Brake System Safety: ABS, ESC and Brake-by-Wire
One fictional brake-by-wire item from tyre physics to a technical safety concept: the hazards, the safety goals that pull against each other, the degradation levels, the timing, and why ABS and ESC follow a different fault philosophy.
- Chapters
- 10
- Chapters
- Figures
- 24
- Figures
- Review Pitfalls
- 8
- Review Pitfalls
- Running Example
- 1
- Running Example
Quick answers
- Why does a brake not fail safe by braking?
- Because unrequested braking is itself one of the main brake hazards. Releasing the brakes is no better, since it removes braking at the moment the driver needs it. A moving car with a brake fault has no passive state that satisfies both goals, so brake-by-wire reacts with a degraded braking mode and a warning, and reaches its final safe state only once the car is stationary and held.
- Why may ABS and ESC switch off after a fault when brake-by-wire may not?
- ABS and ESC sit on top of a base brake that does not depend on them. When they go silent, the pedal still brakes the wheels and the driver has an ordinary car. In brake-by-wire the electronics are the base brake, so switching off would mean losing braking. The item has to keep a degraded but sufficient braking function after any single fault.
Why it pays for itself
Rate brake hazards with the physics behind them
Slip, yaw, split friction and stopping distance are explained first, so severity, exposure and controllability become arguments rather than lookups. The interactive HARA lets you change a rating and see the reasoning that has to change with it.
Design for a system with no safe way to stop working
Braking when nobody asked is a hazard, and so is releasing. The guide shows why brake-by-wire answers a fault with a degraded braking level and a warning, and reaches its final safe state only once the car is stationary and held.
Make the backup survive any single fault
Legally required backup braking shapes the architecture. You see why a backup that shares a power net or a controller with the main path does not count, and what changes for an electro-mechanical brake that has no hydraulic push-through to fall back on.
Keep idle backups honest
Loss of braking waits for the pedal. The timing chapter separates faults that appear during braking from faults that sit latent until the next demand, and the technical concept shows the start-up and standstill tests that find them first.
What you’ll be able to do
Reason about brake hazards physically
Use slip, yaw, split friction and stopping distance to argue severity, exposure and controllability for braking hazards.
Define a brake item
Draw the boundary of a brake-by-wire item, its interfaces and the facts its item definition must record.
Resolve conflicting safety goals
Specify degraded braking levels and warnings when neither braking nor releasing is a safe state.
Design a backup that counts
Make driver-demanded braking survive any single fault, and find latent faults in idle backups before the demand.
Choose the fault philosophy per function
Decide fault by fault whether a function may go silent or must degrade, and state the cost in design and evidence.
Chapter by chapter
- 01
How a Car Stops
The hydraulic brake and the dual circuit that tolerates a leak, stopping distance split into its phases, and where electronics enter the stop.
- The dual circuit
- Stopping distance
- Where electronics enter
- 02
What ABS and ESC Do
Wheel slip and why a locked wheel cannot steer, what ABS does at each wheel, and the yaw and split-friction problems ESC addresses.
- Wheel slip
- The ABS cycle
- Yaw and split friction
- 03
Brake-by-Wire and Its Item Definition
What brake-by-wire changes, drawing the item boundary and its interfaces, and what the item definition must say about a brake.
- Three architectures
- The item boundary
- Item definition contents
- 04
Hazards and the HARA
Finding the braking hazards, severity, exposure and controllability in brake terms, an illustrative HARA you can change, and four braking-specific traps.
- Hazard matrix
- S, E and C for brakes
- Four HARA traps
- 05
Safety Goals and Safe States
From hazardous events to safety goals, why neither braking nor releasing is always safe, and how legally required backup braking shapes the architecture.
- Goals that conflict
- No universal safe state
- Backup braking
- 06
A Functional Safety Concept for Brake-by-Wire
Catching unrequested braking, keeping braking available through every single failure, and telling the driver clearly which degradation level is active.
