Safety Design Decisions Across Vehicle Domains
11 chapters Powertrain, brakes, steering, ADAS, battery, cockpit, airbag, power-net and thermal systems all walk the same ISO 26262 Part 3-6 chain - yet each arrives at a different technical answer. Learn the four forces that make one method produce nine different architectures, and why none of those differences are arbitrary.
How You Learn
Video and text stay in sync. As you scroll through the chapter, the video jumps to the matching explanation automatically.
Learning Objectives
Trace any domain down the Part 3-6 chain
Walk a system from Item Definition through HARA, FSC, TSC, HSI, hardware and software without skipping a link.
Derive safe states from hazard physics
Read a hazard's dynamics to justify torque-off, honest-blank, or ramp-down rather than picking a safe state by habit.
Set FTTI from hazard dynamics
Calculate fault-tolerant time intervals from how fast a hazard develops instead of negotiating them after the fact.
Justify redundancy and monitoring per ASIL
Explain why three-level monitoring, doer/checker or dual-winding motors appear where they do and not elsewhere.
Chapters
The Design-Decision Chain
The same seven-step work-product sequence - Item Definition, HARA, FSC, TSC, HSI, hardware and software - that every safety-related E/E system walks, and the four forces that push domains toward different answers.
Powertrain: EV Traction & Torque Control
How an electric drive derives its safety goal against unintended torque, landing on three-level monitoring and two independent shut-off paths.
Braking: ESC & Brake-by-Wire
Why an integrated one-box brake system treats degradation as a ladder rather than a switch, and where ASIL D forces redundancy.
Steering: EPS & Steer-by-Wire
The ramp-down doctrine for electric power steering, built on a fail-silent channel, dual-winding motor and bounded torque overlay.
ADAS: AEB & L2 Highway Assist
A system that can simply stop acting - so its safety concept centres on false-positive braking, two-modality confirmation and a doer/checker split.
HV Battery Management System
A 400 V traction battery whose safety goals run in seconds not milliseconds, split into a smart primary and a dumb secondary protection layer.
Airbag & Restraint Systems
The famous ASIL asymmetry - inadvertent deployment is ASIL D while non-deployment is lower - and a domain with no meaningful FTTI.
Power Distribution & E-Fuse
A zonal 12 V power net that inherits availability hazards from other items, using selective tripping and a load-shedding ladder on a millisecond clock.
QM Domains with Safety Islands
Cockpit/infotainment and EV thermal systems that are mostly QM, protecting a small ASIL island in a QM ocean via the honest-blank and integrity-island doctrines.
Cross-Domain Synthesis
The patterns that repeat and the ones that diverge, showing FTTI as a derivation from hazard dynamics rather than a negotiation.
The HSI as the Domain Contract
How the Hardware-Software Interface pins down registers, timing, and diagnostics differently in each domain to make the split responsibilities auditable.
Diagrams & Visuals
The Part 3-6 Decision Chain
Animates the seven work products from Item Definition through software design and shows how each decision constrains the next.
Cross-Domain Safe-State Map
Compares the chosen safe state for each of the nine domains against the hazard physics that forced it.
FTTI Timeline by Domain
Plots fault-tolerant time intervals from milliseconds in steering to seconds in the battery to show why architectures diverge.
Degradation Ladder Diagram
Shows how braking and power distribution degrade in graded steps instead of a single hard cutoff.
Doer/Checker & Redundancy Patterns
Contrasts the ADAS doer/checker split, the steering fail-silent channel and the battery dual-layer protection.
Safety Island in a QM Ocean
Illustrates freedom from interference between a small ASIL island and the surrounding QM cockpit or thermal software.
One Hazard, Two Domains, Two Very Different Answers
Take 'unintended longitudinal motion' as it appears in the EV powertrain and in the ADAS AEB function. Both start from an ASIL C/D hazard, yet the powertrain lands on three-level torque monitoring with two shut-off paths while AEB lands on two-modality confirmation with a doer/checker split - because the hazard physics and FTTI differ.
- Powertrain safe state: torque-off via two independent shut-off paths, millisecond FTTI
- AEB safe state: stop acting (release brake demand), false-positive braking as the dominant hazard
- Powertrain TSC: three-level (E-Gas) monitoring on an ASIL D lockstep core
- AEB TSC: two-modality sensor confirmation guarding against phantom targets
- Divergence driver: FTTI derived from how fast each hazard develops, not chosen
- Same standard, same chain, opposite architectures - and both are correct
Cross-Domain Decision Table
Master Safety Design Decisions Across Every Vehicle Domain
Follow the ISO 26262 Part 3-6 chain through nine real automotive domains and learn why one method produces nine different architectures - and how to defend each choice in review.
Start Learning Now