Control method for drive system

Abstract

A control method for a drive system (10-24) designed as a travel drive of a mobile work machine, comprising a first function controller (1) that detects input signals from operating devices (2) for the drive system, and a second controller (4) that detects input signals from the operating devices (2) for the drive system and can influence the drive system via a signal path (5) independent of the function controller (1), wherein the function controller (1) converts the detected input signals into control signals for control elements (3) of the drive system, characterized in that at least two operating states are distinguished, wherein one operating state is a safety operating state in which the drive system designed as a travel drive is at a standstill, and a second operating state is a normal operating state in which the drive system designed as a travel drive is in motion,wherein the second controller (4) in the safety operating state, as a parallel redundant controller, converts the detected input signals into control signals for control elements (3) of the drive system, and in the normal operating state, the second controller (4) monitors the function of the function controller (1), wherein the second controller (4) in the safety operating state, as a parallel redundant controller, converts the detected input signals for standstill and / or start-up and / or selection of the direction of travel into control signals for control elements (3) of the drive system, and in the normal operating state, the function of the second controller (4) is reduced to the monitoring function of the function controller (1).

Description

[0001] The invention relates to a control method for a drive system designed as a travel drive of a mobile work machine, comprising a first function controller which detects input signals from operating devices for the drive system, and a second controller which can detect input signals from the operating devices for the drive system and influence the drive system via a signal path independent of the function controller, wherein the function controller converts the detected input signals into control signals for control elements of the drive system.

[0002] Electronic control systems for drive systems, especially for travel drive systems for mobile work machines such as agricultural machinery, forestry machinery, construction machinery, and industrial trucks, require safety systems to minimize the risk of malfunctions. Examples of such mobile work machines include combine harvesters, forage harvesters, and beet or potato harvesters in the agricultural machinery sector, and counterbalance forklifts, reach trucks, and wheel or telescopic loaders in the industrial truck sector. Mobile work machines often have high vehicle weights, and reliable control of travel movements is particularly important to reduce risk. Electric and hydrostatic drive systems are used. Hydrostatic drive systems often consist of an adjustable axial piston pump that supplies one or more hydraulic drive motors with hydraulic fluid.The hydrostatic drive system is operated by an operator via an electrical control system that acts on control elements, e.g., via electromagnetic control valves on an adjustment device of the axial piston pump, thus regulating the direction of travel, the travel speed, and the torque applied by the hydrostatic drive. There is no mechanical connection between a travel command input device and the control elements.

[0003] Likewise, in purely electric drive systems with electric motors, especially three-phase motors, the implementation of the drive commands depends largely on the control system that controls the power electronics, such as the inverters in three-phase motors.

[0004] In particular, for all control signals generated by the control system to set the drive system in motion from standstill, it must be ensured as far as possible that an operator has issued a corresponding command on the drive command input device, such as an accelerator pedal. Starting from standstill or accelerating that was not initiated by the operator must be avoided and, as a malfunction of the control system, lead to a safety measure such as immediate shutdown of the drive system or transition to a safe state.

[0005] For this purpose, a known solution is to design the control system with complete redundancy. The input signals from the drive command input device or the accelerator pedal are processed by two independently programmed controllers. Each controller has a shutdown path for the drive system that is independent of that of the other controller and can be used to shut down the drive system. Each controller can therefore shut down the drive system if a malfunction is detected. In addition, the results from the two controllers are compared, and if specified tolerance values ​​for difference values ​​are exceeded, a malfunction is assessed and shutdown occurs. The software of the programmed controllers and / or the hardware differs depending on the safety requirements.The control software is programmed by two completely independent teams of programmers to prevent the control software of the two controllers from incurring errors that could occur when the controller is in an identical operating state. Likewise, the occurrence of identical hardware errors can be avoided by using at least partially different hardware. This state of the art technology makes it possible to achieve Safety Category 3 according to the previous EN 954-1 standard, which was replaced by DIN EN ISO 13489-1.

