Written by: Johnny Liu, CEO at Dowway Vehicle
Published: August 7, 2026
Last updated: August 7, 2026
Estimated reading time: 8–10 minutes
Technical level: Automotive engineering overview
Source basis: R&D Report No. 218, “Safety Requirements of Intelligent Driving for One-Box Solutions”
Table of Contents
Quick Answer
A One-box braking system must continue to provide safe braking after a failure. In driver-assistance vehicles, the driver may use a mechanical backup to bring the vehicle to a safe state. In Level 3 and higher automated vehicles, the system cannot depend only on driver pedal input. It normally needs an independent Redundant Brake Unit, redundant wheel-speed sensing, and backup longitudinal stability control.
TL;DR
- Driver-assistance systems can still treat the driver as part of the failure-response strategy.
- Mechanical backup must provide the required emergency deceleration after active brake assistance fails.
- Level 3 and higher vehicles must retain braking capability after a single fault without relying only on the driver.
- A One-box system is therefore commonly paired with a Redundant Brake Unit, or RBU.
- The RBU must support both basic braking and limited longitudinal stability control.
- Redundant wheel-speed sensors are needed to support backup ABS and stability functions.
- European, Chinese, and United States regulations all affect One-box system design.
Electric vehicles and automated driving are two of the strongest forces changing the global automotive industry. For Chinese vehicle manufacturers and high-end component suppliers, they also create an opportunity to compete with established automotive markets.
Over the next five to ten years, automated vehicles are expected to become more visible in daily life. As this happens, One-box braking systems will receive even more attention from Tier 1 suppliers, universities, research teams, and industry-academic startups.
The reason is simple: braking is not just another vehicle function.
It is a core safety function.
When the driver is no longer fully responsible for reacting to a failure, the brake system must be able to detect faults, switch control paths, maintain pressure, manage wheel slip, and bring the vehicle to a reasonable safe state.
This article explains what that means for a One-box braking system.
What Is a One-Box Braking System?
A One-box braking system integrates active brake-pressure generation, brake control, and vehicle stability functions into one main unit. Many One-box products also use a fully decoupled pedal structure, which separates the driver’s pedal feel from the hydraulic pressure-generation process during normal operation.
This integrated design is attractive for electric and intelligent vehicles because it can reduce system size, improve pressure response, support regenerative braking coordination, and simplify chassis integration.
However, integration creates a safety challenge.
When several functions are combined in one unit, a power failure, motor failure, controller failure, valve fault, or pressure-generation failure may affect more than one braking function at the same time. The design must therefore include a clear fallback strategy.
That fallback strategy depends heavily on the vehicle’s automation level.
What Does Driver Assistance Require from a One-Box System?
In a driver-assistance vehicle, the driver remains responsible for moving the vehicle into a safe state after a system fault. The system must identify the problem, report it correctly and quickly, and continue to provide enough braking capability for the driver to control and stop the vehicle.
This safety concept assumes that the driver can receive the warning, understand it, and respond within the available time.
Continued brake capability is critical because the driver cannot bring the vehicle to a safe state if the vehicle loses all braking force.
What Emergency Braking Performance Must Be Maintained?
The source report states that ECE R13 and China’s GB 21670 place mandatory requirements on emergency braking capability.
After the basic braking function fails, the report states that the vehicle should achieve an average deceleration of at least:
2.44 m/s²
This performance is linked in the report to a driver pedal input of 500 N, although some passages use 500 Nm.
Editorial verification note: Pedal input force is normally expressed in newtons, while torque is expressed in newton-metres. Because the source report contains both “500 N” and “500 Nm,” the final published value should be checked against the applicable regulation, test procedure, and original Chinese technical source. This article preserves the source’s stated requirement without silently correcting it.
How Does Mechanical Backup Work?
To meet emergency braking requirements, a One-box system can include a mechanical backup.
When the active booster or pressure-generation function fails, the driver can still press the brake pedal and mechanically move the pistons in the brake master cylinder. The master cylinder then sends brake fluid into the wheel cylinders, creating hydraulic pressure and vehicle deceleration.
The report uses Bosch IPB as an example.
