Title: Brake System Safety: ABS, ESC and Brake-by-Wire | ISO 26262 Academy URL: https://iso26262.academy/features/concepts/brake-system-safety Description: A brake does not fail safe by braking, and releasing is no safer. --- Concept guide · ISO 26262-3 · ISO 26262-4 · 10 chapters # Brake System Safety: ABS, ESC and Brake-by-Wire One fictional brake-by-wire item from tyre physics to a technical safety concept: the hazards, the safety goals that pull against each other, the degradation levels, the timing, and why ABS and ESC follow a different fault philosophy. 10 Chapters 24 Figures 8 Review Pitfalls 1 Running Example Included in [Expert](https://iso26262.academy/pricing#plan-advanced) [Preview free](https://iso26262.academy/register?plan=free&from=%2Fconcepts%2Fbrake-system-safety&utm_source=website&utm_medium=cta&utm_campaign=features_concepts) See the chapters Inside the course 1. 01 **How a Car Stops** 2. 02 **What ABS and ESC Do** 3. 03 **Brake-by-Wire and Its Item Definition** 4. 04 **Hazards and the HARA** 5. 05 **Safety Goals and Safe States** The short version ## Quick answers Why does a brake not fail safe by braking? Because unrequested braking is itself one of the main brake hazards. Releasing the brakes is no better, since it removes braking at the moment the driver needs it. A moving car with a brake fault has no passive state that satisfies both goals, so brake-by-wire reacts with a degraded braking mode and a warning, and reaches its final safe state only once the car is stationary and held. Why may ABS and ESC switch off after a fault when brake-by-wire may not? ABS and ESC sit on top of a base brake that does not depend on them. When they go silent, the pedal still brakes the wheels and the driver has an ordinary car. In brake-by-wire the electronics are the base brake, so switching off would mean losing braking. The item has to keep a degraded but sufficient braking function after any single fault. Keep going, free - [Demo exam · no account Test yourself with 7 exam-style questions](https://iso26262.academy/demo-exam) Why this course · ISO 26262, Part 3 ## Why it pays for itself ### Rate brake hazards with the physics behind them Slip, yaw, split friction and stopping distance are explained first, so severity, exposure and controllability become arguments rather than lookups. The interactive HARA lets you change a rating and see the reasoning that has to change with it. ### Design for a system with no safe way to stop working Braking when nobody asked is a hazard, and so is releasing. The guide shows why brake-by-wire answers a fault with a degraded braking level and a warning, and reaches its final safe state only once the car is stationary and held. ### Make the backup survive any single fault Legally required backup braking shapes the architecture. You see why a backup that shares a power net or a controller with the main path does not count, and what changes for an electro-mechanical brake that has no hydraulic push-through to fall back on. ### Keep idle backups honest Loss of braking waits for the pedal. The timing chapter separates faults that appear during braking from faults that sit latent until the next demand, and the technical concept shows the start-up and standstill tests that find them first. After the course ## What you’ll be able to do ### Reason about brake hazards physically Use slip, yaw, split friction and stopping distance to argue severity, exposure and controllability for braking hazards. ### Define a brake item Draw the boundary of a brake-by-wire item, its interfaces and the facts its item definition must record. ### Resolve conflicting safety goals Specify degraded braking levels and warnings when neither braking nor releasing is a safe state. ### Design a backup that counts Make driver-demanded braking survive any single fault, and find latent faults in idle backups before the demand. ### Choose the fault philosophy per function Decide fault by fault whether a function may go silent or must degrade, and state the cost in design and evidence. The curriculum · 10 chapters ## Chapter by chapter 1. 01 **How a Car Stops** The hydraulic brake and the dual circuit that tolerates a leak, stopping distance split into its phases, and where electronics enter the stop. - The dual circuit - Stopping distance - Where electronics enter 2. 02 **What ABS and ESC Do** Wheel slip and why a locked wheel cannot steer, what ABS does at each wheel, and the yaw and split-friction problems ESC addresses. - Wheel slip - The ABS cycle - Yaw and split friction 3. 03 **Brake-by-Wire and Its Item Definition** What brake-by-wire changes, drawing the item boundary and its interfaces, and what the item definition must say about a brake. - Three architectures - The item boundary - Item definition contents 4. 04 **Hazards and the HARA** Finding the braking hazards, severity, exposure and controllability in brake terms, an illustrative HARA you can change, and four braking-specific traps. - Hazard matrix - S, E and C for brakes - Four HARA traps 5. 05 **Safety Goals and Safe States** From hazardous events to safety goals, why neither braking nor releasing is always safe, and how legally required backup braking shapes the architecture. - Goals that conflict - No universal safe state - Backup braking 6. 06 **A Functional Safety Concept for Brake-by-Wire** Catching unrequested braking, keeping braking available through every single failure, and telling the driver clearly which degradation level is active. - Goals to requirements - Degradation levels - Warnings and the driver 7. 07 **A Technical Safety Concept Sketch** An architecture with redundant power, sensing and actuation that you can break, the reasoning behind each redundancy, the pedal feel simulator, and the tests that keep idle backups honest. - An architecture you can break - Why each redundancy - Latent-fault tests 8. 