- First define the load paths through positive mechanical support and mechanical self-retention, then configure actuation and monitoring.
- After a fault, retain the load, stop hazardous motion, inhibit release and provide a safe recovery path.
- Develop fault-injection cases for pressure, valves, locking, sensors, communication, mismatches and unintended release commands.
- Progress from simulation and surrogate loads to actual battery packs in stages, with records traceable to the corresponding safety requirements.
00Executive summary
Traction battery packs are heavy and have complex centers of gravity. Their enclosures, sealing faces, high-voltage connections and cooling interfaces are sensitive to mechanical damage, and damaged cells may present additional risks. Loss of air or electrical power, incomplete locking, incorrect sensor signals or unintended release can cause a fall and damage the enclosure, insulation or cooling system. GB 38031-2025 took effect on July 1, 2026 and specifies safety requirements for traction batteries used in electric vehicles [1]. It addresses battery product safety and does not replace the mechanical safety design of handling tooling. Tooling design must therefore control mechanical damage and abnormal energy events.
The fail-safe architecture combines positive mechanical support, mechanically self-retaining locks, a supported-load release interlock and diagnostics using multiple signals. Retention of heavy loads should not depend primarily on friction or continuous air pressure. The mechanical load path and closed, locked state must be explicit; support must be confirmed before release, with pressure, position, lock and load states monitored together. Safety-related control functions may be designed to ISO 13849-1:2023 and validated through analysis and testing to ISO 13849-2:2012 [2][3]. The required performance level is determined by the specific risk assessment.
Key findings
- Heavy battery packs shall use geometric support and mechanically self-retaining features as the primary load path; a single pneumatic-pressure, vacuum, or friction function shall not be the sole drop-prevention measure.
- Fail-safe behavior aims to retain the load, stop hazardous motion and inhibit release while preserving a diagnosable recovery path. Continued production after a fault must not be the objective.
- Fault injection must cover stuck sensors, signal shorts/opens, stuck valves, ruptured pipes, pressure drops, communications outages, recipe mismatches and false release commands.
- Progress from low to high energy, surrogate loads to actual battery packs, and single faults to justified fault combinations.
- Validation records must link each safety requirement to its fault assumptions, test steps, raw signals, assessment and corrective-action results to provide complete traceability.
01Research scope and safety objectives
This study addresses dedicated tooling for battery modules, lower enclosures, battery trays and complete traction battery packs during assembly, inspection, repair and line-side transfer. The carrier may be a pneumatic industrial manipulator, lifting device, robot or special-purpose machine. The scope covers the tooling and its control interfaces, excluding cell electrochemical design, BMS algorithm certification and transport regulations.
The safety objectives fall into four categories: protect personnel from dropped-load and crushing hazards; prevent handling damage to the battery-pack housing, sealing surfaces, or interfaces beyond product limits; prevent a single tooling fault from directly causing hazardous release; and provide defined steps for transferring the load to safe support during an abnormal condition. ISO 12100 requires hazard identification and risk reduction throughout the machinery life cycle [4], while ISO/TR 20218-1 provides safety guidance for the design and integration of robot end effectors [5].
| Safety function | Trigger condition | Target response | Required records |
|---|---|---|---|
| Grip/support confirmation | Before pickup | Lifting is prohibited without confirmation | Position, pressure/force, locked status |
| Load retention | Loss of air supply, loss of electrical power, valve failure | No hazardous release; motion stopped | Holding time, displacement and structural condition |
| Supported-load release | Workpiece supported in a permitted orientation | Unlocking/unclamping permitted only after these checks | Support signal, position, and command record |
| Mismatch prevention | Battery model/tooling/recipe is inconsistent | Clamping and lifting inhibited | ID, recipe version, interlocking log |
| Abnormal-condition recovery | Any safety-related fault | Enter the controlled set-down or maintenance state | Recovery steps and authorization records |
02Load-bearing architecture and fail-safe principles
02.1 Positive mechanical support
Define the support path from the structural and no-contact areas on the underside of the battery pack. Prefer support arms, fork supports, locating through load-bearing holes or side rails, or mechanical gripping points approved by the product supplier. Where cylinders or motors close, position or lock the tooling, the structure must still account for load retention after energy loss and must not immediately lose all holding capability.
