined with a gate drive resistor, pull-up resistor, and feedback capacitor, to achieve fast and smooth switching control while suppressing oscillation. The freewheeling diode in the main contactor coil circuit effectively absorbs turn-off spikes, protecting the power transistor. The current detection circuit uses a high-precision alloy sampling resistor and a low-pass filter to provide an accurate, low-noise current sampling signal. The overcurrent protection circuit compares the base conduction threshold of the NPN transistor with the sampling voltage, achieving precision and enabling independent overcurrent safety shutdown even if both MCUs completely fail. The status acquisition circuit uses voltage divider resistors, filter capacitors, and clamping diodes to safely reduce the voltage on the high-voltage coil side to a low-voltage logic level and limit the input voltage range. Dual-channel isolation buffers provide isolated drive with high input impedance and low output impedance, avoiding mutual interference between the two microcontroller inputs and further improving diagnostic coverage to over 99%. Power supply decoupling capacitors effectively suppress comparator power supply noise, ensuring the accuracy of analog comparisons. These refined designs work together to enable this invention to further reduce the risk of common-cause faults while meeting PLD requirements, and achieve diagnostic coverage and fault response speed far exceeding standard requirements. Attached Figure Description

[0018] Figure 1 This is a schematic diagram of the circuit loop of the present invention.

[0019] Figure 2 This is the circuit diagram of the present invention.

[0020] The attached diagram is labeled as follows: 1. MCU control unit; 2. NAND gate control circuit; 3. Power drive circuit; 4. Main contactor coil circuit; 5. Current detection circuit; 6. Overcurrent protection circuit; 7. Status acquisition circuit; 8. Status feedback circuit. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0022] As attached Figure 1 and attached Figure 2The diagram shows a safety drive circuit for the main contactor of an electric forklift. The circuit includes: an MCU control unit 1, a NAND gate control circuit 2, a power drive circuit 3, a main contactor coil circuit 4, a current detection circuit 5, an overcurrent protection circuit 6, a status acquisition circuit 7, and a status feedback circuit 8; all the hardware involved conforms to the ISO 13849-1 standard Cat2 architecture. The MCU control unit 1 includes at least two microcontrollers with different hardware architectures and models; multiple microcontrollers are bidirectionally connected; the hardware architecture includes a core architecture; for example, the MCU control unit 1 includes a first microcontroller MCU1 and a second microcontroller MCU2; the first microcontroller MCU1 and the second microcontroller MCU2 are bidirectionally connected via a CAN bus to achieve bidirectional communication and state synchronization; the output terminals of the first microcontroller MCU1 and the second microcontroller MCU2 are electrically connected to the two input terminals of the NAND gate control circuit 2, that is, their general-purpose I / O ports are independently connected to the two input terminals of the NAND gate control circuit 2. The first microcontroller MCU1 and the second microcontroller MCU2 run independently compiled control programs and diagnostic logic, with a diagnostic cycle of no more than 10ms, which meets the periodic diagnostic requirements of the Cat2 architecture; the specific control programs and diagnostic logic are existing technologies in this field and will not be further described here. In this embodiment, the first microcontroller MCU1 uses an ARM Cortex-M4 core, while the second microcontroller MCU2 uses an ARM Cortex-M3 core. The two microcontrollers have completely different core architectures and hardware models, running independently compiled control programs and diagnostic logic to avoid common-cause faults at both the hardware and software levels. The diagnostic cycle for both MCUs is set to 10ms, which meets the requirements of the Cat2 architecture for periodic fault diagnosis. The calculated common-cause fault CCF score for the two MCUs is 72 points, satisfying the requirement of a PLD level ≥ 65 points.