08 **FTTI and Timing for Braking** How long unintended braking may last, why loss of braking waits for the pedal, and the timing shapes of the ABS and ESC goals. - Unintended braking - Faults that wait - ABS and ESC timing 9. 09 **Fail-Silent ABS and ESC Versus Degraded Brake-by-Wire** Why ABS and ESC may switch themselves off and brake-by-wire may not, and what each philosophy costs in design and evidence. - Two philosophies - Twin state machines - What each costs 10. 10 **Pitfalls and Review Checklist** The mistakes that recur in brake safety concepts and a checklist, grouped by lifecycle step, to catch them in a review. - Recurring pitfalls - Review checklist - By lifecycle step Read all 10 chapters with Expert. Start with a free account: the complete Functional Safety Concept guide and 5 practice exams a month, then upgrade when you need this guide. [Expert](https://iso26262.academy/pricing#plan-advanced) [Preview free](https://iso26262.academy/register?plan=free&from=%2Fconcepts%2Fbrake-system-safety&utm_source=website&utm_medium=cta&utm_campaign=features_concepts) [Try the 7-question demo exam](https://iso26262.academy/demo-exam) Diagrams & visuals ## Not just text: the visual toolkit ### Dual-Circuit Scene Front and rear split against diagonal split, with a leak in one circuit and the braking that remains. ### Slip Curve Braking friction and remaining lateral grip against wheel slip, with the window ABS keeps the wheel in. ### Split-Friction Stop An emergency stop on split friction without ABS, with ABS, and with yaw-moment limitation. ### Item Boundary The example brake-by-wire item with its elements and its interfaces to neighbouring items. ### Interactive HARA Hazardous events of the example item with the severity, exposure and controllability reasoning behind each class. ### Safe-State Dilemma Candidate reactions to brake faults and the safety goals each one protects or violates. ### Degradation Staircase The levels of the example item from full function down to stationary and held. ### Twin State Machines The same faults injected into fail-silent ABS and ESC and into degraded brake-by-wire. Chapters 3 to 9 ## One Brake-by-Wire Item, End to End A generic electro-hydraulic brake-by-wire item runs through the whole guide, from its item definition to its timing requirements, with an electro-mechanical variant where the absence of hydraulic push-through changes the answer. - The item boundary and its interfaces to other items - An illustrative HARA you can change and argue with - Safety goals that pull in opposite directions - Degradation levels from full function to stationary and held - A technical concept with redundant power, sensing and actuation Inside the running example The item boundary and its interfaces to other items Full running example available with an Expert plan Built for ## Who this guide is for - Engineers on brake-by-wire, integrated brake or ABS and ESC programmes - Safety engineers writing the HARA, safety goals or functional safety concept for a chassis item - System architects deciding how much redundancy a degraded braking level needs - Engineers coming from another domain who need the brake physics before the safety analysis makes sense ## Frequently Asked Questions Common questions about Brake System Safety: ABS, ESC and Brake-by-Wire A failed pressure source harms nobody until the driver brakes, so the fault can stay hidden until the demand. That splits the requirement in two: a short detection and switchover time for faults that appear during braking, sized from the stopping-distance budget, and a test interval for the backups that keeps a hidden fault at the moment of demand unlikely. In general terms only: service, secondary and parking braking, residual performance after a failure and the required warning signals. The regulation's figures are not reproduced. How the braking regulation relates to ISO 26262 evidence is covered on the Homologation and Regulations guide, and every rating, ASIL and time on this page is illustrative. ## Start the course today A free account unlocks one full concept guide, 3 work product templates, 1 guided process, the Markov and RBD simulators, and 5 practice exams per month. The Pro and Expert plans unlock more of the 93-guide library. No credit card required. [Preview free](https://iso26262.academy/register?plan=free&from=%2Fconcepts%2Fbrake-system-safety&utm_source=website&utm_medium=cta&utm_campaign=features_concepts) [View Pricing Plans](https://iso26262.academy/pricing) Continue with ## Where this topic leads next. [Browse all 93 guides](https://iso26262.academy/features/concepts#library) - Vehicle domains [Battery & HV Powertrain Safety](https://iso26262.academy/features/concepts/battery-hv-safety) Functional safety for electric vehicles from cell to wheel: how lithium-ion cells fail, the BMS measurement chain, contactors and HVIL, isolation monitoring, safe torque, charging and thermal runaway, plus the FMEDA and FTTI work behind it. [Expert](https://iso26262.academy/pricing#plan-advanced) 14 chapters - Vehicle domains [Inverter and Motor Control Safety](https://iso26262.academy/features/concepts/inverter-motor-control-safety) How a traction inverter earns its ASIL: unintended-torque hazards, Active Short Circuit vs freewheeling safe states, three-level torque monitoring, and the protection layers from gate driver to control software. [Expert](https://iso26262.academy/pricing#plan-advanced) 12 chapters - Beyond the standard [SotIF for the Functional Safety Engineer](https://iso26262.academy/features/concepts/sotif-for-fusi) A FuSi-engineer manual for extending HARA, FSC, TSC, FMEDA, and the safety case into ISO 21448 (SotIF), ISO/PAS 8800, and ISO/IEC TR 5469. Deeply technical with worked examples on triggering conditions, acceptance criteria, and field monitoring. [Pro](https://iso26262.academy/pricing#plan-basic) [Expert](https://iso26262.academy/pricing#plan-advanced) 12 chapters