Title: Actuator Safety | ISO 26262 Academy URL: https://iso26262.academy/features/concepts/actuator-safety Description: Motors, valves and relays are where safety goals become physical - learn how actuation channels fail stuck or runaway, how feedback and diagnostics catch it, and how safe states from de-energize to active hold are engineered and quantified. --- Concept guide · ISO 26262-5/-4 · 14 chapters # Actuator Safety Master the point where safety goals become physical: how motors, valves and relays fail, how control loops hide those faults, and how diagnostics, safe states and architecture patterns keep the actuation channel honest. 14 Chapters 1 Worked FMEDA 100-120 Minutes of study Included in Expert [Start learning](https://iso26262.academy/register?plan=free&from=%2Fconcepts%2Factuator-safety&utm_source=website&utm_medium=cta&utm_campaign=features_concepts) See the chapters Inside the course 1. 01 **Where Safety Becomes Physical** 2. 02 **A Tour of Automotive Actuators** 3. 03 **The Mechatronic Control Loop** 4. 04 **How Actuators Fail** 5. 05 **Torque and Motion Paths** The short version ## Quick answers What is actuator safety in ISO 26262? Actuator safety is the discipline of ensuring that the components which turn electronic commands into physical action - motors, valves, relays and their power stages - cannot violate a safety goal when they fail. Because every safety goal is ultimately enforced by an actuator that moves, holds or releases something, actuation is where the safety argument becomes physical. In ISO 26262 terms it spans hardware design and metrics under Part 5, and the system-level safe states, monitoring architectures and fault reactions defined under Part 4, tied together by diagnostics that detect stuck, runaway and lost-actuation failure modes within the fault-tolerant time interval. What are the typical failure modes of automotive actuators? The recurring families are: stuck actuation, where the actuator freezes at its current position, such as a welded relay contact or jammed valve; runaway or unintended actuation, where it moves without a valid command; sluggish or degraded response, where it moves too slowly to serve the function; oscillation; and complete loss of actuation. Each maps to a different vehicle-level hazard - a stuck throttle and a lost steering assist are entirely different events - which is why the course derives HARA and safe states per failure mode, not per component. Keep going, free - [Demo exam · no account Test yourself with 7 exam-style questions](https://iso26262.academy/demo-exam) Why this course · ISO 26262, Part 5 ## Why it pays for itself ### Stop treating actuators as black boxes The failure-mode catalog and torque-path tracing turn "the motor might fail" into named stuck, runaway and lost-actuation modes you can rate, detect and design against. ### Pick safe states you can defend De-energize is not always safe. The safe-state and degradation chapters give you the selection logic for de-energize, hold and active safe states, per function and per hazard. ### Numbers ready for the assessor The worked FMEDA of a motorized actuation channel shows element budgets, diagnostic coverage claims and residual FIT the way a hardware safety review actually reads them. After the course ## What you’ll be able to do ### Classify Actuator Failure Modes Name and analyze stuck, runaway, sluggish and lost-actuation failure modes for motors, valves and relays, and map each to its vehicle-level effect. ### Derive Safety Goals for Actuation Run HARA for actuation functions and derive safety goals with controllability reasoning specific to unintended movement and loss of function. ### Design Credible Safe States Select between de-energize, hold and active safe states per function, and design the degradation ladder that connects them. ### Specify Actuator Diagnostics Choose feedback sensing and diagnostics - open-load, plausibility, tracking error, startup pattern tests - that achieve the coverage the ASIL demands. ### Quantify an Actuation Channel Build an FMEDA for a motorized actuation channel, compute residual dangerous FIT per element, and argue the numbers the way an assessor reads them. The curriculum · 14 chapters ## Chapter by chapter 1. 01 **Where Safety Becomes Physical** Understand why actuation is the last line of the safety argument - every safety goal ultimately succeeds or fails at an actuator that moves, holds or releases. - Actuation as the end of the chain - Physical safe states - Page roadmap 2. 02 **A Tour of Automotive Actuators** Survey the actuator landscape: motors, solenoid valves, relays and their power stages, and the numbers that set the scene for each family. - Actuator families - Power stages - Domain examples 3. 03 **The Mechatronic Control Loop** See how setpoint, controller, power stage, actuator and feedback close a loop - and why a well-tuned loop quietly compensates for faults until it cannot. - Loop anatomy - Fault masking - Compensation limits 4. 04 **How Actuators Fail** Build a failure-mode vocabulary for actuation: stuck, runaway, sluggish, oscillating and lost actuation, and what each means at the vehicle level. - Stuck vs runaway - Failure-mode catalog - Vehicle-level effects 5. 05 **Torque and Motion Paths** Trace how commanded torque and motion flow from software through electronics to mechanics, and where a single fault can corrupt the path. - Torque path tracing - Motion path elements - Corruption points 6. 