Active Short Circuit in EV Inverters: Why Switching Off Isn't Always Safe

Why switching off a faulted EV inverter at high speed can overcharge its DC link, how Active Short Circuit prevents it, with a live fault simulator.

10 November 2026 · Dr. Vasan Prabhu Veeramani

696 V

line-to-line back-EMF peak of the example motor at 12,000 rpm

400 V

battery and DC-link voltage the inverter is built around

→

687 V

peak DC link after all six switches turn off and the contactor opens, reached 7 ms after the fault

Figures from the simulator below. Run the fault yourself.

The magnets don't stop when the PWM does

In a permanent magnet synchronous motor (PMSM), the rotor magnets induce a voltage in every stator winding whenever the rotor turns. Its peak value per phase is the electrical speed times the magnet flux linkage:

e_pk = ω_e · ψ_m V_LL,pk = √3 · ω_e · ψ_mω_e = electrical speed (rad/s), ψ_m = magnet flux linkage (Wb), V_LL,pk = peak line-to-line back-EMF

Back-EMF rises in proportion to speed, and it does not depend on whether the inverter is switching. Below base speed the inverter can produce more voltage than the motor generates. Above base speed it cannot, so the controller injects negative d-axis current to weaken the magnet field and hold the terminal voltage inside what the DC link can supply.

That field weakening only works while the controller works. When a fault stops it (a frozen microcontroller, a lost position sensor, a gate-driver fault), the full back-EMF appears at the motor terminals.

Every figure on this page uses one example motor:

Parameter	Value
Pole pairs, p	4
Magnet flux linkage, ψ_m	0.08 Wb
Synchronous inductance, L_d = L_q	0.40 mH
Phase resistance, R_s	15 mΩ
Battery and DC link	400 V, 500 µF
Maximum speed	16,000 rpm

Illustrative values for a 60 kW-class surface-PM traction motor, not a specific product.

Figure 1. Line-to-line back-EMF peak of the example motor against speed. Above about 6,900 rpm it exceeds the 400 V DC link; at 16,000 rpm it reaches 929 V. In the shaded region, turning all switches off lets the motor drive current into the DC link.

What "all switches off" really does

Turning off all six switches is usually called safe pulse-off (SPO) or freewheeling. It does not disconnect the motor. Every IGBT or MOSFET has an antiparallel diode, and those six diodes form a three-phase bridge rectifier from the motor to the DC link. Whenever the line-to-line back-EMF peak is higher than the DC-link voltage, the diodes conduct. This is called uncontrolled generation.

What happens next depends on where that current can go.

Contactors open. A crash signal, a high-voltage interlock (HVIL) fault or a battery-side fault can open the main contactors. Only the DC-link capacitor is left to absorb the current, so its voltage climbs towards the back-EMF peak. In the example at 12,000 rpm, the 500 µF capacitor passes 500 V in under a millisecond and reaches about 687 V within 7 ms. That is above a typical 500 V capacitor rating and above a 650 V IGBT rating.
Contactors closed. The battery clamps the voltage, but the motor is now regenerating into it with no control of current or torque. The example motor brakes with about 44 N·m at 12,000 rpm. That is a deceleration the driver didn't ask for, and charging current into a battery that may already be full or cold.

Below the crossover speed, the diodes stop conducting as soon as the winding current left over from normal operation has decayed. Switching off is then safe and produces no torque. That is why safe pulse-off is still the right answer at low speed.

Active Short Circuit: short the motor, not the battery

In Active Short Circuit (ASC), the inverter turns on all three low-side switches and keeps the three high-side switches off (or the reverse). All three motor terminals are tied to the same rail, so the windings are shorted to each other through the inverter. There is no path to the other rail, so neither the DC-link capacitor nor the battery receives any current.

Inside that short, the back-EMF drives current through the winding inductance and resistance. Solving the motor's dq equations with zero terminal voltage gives the steady-state currents:

i_d = − ω_e²L_qψ_m / (R² + ω_e²L_dL_q) i_q = − ω_eψ_mR / (R² + ω_e²L_dL_q)At high speed the resistance becomes negligible: i_d → −ψ_m/L_d and i_q → 0

Two things follow. First, the current settles at the characteristic current ψ_m/L_d regardless of speed: 200 A for the example motor. Second, that current is almost entirely negative d-axis current, which opposes the magnet flux and produces very little torque. The motor's kinetic energy is dissipated slowly as heat in the winding resistance and in the switches and diodes.

Figure 2. Steady-state ASC behaviour of the example motor, on a logarithmic speed axis. The current is flat at ψ_m/L_d = 200 A over almost the whole speed range. The braking torque peaks at 48 N·m near 90 rpm (where ω_eL ≈ R) and is under 1 N·m above 10,000 rpm. ASC is gentle at high speed and harsh at low speed.

This gives designers two checks. The characteristic current must stay below the magnet's demagnetisation limit at the worst-case magnet temperature, and within what the switches can carry for the whole time the vehicle takes to slow down. Many designs aim for a characteristic current at or below rated current.

The second check is the transient when ASC starts. The current does not jump straight to its steady value; it spirals towards it, decaying with the winding time constant L/R (about 27 ms here). If the motor was in deep field weakening, it was already carrying large negative d-axis current and the overshoot is small. If it was motoring at mid speed with little d-axis current, the first peak can approach twice the steady value: about 390 A for the example motor at 5,000 rpm.