[0006] A disadvantage of this state-of-the-art technology is that it requires considerable additional effort to develop the controllers. This doubled the effort, as programming must be performed twice for each separate application. This doubled effort also arises during safety testing, when the programming is checked for safe functionality. This makes the development of a drive system more time-consuming and results in significant additional costs. Finally, subsequent adjustments and modifications are also very costly and time-consuming to implement.

[0007] It is also known to use a system consisting of two controllers, in which one controller acts as a function controller and the second controller monitors it. The function controller processes the input signals from the drive command input device, e.g. the accelerator pedal, and generates the control commands for the hydrostatic or electric drive system. The second controller is used for monitoring and, as a so-called "watchdog controller", checks the functionality of the function controller. This is done, for example, by plausibility checks by checking the control signals generated by the function controller for plausible value ranges. If these criteria are not met, the monitoring controller shuts down the drive system or transfers it to a safe state.

[0008] A disadvantage of this state-of-the-art technology is that higher safety requirements are difficult or impossible to implement. This is prevented by the fixed design and the exclusive use of the second controller for monitoring. Safety requirements corresponding to a Performance Level (PL) letter "d" according to the classifications of DIN EN ISO 13489-1 are therefore difficult or impossible to achieve. A "PL d" would correspond to a failure probability of less than 2.29 * 10 -7 per operating hour.

[0009] DE 39 21 286 A1 discloses a method for the safe electronic control of a process, in which control commands are fed to a control channel and converted into control output variables, which are then fed to the process generating the process output variables. To increase the safety of the control system with minimal effort, at least the safety-relevant control commands and process output variables are recorded and fed to a feedback monitoring unit containing mathematical knowledge of the behavior of the control channel. If there is no plausible match between the control commands and process output variables, shutdown signals are generated by the feedback monitoring unit, and the process is controlled toward a safe state.

[0010] The disadvantage of this state of the art, which only provides plausibility monitoring of the safety-relevant control commands and thus function monitoring, is that it means that possibly required safety categories cannot be achieved.

[0011] US 2005 / 0 027 374 A1 discloses a system and method for continuous online security and reliability monitoring.

[0012] An electronic control system with safety devices is known from DE 33 03 791 A1.

[0013] The present invention is based on the object of providing a control method for a drive system, a corresponding drive system and a mobile work machine, which can be implemented cost-effectively and with little effort and with which a high level of safety can be achieved.

[0014] This object is achieved by a control method for a drive system having the features of claim 1, an electronic control having the features of claim 11, a drive system having the features of claim 12, and a mobile work machine having the features of claim 13. Advantageous further developments are specified in the subclaims.

[0015] The object is achieved according to the invention in that in a control method for a drive system designed as a travel drive of a mobile work machine, in particular an industrial truck, with a first function controller which detects input signals from operating devices for the drive system, and with a second controller which detects input signals from the operating devices for the drive system and can influence the drive system via a signal path independent of the function controller, the function controller converts the detected input signals into control signals for control elements of the drive system and at least two operating states are distinguished.One operating state is a safety operating state in which the drive system designed as a travel drive is at a standstill, and a second operating state is a normal operating state in which the drive system designed as a travel drive is in motion, wherein the second controller in the safety operating state converts the detected input signals into control signals for control elements of the drive system as a parallel redundant controller, and in the normal operating state the second controller monitors the function of the function controller, wherein the second controller in the safety operating state converts the detected input signals for standstill and / or start-up and / or selection of the direction of travel into control signals for control elements of the drive system as a parallel redundant controller, and in the normal operating state the function of the second controller is reduced to the monitoring function of the function controller.

