Drive protections

Summit servo drives include a wide set of hardware and firmware protections that allows reaching the maximum performance with the required safety for the application and the drive itself. These protections are detailed in the product manual.


Summit servo drives have been designed to operate in a wide range of voltages. Protections are available to protect the drive in front an undesired out of range reading:

  • Fault generation (motor stopped) if and under-voltage or over-voltage is detected

    Read the product manual for further details about the voltage input range.

  • Fault generation (motor stopped) if the bus voltage is not stable and over the under-voltage level after some time once the power stage is powered. 
  • User-configurable under and over-voltage threshold to generate the desired fault reaction. This threshold should never overcome the product limits.

    If the user-configuration overcomes the drive limits, then it is ignored and only the drive protection is active.

Voltage values read by the drive are available to the user to help analyze the system.

Current limits

Summit servo drives have current limit protections to avoid damage on the system, the actuator or the drive itself:

  • Over-current detection. This protection generates a fault condition if the drive reads a current level above the over-current threshold.

    This protection is always enabled.

    The over-current threshold is product dependent. The over-current threshold is checked on every drive phase.

  • Max. current limit.  This protection limits current set-points injected to the current control loops above the max current level. Further information is available on Current modes (CSC,C, CA) section.

    This protection is active if at least the current loop is enabled. Therefore it works for all current, velocity and position modes, but it is inactive in voltage mode.

    Max current limit is applied to the total motor current → \( motor \ current = \sqrt[2]{Iq^{2} + Id^{2}} = max[abs(Ia), abs(Ib), abs(Ic)]\)

  • I2T protection. This protection limits the current set-point to the current control loops by a thermal estimation based on current readings.  The main functionality of the I2T is to detect an instantaneous exceed of thermal energy on the drive. It covers the case where the temperature sensors are too slow to detect a dangerous situation.

    This protection is always active. For modes of operation where the current loop is not enabled, instead of limiting the current, a fault is generated.


    The instantaneous energy dissipated by a motor is proportional to the square of the current circulating through it and to the time this current lasts circulating through it. The nominal current is the current that a motor can stand in a continuous manner without exceeding its thermal limits. Therefore, any current above the nominal one creates an accumulation of thermal energy in the motor's surroundings that the cooling systems will have to dissipate. If this process of accumulating thermal energy exceeds the cooling system's ability to dissipate it, the system is bound to reach its thermal limits, and permanent damage to the motor or the surrounding element can be inflicted. The so-called i2t is an indirect magnitude proportional to the energy dissipated by the motor, and the i2t protection is a control mechanism aimed to ensure that the integral of the power dissipated by the motor in the form of thermal energy does not exceed its thermal limits.

    The energy dissipated by a motor is defined as:

    \[ E_{system}=P· t=i_{A}^2· R· t\]

    Where \( i_{A}\) is the current flowing through the motor and R is its resistance.

The current used by this algorithm is the total motor current → \( motor \ current = \sqrt[2]{Iq^{2} + Id^{2}} = max[abs(Ia), abs(Ib), abs(Ic)]\)

  • The nominal current that can flow through the motor is determined by the power it can dissipate continuously without exceeding its thermal limits.

    \[ E_{system-nom}=P· t=i_{A-nom}^2· R· t\]

    In a transient peak, the motor could tolerate an excess of energy with respect to the continuous limit.

    The excess of energy could be expressed as follows:

    \[ E_{trans}=i_{A-peak}^2· R· t-i_{A-nom}^2· R· t\]

    Most times we do know the current rating system, the peak current and the maximum duration of the peak. Therefore, the equation could be simplified as follows:

    \[ E_{excess}=\frac{E_{trans}}{R}=(i_{A-peak}^2-i_{A-nom}^2)· t\]

    This excess of energy is called I-squared-t (\( i^2t\)), and it is expressed in amper2 per second.

    \[ i^2t=(i_{A-peak}^2-i_{A-nom}^2)· t_{peak}\]

    The following picture shows a graphical representation of the \( i^2t\) limit algorithm implemented in the controller. On the left side of the graph, the system is working with its nominal current. Under this situation, the system could be working infinitely. Once the actual current crosses the motor nominal current, the algorithm starts to integrate the excess of energy (red zone). If the excess of energy reaches the prefixed value, the current will be decreased to its nominal value, and an interrupt will be generated.

    Once the system has started to limit the current, it will not allow new overcurrent peaks until the \( i^2t\) accumulated goes below half of its maximum allowed value.

There are two active I2T: User and system. The system is always active and it generates a fault if it is detected. The user is always active too but its reaction is configurable. The system values are hardcoded by the manufacturer whereas the user parameters are modifiable at any time. Every time a user parameter is changed, both I2T is compared. The applied nominal current is the smaller between both.

If system I2T is detected before the user I2T levels, a fault is generated independently if the current loop is enabled or not.

  • For example, if the system is configured with the following parameters:

    \[ i_{A-nom} = 1 A\]
    \[ i_{A-peak} = 2 A\]
    \[ t_{peak} = 1 s\]

    The i2t variable or energy excess will have the following value:

    \[ i^2t=(i_{A-peak}^2-i_{A-nom}^2)· t_{peak}=3 A- s\]

    It means that the system will tolerate a peak of 2 A during 1 s, but also some other combinations, like for example:

    \[ i_{A-nom} = 1 A\]
    \[ i_{A-peak} = 1.5 A\]
    \[ i^2t=(i_{A-peak}^2-i_{A-nom}^2)· t_{peak}= 3 A- s- t_{peak} = 2.4 s\]

    The system will not allow new overcurrent peaks until the energy excess goes below \( \frac{i^2t}{2}=1.5 A·s\)


Temperature is one of the key elements that must be monitored in order to reach the maximum performance of the drive safely. Summit servo drives are composed of 2 power stage and 1 motor temperature sensors.

The power stage sensors are defined and parameterized by Ingenia whereas motor temperature sensor configuration is user-dependent. 

Further information about motor temperature sensor options is available on the Motor and brake section.

Temperature readings of all the available sensors onboard are available for the user to monitor the state of the drive

Current derating

The current limit mentioned above is only applied if the users need to decrease the maximum drive capabilities in order to avoid damage to the system and/or actuator. Otherwise, the drive current limit is based on the power stage temperature.

The complete current limit chain is the following one:


If derating is enabled, the I2T algorithm is not computed. 

The I2T accumulator is frozen during derating. That means that once the derating stops if the accumulator overcame the limit, the peak current is not reachable until energy decreases I2T Limit * 0.5

The derating is applied following the next equation:

\[ I_{derating} = I_{nominal} · \left(1-\frac{K_{derating}·(Temperature_{actual}-Temperature_{limit})}{I_{nominal}}\right)\]

The constant K is product dependent and the temperature limit is obtained taking into account the operating voltage and frequency.

\[ Temperature_{threshold} = Temperature_{max \ threshold} · \left(1-\frac{K_{freq}·(Voltage_{actual}-Voltage_{minimum})}{Temperature_{max \ threshold} }\right)\]

The constant Kf, temperature max threshold and minimum voltage are product dependent

Safe torque off (STO)

The Safe Torque Off (STO) is a drive-integrated safety function that ensures no torque-generating energy can be applied to the motor. The status of this circuit can be monitored by the user via the STO status reporting parameter. 


To activate or deactivate the STO, both inputs STO1 and STO2 need to be set to the same value. It is product dependent whether both to a low level or both to a high level will disable the power stage