Possible causes of active pressure-generation failure include:
- Power supply failure
- Booster motor failure
- Active pressure-generation module failure
- Related electrical or control faults
In the mechanical backup mode described in the report:
- Valve 1 closes
- Valve 4 closes
- Valve 5 closes
- Valve 2 opens
- Valve 3 opens
The driver presses the pedal, the master-cylinder pistons move, and brake fluid is pushed through the hydraulic circuit into the four wheel cylinders.
The key point is that the vehicle can still generate braking force even when the active pressure-generation module is unavailable.
Why Does the Master Cylinder Use Two Hydraulic Chambers?
The brake master cylinder uses a dual-chamber design. The primary and secondary chambers each connect to two wheel-brake circuits.
The exact wheel connection depends on the hydraulic layout.
Two common layouts are:
- X-split layout
- H-split layout
Passenger vehicles commonly use an X-split arrangement.
In an X-split system, each hydraulic circuit normally serves wheels on opposite corners of the vehicle. This helps preserve a more balanced braking effect if one circuit fails.
A dual-circuit system matters because a single hydraulic leak should not eliminate all braking capability.
What Happens If One Brake Circuit Leaks?
The Bosch IPB design requirement described in the source report goes beyond basic mechanical backup.
It also considers an extreme condition in which the One-box has already entered mechanical backup mode and either the primary or secondary brake circuit then develops a leak.
Under that condition, the remaining brake circuit should still provide an average deceleration of at least 2.44 m/s² at the stated driver pedal input.
The report therefore explains that, when no hydraulic circuit leak is present, the IPB mechanical backup design should be able to produce approximately:
4.88 m/s²
This higher target creates enough braking margin so that, after one hydraulic circuit is lost, the remaining circuit can still provide the required 2.44 m/s².
This is an important design principle.
A fallback system is not truly robust if it only works when every hydraulic circuit remains healthy.
Why Does Master-Cylinder Bore Size Matter?
One-box systems often use a smaller master-cylinder bore because the brake pedal is fully decoupled during normal assisted operation.
When the active booster works normally, the system can maintain a suitable pedal feel while also achieving effective pressure generation. A smaller bore can help produce hydraulic pressure efficiently.
But the same choice can create a problem in mechanical backup mode.
For most current vehicle designs, the following dimensions are difficult to change:
- Brake pedal ratio
- Maximum pedal travel
- Available master-cylinder length
- Pedal-box packaging space
If the master-cylinder length remains the same while the bore diameter becomes smaller, the total amount of brake fluid displaced during a given pedal stroke decreases.
That means that, at the same pedal depth, a One-box master cylinder may deliver less brake fluid to the wheel cylinders than a system using an iBooster or a conventional vacuum booster.
Less displaced fluid can limit wheel-cylinder movement and reduce the braking force available during mechanical backup.
For this reason, the master-cylinder structure, bore, stroke, chamber volume, seal arrangement, and wheel-end fluid demand must be designed carefully.
A smaller master cylinder may improve normal pressure-building performance, but it must not prevent the mechanical backup from meeting emergency braking requirements.
Why Is Mechanical Backup Not Enough for Level 3 Automated Driving?
For Level 3 and higher automated driving, the vehicle system carries greater responsibility for managing failures and reaching a safe state.
SAE J3016 is widely used to describe levels of driving automation. According to the source report’s interpretation, Level 3 and higher systems must retain braking or steering capability after a single failure so that the vehicle can move into a safe condition and avoid personal injury.
The main difference is responsibility.
In a driver-assistance system, the driver is expected to respond.
In a Level 3 or higher automated system, the automated driving system must manage the failure scenario.
That means a brake fallback strategy based only on driver pedal force is not enough.
A mechanical backup still has value, but it cannot be the only safety path for highly automated driving because the automated system cannot physically press the brake pedal in the same way as a human driver.
What Is a Safe State for a Highly Automated Vehicle?
A safe state is the operating condition the vehicle reaches after detecting a serious fault.
The source report gives two possible examples:
- Stop in the current lane
- Stop in the emergency lane
The exact safe-state strategy depends on the road, traffic, vehicle speed, available steering capability, sensor condition, and system design.
However, both examples require reliable braking.