[0016] Advantageously, this allows a higher and sufficient level of safety to be achieved in the safety operating mode without the development costs for the electronic control of the drive system increasing to the extent that would be the case with a fully redundant control system. Subsequent adjustments to the functionality of the function controller are also simpler and easier to implement if no adjustments to functions performed in safety mode are necessary, since then the programming of the second controller for monitoring in normal operation only needs to be adjusted if necessary, but no parallel double programming for redundant operation is required. The safety operating mode takes into account that when a drive system is at a standstill, the operator may have left the system, for example, if it is a travel drive, as the driver may have left the vehicle.This safety operating state therefore includes all control sequences, including maintaining the standstill of the drive system, which assume an operating state in which the drive system is at a standstill. In general, a safe operating state for a drive system that does not relate to a travel drive, for example, and therefore also regardless of a standstill of the drive system, can be summarized as all those operating states in which control by an operator is possible. When assessing the risk of a hazard, it must therefore be taken into account, for example in accordance with the EN ISO 13849-1 standard, that it may not be possible to avoid a hazard through intervention by the operator and the corresponding parameter, designated with the letter P in the standard, must be taken into account with values ​​adapted to this.Since the driver or operator may not be present, they cannot intervene in the event of a malfunction. This requires high reliability and a very low failure probability per operating time for the control system that implements the operating commands. This high level of reliability can be achieved in the safety operating state through redundant operation, in which the calculated control signals from the two controllers are compared. If a deviation exceeds a permitted tolerance value, the drive system is brought into a safe state, in particular, shut down, by the function controller and / or the secondary controller operating in parallel.

[0017] In the control method according to the invention, the second controller in the safety operating state, as a parallel redundant controller, converts the detected input signals for standstill and / or start-up and / or selection of the running direction into control signals for control elements of the drive system.

[0018] This enables the use of safety and monitoring software in the secondary controller that is independent of the specific application. The secondary controller only operates redundantly for the clearly defined functional sequences of maintaining standstill and / or starting and / or selecting the direction of rotation of the drive system in the safety operating state. In normal operating state, the function of the secondary controller is reduced to the monitoring function, which requires less complex programming and usually does not need to be adjusted when the functional controller is modified in normal operating state. A controller that only serves monitoring purposes is often referred to as a "watchdog" controller. This enables optimization of development time and also the implementation of a control behavior for only small batch production runs.The time required for a security check can be significantly reduced and a higher security standard can be achieved with the same effort.

[0019] In the invention, the drive system is a travel drive for a mobile work machine, in particular an industrial truck.

[0020] The drive system can be a hydrostatic drive.

[0021] The control method according to the invention is particularly advantageous for industrial trucks powered by a hydrostatic drive system. The reduced complexity and adaptability make it possible to individually adapt the control system to customer needs and to adapt the control system to customer requirements on-site at branch offices, while still meeting the required safety requirements.

[0022] The hydrostatic travel drive can consist of a hydraulic pump adjustable in the delivery direction and in the delivery volume and / or a hydraulic motor, in particular a hydraulic motor adjustable in the displacement volume, in a closed circuit, wherein the hydraulic pump is adjusted by a pump adjustment device which is controlled by an electromagnetic control device, in particular a proportional valve, for the reverse adjustment direction and by an electromagnetic control device, in particular a proportional valve, for the forward adjustment direction, and / or wherein the hydraulic motor is adjusted by a motor adjustment device which is controlled via an electromagnetic control device, in particular a proportional valve.

[0023] In an advantageous embodiment, in normal operating mode, the second controller monitors whether a maximum current of the electromagnetic control device for the reverse direction and / or a maximum current of the electromagnetic control device for the forward direction and / or a maximum current of the electromagnetic control device of the motor adjustment device is exceeded.

[0024] In normal operating mode, the secondary controller can monitor whether the electromagnetic control device for the reverse direction and the electromagnetic control device for the forward direction are energized simultaneously.