[0023] The multiple input terminals of the NAND gate control circuit 2 are electrically connected to the output terminals of multiple microcontrollers in the MCU control unit 1, respectively. The NAND gate control circuit 2 has multiple input terminals, each corresponding to one of the microcontrollers in the MCU control unit 1; that is, each input terminal of the NAND gate control circuit 2 is electrically connected to the output terminal of the corresponding microcontroller. For example, the NAND gate control circuit 2 includes: a NAND gate chip, a current-limiting resistor R3, and a pull-up resistor R1. The NAND gate chip is a U3A, and its output terminal is electrically connected to the input terminal of the power drive module through the current-limiting resistor R3. The common node between the current-limiting resistor R3 and the input terminal of the power drive module is electrically connected to the first power supply terminal through the pull-up resistor R1. like Figure 2As shown, in this embodiment, pin 18 of the PB0 port of the first microcontroller MCU1 is used as the output terminal, and pin 6 of the PA0 port of the second microcontroller MCU2 is used as the output terminal. The NAND gate control circuit 2 uses a NAND gate chip with two inputs corresponding to the number of microcontrollers in the MCU control unit 1. Its A port serves as the input terminal to receive the control signal output by the first microcontroller MCU1, its B port serves as the input terminal to receive the control signal output by the second microcontroller MCU2, and its C port serves as the output terminal of the NAND gate to output the drive enable signal. Since pin 2 of the comparator in the power drive circuit 3 serves as the input terminal, the output terminal of the NAND gate chip is electrically connected to it through the current limiting resistor R3. The current limiting resistor R3 limits the current input to pin 2 of the NAND gate chip. The first power supply terminal is set to 3.3V, so the pull-up resistor R1 pulls the input terminal of the power drive circuit 3 up to 3.3V, ensuring that the power MOSFET of the power drive circuit 3 does not work when powered on, and the main contactor switch does not engage. The NAND gate chip outputs a valid low-level drive signal only when both the first microcontroller MCU1 and the second microcontroller MCU2 simultaneously output a valid high-level signal; the corresponding logic truth table is as follows:

[0024] Only when A=1 and B=1, C=0, the power MOSFET is turned on, and the main contactor switch is engaged; in all other combinations, C=1, the drive circuit is forcibly shut off, and the main contactor is disengaged.

[0025] One input terminal of the power drive circuit 3 is electrically connected to the output terminal of the NAND gate control circuit 2. For example, the power drive circuit 3 includes a power MOSFET, a filter capacitor C2, a gate drive resistor R4, a pull-up resistor R2, a comparator, and a feedback capacitor C1. The power MOSFET is an N-channel power MOSFET FET1, which is used to drive the main contactor coil K1 of the main contactor coil circuit 4 to turn on and off. The gate drive resistor R4 is used to drive the gate G of the power MOSFET. The pull-up resistor R2 is used to pull up the gate G of the power MOSFET to a certain voltage to ensure that the power MOSFET can be reliably turned on. The comparator is U2A. The feedback capacitor C1 is used to prevent the comparator from oscillating.

[0026] like Figure 2As shown, the comparator's pin 1 serves as the output, its second negative pin as the first input, its third positive pin as the second input, its fourth pin as the GND terminal, and its eighth pin as the power supply terminal. The output of the NAND gate is electrically connected to the comparator's first input through a current-limiting resistor R3. The comparator's output is electrically connected to the gate G of the power MOSFET through a gate drive resistor R4. The common node between the comparator's output and the gate drive resistor R4 is also electrically connected to a pull-up resistor R2 and a feedback capacitor C1, respectively. The other end of the pull-up resistor R2... The second power supply terminal is electrically connected to the second power supply terminal, which is set to 15V so that the pull-up resistor R2 pulls the power MOSFET to 15V to ensure reliable conduction. The other end of the feedback capacitor C1 is electrically connected to the second input terminal of the comparator, that is, the feedback capacitor C1 is connected between the first and third pins of the comparator to prevent the comparator from oscillating. The drain D of the power MOSFET is electrically connected to the output terminal of the main contactor coil circuit 4 and the filter capacitor C2, respectively. The other end of the filter capacitor C2 is connected to GND. The source S of the power MOSFET is electrically connected to the input terminal of the current detection circuit 5.

[0027] The logic truth table of power drive circuit 3 is as follows:

[0028] The power drive circuit 3 uses a comparator and operates as follows: When pin 2 of U2A is low and pin 3 is high, pin 1 outputs a high level, the gate G of the power MOSFET is high, the power MOSFET is turned on, and the main contactor switch is energized. When the input level of pin 2 of the comparator is high and the input level of pin 3 is high, the output level of pin 1 is low, the gate G of the power MOSFET is low, the power MOSFET is turned off, and the main contactor switch is opened. When pin 3 of the comparator is low, regardless of whether the input at pin 2 is low or high, the output at pin 1 is low. When the gate G of the power MOSFET is low, the power MOSFET is turned off, and the main contactor switch is open.

