Inverter and Motor Control Safety

The traction inverter converts DC battery power into the phase currents that create motor torque, which makes it the direct controller of the most safety-relevant quantity in an electric vehicle. A malfunction can produce unintended acceleration, unintended braking torque, or loss of propulsion - and unlike a combustion powertrain there is no mechanical linkage or idle behavior to fall back on. Safety goals are typically expressed as limits on torque impulse with a fault tolerant time interval, and the whole chain from accelerator pedal to phase current inherits the resulting ASIL, developed under ISO 26262 Parts 4 and 5.

Active Short Circuit (ASC) closes all high-side or all low-side switches of the bridge, shorting the machine phases so a spinning permanent-magnet machine circulates current instead of feeding energy back. At high speed it is usually the right safe state for permanent-magnet drives, because opening all switches (freewheeling) would rectify the back-EMF into the DC link and create braking torque plus overvoltage. At low speed the trade-off reverses. The course derives this from the machine physics and covers the high-side vs low-side decision and the machine-type matrix.

Level 1 is the functional control itself: pedal interpretation, torque arbitration and field-oriented control. Level 2 independently monitors that the delivered torque matches the driver request, typically integrating torque error over time as an impulse monitor with a time budget tied to the FTTI. Level 3 supervises the compute platform itself - the classic architecture inherited from engine control. The monitor is only as honest as its inputs, which is why the course pairs it with resolver, current, voltage and temperature plausibility.

Gate drivers sit on the isolation barrier and host the fastest protection in the system: desaturation detection spots a shorted or overloaded switch within microseconds, soft turn-off removes it without a destructive voltage spike, and Miller clamping prevents parasitic turn-on. They also execute the safe-state command - ASC or freewheeling - so their own self-supervision and their independence from the failing control path are part of the safety argument.

The course has 12 chapters: the torque machine and its hazard taxonomy, safety goals, inverter anatomy, ASC vs freewheeling safe states, the three-level torque monitoring concept, sensor integrity, gate drivers and power-stage protection, fast protection loops, software and control-path safety, architectures with a worked ASIL decomposition, verification with fault injection, and a closing pitfalls and trends chapter with an interactive design review checklist. It is part of the concept library; a free account starts you off, and the Pro and Expert plans unlock more of the library.