Fault lab

Trip the inverter and watch where the energy goes

Choose the fault response, the speed and what the battery contactor does. The motor runs normally for 3 ms, then the fault hits. The waveforms are computed in your browser from the motor and circuit equations; the circuit shows which device carries each phase current at every instant.

Response to the fault

Motor speed at the fault12,000 rpm

Line-to-line back-EMF peak 696 V vs DC link 400 V. The diodes can conduct.

Battery contactor at the fault

Swipe the circuit sideways to see the motor.

Time t = 30.0 ms · fault at 3.0 ms

Peak DC-link voltage

687 V

Peak phase current after fault

186 A

Braking torque after fault

0 N·m

Loading the simulation…

About the model

Surface-PM machine (L_d = L_q) with the parameters in the table above, an ideal two-level IGBT inverter with ideal diodes, and 50 mΩ of battery and cable resistance. Before the fault the phase currents follow an ideal current controller (up to 100 A torque current, with field weakening as needed). Speed is held constant over the 30 ms window because the vehicle's inertia is far larger than the fault energy. Iron losses, dead time, device voltage drops, saturation and saliency are left out. In ASC, current flows through the IGBT in one direction and its diode in the other, so each lower device alternates between switch and diode. This is a teaching model, not a design tool.

Choosing the safe state

Neither state is safe everywhere. ASC is right at high speed, where switching off would cause uncontrolled generation. Safe pulse-off is right at low speed, where ASC brakes hardest and switching off is harmless. Most traction inverters combine the two:

Fault detected

Watchdog timeout, gate-driver desaturation, overcurrent, DC-link overvoltage, HVIL break, loss of the 12 V supply, position-sensor fault.

Would switching off cause uncontrolled generation?

Compare speed (or estimated back-EMF) with the measured DC-link voltage, using a hysteresis band so the decision doesn't chatter.

Yes: above the crossover speed

Active short circuit

All low-side switches on (or all high-side). The DC link is protected; the motor carries about ψ_m/L_d and brakes gently.

No: below the crossover speed

Safe pulse-off

All six switches off. No torque, no current once the leftover winding current has decayed.

Speed falls below the threshold → hand over from ASC to safe pulse-off

This removes the rising low-speed braking torque before it becomes noticeable to the driver.

Vehicle stopped, contactors open → active discharge

The DC-link capacitor is discharged to below 60 V.

Which side to short is a decision too. If the gate driver or its supply on one side has failed, the inverter shorts through the other side. Some designs alternate between low side and high side during a long ASC so that the heat is shared between all six devices.

ASC can't depend on the microcontroller

Many of the faults that call for ASC are faults of the control processor itself: a watchdog reset, a software hang, a lost supply. So the path that commands ASC has to work without it.

An independent decision path. A separate safety monitor (a small supervisor MCU, a CPLD or logic in the gate-driver chips) detects the fault and drives the gate drivers' dedicated safe-state inputs. These force a defined output state without any software running.
Gate-drive power that survives. If the 12 V supply is lost, the low-side gate drivers still need power to hold their switches on. A common answer is a backup supply derived from the high-voltage DC link.
A defined reaction time. At 16,000 rpm the example motor would push the DC link past its rating in about a millisecond. The detection-to-ASC time is part of the safety analysis.
Tested, not assumed. Under ISO 26262, ASC is a safety mechanism for safety goals such as avoiding DC-link overvoltage and unintended braking torque. Its diagnostic coverage is analysed, and the path is usually tested at start-up.

ASC and active discharge are different jobs

ASC handles energy that the spinning motor is still producing. Active discharge handles energy already stored in the DC-link capacitor once the motor has stopped and the contactors are open. A switched resistor (or, in some designs, current circulated through the motor windings with zero torque) brings the voltage below 60 V DC, the touch-safe limit for high-voltage systems, typically within a few seconds. A passive bleed resistor does the same job more slowly as a backup.

Neither can do the other's job. A low-side short never touches the DC+ rail, so it cannot discharge the capacitor. A discharge resistor cannot stop a spinning magnet from generating. Shorting both switches of one leg at the same time, a shoot-through, discharges the capacitor through the switches and destroys them, which is why the two functions are kept separate.

Design checklist

Check	Why it matters	Example motor
Crossover speed	Above it, switching off causes uncontrolled generation.	≈ 6,900 rpm
Back-EMF at maximum speed	Worst-case DC-link voltage if the inverter switches off with the contactors open.	929 V at 16,000 rpm
Characteristic current ψ_m/L_d	Steady ASC current. Compare with the demagnetisation limit and device ratings.	200 A
ASC entry peak	Transient overshoot, up to about twice the steady value from a motoring point.	≈ 390 A at 5,000 rpm
Low-speed ASC torque	Sets the ASC-to-pulse-off handover speed.	Up to 48 N·m near 90 rpm
ASC duration and heat	Three devices and their diodes carry the current until the vehicle slows.	Check junction temperature over the longest coast-down
Independence	ASC must work with the MCU and the 12 V supply gone.	Safety monitor + HV-derived gate supply

Interior-PM motors with L_q > L_d follow the same logic, but saliency moves the torque peak and changes the transient. Run the same checks on your own machine's parameters before you settle on a strategy.

Dr. Vasan Prabhu Veeramani leads the trainer team at Aura Volt and teaches EV powertrain, motor-drive and power-electronics engineering, with MATLAB/Simulink models students run themselves.

Run more inverter and motor-drive experiments in the Virtual Lab, or browse the courses.