[0029] The output terminal of the main contactor coil circuit 4 is electrically connected to the other input terminal of the power drive circuit 3. For example, the main contactor coil circuit 4 includes a main contactor coil K1 and a freewheeling diode D1. One end of the main contactor coil K1 and the cathode of the freewheeling diode D1 are both electrically connected to the power supply COIL_RETURN terminal. The common node between the filter capacitor C2 and the drain D of the power MOSFET is also electrically connected to the other end of the main contactor coil K1 and the anode of the freewheeling diode D1. The freewheeling diode D1 is used to discharge the reverse electromotive force when the main contactor switch is turned off. That is, when the power MOSFET is turned off, the load of the main contactor coil K1 provides a reverse electromotive force discharge path to prevent the power MOSFET from being broken down by reverse voltage.

[0030] The input terminal of the current detection circuit 5 is electrically connected to the output terminal of the power drive circuit 3. For example, the current detection circuit 5 includes a sampling resistor R11, a low-pass filter resistor R8, and a capacitor C6. The source S of the power MOSFET is electrically connected to both the sampling resistor R11 and the low-pass filter resistor R8. The other end of the sampling resistor R11 is connected to GND. The other end of the low-pass filter resistor R8 is connected to GND through the capacitor C6. Therefore, the low-pass filter resistor R8 and the capacitor C6 form a low-pass filter to filter the voltage sampled by the sampling resistor R11.

[0031] The input and output terminals of the overcurrent protection circuit 6 are electrically connected to the output terminal of the current detection circuit 5 and the input terminal of the power drive circuit 3, respectively. For example, the overcurrent protection circuit 6 includes an NPN transistor Q2, a pull-up resistor R6, and a capacitor C5. The base B of the NPN transistor Q2 is electrically connected to the common node between the low-pass filter resistor R8 and the capacitor C6. That is, the base B of the NPN transistor Q2 is electrically connected to the output terminal of the current detection circuit 5. The collector C of the NPN transistor Q2 is electrically connected to the pull-up resistor R6 and the capacitor C5, respectively. The other end of the pull-up resistor R6 is electrically connected to the first power supply terminal, so the pull-up resistor R6 is pulled up to 3.3V. The other end of the capacitor C5 and the emitter E of the NPN transistor Q2 are both connected to GND. The common node between the collector C of the NPN transistor Q2, the pull-up resistor R6, and the capacitor C5 is electrically connected to the common node between the feedback capacitor C1 and the second input terminal of the comparator. The capacitor C5 is mainly used for filtering.

[0032] When the current in the current detection circuit 5 exceeds 3.5A, the voltage sent to the overcurrent protection circuit 6 exceeds 0.7V. At this time, NPN transistor Q2 turns on, and the collector voltage (C) of NPN transistor Q2 is 0V. It is connected to pin 3 of the comparator in the power drive circuit 3, turning off the power MOSFET and thus disconnecting the main contactor coil K1. Conversely, when the current in the current detection circuit 5 does not exceed 3.5A, the base voltage (B) of NPN transistor Q2 is less than 0.7V, and NPN transistor Q2 does not turn on. At this time, pin 3 of the comparator in the power drive circuit 3 is at a high level of 3.3V, and the power MOSFET is driven by the output of the NAND gate control circuit 2.

[0033] In the current detection circuit 5, the sampling resistor R11 is a high-precision alloy resistor with a resistance of 200mΩ, a rated power of 3W, and an accuracy of ±1%. It is used to convert the current signal into a voltage signal. The formula for calculating the converted voltage value is shown below. ; in: This is the voltage after sampling and conversion. R11 is the sampling resistor, representing the current flowing through the power MOSFET. Therefore, the sampling voltage value generated across the sampling resistor R11 by the 3.5A loop current... The calculated value is 0.7V, which is the critical value for overcurrent.