Where force is transmitted by friction clamping, obtain verifiable data for the minimum friction coefficient, contact materials, surface condition and clamping force. Also assess the effects of clamping on the enclosure, cooling plate, sealing faces and coatings. For heavy-load retention, evaluate positive mechanical support first; increasing clamping force alone is not an adequate way to address the risk.
02.2 Load Cases and Example Calculations
F_eq = m · (g + a_z) + F_shock
F_design = S_L · F_eqAssume a battery pack mass of 650 kg and a maximum upward acceleration of 0.25g, with no additional impact load. The equivalent vertical load is approximately 7.97 kN. With the example safety factor S_L=2.0, the design vertical load is approximately 15.9 kN; four ideal, uniformly loaded support points carry approximately 4.0 kN per point on average. The actual design must also account for center-of-gravity offset, unequal support stiffness, manufacturing tolerances, inclination, braking, and failure of one support point. This example is neither a project load rating nor a recommended safety factor.
When the center of gravity is offset, calculate each support reaction using static equilibrium or finite element analysis; do not divide the total load equally. Compare the maximum reaction at any single support across battery packs of different lengths, masses and accessory configurations, and use it as an input to support design.
02.3 Locking and release
After closing, the locking mechanism shall provide a verifiable mechanical state. If drive energy is lost, it shall retain the load or at least prevent hazardous release. Release requires confirmation that the workpiece is supported, the tooling is at a permitted position, motion has stopped, the personnel zone is safe, and the operating command is valid. Any sensor conflict shall lead to a conservative state rather than substitution of a software default for actual feedback.
03Pneumatic, electrical and control safety architecture
ISO 4414:2010 applies to pneumatic systems and components on machinery and addresses significant hazards associated with their intended use [6]. For battery-pack tooling, the pneumatic design shall address line rupture, fitting disconnection, valve-spool seizure, supply-pressure fluctuation, residual energy, and maintenance isolation. Air receivers or pressure-retention devices can only delay loss of capacity; they do not automatically constitute safe load holding.
Diagnostics should cover supply pressure, pressure in both actuator chambers or critical circuits, lock position, jaw/support-arm position, workpiece presence, supported-load status, load/weight plausibility and communication health. Use physically diverse signals where practicable. Two signals derived from the same mechanical target or carried in the same cable cannot be treated as independent redundancy solely because there are two of them.
Lift_Enable = Load_Present ∧ Clamp_Closed ∧ Lock_Confirmed ∧ Pressure_OK ∧ Recipe_Match
Release_Enable = Supported ∧ Safe_Position ∧ Motion_Stopped ∧ Operator_Command ∧ Diagnostics_OKThese logic expressions describe functional relationships; they do not demonstrate a performance level. Design and validate the safety-related control architecture, diagnostic coverage, common-cause failure measures and software to the project’s selected standards [2][3].
