Inside EMB Functional Safety: Redundancy, ISO 26262, and the End of Hydraulic Brakes

• Author: Johnny Liu | CEO at Dowway Vehicle
• Technical Reviewer: Yan Hailiang (Functional Safety Lead at Suzhou Coordinates)
• Published: August 6, 2026
• Target Reading Time: 7–9 minutes (~1,750 words)
• Target Audience: Automotive Engineers, EV Enthusiasts, Smart Chassis Product Managers
• Reading Level: Grade 8 (Clear language, simple explanations for technical topics)

Overview Fact Sheet

Quick Summary: Electro-Mechanical Braking (EMB) is a pure brake-by-wire technology. It replaces hydraulic brake fluid with wires and motor-driven calipers attached directly to the wheels. This change drops brake response times from$300\text{–}500\,\text{ms}$down to$<100\,\text{ms}$. Because EMB has no mechanical pedal linkage or fluid backup, functional safety requires ASIL D full-link redundancy (dual power, dual wiring, dual controllers) and strict compliance with GB 21670 and ISO 26262.

Metric / Parameter	Traditional Hydraulic Brakes	Electro-Mechanical Braking (EMB)
Response Time	$300\text{–}500\,\text{ms}$	$<100\,\text{ms}$ (43% speed boost)
Actuation Medium	Brake Fluid, Master Cylinder, Booster Pumps	Electrical Wiring, Servo Motors
Emergency Stopping Distance	Baseline	Reduced by approx. $2\,\text{m}$
Mechanical Fallback	Physical Hydraulic Pedal Linkage	Dual Electrical Power Redundancy (ASIL D)
National Safety Standard	Mandatory Hydraulic Rules	GB 21670 (Effective Jan 1, 2026)

Introduction: Moving from Hydraulic Fluid to Electric Wires

In 2025, global electric vehicle (EV) sales passed $16\,\text{million}$ units, taking over $50\%$ of the total car market. As Level 3 (L3) autonomous driving rules take effect around the world, old chassis designs face a major bottleneck. Hydraulic brakes move too slowly for self-driving computers.

For over a hundred years, cars used brake fluid, vacuum pumps, metal pipes, and master cylinders to slow down. Modern electric vehicles like the Chery Exeed and Li Auto L9 are switching to Electro-Mechanical Braking (EMB). EMB removes brake fluid completely and relies on direct electric control.

This technical breakdown comes from a live technical session held by SASETECH—an automotive safety community founded by the founder of Panshi Information. The talk featured Yan Hailiang, Functional Safety Lead at Suzhou Coordinates. He brings more than 10 years of experience in smart driving, chassis safety, and $0\text{–}1$ ASIL D product certifications. Below is the full engineering summary covering EMB architecture, safety backups, regulatory steps, and central chassis control.

I. EMB Redundancy Design: Doing Subtractions and Additions

The main safety strategy behind EMB comes down to two actions: removing heavy mechanical parts, and adding electrical safety backups.

[ Traditional Hydraulic Brake ] 
 Fluid + Master Cylinder + Booster Pumps + Brake Lines
                  │
                  ▼  (SUBTRACTION: Remove Fluid & Pipes)
[ EMB Actuator Setup ] 
 Direct Electric Wires + Wheel Motors (<100ms Response)
                  │
                  ▼  (ADDITION: Add ASIL D Redundancy)
[ Dual Power Isolation & Communication Buffers ]

1. Removing Old Mechanical Parts

• Faster Response Speed: Hydraulic fluid takes time to build pressure, causing a $300\text{–}500\,\text{ms}$ delay. EMB uses electric signals to move wheel calipers, cutting reaction times to under $100\,\text{ms}$.
• Cleaner Chassis Layout: Removing master cylinders, fluid lines, and booster pumps frees up space inside the frame. It also eliminates toxic brake fluid leaks.
• Unified Chassis Controls: Braking, steering, and suspension no longer need separate systems. Engineers can group them into one central chassis computer.

2. Adding Safety Backups

To reach the highest car safety rating (ASIL D under ISO 26262), engineering teams use two main design paths:

1. Central Controller + 4 Wheel Caliper Controllers: The four wheel controllers act as backups if the main unit fails. Inside the central unit, dual internal channels run main and backup logic simultaneously.
2. Full-Link Redundancy Architecture: Uses isolated dual power lines, dual communication channels, dynamic brake force compensation code, wheel speed sensors wired to each wheel controller, and dual-line power wiring throughout the car.