[0034] The input terminal of the status acquisition circuit 7 is electrically connected to the common node between the main contactor coil circuit 4 and the power drive circuit 3. For example, the status acquisition circuit 7 includes: voltage divider resistor R5, voltage divider resistor R9, filter capacitor C4, and clamping diode D3. The common node between the filter capacitor C2, the drain D of the power MOSFET, one end of the main contactor coil K1, and the anode of the freewheeling diode D1 is also electrically connected to one end of the voltage divider resistor R5. The other end of the voltage divider resistor R5 is electrically connected to one end of the voltage divider resistor R9, one end of the filter capacitor C4, and the anode of the clamping diode D3. The other end of the voltage divider resistor R9 and the other end of the filter capacitor C4 are both connected to GND. The cathode of the clamping diode D3 is electrically connected to the clamping power supply terminal. The common node between the voltage divider resistor R5, voltage divider resistor R9, filter capacitor C4, and the anode of the clamping diode D3 is electrically connected to the input terminal of the status feedback circuit 8.

[0035] like Figure 2As shown: Voltage divider resistors R5 and R9 divide the voltage passing through the main contactor coil K1. When the power MOSFET is turned on, the voltage Vstatus at the common node between the voltage divider resistors R5 and R9, the filter capacitor C4, and the anode of the clamping diode D3 is 0V. When the power MOSFET is turned off, this voltage Vstatus is lower than the clamping voltage. Vstatus is filtered by the filter capacitor C4 and clamped by the clamping diode D3, and then sent to two status feedback circuits respectively.

[0036] The input terminals of multiple state feedback circuits 8 are electrically connected to the output terminals of the state acquisition circuit 7, and the output terminals of the multiple state feedback circuits 8 are electrically connected to the input terminals of multiple microcontrollers of the MCU control unit 1. For example, the state feedback circuit 8 includes a first isolation buffer U5A and a second isolation buffer U5B. Both of these isolation buffers use tri-state buffer chips, and the two buffers are independent of each other and have no electrical coupling, avoiding the impact of a single-path feedback failure on the other path. The input terminals of the first isolation buffer U5A and the second isolation buffer U5B are both electrically connected to the common node between the anodes of the voltage divider resistor R5, the voltage divider resistor R9, the filter capacitor C4, and the clamping diode D3. The output terminals of the first isolation buffer U5A and the second isolation buffer U5B are electrically connected to the input terminals of the first microcontroller MCU1 and the second microcontroller MCU2, respectively.

[0037] like Figure 2 As shown, pin 19 of port PB1 of the first microcontroller MCU1 is used as the input terminal, and pin 9 of port PA3 of the second microcontroller MCU2 is used as the input terminal. The first isolation buffer U5A and the second isolation buffer U5B are independently connected to the input terminals for status detection of the first microcontroller MCU1 and the second microcontroller MCU2, respectively, to realize dual-channel independent acquisition of drive status. The dual MCUs can identify various fault modes such as drive circuit disconnection, short circuit, MOSFET failure, and feedback circuit failure through CAN bus cross-verification, with a diagnostic coverage of ≥99%.

[0038] The circuit of the present invention further includes: a power supply decoupling capacitor C3, used to ensure the power supply stability of the comparator; one end of the power supply decoupling capacitor C3 is electrically connected to the power supply input terminal and the second power supply terminal of the comparator respectively; the other end of the power supply decoupling capacitor C3 is connected to GND.

[0039] Workflow of this invention: Power-on initialization and self-test process: After the system is powered on, both the first microcontroller MCU1 and the second microcontroller MCU2 of MCU control unit 1 complete independent hardware self-tests (including power supply, clock, I / O ports, and CAN interface). They then complete handshake synchronization via the CAN bus to confirm that the two MCUs are communicating normally and in the same state. If either MCU fails its self-test or has a communication error, that MCU will continuously output a low-level control signal, forcibly shutting down the drive circuit and preventing it from starting.

[0040] Normal drive workflow; When the vehicle controller issues a contactor engagement command, the first microcontroller MCU1 and the second microcontroller MCU2 independently complete safety logic checks. After confirming there is no fault, they simultaneously output high-level control signals to the two input terminals of the NAND gate control circuit 2. The low-level signal output by the NAND gate control circuit 2 is sent to the power drive circuit 3. During the drive process, the first microcontroller MCU1 and the second microcontroller MCU2 complete state synchronization and loop diagnosis every 10ms, which meets the periodic diagnostic requirements of the Cat2 architecture.