04Hazard Analysis and FMEA
| Failure mode | Local cause | Potential consequence | Design control | Verification method |
|---|---|---|---|---|
| Sudden loss of the main air supply | Loss of air in the main header or a disconnected fitting | Clamping force decreases and load slips | Mechanical support, self-retaining lock, check valve, and monitoring | Air-loss fault injection |
| Single branch rupture | Worn hoses or damaged fittings | Single-jaw failure and eccentric loading | Zone isolation, support-point redundancy, and pressure monitoring | Introduce a leak at the specified location |
| Valve spool stuck in the release position | Contamination, mechanical failure | Inadvertent unclamping | Release isolation, two-condition permission and mechanical retention | Simulated valve seizure |
| Incomplete locking | Tolerances, foreign matter, misalignment | Disconnection while carrying the load | Independent lock feedback and positive mechanical retention | Partially locked-state test |
| Sensor stuck high (1) | Line short circuit, software freeze | Not clamped but allowed to lift | Complementary signals and timing/plausibility diagnostics | Signal is forced to 1 |
| Sensor stuck low (0) | Open circuit, target deviation | Release inhibited or incorrect fault diagnosis | Open-circuit diagnostics and maintenance state | Signal is forced to 0 |
| Incorrect model recipe | Barcode-reading, network, or operator error | Incorrect load-transfer point and interference | Mechanical error-proofing, ID consistency, version control | Mismatch injection |
| Unintended release command | Human-machine interface or program error | Dropped suspended load | Support-confirmation interlock, restricted position, dual action | Release command issued with the load suspended |
| Communication interruption | Bus failure, PLC restart | Status unknown | Load retained; motion stopped; release inhibited | Disconnect/restart injection |
| Abnormal load | Two packs picked together, foreign objects or abnormal center of gravity | Overloading of structure or lifting gear | Weight plausibility check and double-pick prevention | Surrogate-load testing |
Combine FMEA with a fault tree or safety requirements matrix to analyze the load-drop top event and identify minimal cut sets, such as “no positive mechanical support + lock failure + unintended release command” or “common-cause sensor failure + no software diagnosis.” If a single fault can trigger the top event, prioritize structural changes; reducing the occurrence score alone is not sufficient.
05Fault-injection validation strategy
ISO 13849-2:2012 specifies validation of safety functions, categories and performance levels by analysis and testing [3]. Fault injection is one part of validation; complete design review, component data, calculations and software verification are also required. Before testing, complete the risk assessment, test-area exclusion, surrogate-load design, emergency support and recovery plans.
05.1 Staged testing
- Model and logic stage: force inputs in simulation or offline logic to verify state-machine and alarm responses.
- Low-energy bench stage: use empty tooling or lightweight surrogates to inject wiring, valve and pressure faults.
- Rated surrogate-load stage: verify retention, displacement and structure with non-battery loads of equivalent geometry and mass.
- Actual battery-pack stage: test only interface and product-protection items not covered by the earlier stages, under controlled risks and authorization.
- Site integration stage: verify interlocks with the manipulator, lifting equipment, conveyors, fixtures and safety systems.
05.2 Fault injection matrix
| No. | Injected fault | Injection timing | Expected system state | Key records |
|---|---|---|---|---|
| FI-01 | Shut off the main air supply | Stationary after lifting / during motion | Load retained; hazardous motion stopped; release inhibited | Pressure, displacement, stop time |
| FI-02 | Rapid leakage in a single branch | Worst-case orientation | Isolate the fault, issue an alarm, and maintain a condition that permits controlled set-down | Zone pressure and support reactions |
| FI-03 | Lock feedback stuck high (1) | Before closing | Lifting is not permitted | Input/output and alarm log |
| FI-04 | Lock feedback stuck low (0) | Partially locked state | Plausibility diagnostic is triggered; lifting is not permitted | Position, pressure, signal contradictions |
| FI-05 | Release-valve command stuck active | Load suspended | Physical or control layers prevent hazardous releases | Valve current, pressure, lock status |
| FI-06 | False support-confirmation signal | Before supported placement | Dual/diverse checks reject release | Support, position, load changes |
| FI-07 | Controller restart / communication loss | During handling | Outputs enter the defined safe state; load retained | Restart time, output status |
| FI-08 | Incorrect battery model / recipe | Before pickup | Recipe mismatch detected; motion inhibited | ID, recipe version, CRC/signature |
| FI-09 | Emergency stop | Maximum credible operating speed | Stop without releasing the load | Peak acceleration, structure/load displacement |
| FI-10 | Incorrect maintenance-release operation | Load unsupported | Subject to permissions and mechanical conditions | Permissions, steps, lock status |
Define three possible outcomes for each case in advance: “pass,” “fail” and “engineering review required.” In addition to whether the load falls, record peak displacement, changes in locking, alarm visibility, whether recovery requires bypassing a safety function, and any hidden damage to the battery pack.