Even if the target is only to stop in the current lane, the vehicle must still control deceleration and wheel slip.
If the target is to move into an emergency lane, the vehicle may need braking, steering, power, communication, and sensing redundancy to work together during the minimum-risk manoeuvre.
Industry practice therefore generally treats brake redundancy as essential for vehicles supporting Highly Automated Driving, or HAD.
How Does a One-Box Plus RBU System Provide Brake Redundancy?
To create an independent braking path, a One-box system can be paired with a Redundant Brake Unit.
RBU means Redundant Brake Unit.
The One-box remains the main braking unit during normal operation. The RBU becomes the backup pressure-generation unit if the One-box can no longer respond to the braking request.
The two systems use connected but controllable hydraulic paths.
How Are the Hydraulic Lines Connected?
The brake master cylinder has two chamber outlets.
According to the report:
- The two master-cylinder outlet circuits connect to the One-box.
- Those circuits also connect to the RBU input ports.
- The RBU has two output circuits.
- Each RBU output connects to the wheel-cylinder circuits inside the IPB hydraulic arrangement.
This creates a second route for building wheel-cylinder pressure.
The architecture is designed so that the One-box and RBU do not both generate uncontrolled pressure at the same time. Valve states determine which unit is connected to the wheel circuits.
How Does the System Work During Normal Braking?
During normal operation, the One-box responds to the upper-level brake request from the vehicle control system or automated driving system.
The valve state described in the report is:
- Valve 1 closed
- Valve 2 closed
- Valve 3 closed
- Valve 4 open
- Valve 5 open
The motor in the One-box active pressure-generation module pushes the actuator rod.
The actuator moves fluid through open valves 4 and 5.
Hydraulic pressure then reaches the wheel cylinders and produces the requested deceleration.
In this mode, the One-box performs the primary braking task.
What Happens When the One-Box Fails?
When the One-box system fails, the braking system enters backup mode.
The valve state changes to:
- Valve 2 open
- Valve 3 open
- Valve 1 closed
- Valve 4 closed
- Valve 5 closed
The RBU motor then operates.
It uses hydraulic fluid from the master-cylinder side and builds pressure through valves 2 and 3. That pressure is delivered to the wheel cylinders through the redundant hydraulic path.
The vehicle can therefore continue braking without depending only on the failed One-box active pressure-generation unit or on immediate driver pedal input.
One-Box Valve-State Comparison
| Operating Mode | Valve 1 | Valve 2 | Valve 3 | Valve 4 | Valve 5 | Pressure Source |
|---|---|---|---|---|---|---|
| Normal One-box braking | Closed | Closed | Closed | Open | Open | One-box motor and actuator |
| Mechanical backup example | Closed | Open | Open | Closed | Closed | Driver and master cylinder |
| RBU backup mode | Closed | Open | Open | Closed | Closed | RBU motor |
The mechanical backup and RBU mode may use similar hydraulic valve routing, but the pressure source is different. In mechanical backup, the driver moves the master-cylinder pistons. In RBU backup, the RBU motor generates the pressure.
Why Must the RBU Support Longitudinal Stability?
Highly automated driving does not only require basic brake-force redundancy.
It also requires longitudinal stability redundancy.
If the primary One-box fails while the vehicle is moving at speed, the backup system must manage wheel slip during deceleration. Without that ability, one or more wheels may lock, vehicle stability may decrease, and the minimum-risk stop may become harder to control.
The RBU therefore needs a longitudinal stability-control function.
Why Are Many RBU Designs Based on ESC?
The source report states that current market RBU solutions are generally developed by reducing or simplifying an Electronic Stability Controller.
ESC is the chassis system that controls wheel-end brake pressure to support vehicle stability.
By starting with an ESC-type hydraulic architecture, suppliers can retain pressure modulation, motor-driven pumping, valve control, and wheel-slip management.
However, the RBU does not need to reproduce every function of a full ESC.
Its purpose is to support a limited backup operating period after the main One-box has failed.
How Is an RBU Different from a Full ESC?
A full ESC can control the pressure at four wheel ends independently.
The RBU described in the report has more limited control capability.