The Advantage for Car Makers: EMB separates hardware motors from control software. Car manufacturers can move braking code onto their own domain computers, making software easy to reuse across different car models.

II. Essential Capabilities: Beyond Stopping

EMB does more than just bring a car to a stop. It gives engineers precise vehicle movement controls that hydraulic systems cannot match:

                  ┌─► 1. Shorter Stopping Distance (-2m, +0.05G Deceleration)
                  │
EMB Key Features ─┼─► 2. Brake-Assisted Steering (Yaw Moment Control)
                  │
                  └─► 3. Single-Wheel Failure Drift Compensation

• Shorter Emergency Stops: By cutting reaction delays by 43%, EMB stops a car roughly $2\,\text{m}$ sooner in emergency stops. Finer ABS slip control raises average deceleration by $+0.05\,\text{G}$, which helps Automatic Emergency Braking (AEB) and L3+ driving software act faster.
• Brake-Assisted Steering: If a driver turns sharply and the front wheels slide (understeer), EMB applies brief braking force to the inner wheels. This creates a turning force (yaw moment) that helps steer the car through the corner.
• Single-Wheel Failure Drift Control: If one wheel motor breaks or loses power, the central system instantly adjusts brake forces on the remaining three wheels. This stops the car from spinning or pulling to one side. In test track demos, vehicles with one wheel brake disconnected completely still stopped in a smooth, straight line.

III. Handling Complete Power Loss

In a normal gas car, if the engine stops or the battery dies, you can still push the brake pedal hard to force hydraulic fluid down the line. In a pure wire-controlled EMB system, no electricity means no brakes.

To fix this power risk, safety regulators require strict dual-power redundancy:

[ Main Traction Battery ] ────┐
                              ├──► [ ASIL D Power Isolation Module ] ──► Dual EMB Power Paths
[ 12V Auxiliary Battery ] ────┘

• Dual Power Line Isolation: Two separate power sources feed the brakes. They must operate independently so a short circuit in one line cannot affect the other. Backup storage devices (batteries or DC-DC converters) must run continuous hardware self-tests to spot faults right away.
• The “8+1” Brake Test: The system must complete 8 consecutive full-power emergency stops. After those 8 stops, it must keep enough stored power for a 9th emergency stop with deceleration $\ge 2.44\,\text{m/s}^2$.
• The “4+1” Battery Health Test: Energy storage units must monitor their State of Health (SOH). If battery health falls by $>20\%$, an alert light turns on. If battery power hits a dangerously low level, the car must automatically slow down to under $20\,\text{km/h}$ within $60\,\text{s}$.

The Industry Fix: Engineering teams connect the main high-voltage EV battery with a secondary $12\,\text{V}$ auxiliary battery. An ASIL D power isolation module sits between both energy sources to keep power flowing even during single-point electrical failures.

IV. Regulatory Compliance: GB 21670 vs. ISO 26262

Engineers often ask: If our brake system passes China’s mandatory national standard (GB 21670), do we still need the international ISO 26262 process?

The answer is yes. These two standards work together:

• GB 21670 (National Mandatory Standard): Focuses on physical test results. It sets required stopping distances and hardware tests for wire-controlled ETBS systems starting January 1, 2026.
• ISO 26262 (International Safety Standard): Focuses on engineering processes. It details how hardware and software must be built, documented, and tested step-by-step using a strict V-model lifecycle.

       GB 21670 (Physical Performance Test Results)
                          +
       ISO 26262 (Development Methodology & Process)
                          =
   Complete Production-Ready Safety Evidence Chain

The 3-Layer Implementation Step

1. System Requirements: The Electronic Highway Braking system (ETBS) must meet ASIL D hardware target numbers.
2. Process Steps: Development must follow ISO 26262 V-model steps from early concept work down to final track testing.
3. Document Evidence: Manufacturers must keep detailed records for Hazard Analysis and Risk Assessment (HARA), safety goals, and system architecture plans (as required by Appendices A, B, and C of GB 21670).

ASIL Decomposition Method: You do not need every single part to hold an individual ASIL D rating. By pairing two independent ASIL B power channels with automatic backup switching and end-to-end (E2E) signal protection, the combined system reaches ASIL D system safety at a lower manufacturing cost.

