电动轮椅遥控与蓝牙功能的安全验证

结论：无线控制的核心风险是失联和误响应，验证要围绕这两点

越来越多的电动轮椅带有无线功能——遥控器控制移动、手机 App 调参数、蓝牙连接配件、远程诊断。

这些功能带来便利，也带来一类新的风险：控制指令通过无线信道传输，而无线信道是不可靠的。

具体的风险有两类：

失联。 连接中断时，轮椅如果继续执行上一条指令，就会在无人控制的状态下移动。

误响应。 接收到错误的、延迟的、或非预期来源的指令，导致非预期动作。

安全验证要围绕这两点设计。

风险的具体表现

风险	场景	后果
连接中断	超出范围、干扰、电量耗尽	失控移动
指令延迟	信道拥塞	动作滞后
指令丢失	干扰	停止指令未执行
误配对	附近有同型设备	被他人控制
误触发	遥控器误操作	非预期移动
多源冲突	遥控与摇杆同时操作	行为不确定

「停止指令丢失」是较严重的情形 ——用户按了停止但指令没有到达，轮椅继续移动，而用户以为已经发出了停止命令。

失联保护的验证

这是无线控制最核心的验证项：

失联的检测。 系统多久能检测到连接中断。

失联后的行为。 检测到失联后的动作——应当是停止，而不是保持上一指令。

停止的方式。 立即制动还是减速停止，需要平衡失控风险和急停带来的倾翻风险。

恢复的行为。 连接恢复后是否自动继续，建议需要重新确认而不是自动恢复。

提示。 失联时是否有声光提示。

验证的方法。 通过断电遥控器、屏蔽信号、超出范围等方式模拟失联。

「连接恢复后不应自动继续」是重要的设计原则 ——如果自动恢复上一指令，用户可能在毫无准备的情况下面对突然移动的轮椅。

超距行为的验证

有效范围的确定。 标称的遥控距离。

边界行为。 在距离边界附近的行为是否稳定。

超距后的行为。 超出范围后是否可靠停止。

返回范围的行为。 重新进入范围后的行为。

遮挡的影响。 有障碍物遮挡时的表现。

「边界附近的抖动」是需要验证的情形 ——在信号强度临界的位置，连接可能反复通断，轮椅的行为应当是稳定的停止而不是断续移动。

误响应的验证

配对的排他性。 一个遥控器只控制配对的那台轮椅。

多设备环境。 附近有多台同型产品时的行为。

配对的过程。 配对是否需要物理确认。

指令的校验。 接收的指令是否有校验机制。

非法指令的处理。 接收到无效指令时的行为。

「多设备环境的验证」在实际场合很有必要 ——养护机构、康复中心可能有多台同型轮椅，如果配对机制不可靠，一个遥控器可能影响多台设备。

误操作的防护

遥控器的按键防护。 防止口袋中误触。

启动的确认。 移动指令是否需要确认或长按。

急停的可达性。 急停是否明显且易于操作。

锁定功能。 遥控器是否可锁定。

电量提示。 遥控器电量低时的提示。

「遥控器电量」是实际的风险点 ——遥控器电量耗尽等同于失联，而用户可能没有注意到电量提示。

多源控制的验证

电动轮椅可能有多个控制源——摇杆、遥控器、App、陪护控制器。

优先级的定义。 哪个控制源优先。

冲突的处理。 同时收到不同指令时的行为。

切换的过程。 控制源切换时的行为。

陪护优先。 陪护控制器通常应当有更高优先级。

明确且可预测。 行为应当是确定的，不是随机的。

「优先级必须明确且可预测」 ——如果冲突时的行为不确定，使用者和陪护者都无法预期轮椅会怎么动。

App 控制的特殊考虑

参数调整的权限。 哪些参数允许用户调、哪些需要专业人员。

安全参数的保护。 速度上限、加速度等安全相关参数的保护。

调整后的验证。 参数改变后是否需要验证。

版本的兼容。 App 版本与控制器版本的匹配。

移动控制的限制。 App 是否允许控制移动，如果允许，风险与遥控器相同甚至更高（手机可能被来电打断）。

「手机被来电打断」是 App 控制的特有风险 ——正在控制移动时来电，App 被切到后台，控制中断。

与电磁兼容的关系

抗扰度。 在电磁干扰下无线控制是否仍然可靠。

共存性。 与其他无线设备的共存。

发射限值。 无线模块的发射符合要求。

频段的合规。 使用的频段符合当地规定。

无线功能的验证与电磁兼容验证应当结合 ——因为干扰环境下的失联正是最需要验证的情形。

常见的准备不足

信息不全。 材料、工艺、使用环境的信息缺失，导致方案设计缺乏依据。

样品不具代表性。 试制样品或挑选样品，与量产状态有差距。

条件未明确。 测试条件没说清楚，数据的适用范围就不明确。

只看初始值。 忽略了环境和时间作用后的性能变化。

项目不完整。 遗漏了必要的项目，提交时才发现。

这五项在实际委托中出现频率较高，建议在项目启动时逐项确认，因为它们造成的返工成本远高于事前确认所花的时间。

数据的组织与保存

记录的完整性。 条件、方法、设备、样品状态、实测值。

可追溯性。 数据与样品批次、生产批次的关联。

保存期限。 覆盖产品的生命周期。

检索的便利。 需要时能快速定位。

版本的管理。 数据更新时的版本控制。

建议建立统一的数据台账，记录每组数据的来源、条件、适用范围和有效期。数据积累起来之后，后续的产品开发和变更评估都能受益。

我们的做法

验证无线控制功能时，我们把失联行为作为重点项目 ——通过断电、屏蔽、超距多种方式模拟失联，确认轮椅的响应是可靠停止而不是保持上一指令。

多设备环境和多控制源冲突我们会单独设置场景验证，因为这两类情形在实际使用中会遇到而在常规试验中不一定覆盖。

如果产品支持 App 控制移动，我们会提示验证来电、锁屏、后台切换等中断场景，这是手机控制特有的风险。

如果你的电动轮椅有遥控或无线功能需要安排安全验证，可以把功能说明和控制逻辑发过来一起确定方案，或者直接联系：132 4819 8029。检测能力见服务介绍，产品分类见电动轮椅检测，案例见案例。