[0025] In an advantageous embodiment of the method, in normal operating mode, the second controller monitors whether a release valve device arranged in the supply line to the electromagnetic control device for the reverse setting direction or the electromagnetic control device for the forward setting direction is supplied with a minimum current, in particular an electromagnetic switching valve, is supplied with a minimum current.

[0026] This allows malfunctions of the function controller to be detected through tests that remain unchanged when the programming of the function controller is adjusted.

[0027] The drive system is advantageously an electric drive.

[0028] The advantages described also apply to an electric drive.

[0029] In a favorable embodiment of the control method according to the invention, the drive system is an actuator of a working hydraulic system of an industrial truck, in particular a lifting drive of a lifting mast of a forklift truck.

[0030] The method according to the invention is particularly suitable for controlling working hydraulics, which may include, for example, the lifting device of a lifting mast, a mast tilting device, a thrust device of a reach mast, or even a lateral thrust of a load-handling device. The control method according to the invention is particularly advantageous for controlling a lifting device, since it can reduce the risk of, for example, an incorrect, independent lowering.

[0031] In an advantageous embodiment, the second controller can switch off the drive system via the independent signal path and switches off the drive system in the event of a detected malfunction.

[0032] Advantageously, the secondary controller is connected to the function controller via a data bus, in particular an SPI bus, the function of which is monitored by the secondary controller and the function controller, and in the normal operating state, if the data bus fails, the drive system is switched off when the output system is in motion.

[0033] This ensures a safety shutdown in the event of a monitoring failure. The data bus's functionality is verified using checksums or the exchange of counter variables that are incremented with each transmitted data packet, allowing the non-transmission of a data packet to be detected.

[0034] In an advantageous embodiment, the second controller detects the input signals of the operating devices for the drive system in the normal operating state and receives the results of the detection of the input signals of the operating devices by the function controller via the data bus and compares them.

[0035] This makes it possible to monitor the function of the analog / digital converters of the function controller and to detect their failure.

[0036] The object is also achieved by an electronic control system with a first function controller which can detect input signals from operating devices for the drive system, and with a second controller which can detect input signals from the operating devices for the drive system and influence the drive system via a signal path independent of the function controller, wherein the function controller can convert the detected input signals into control signals for control elements of the drive system and the function controller and the second controller carry out a previously described control method.

[0037] This provides an electronic control system that can be used for a variety of different drive systems and that, due to the method according to the invention used, can be easily adapted to the different drive systems and meets the necessary safety requirements.

[0038] The task is further solved by a drive system with a previously described electronic control and a mobile work machine with such a drive system.

[0039] These have the advantages already described above.

[0040] Further advantages and details of the invention are explained in more detail with reference to the exemplary embodiments shown in the schematic figures. Fig. 1 a functional diagram of the control method according to the invention in a safety operating state, Fig. 2 a functional diagram of the control method according to the invention in a normal operating state and Fig. 3 schematically shows a hydrostatic drive system in which the method according to the invention is used.

[0041] The Fig. 1 shows a functional diagram of the control method according to the invention in a safety operating state. A function controller 1 receives, as indicated by the two arrows, input signals from an operating device 2 for inputting control commands for the drive system by an operator. The function controller 1 calculates control commands for control elements 3 of the drive system from these input signals and receives sensor data from the control elements 3 regarding control values. A secondary controller 4 receives the same input signals for the drive system and the sensor data from the control elements 3 from the operating device 2 and redundantly calculates the same control commands, which are compared with those of the function controller 1 by both the function controller 1 and the secondary controller 4 via a data bus, as shown by the double arrow.If there is an unacceptably large deviation between the control commands of function controller 1 and the control commands of secondary controller 4, function controller 1 switches off the drive system via control elements 3. At the same time, secondary controller 4 also redundantly switches off the drive system via an independent signal path 5. The safety operating state occurs when the drive system is at a standstill and there is no guarantee that an operator can monitor the drive system and intervene if a malfunction occurs. In the safety operating state, in the present example of a travel drive of a mobile work machine, all signals for maintaining standstill and / or starting up and / or selecting the direction of travel, depending on the direction of travel, are converted by function controller 1 into control signals for control elements 3 of the drive system.