- Goals to requirements
- Degradation levels
- Warnings and the driver
- 07
A Technical Safety Concept Sketch
An architecture with redundant power, sensing and actuation that you can break, the reasoning behind each redundancy, the pedal feel simulator, and the tests that keep idle backups honest.
- An architecture you can break
- Why each redundancy
- Latent-fault tests
- 08
FTTI and Timing for Braking
How long unintended braking may last, why loss of braking waits for the pedal, and the timing shapes of the ABS and ESC goals.
- Unintended braking
- Faults that wait
- ABS and ESC timing
- 09
Fail-Silent ABS and ESC Versus Degraded Brake-by-Wire
Why ABS and ESC may switch themselves off and brake-by-wire may not, and what each philosophy costs in design and evidence.
- Two philosophies
- Twin state machines
- What each costs
- 10
Pitfalls and Review Checklist
The mistakes that recur in brake safety concepts and a checklist, grouped by lifecycle step, to catch them in a review.
- Recurring pitfalls
- Review checklist
- By lifecycle step
Read all 10 chapters with Expert.
Start with a free account: the complete Functional Safety Concept guide and 5 practice exams a month, then upgrade when you need this guide.
Expert plan pricingNot just text: the visual toolkit
Dual-Circuit Scene
Front and rear split against diagonal split, with a leak in one circuit and the braking that remains.
Slip Curve
Braking friction and remaining lateral grip against wheel slip, with the window ABS keeps the wheel in.
Split-Friction Stop
An emergency stop on split friction without ABS, with ABS, and with yaw-moment limitation.
Item Boundary
The example brake-by-wire item with its elements and its interfaces to neighbouring items.
Interactive HARA
Hazardous events of the example item with the severity, exposure and controllability reasoning behind each class.
Safe-State Dilemma
Candidate reactions to brake faults and the safety goals each one protects or violates.
Degradation Staircase
The levels of the example item from full function down to stationary and held.
Twin State Machines
The same faults injected into fail-silent ABS and ESC and into degraded brake-by-wire.
One Brake-by-Wire Item, End to End
A generic electro-hydraulic brake-by-wire item runs through the whole guide, from its item definition to its timing requirements, with an electro-mechanical variant where the absence of hydraulic push-through changes the answer.
- The item boundary and its interfaces to other items
- An illustrative HARA you can change and argue with
- Safety goals that pull in opposite directions
- Degradation levels from full function to stationary and held
- A technical concept with redundant power, sensing and actuation
Full running example available with an Expert plan
Who this guide is for
- Engineers on brake-by-wire, integrated brake or ABS and ESC programmes
- Safety engineers writing the HARA, safety goals or functional safety concept for a chassis item
- System architects deciding how much redundancy a degraded braking level needs
- Engineers coming from another domain who need the brake physics before the safety analysis makes sense
Frequently Asked Questions
Common questions about Brake System Safety: ABS, ESC and Brake-by-Wire
Start the course today
A free account unlocks one full concept guide, 3 work product templates, 1 guided process, the Markov and RBD simulators, and 5 practice exams per month. The Pro and Expert plans unlock more of the 93-guide library. No credit card required.
Continue with
Where this topic leads next.
- Vehicle domainsBattery & HV Powertrain SafetyFunctional safety for electric vehicles from cell to wheel: how lithium-ion cells fail, the BMS measurement chain, contactors and HVIL, isolation monitoring, safe torque, charging and thermal runaway, plus the FMEDA and FTTI work behind it.
- Vehicle domainsInverter and Motor Control SafetyHow a traction inverter earns its ASIL: unintended-torque hazards, Active Short Circuit vs freewheeling safe states, three-level torque monitoring, and the protection layers from gate driver to control software.
- Beyond the standardSotIF for the Functional Safety EngineerA FuSi-engineer manual for extending HARA, FSC, TSC, FMEDA, and the safety case into ISO 21448 (SotIF), ISO/PAS 8800, and ISO/IEC TR 5469. Deeply technical with worked examples on triggering conditions, acceptance criteria, and field monitoring.