There are two kinds of reaction. A soft stop: zero current, the bike coasts under control until the motor stops, then the bridge is disarmed — the response to overheating, overvoltage, a faulty current sensor or throttle. Every other fault disarms the bridge at once. A fault stays until it is cleared, and its cause goes into the log.
Bus overvoltage
Checked every current-loop tick: 200 µs above the threshold and the outputs switch off in the same tick; at high revs the drive goes into a controlled coast. The default threshold is 90 V (90 % of the switch rating), and no more than "the voltage at switch-on + 12 V".
Bus without regen
If the voltage rises 3 V above the switch-on value, the motor puts the energy back into motion; braking current is forbidden on the move.
Regen
Only when allowed, only up to 95 % of the full voltage, the charge current within the battery's rating.
Voltage out of range
A bus outside 10–130 V — no running; below 10 V — a fault.
Phase current
The current vector is limited in magnitude, rises no faster than 5000 A/s, and the limit falls with temperature.
Current sensors
Every tick the sum of the three phases is checked against zero: more than half the ticks bad within 10 ms — a soft stop. Before switch-on the sensor zeros are checked: drift over 3 A — no switch-on.
Motor temperature
Current derates from 100 °C, down to the minimum at 135 °C, a trip at 150 °C. An open or shorted sensor reads as overheating.
Controller temperature
Current derates from 65 °C down to the minimum at 85 °C.
Runaway and overspeed
Speed drifting from the command and rising under current for 30 ms — an immediate trip. Revs 20 % over the limit — the same.
Rotor angle
The angle is confirmed by the encoder and an observer; a tracking error over the limit trips the drive. Without a confirmed angle the bike won't switch on.
Throttle
A signal outside its window — zero torque, a soft stop. Switch-on only with the throttle closed.
Control loops
If the fast or the slow loop hasn't advanced within 5 ms, the bridge is disarmed at once. Numeric errors and a stack overrun stop the drive too.
Interlocks
The key, the kill switch, the tip-over sensor; optionally the side stand and READY only with the brake.
Settings
Written only while standing, with the bridge disarmed, through a before → after review. Kept in two FRAM slots with a CRC: a power cut won't corrupt them.
Calibrations
If the link to the phone is lost for over 0.5 s, the controller cuts the current.
Fault log
Every fault with a snapshot of the drive at the moment it tripped — 32 entries in FRAM.
Secure boot
Before installing and before every start — an RSA-2048 signature, a SHA-256 hash and the binding to the chip. The flash is read-protected.
Updates
The whole package is checked before the old version is erased. If the transfer breaks, the previous firmware runs; if the install fails, it is retried at the next power-up.