[0041] Hardware overcurrent protection workflow: The overcurrent protection circuit 6 is connected in series in the power drive circuit 3. Its core function is to achieve hardware shutdown independent of the MCU through three stages: current-to-voltage conversion, filtering, and voltage comparison. The specific working process and parameter calculations are as follows: Current-to-voltage conversion stage: The entire operating current of the power drive circuit 3 flows through the sampling resistor R11, which is connected in series between the source (S) and GND of the power MOSFET. This resistor is a high-precision alloy resistor with a resistance of 200mΩ, a rated power of 3W, and an accuracy of ±1%. According to Ohm's law, the sampling voltage generated across the sampling resistor R11 by this current is... If the overcurrent protection threshold is set to 3.5A, when the loop current reaches this threshold, the corresponding sampling voltage is... .

[0042] Filtering Stage: To ensure a more stable 0.7V sampling voltage, an RC low-pass filter composed of resistor R8 and capacitor C6 is used to filter out high-frequency signal components from the signal before feeding it into the second input of the comparator. The cutoff frequency of the low-pass filter is:

[0043] Where R8=1K C6 = 10nF, substitute into the formula to calculate the cutoff frequency. .

[0044] Overcurrent protection and shutdown: Under normal operating conditions, the current through the sampling resistor R11 is less than 3.5A, and the sampling voltage... With a reference voltage less than 0.7V, NPN transistor Q2 is not turned on, and its collector C is at a high level, connected to pin 3 of the comparator in power drive circuit 3, without affecting the normal driving of the power MOSFET; when a short circuit or overcurrent fault occurs in the circuit containing sampling resistor R11, and the current exceeds 3.5A, the sampling voltage... When the reference voltage exceeds 0.7V, NPN transistor Q2 immediately turns on, and its collector C goes low. This signal, connected to pin 3 of the comparator in power drive circuit 3, forces the gate G of the power MOSFET to go low, turning off the power MOSFET and achieving hardware overcurrent protection. The entire protection process is implemented entirely by hardware circuitry, without the need for MCU software intervention. The response time is ≤1μs, and even if both MCUs fail completely, the power circuit can still be reliably shut off.

[0045] Status feedback and fault diagnosis process: The common node between the filter capacitor C2, the drain D of the power MOSFET, one end of the main contactor coil K1, and the anode of the freewheeling diode D1 is the status acquisition point Vstatus of the drive circuit. It reflects the actual on / off state of the power MOSFET in real time: Vstatus is low when the power MOSFET is on and high when it is off. The clamping diode D3 is used to limit the status signal voltage to the limiting voltage at the clamping power supply terminal, protecting the subsequent circuitry.

[0046] The status signal output from the status acquisition point is sent to the corresponding status detection I / O ports of the first microcontroller MCU1 and the second microcontroller MCU2 via two independent isolation buffers, the first isolation buffer U5A and the second isolation buffer U5B, respectively. The two MCUs independently acquire the status signal and compare it with their own output control signal for verification. If one of the MCUs (the first microcontroller MCU1 or the second microcontroller MCU2) outputs a high-level drive signal, but a high-level feedback signal is collected, it is determined that the power MOSFET is not turned on or the drive circuit is disconnected. If one of the MCUs (the first microcontroller MCU1 or the second microcontroller MCU2) outputs a low-level shutdown signal, but a low-level feedback signal is collected, it is determined that the power MOSFET is broken down or the drive circuit is short-circuited.

[0047] In this system, the first microcontroller MCU1 and the second microcontroller MCU2 cross-verify the status signals acquired via the CAN bus. If either MCU detects a fault, it immediately pulls the control signal low, forcibly shutting down the drive circuit, and simultaneously reports the fault to the vehicle controller. Calculations show that this embodiment, through dual-path independent feedback and dual-MCU cross-verification, can identify over 96% of dangerous faults in the drive circuit, with an average diagnostic coverage rate (DCavg) of 96%, meeting the PLD level requirement of ≥90%.