English version

Conclusion. More powered wheelchairs carry wireless functions: handsets that control movement, phone applications that adjust parameters, Bluetooth connections to accessories and remote diagnostics. These bring convenience and a new class of risk, since control commands travel over a wireless channel and wireless channels are unreliable. Two risks follow specifically. Loss of connection, where a wheelchair that continues executing its last command after the link drops moves with nobody controlling it. And erroneous response, where wrong, delayed or unintended commands produce unintended motion. Safety verification should be designed around these two.

How the risks appear. Connection loss from going out of range, interference or a flat battery produces uncontrolled movement. Command delay from channel congestion produces lagging response. Command loss from interference means a stop command is not executed. Mis-pairing where similar devices are nearby allows control by someone else. Inadvertent triggering of the handset produces unintended movement. And conflicting sources, where handset and joystick are operated together, produce indeterminate behaviour. A lost stop command is the more serious case: the user presses stop, the command does not arrive, the chair continues, and the user believes a stop has been commanded.

Verifying loss-of-connection protection. This is the core verification for wireless control. Detection covers how quickly the system detects that the link has dropped. Behaviour on detection covers what it then does, which should be stopping rather than holding the last command. Manner of stopping covers immediate braking against decelerating to a halt, balancing the risk of uncontrolled movement against the tipping risk of an abrupt stop. Behaviour on recovery covers whether motion resumes automatically, and requiring fresh confirmation rather than automatic resumption is advisable. Indication covers whether audible or visible warning accompanies loss of connection. And the method covers simulating loss by powering down the handset, shielding the signal and exceeding the range. That motion should not resume automatically on recovery is an important design principle: automatic resumption of the last command can confront a wholly unprepared user with a chair that suddenly moves.

Verifying out-of-range behaviour. Establish the effective range against the stated figure. Check boundary behaviour for stability near the limit. Check out-of-range behaviour for reliable stopping. Check re-entry behaviour on returning within range. And check the effect of obstructions. Fluttering near the boundary needs verification: where signal strength is marginal the link may connect and drop repeatedly, and the chair's behaviour should be a stable stop rather than intermittent movement.

Verifying against erroneous response. Pairing exclusivity means one handset controls only the chair it is paired with. Multi-device environments test behaviour where several similar products are nearby. The pairing process should consider whether physical confirmation is required. Command validation covers whether received commands are checked. And invalid command handling covers behaviour on receiving something invalid. Verification in multi-device environments is genuinely necessary: care homes and rehabilitation centres may hold several identical chairs, and unreliable pairing lets one handset affect several.

Guarding against inadvertent operation. Handset key protection prevents operation in a pocket. Movement confirmation covers whether motion commands require confirmation or a long press. Emergency stop accessibility covers whether it is conspicuous and easy to operate. Locking covers whether the handset can be locked. And battery indication covers low-battery warning on the handset. Handset battery is a real risk point: a flat handset battery amounts to loss of connection, and users may not have noticed the warning.

Verifying multiple control sources. A powered chair may have several: joystick, handset, application and attendant control. Define the priority among them. Define conflict handling when different commands arrive together. Define switching behaviour when the source changes. Give attendant control the higher priority, as it generally should have. And make behaviour definite and predictable rather than random. Priority must be explicit and predictable: where conflict produces indeterminate behaviour, neither user nor attendant can anticipate how the chair will move.

Particular considerations for application control. Parameter permissions cover which parameters a user may adjust and which require a professional. Safety parameter protection covers speed limits, acceleration and other safety-related settings. Post-adjustment verification covers whether changes require confirmation. Version compatibility covers matching between application and controller versions. And movement control limits cover whether the application may command motion, since the risk then equals that of a handset or exceeds it, because a phone can be interrupted by an incoming call. Interruption by an incoming call is a risk peculiar to application control: a call arriving during movement pushes the application to the background and interrupts control.

Relationship with electromagnetic compatibility. Immunity covers whether wireless control remains reliable under electromagnetic interference. Coexistence covers operation alongside other wireless devices. Emission limits cover compliance of the wireless module. And band compliance covers the frequencies used against local requirements. Wireless verification should be combined with electromagnetic compatibility verification, since loss of connection under interference is precisely the case most needing verification.

How we handle it. In verifying wireless control we treat loss-of-connection behaviour as the priority item, simulating it by powering down, shielding and exceeding range, and confirming that the chair responds by stopping reliably rather than holding its last command. We set up separate scenarios for multi-device environments and multi-source conflict, since both occur in real use while routine testing may not cover them. And where a product allows application control of movement we raise verification of interruption scenarios including incoming calls, screen lock and backgrounding, which are risks peculiar to phone control.

If your powered wheelchair has remote or wireless functions needing safety verification, send us the functional description and control logic and we will settle the approach. Phone or WeChat: +86 132 4819 8029.