[0042] The Fig. Figure 2 shows a functional diagram of the control method according to the invention in a normal operating state, which includes all safety-relevant functions that must be executed during driving. The same functional units are designated by the same reference numerals. The function controller 1 calculates control commands for the control elements 3 of the drive system from input signals received from the operating device 2 and the sensor data received from the control elements 3. The secondary controller 4 can shut down the drive system via an independent signal path 5. In the normal operating state, the secondary controller 4 only checks the functionality of the function controller 1, without the secondary controller 4 itself also calculating the control commands.This is done, for example, by calculating plausible value ranges and checking the control commands against them, or by checking the control commands for conflicting control commands, such as a simultaneous control signal from a controllable hydraulic pump for the forward and reverse flow directions. If the secondary controller 4 detects a malfunction of the function controller 1, the secondary controller 4 shuts down the drive system via the independent signal path 5.

[0043] Fig.Figure 3 schematically shows a hydrostatic drive as an example of a hydrostatic drive system in which the method according to the invention is used. In the present example, a hydraulic pump 10, adjustable in delivery volume and delivery direction, is driven by a drive machine 11, for example, an internal combustion engine. Via hydraulic lines 12, the hydraulic pump 10 is connected to a hydraulic motor 13, adjustable in displacement, which, as symbolically shown, drives a drive wheel 14 of an industrial truck or, via a transfer case, the drive wheels on both sides of the vehicle. The hydraulic lines 12, the hydraulic pump 10, and the hydraulic motor 13 form a closed circuit for the circulation of the pressure medium. The hydraulic motor 13 can alternatively be designed as a fixed-displacement motor with a constant displacement.

[0044] The hydraulic motor 13, designed as a variable displacement motor, can be adjusted via a motor adjustment device 15, which is controlled via an electromagnetic control device 17, designed, for example, as an electromagnetic proportional valve 16. The adjustable hydraulic pump 10 can be controlled in two directions to reverse the delivery direction, in order to be able to switch the hydraulic motor 13 between forward and reverse travel by reversing the pressure medium flow in the hydraulic lines 12.

[0045] The hydraulic pump 10 is controlled via a pump adjustment device 18, which is controlled via an electromagnetic control device 20 for the reverse setting direction, designed as an electromagnetic proportional valve 19, and an electromagnetic control device 22 for the forward setting direction, designed as an electromagnetic proportional valve 21. The control of the delivery rate of the hydraulic pump 10 and the displacement of the hydraulic motor 13 can be carried out as a function of a speed-dependent control pressure. The electromagnetic control device 20 for the reverse setting direction and the electromagnetic control device 22 for the forward setting direction together form a control valve device, with which, for example,The pump adjustment device 18, which is designed as an adjusting piston actuated on both sides, can be moved backwards from a position for maximum delivery rate to a position for maximum delivery rate forwards, in that the electromagnetic control device 20 for the reverse adjustment direction applies pressure medium to the adjusting piston from one side and the electromagnetic control device 22 for the forward adjustment direction applies pressure medium to the adjusting piston from the other side.

[0046] In the normal operating state during driving, the secondary controller 4 monitors the function of the hydrostatic drive system control by the function controller 1 using three basic monitoring functions. These are, first, monitoring the data communication between the function controller 1 and the secondary controller 4 via a data bus; second, a plausibility check of the input signals; and third, monitoring the switching currents for the control elements 3 at the outputs of the function controller 1.

[0047] In a pressure medium supply for the electromagnetic control device 20 for the reverse setting direction and the electromagnetic control device 22 for the forward setting direction, a release valve device 23, designed here as an electromagnetic switching valve 24, is arranged, which releases the inflow when current is applied and thus when actuated.