[0048] Abnormal operating condition safety handling procedures: When any of the following abnormal operating conditions occur in the system, the drive circuit will be forcibly shut down and enter a safe state: 1. Either the first microcontroller MCU1 or the second microcontroller MCU2 outputs a low-level control signal; 2. Communication between the two MCUs is interrupted, and their states are out of sync; 3. The current in the loop containing the sampling resistor R11 exceeds 3.5A, triggering the hardware overcurrent protection; 4. If the status feedback signal is inconsistent with the control command, it is determined to be a loop fault; 5. Any MCU self-test fails, program crashes, or watchdog timer is reset.

[0049] It should be noted that the safety drive circuit of this invention fully complies with the performance level requirements of ISO 13849-1 standard PLd. The corresponding core functional safety parameters are calculated as follows: 1. Mean Time To Failure (MTTFd): Based on the B10 lifetime parameters of components in the standard, the B10 lifetime of the power MOSFET Q1 is 1×10^7 cycles, and the B10 lifetime of the contactor is 1×10^6 cycles. Combined with the annual working cycle of the system, the MTTFd of the system is calculated to be 32 years, far exceeding the threshold of ≥10 years required by the PLd level; 2. Average Diagnostic Coverage (DCavg): This invention, through dual-path independent status feedback, hardware overcurrent protection, and dual MCU cross-verification, can identify 96% of dangerous faults in the drive circuit. The calculated DCavg is 96%, meeting the threshold of ≥90% required by the PLd level; 3. Common Cause Fault (CCF) Score: Through the design of different dual MCUs, independent hardware protection, redundant feedback channels, and separate power supply design, the common cause fault score reaches 72 points, meeting the threshold of ≥65 points required by the PLd level.

[0050] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

[0051] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0052] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A safety drive circuit for the main contactor of an electric forklift, characterized in that, The circuit includes: The MCU control unit (1) includes at least two microcontrollers with different hardware architectures and models; the multiple microcontrollers are bidirectionally connected to each other. NAND gate control circuit (2), wherein multiple input terminals of the NAND gate control circuit (2) are electrically connected to the output terminals of multiple microcontrollers of the MCU control unit (1); A power drive circuit (3) is provided, wherein one input terminal of the power drive circuit (3) is electrically connected to the output terminal of the NAND gate control circuit (2); The main contactor coil circuit (4) is electrically connected to the other input terminal of the power drive circuit (3). A current detection circuit (5) is provided, the input terminal of which is electrically connected to the output terminal of the power drive circuit (3). The overcurrent protection circuit (6) is electrically connected to the output terminal of the current detection circuit (5) and the input terminal of the power drive circuit (3), respectively. The state acquisition circuit (7) is electrically connected to the common node between the main contactor coil circuit (4) and the power drive circuit (3). The input terminals of the multiple state feedback circuits (8) are electrically connected to the output terminals of the state acquisition circuit (7), and the output terminals of the multiple state feedback circuits (8) are electrically connected to the input terminals of the multiple microcontrollers of the MCU control unit (1).

2. The safety drive circuit for the main contactor of an electric forklift according to claim 1, characterized in that: The MCU control unit (1) includes: a first microcontroller MCU1 and a second microcontroller MCU2; the first microcontroller MCU1 and the second microcontroller MCU2 are bidirectionally connected via a CAN bus. The output terminal of the first microcontroller MCU1 and the output terminal of the second microcontroller MCU2 are electrically connected to the two input terminals of the NAND gate control circuit (2), respectively.

3. The safety drive circuit for the main contactor of an electric forklift according to claim 2, characterized in that: The NAND gate control circuit (2) includes: a NAND gate chip, a current limiting resistor R3, and a pull-up resistor R1; The output terminal of the NAND gate chip is electrically connected to the input terminal of the power drive module through a current-limiting resistor R3, and the common node between the current-limiting resistor R3 and the input terminal of the power drive module is electrically connected to the first power supply terminal through a pull-up resistor R1.