It can regulate pressure at only two wheel ends at the same time, based on either:
- An X-split hydraulic arrangement
- An H-split hydraulic arrangement
Because it cannot regulate all four wheel pressures independently at the same time, its control performance is lower than that of a complete ESC.
This is a deliberate reduction in function.
The RBU is expected to operate only after a One-box fault. Once that fault occurs, the automated driving system should bring the vehicle into a safe state as quickly as possible.
The vehicle should not continue normal driving for a long period in RBU mode.
Because the backup operating time is limited, the probability of encountering another severe dynamic event during that period is also reduced.
From a safety-probability perspective, the report considers this reduced-function design acceptable.
It also lowers the cost of the combined One-box plus RBU architecture.
What Does the Control and Takeover Strategy Need to Do?
The source report includes a control and takeover strategy diagram, although the full diagram text is not reproduced in the supplied written material.
Based on the description in the report, the strategy includes these stages:
- The One-box handles normal brake requests.
- The system continuously monitors One-box operation.
- A fault is detected and diagnosed.
- Hydraulic valves switch to the redundant path.
- The RBU begins pressure generation.
- Backup longitudinal stability control becomes active.
- The automated driving system starts a minimum-risk manoeuvre.
- The vehicle moves toward the defined safe state.
- The vehicle stops in the current lane or, when possible, in an emergency lane.
- The system reports the fault and prevents continued normal automated driving.
The exact timing thresholds, diagnostic logic, communication architecture, and fault-tolerant control algorithm are not provided in the source report. They should not be invented without additional technical documentation.
Why Are Redundant Wheel-Speed Sensors Required?
Longitudinal stability control depends on wheel-speed data.
The One-box uses wheel-speed signals for functions such as ABS and stability control. The RBU also needs wheel-speed signals to regulate pressure and prevent excessive wheel slip during backup braking.
If both systems depend on the same sensor, wiring path, power supply, or communication channel, that shared path may become a single point of failure.
The report therefore states that redundant wheel-speed sensors are required.
The redundant sensing arrangement separately supports:
- The ABS and stability function inside the One-box
- The longitudinal stability function on the RBU side
This allows the RBU to continue receiving the wheel-speed information needed for pressure modulation even if the primary sensing path is unavailable.
What Is Bosch’s “Three-Level ABS” Solution?
The source report states that Bosch has introduced a brake-redundancy system based on redundant wheel-speed sensors.
It refers to this system as a:
“Three-level ABS” solution
The report describes this as a mainstream market approach.
The supplied report does not provide a complete technical definition of all three ABS levels, their exact hardware allocation, or their control sequence. Those details should be added only after checking Bosch documentation or another verified primary technical source.
The important point in the report is that redundant wheel-speed sensing allows the primary One-box stability function and the RBU backup stability function to receive the necessary wheel-speed information through separate safety paths.
How Do ADAS and Level 3+ Requirements Compare?
| Requirement | Driver Assistance | Level 3 and Higher Automation |
| Main fallback responsibility | Driver | Automated driving system |
| Fault warning | Required | Required |
| Mechanical pedal backup | Important | Useful but not sufficient alone |
| Independent pressure source | Not always required | Required for brake redundancy |
| RBU | Usually optional by architecture | Common solution |
| Backup stability control | Limited requirement by system | Needed for minimum-risk braking |
| Redundant wheel-speed sensing | Architecture-dependent | Required for robust backup control |
| Safe-state target | Driver brings vehicle to safety | System performs minimum-risk manoeuvre |
| Single-fault tolerance | Driver may compensate | System must retain braking or steering capability |
Which Regulations and Standards Affect One-Box Development?
Vehicle technical standards and regulatory systems are mandatory requirements for entering many regional markets.
Different countries and regions have created rules for vehicle safety, braking safety, hydraulic systems, electric motors, powertrains, and crash protection.
The European Economic Commission regulatory framework began in 1958 and has been repeatedly revised and expanded. Its regulations created common requirements for vehicle and component safety and environmental performance.
The framework has influenced vehicle-management systems in many other countries. A large number of national vehicle rules refer to or follow parts of the ECE regulatory system.