[0048] Function controller 1 exchanges data with secondary controller 4 via an SPI bus system. In normal operating mode, secondary controller 4 checks whether communication on the bus is present and functioning properly according to the SPI protocol. An error that leads to the secondary controller shutting down the drive system is detected if the drive system is in motion at the same time as a persistent disruption to SPI communication. The shutdown time for this error scenario is, for example, 600 ms. At the same time, function controller 1 checks whether the data responses from secondary controller 4 are correct. For this purpose, the SPI protocol is bidirectionally secured using checksums. In addition, a counter variable from function controller 1 is incremented by one with each new data transmission and must be sent back by the secondary controller with the next transmission.If the returned value of the counter variable does not correspond to the incremented value, a data transmission error is detected. This ensures the proper functioning of the monitoring function by the secondary controller 4.

[0049] The secondary controller 4 can also redundantly receive the input signals from the operating device 2 and check them for plausibility in the function controller 1. The result is communicated to the secondary controller 4 via the SPI bus. This allows the secondary controller 4 to test the A / D converter unit of the function controller 1 and perform dual-channel monitoring of the input signals.

[0050] The third monitoring function in normal operating mode is intended to prevent simultaneous conflicting output signals and impermissibly high switching currents. If the secondary controller 4 simultaneously registers a control, in particular a pulse width modulation for generating such a signal, at the outputs for the electromagnetic proportional valve 19 or for the electromagnetic control device 20 for the reverse direction and for the electromagnetic proportional valve 21 or for the electromagnetic control device 22 for the forward direction and a total current through one or more measuring resistors is greater than a limit value, e.g. 250 mA, an error counter "CheckCurrent" of the secondary controller 4 is activated and after a period of time, e.g. 600 ms, the drive system is switched off.If the outputs for the electromagnetic control device 20 for the reverse direction and / or for the electromagnetic control device 22 for the forward direction are energized in a way that exceeds a permissible maximum current value by a specified value, e.g. 100 mA, the error counter “CheckCurrent” of the second controller 4 is activated and after a period of time, e.g. 600 ms, the drive system is switched off.

[0051] Likewise, the error counter “CheckCurrent” of the second controller 4 is activated and, with a time delay, e.g. after 600 ms, the drive system is switched off if the current supply to the output for the electromagnetic proportional valve 16 or the control device 17 of the hydraulic motor 13 exceeds a permissible maximum current value by a specified value, e.g. 100 mA.

[0052] Finally, the secondary controller 4 monitors for failure or interruption of the release valve current at the release valve device 23 during movement of the drive system, i.e. when the hydraulic pump 10 is controlled by the electromagnetic control device 20 for the reverse direction or the electromagnetic control device 22 for the forward direction. The current limits for the pump current are, for example, more than 250 mA for a 12 V system and more than 125 mA for a 24 V system. If these are present, it is assumed that the hydraulic pump 10 is controlled. The current limits for the release valve current are, for example, less than 250 mA for a 12 V system and less than 125 mA for a 24 V system. If the release valve current is lost during movement of the drive system, the error counter of the secondary controller 4 starts running up to 30 and is then switched off after a time delay.

[0053] In the normal operating state, the function of the secondary controller 4 is therefore reduced to the monitoring function. Programming the secondary controller 4 is significantly simplified, and if programming changes are made to the function controller 1 for the normal operating state, the programming of the secondary controller 4 does not necessarily need to be adjusted. This optimizes development time and reduces the time required for safety testing of the controller.