4. The safety drive circuit for the main contactor of an electric forklift according to claim 3, characterized in that: The power drive circuit (3) includes: a power MOSFET, a filter capacitor C2, a gate drive resistor R4, a pull-up resistor R2, a comparator, and a feedback capacitor C1; The output terminal of the NAND gate chip is electrically connected to the first input terminal of the comparator through a current-limiting resistor R3; the output terminal of the comparator is electrically connected to the gate G of the power MOSFET through a gate drive resistor R4; the common node between the output terminal of the comparator and the gate drive resistor R4 is also electrically connected to the pull-up resistor R2 and the feedback capacitor C1 respectively, and the other end of the pull-up resistor R2 is electrically connected to the second power supply terminal; the other end of the feedback capacitor C1 is electrically connected to the second input terminal of the comparator; the drain D of the power MOSFET is electrically connected to the output terminal of the main contactor coil circuit (4) and the filter capacitor C2 respectively, and the other end of the filter capacitor C2 is connected to GND; the source S of the power MOSFET is electrically connected to the input terminal of the current detection circuit (5).

5. The safety drive circuit for the main contactor of an electric forklift according to claim 4, characterized in that: The main contactor coil circuit (4) includes: main contactor coil K1 and freewheeling diode D1; One end of the main contactor coil K1 and the cathode of the freewheeling diode D1 are both electrically connected to the power supply COIL_RETURN terminal; the common node between the filter capacitor C2 and the drain D of the power MOSFET is also electrically connected to the other end of the main contactor coil K1 and the anode of the freewheeling diode D1.

6. The safety drive circuit for the main contactor of an electric forklift according to claim 4, characterized in that: The current detection circuit (5) includes: a sampling resistor R11, a low-pass filter resistor R8, and a capacitor C6; The source S of the power MOSFET is electrically connected to the sampling resistor R11 and the low-pass filter resistor R8, respectively; the other end of the sampling resistor R11 is connected to GND; the other end of the low-pass filter resistor R8 is connected to GND through capacitor C6.

7. The safety drive circuit for the main contactor of an electric forklift according to claim 6, characterized in that: The overcurrent protection circuit (6) includes: an NPN transistor Q2, a pull-up resistor R6, and a capacitor C5; The base B of the NPN transistor Q2 is electrically connected to the common node between the low-pass filter resistor R8 and the capacitor C6; the collector C of the NPN transistor Q2 is electrically connected to the pull-up resistor R6 and the capacitor C5 respectively, and the other end of the pull-up resistor R6 is electrically connected to the first power supply terminal; the other end of the capacitor C5 and the emitter E of the NPN transistor Q2 are both connected to GND; the common node between the collector C of the NPN transistor Q2, the pull-up resistor R6 and the capacitor C5 is electrically connected to the common node between the feedback capacitor C1 and the second input terminal of the comparator.

8. The safety drive circuit for the main contactor of an electric forklift according to claim 5, characterized in that: The status acquisition circuit (7) includes: voltage divider resistor R5, voltage divider resistor R9, filter capacitor C4 and clamping diode D3; The common node between the filter capacitor C2, the drain D of the power MOSFET, one end of the main contactor coil K1, and the anode of the freewheeling diode D1 is also electrically connected to one end of the voltage divider resistor R5. The other end of the voltage divider resistor R5 is electrically connected to one end of the voltage divider resistor R9, one end of the filter capacitor C4, and the anode of the clamping diode D3, respectively. The other end of the voltage divider resistor R9 and the other end of the filter capacitor C4 are both connected to GND. The cathode of the clamping diode D3 is electrically connected to the clamping power supply terminal. The common node between the voltage divider resistor R5, the voltage divider resistor R9, the filter capacitor C4, and the anode of the clamping diode D3 is electrically connected to the input terminal of the state feedback circuit (8).

9. The safety drive circuit for the main contactor of an electric forklift according to claim 8, characterized in that: The state feedback circuit (8) includes: a first isolation buffer U5A and a second isolation buffer U5B; The input terminals of the first isolation buffer U5A and the second isolation buffer U5B are both electrically connected to the common node between the anodes of the voltage divider resistor R5, the voltage divider resistor R9, the filter capacitor C4, and the clamping diode D3; the output terminals of the first isolation buffer U5A and the second isolation buffer U5B are respectively electrically connected to the input terminals of the first microcontroller MCU1 and the second microcontroller MCU2.

10. A safety drive circuit for an electric forklift main contactor according to claim 6, characterized in that: Also includes: Power supply decoupling capacitor C3; one end of the power supply decoupling capacitor C3 is electrically connected to the comparator power input terminal and the second power supply terminal respectively; the other end of the power supply decoupling capacitor C3 is connected to GND.

Images