06Acceptance criteria and supporting records
Derive acceptance criteria from the project risk assessment and technical agreement, specifying at least the categories of criteria and their operating conditions. Typical categories include rated and worst-case loads, individual support reactions, allowable enclosure deformation, holding time, maximum slip, stopping acceleration, fault detection time, alarms and reset, release permission, and maintenance isolation. Values must reflect the battery pack, carrier and personnel exposure conditions; universal values must not be applied.
| Record category | Typical documents | Quality requirements |
|---|---|---|
| Requirements | Safety Requirements Specification, customer interfaces, product prohibited/restricted zones | Unique number, version and source |
| Analysis | Load calculation, finite element, FMEA/FTA, PL evaluation | Assumptions are explicit and worst-case operating conditions are traceable |
| Design | Drawings, BOM, pneumatic circuit/electrical diagram, software version | Matches the analysis and physical equipment |
| Verification | Test plan, original curves, photos, logs | Fault, time base and assessment criteria fully recorded |
| Release approval | Deviations, completed corrective actions, approval and maintenance requirements | Defined restrictions for unresolved issues |
Record commands, valve actuation, pressure changes, lock displacement and carrier stop signals on a common time base so that fault-response sequences and relationships can be analyzed. HMI screenshots alone are insufficient for this validation.
07Safe recovery, maintenance and changes
Abnormal recovery shall be defined during design. Typical steps include stopping the carrier, confirming load retention, establishing temporary support, isolating energy, clearing the fault, reconfirming lock engagement, low-speed set-down, and reset approval. Personnel shall not stand beneath the battery pack or rely on continuous manual support. If a mechanical lock must be released manually, the action shall be controlled by tooling, authorization, and confirmed support conditions.
Maintenance inspections cover lock wear, support-arm deformation, fasteners, hose wear, valve contamination, sensor targets, cable bending, contact-pad materials and calibration status. Changes to battery pack mass, center of gravity, enclosure structure, permitted support points, tooling modules, software recipes or carrier acceleration require an impact assessment and any necessary revalidation.
08Conclusions and application requirements
Fail-safe design begins with structural load paths and mechanical retention. Pneumatic, electrical and control systems then provide state confirmation, fault diagnosis and controlled release. On a fault, the system must prevent hazardous release and enter a state from which safe recovery is possible, rather than maintain production takt time. Fault-injection cases must correspond to safety requirements, FMEA/FTA, control logic and the actual structure, with reviewable acceptance criteria and corrective-action results.
Qualified professionals must design and approve project applications according to applicable regulations, standards, customer requirements and actual risks. Product conformity to GB 38031, ISO 13849 performance levels, third-party inspection and customer acceptance each require the relevant assessment and test records. This report provides the research method and validation plan.
References
- GB 38031-2025 Safety requirements for power batteries for electric vehicles. https://openstd.samr.gov.cn/bzgk/std/newGbInfo?hcno=3AB693FAFF5D9716DF61C61D6FD2187A
- ISO 13849-1:2023. Safety of machinery - Safety-related parts of control systems - Part 1: General principles for design. https://www.iso.org/standard/73481.html
- ISO 13849-2:2012. Safety of machinery - Safety-related parts of control systems - Part 2: Validation. https://www.iso.org/standard/53640.html
- ISO 12100:2010. Safety of machinery - General principles for design - Risk assessment and risk reduction. https://www.iso.org/standard/51528.html
- ISO/TR 20218-1:2018. Robotics - Safety design for industrial robot systems - Part 1: End-effectors. https://www.iso.org/standard/69488.html
- ISO 4414:2010. Pneumatic fluid power - General rules and safety requirements for systems and their components. https://www.iso.org/standard/44790.html
- ISO/TR 14121-2:2012. Safety of machinery - Risk assessment - Part 2: Practical guidance and examples of methods. https://www.iso.org/standard/57180.html
- U.S. Department of Transportation / NHTSA. Safety Management of Automotive Rechargeable Energy Storage Systems. https://rosap.ntl.bts.gov/view/dot/38221/dot_38221_DS1.pdf
- Held, M.; Bronnimann, R. Safe cell, safe battery? Battery fire investigation using FMEA, FTA and practical experiments. Microelectronics Reliability 64, 2016. https://doi.org/10.1016/j.microrel.2016.07.051