06 **HARA and Safety Goals for Actuation** Derive hazards and safety goals for actuation functions, with the severity, exposure and controllability reasoning specific to unintended or lost actuation. - Actuation hazards - S/E/C reasoning - Safety goal patterns 7. 07 **Feedback: Position, Speed and Current** Cover the sensors that watch the actuator - position, speed and current feedback - and how sensor choice and redundancy shape what faults are even detectable. - Position sensing - Current feedback - Sensor redundancy 8. 08 **Actuator Diagnostics** Learn the diagnostic toolbox for actuation channels: open-load and short detection, plausibility and tracking-error checks, and startup versus runtime tests. - Open-load detection - Tracking error checks - Startup vs runtime tests 9. 09 **Safe States and Degradation** Choose the right safe state per function - de-energize, hold, ramp down or active control - and design the degradation ladder between full function and off. - De-energize vs active hold - Degradation ladders - Safe state selection 10. 10 **Architecture Patterns for Safe Actuation** Apply monitoring architectures to actuation: command-and-monitor channels, independent shutoff paths, and where the second channel must live to be credible. - Monitoring channels - Independent shutoff - Pattern trade-offs 11. 11 **Motor Control Safety in Depth** Go deep on electric motor control: bridge topologies, commutation faults, safe torque off and active short circuit, and the transitions between them. - H-bridge faults - Active short circuit - Safe torque off 12. 12 **Valves, Relays and Switching Actuators** Treat switching actuators on their own terms: welded contacts, stuck valves, coil driver faults and the diagnostics that fit on-off devices. - Welded contacts - Stuck valve modes - Coil driver checks 13. 13 **Quantifying the Actuation Channel** Run a worked FMEDA over one motorized actuation channel - element failure rates, diagnostic coverage, residual FIT - then improve it and roll it into a system-level FTA. - Channel FMEDA - DC improvement pass - System-level FTA 14. 14 **Verification, Fault Injection and Pitfalls** Prove the claims: fault injection for actuation channels, verification of safe states under load, and the recurring pitfalls that surface in reviews. - Fault injection - Safe state verification - Pitfall gallery Worked Example ## FMEDA of a Motorized Actuation Channel Chapter 13 quantifies one complete actuation channel element by element, then shows how targeted diagnostic upgrades change the bottom line. - Element budget: lockstep MCU, gate driver, H-bridge MOSFETs, current sensing, position feedback, motor winding and harness - Baseline diagnostic coverage per element, from 70% on the harness to 99% on the lockstep MCU - Improvement pass: startup pattern tests and bridge test pulses lift gate driver and MOSFET coverage to 95% - Residual dangerous failure rate per element in FIT, before and after the upgrades - System-level FTA combining the channel with mixed causes, plus design-out arguments for jamming Actuation channel FMEDA Microcontroller (lockstep, ECC) - 100 FIT, DC 99% - lockstep cores, ECC memories, clock and voltage monitors Unlock in course Built for ## Who this guide is for - System and hardware engineers who own an actuation channel in an ASIL project - Software engineers writing monitoring, arming or safe-state logic for motors, valves or relays - Safety engineers deriving safety goals and safe states for actuation functions - FMEDA owners who need credible diagnostic coverage claims for power stages and feedback sensors ## Frequently Asked Questions Common questions about Actuator Safety De-energize is only safe when the passive behavior of the system is safe. For an electric power steering motor, removing power loses assist but the driver can still steer - usually acceptable. For a function that must hold position or pressure, removing power can itself create the hazard, which is why active hold and controlled ramp-down exist as safe states. The course builds a selection logic across de-energize, active hold, ramp-down and continued active control, and shows how degradation ladders connect full function to the final safe state. You decompose the channel into elements - microcontroller, gate driver, power bridge, current sensing, position feedback, winding and harness - assign each a failure rate in FIT and a diagnostic coverage claim tied to a real mechanism, and compute the residual dangerous failure rate. The worked example in Chapter 13 does exactly this for a motorized channel, then shows how startup pattern tests and bridge test pulses raise coverage on the power stage, and finally combines the channel into a system-level fault tree with mixed causes. The course has 14 chapters: an actuator landscape tour, the mechatronic control loop and its fault-masking behavior, failure modes, torque and motion paths, HARA for actuation, feedback sensing, diagnostics, safe states and degradation, architecture patterns, deep dives on motor control and on valves and relays, a worked FMEDA of one actuation channel, and a closing chapter on verification, fault injection and pitfalls. It is written for roughly 100 to 120 minutes of focused study. ## Start the course today A free account unlocks one full concept guide, 3 work product templates, 1 guided process, the Markov simulator, and 5 practice exams per month. The Pro and Expert plans unlock more of the 78-guide library. No credit card required. [Start learning](https://iso26262.academy/register?plan=free&from=%2Fconcepts%2Factuator-safety&utm_source=website&utm_medium=cta&utm_campaign=features_concepts) [View Pricing Plans](https://iso26262.academy/pricing)