Claims

[1] Control method for a drive system (10 - 24) designed as a travel drive of a mobile work machine, comprising a first function controller (1) which detects input signals from operating devices (2) for the drive system, and a second controller (4) which can detect input signals from the operating devices (2) for the drive system and influence the drive system via a signal path (5) independent of the function controller (1), wherein the function controller (1) converts the detected input signals into control signals for control elements (3) of the drive system, characterized bythat at least two operating states are distinguished, wherein one operating state is a safety operating state in which the drive system designed as a travel drive is at a standstill, and a second operating state is a normal operating state in which the drive system designed as a travel drive is in motion, wherein the second controller (4) in the safety operating state, as a parallel redundant controller, converts the detected input signals into control signals for control elements (3) of the drive system, and in the normal operating state the second controller (4) monitors the function of the function controller (1),wherein the second controller (4) in the safety operating state, as a parallel redundant controller, converts the detected input signals for standstill and / or start-up and / or selection of the running direction into control signals for control elements (3) of the drive system, and in the normal operating state, the function of the second controller (4) is reduced to the monitoring function of the function controller (1). [2] Control method according to claim 1, characterized by that the drive system (10 - 24) is a hydrostatic drive. [3] Control method according to claim 2, characterized byin that the hydrostatic travel drive consists of a hydraulic pump (10) adjustable in the conveying direction and in the conveying volume and / or a hydraulic motor (13), in particular a hydraulic motor (13) adjustable in the displacement volume, in a closed circuit, wherein the hydraulic pump (10) is adjusted by a pump adjustment device (18) which is controlled by an electromagnetic control device (20), in particular a proportional valve (19), for the reverse adjustment direction and by an electromagnetic control device (22), in particular a proportional valve (21), for the forward adjustment direction, and / or wherein the hydraulic motor (13) is adjusted by a motor adjustment device (15) which is controlled via an electromagnetic control device (17), in particular a proportional valve (16). [4] Control method according to claim 3, characterized byin that in normal operating mode the second controller (4) monitors whether a maximum current of the electromagnetic control device (20) for the reverse direction and / or a maximum current of the electromagnetic control device (22) for the forward direction and / or a maximum current of the electromagnetic control device (17) of the motor adjustment device (15) is exceeded. [5] Control method according to claim 3 or 4, characterized by that in normal operating mode, the second controller (4) monitors whether there is simultaneous energization of the electromagnetic control device (20) for the reverse setting direction and the electromagnetic control device (22) for the forward setting direction. [6] Control method according to one of claims 3 to 5, characterized bythat in the normal operating mode, the second controller (4) monitors whether a release valve device (23) arranged in the supply line to these, in particular an electromagnetic switching valve (24), is supplied with a minimum current while the electromagnetic control device (20) for the reverse setting direction or the electromagnetic control device (22) for the forward setting direction is supplied with a minimum current. [7] Control method according to claim 1, characterized by that the drive system (10 - 24) is an electric drive. [8] Control method according to one of claims 1 to 7, characterized by that the secondary controller (4) can switch off the drive system (10 - 24) via the independent signal path (5) and switches it off in the event of a detected malfunction. [9] Control method according to claim 8, characterized bythat the second controller (4) is connected to the function controller (1) via a data bus, in particular an SPI bus, the function of which is monitored by the second controller (4) and the function controller (1), and that in the normal operating state, in the event of a failure of the data bus, the drive system (10 - 24) is switched off when the output system is in motion. [10] Control method according to claim 9, characterized by that the second controller (4) detects the input signals of the operating devices (2) for the drive system (10 - 24) in the normal operating state and receives the results of the detection of the input signals of the operating devices (2) by the function controller (1) via the data bus and compares them. [11] Electronic control with a first function controller (1) which can detect input signals from operating devices (2) for the drive system (10 - 24), and with a second controller (4) which can detect input signals from the operating devices (2) for the drive system and influence the drive system via a signal path (5) independent of the function controller (1), wherein the function controller (1) can convert the detected input signals into control signals for control elements (3) of the drive system and the function controller (1) and the second controller (4) carry out a control method according to one of claims 1 to 10. [12] Drive system (10-24) with an electronic control according to claim 11. [13] Mobile work machine with a drive system (10 - 24) according to claim 12.

Images