Vehicle Motion Control Safety

Vehicle motion control is the layer that turns competing motion demands into one coordinated set of actuator commands across braking, steering, propulsion, regenerative braking and suspension. It needs its own analysis because every one of those subsystems ultimately spends the same limited tire force, and each subsystem safety argument rests on assumptions about a plant that now includes all the others. The coordination layer has its own hazards, its own interfaces, its own failure modes and its own verification problem, none of which belong to any single actuator safety case.

Yes, and that is the claim the whole guide rests on. A regenerative braking controller can assume the wheel it brakes is free to be braked while a slip controller assumes it is the only thing modulating torque at that wheel: both assumptions are individually reasonable, they are mutually exclusive, and no component-level safety case owns the sentence that says so. The resulting hazardous event has no broken part in it, which is why the guide treats wrong arbitration logic, an incomplete priority table and an allocation rule that inverts under saturation as systematic faults of the coordination layer.

SAE J2980 is a recommended practice giving guidance and example results for determining ASIL for collision-related motion-control hazards within its stated passenger-car scope. Its value is a consistent starting vocabulary and set of considerations, not a substitute for an item-specific hazard analysis and risk assessment. The guide uses it as a public anchor for how motion hazards are organized and deliberately reproduces none of its tables or results, since the document is licensed; every rating shown in the guide is an illustrative teaching example with the reasoning, not the letter, as the content.

A capability contract is the reverse direction of the motion interface: an actuator continuously publishing what it can deliver right now, at what gradient, after what latency, and in which degradation state. It matters more than the forward direction because a datasheet deceleration figure is a constant while the deliverable figure after sustained braking is not, and regenerative acceptance collapses near a full battery. Every safety function that plans against a capability number inherits its honesty or its lies, which is why the guide treats optimistic, stale and out-of-contract capability reports as an enumerable failure catalog with a detection hook per line.

It depends entirely on the shape of the failure at its outputs, which is why the guide separates silent, frozen, babbling and partial coordinator failures and shows that each produces a different vehicle. Timeouts catch silence and alive counters catch freezing, while babbling is fresh and well-formed enough to defeat both and falls to actuator-local plausibility. Beyond detection the guide covers the fail-silent coordinator with actuator-local fallback, the trap of letting each supplier choose its own timeout, when fail-operational patterns are actually required, and why a standby that boots without the vehicle present state creates its own gap.

The course has 14 chapters: how the chassis grew many hands, the shared physics of the four contact patches, motion hazards and the HARA, motion requests and capability contracts, control allocation, authority and arbitration, incompatible requests and cross-domain plausibility, saturation and degraded capability, common dependencies and dependent failures, coordinator failure, graceful degradation and fallback distribution, timing across the chain, verifying a coordinated function, and a worked coordinated motion architecture with ten recurring pitfalls.