V. Centralized Chassis Domain Architecture

Changes in car computer design are speeding up EMB adoption across the industry:$$\text{Distributed ECUs (2015)} \longrightarrow \text{Domain Controllers} \longrightarrow \text{Central Computing + Zonal Control}$$

Modern chassis setups rely on three main technology choices:

1. Full X-by-Wire Control (Electric control for steering, braking, and accelerator).
2. Decoupled Software and Hardware (Separating control code from mechanical motors).
3. XYZ 3D Motion Control (Managing forward, side, and up-down car movements together).

                      [ Central Computing Domain Controller ]
                                         │
        ┌────────────────────────────────┼────────────────────────────────┐
        ▼                                ▼                                ▼
  Longitudinal (X)                  Lateral (Y)                     Vertical (Z)
   (EMB Braking)               (Steer-by-Wire Control)           (Active Suspension)

Real-World Example: Nio ET9 at $130\,\text{km/h}$

Consider a tire blowout happening at $130\,\text{km/h}$ in a Nio ET9:

• Steer-by-wire adjusts front wheel angles within $230\,\text{ms}$ to stay in the lane.
• ESP and torque control rebalance motor power across the wheels within $10\,\text{ms}$.
• Active suspension levels body lean within $1\,\text{ms}$.

This millisecond response rate is impossible with slow hydraulic fluid. Pure electric EMB motors link straight to central chassis computers, helping all three systems work as one unified safety shield.

VI. Technical Questions and Answers (Q&A)

Q1: Does EMB need physical pressure sensors on every wheel caliper?

Short Answer: No, mass-production EMB systems do not need physical force sensors on every wheel because software algorithms estimate clamping force accurately.

Instead of adding expensive force sensors that can wear out, engineers use force estimation code. This software calculates clamping force using motor electrical current, motor turning angle, and wheel speed. This approach cuts hardware costs while keeping braking force accurate.

Q2: Is EMB strictly required for Level 3 (L3) autonomous driving?

Short Answer: L3 systems can still use modified hydraulic systems (EHB), but EMB is preferred due to its sub-100ms speed, while L4 driving will require EMB.

L3 self-driving systems can run on Electro-Hydraulic Brakes (EHB) if engineers manage hydraulic delays. Most safety targets set a Fault Tolerant Time Interval (FTTI) between $200\text{–}500\,\text{ms}$. Because EMB responds in $<100\,\text{ms}$, it leaves plenty of time budget for safety software to react. L4 self-driving cars and above will strictly require pure EMB setups.

Q3: How do engineers manage common-cause failures in dual Microcontroller Units (MCUs), and is system degradation a valid safe state?

Short Answer: Dual MCUs use Dependent Failure Analysis (DFA) to manage shared risks, and controlled performance degradation is accepted as a safe state if minimum stopping rules are met.

Engineers use Dependent Failure Analysis (DFA) to study shared risks across dual MCUs. While teams use different sensor types where possible (such as mixing Hall-effect and inductive sensors), using two completely different MCU chips is too expensive for mass production.

Regarding degradation: Yes, reducing system output is a recognized safe state, as long as the reduced brake power still meets minimum emergency deceleration targets. Whenever a system degrades, engineers must re-calculate the overall ASIL safety level.

Q4: Should all four wheel-end actuators use completely different components to prevent shared failures?

Short Answer: Component variations are added where practical, but making all four wheel controllers completely different is cost-prohibitive for mass production.

Engineering teams use component variations where it makes sense. However, making core chips like MCUs completely different across four wheels raises factory costs significantly. Industry teams focus instead on careful DFA studies, physical wiring separation, and real-time fault checks to manage shared risks cleanly.

Final Words: Building Production-Ready EMB Systems

Replacing hydraulic fluid with electric wiring is about more than quick stopping times. It creates an independent, flexible wheel controller for future software-defined cars.

As engineering teams shift EMB from track tests to high-volume factories, success will not depend on adding the highest count of extra parts. Winning designs will be the ones that can detect, isolate, and handle component faults within milliseconds while maintaining clear ISO 26262 documentation for regulators.

About the Author

Johnny Liu is the CEO at Dowway Vehicle. He specializes in next-generation wire-controlled chassis setups, power electronics, and automotive functional safety architecture.

Have questions about EMB power isolation or ISO 26262 compliance? Reach out to our technical team or join the SASETECH automotive safety community.