Safe State Definition and Verification for Distributed Multi-Controller EMB Architectures

Abstract

The Electro-Mechanical Brake (EMB) system is an essential technology for safe braking in modern vehicles. However, the adoption of multi-controller architectures has introduced new challenges to conventional Safe State strategies. Traditionally, the Safe State defined in functional safety means "function shutdown," and in accordance with ISO 26262-1:2018 (Part 1: Vocabulary), aims for an "operational mode without risks exceeding reasonable levels." However, in the multi-controller architecture of EMB systems, the Fail-Operational Safe State concept is applied, where the system continues to provide limited functions even in the event of faults. It is essential to verify whether such operational modes actually satisfy the safety requirements of ISO 26262-3 and ISO 26262-4. This paper redefines the Safe State according to failure modes in EMB systems, analyzes system state transitions, and presents a coherence analysis methodology for validating the availability of resources required to provide limited functions in the Fail-Operational Safe State. Through this approach, potential design defects in multi-controller-based EMB systems can be detected early, validated across 1,149,952 fault scenarios with zero total-failure outcomes, and traceability of functional safety requirements can be established.