Hi everyone, thanks for all the likes and follows, both up to this point and in future. Please accept my apologies for not individually thanking all of you as the HaD.io emails suggest but my feed gets rather filled with project teams thanking individuals. I thought this way would be less annoying for everyone.

Using stepper motors is smart - achieving functional safety is much easier than with commutated motors - no pulse, no step, no movement. It's easier to do speed control, too!

Funny you should say that - my query on the stack is aimed at improving control smoothness. On the safety side, I couldn't be sure but I think I have implemented it in software. For example, once the enable pin takes the magnetic field away to save power while static, you can easily freewheel the wheelchair. When I tried my first iteration of the control code, I forgot to make the controller check that we were at 0 velocity before the enable pin was allowed to remove the magnetic field and went freewheeling across the room! Also, all braking is done using a decelerating magnetic field, so just taking the power away results in the uncontrolled freewheeling I mentioned. Not only does the acceleration curve have to prevent stalling in the drive mode but also keep the rotor coupled to the field during braking, otherwise it's "freewheeling and noise" again!

What you write about freewheeling is an interesting effect, but the only way to prevent that is by applying a drive system with inherent stop, like a worm gear (which bears other risks). You would have that with commutated drives, too. However, DC drives have the difference that a simple short-circuit or stuck-active failure mode, that would fully energize the motor, would cause the wheelchair to accelerate with maximum power. Now think of a DC motor that's normally operated at 40% PWM duty cycle for full speed - a stuck-active failure would operate it at 100%! 

In the EN60204. the European standard for electrical safety, the type of controlled stop you describe is known as "category 1 stop". Maybe you should think about introducing a fail-safe braking mode, e.g. by statically energizing one of the stepper motor windings (an independent control circuit should do that when it detects that the main circuit failed, and the system still has kinetic energy). It doesn't matter if it's noisy as long as it's safe, and it would only be needed in the case of a failure in the main drive (which is unlikely due to thorough testing, and careful mitigation of the effect of random failures, or aging through environmental stress).

If you have questions about Functional Safety and methodology, I can give you some pointers. Since this art isn't well known in the Maker community, it would be great if someone would write about it :-)

By the way, you are right about speed control - for stepper motors to operate correctly you need a robust control loop that identifies the energy state of the system, and controls the magnetic of the stepper motors within the limits of the magnetic coupling. Funny that I didn't think about how difficult it is to get it working when I read that you use stepper motors. 

@Thomas, thank you for that insight. I am interested in the safety side of it. At the weekend I thought a DC motor with a worm gear would be good but in that case, if the power fails then the user *may* be tipped out of the chair suddenly, as a worm gear won't allow freewheeling! It's a topic which requires some thought.

Hi Simon, I've often thought about building some kind of SafeDuino using IEC60335 libraries (e.g. for STM8 or STM32). It really isn't that hard if just achieved functional safety, and not a safety certification, is the goal. I guess that a good deal of the price difference between your solution
and a commercial solution can be explained by certification costs. It's important to find a good way for decelerating in the absence of power (fail-safe). Providing a solution for "Category1 Stop" (active deceleration) would be far more difficult.

This is the commercial version. I doubt they've put the level of conscious safety engineering into it that you have already done! http://www.guiseleymobility.com/bradshawbowlsbuggies.htm

Sometimes the type of technology used is "simple" so that all failure modes are well known, and properly mitigated. Most things with any type of analog control of speed, rate, etc. don't fall under the category of "simple". Often a combination of "rate" with something binary, like "hold-to-run", is applied for mitigating such failure modes. A proper analysis of failure modes and their effect can help to identify problems. Failure modes for Machine Safety can help to build a safety case. However, I have no first-hand experience in "homologation"of self-driving wheelchairs. 

The following page lists some of the relevant standards (which might still be applicable after 01/Apr/2019) :
https://www.tuv.com/media/netherlands/documents/products/wheelchair_leaflet_tuv_rheinland.pdf