European Regulations Mentioned in the Report
| Regulation | Scope Described in the Source Report |
| ECE R13 | Detailed braking requirements and test procedures, mainly for commercial vehicles |
| ECE R13H | Braking requirements and test procedures for passenger vehicles |
| ECE R131 | Harmonized requirements for advanced emergency braking systems |
| ECE R90 | Requirements for replacement brake-system components |
| ECE R85 | Net power requirements for internal-combustion engines or electric drive systems in M- and N-category vehicles |
| ECE R12 | Protection against driver injury from the steering mechanism during a collision |
The report notes that ECE R85 has been adopted by multiple countries.
Chinese Standards Mentioned in the Report
| Standard | Scope Described in the Source Report |
| GB 21670 | Emergency braking and related brake-system performance requirements |
| GB/T 18488 | Operating conditions, requirements, and tests for electric-vehicle drive-motor systems |
| QC/T 893-2011 | Identification and classification of drive-motor system faults |
| GB 12981-2003 | Requirements and testing for hydraulic brake fluid used in vehicle braking systems |
| GB 13094-2017 | Structural safety requirements for passenger vehicles |
The report places GB/T 18488 and QC/T 893-2011 within the wider electric-motor and drive-system regulatory context.
It places GB 12981-2003 within the hydraulic brake-fluid context.
United States Regulations Mentioned in the Report
| Regulation | Scope Described in the Source Report |
| FMVSS 105 | Hydraulic requirements and performance requirements for braking systems |
| FMVSS 116 | Requirements for motor-vehicle brake fluids |
| FMVSS 203 | Crash-protection requirements related to steering-control systems |
The report also notes that the United States was the first country to develop vehicle safety regulations.
Why Does Regulatory Harmonization Matter?
Every major market still uses its own test procedures and certification system.
However, vehicle platforms, brake systems, motors, controllers, and automated-driving functions are increasingly developed for global use.
As globalization continues, mutual recognition and harmonization of international automotive regulations are becoming an important trend.
For a One-box supplier, this means regulatory planning cannot begin after the hardware is complete.
The target markets, braking categories, emergency performance, hydraulic architecture, electric-drive requirements, fault classifications, brake-fluid specifications, and crash-safety requirements should be considered early in product development.
What Are the Main Engineering Requirements for One-Box Safety?
A safe One-box design must match the vehicle’s automation level, fallback responsibility, hydraulic architecture, and target regulations.
Engineering Checklist
- Define whether the vehicle is driver-assisted or Level 3 and above.
- Define who is responsible for reaching the safe state.
- Detect faults correctly and report them in time.
- Maintain emergency braking capability after active pressure-generation failure.
- Verify the stated 2.44 m/s² emergency deceleration requirement.
- Confirm the correct pedal-input unit in the applicable regulation.
- Design a reliable mechanical backup path.
- Use a dual-chamber master cylinder.
- Select and validate the X-split or H-split hydraulic layout.
- Confirm braking performance after one hydraulic circuit leaks.
- Evaluate the 4.88 m/s² no-leak mechanical-backup target described in the report.
- Check master-cylinder bore, length, stroke, and fluid displacement.
- Consider fixed pedal ratio and maximum pedal travel.
- Compare fluid-volume requirements with iBooster and vacuum-booster architectures.
- Add an independent RBU for Level 3 and higher automated-driving applications.
- Define One-box and RBU hydraulic connections.
- Validate all normal and backup valve states.
- Ensure the RBU can generate pressure independently.
- Include backup longitudinal stability control.
- Understand the difference between full four-wheel ESC control and reduced two-wheel RBU control.
- Limit vehicle operation time after One-box failure.
- Define the minimum-risk manoeuvre.
- Add redundant wheel-speed sensing.
- Separate the sensing needs of the One-box ABS and RBU stability function.
- Validate the final system against European, Chinese, and United States requirements.
What Does the Future Hold for One-Box Brake Systems?
One-box technology will remain important as electric vehicles and automated-driving systems develop.
For driver-assistance vehicles, the main challenge is maintaining dependable mechanical backup and meeting emergency braking requirements after active assistance fails.
For Level 3 and higher vehicles, the challenge is larger.
The braking system must continue operating after a single fault without depending only on driver pedal input. It must also support wheel-slip control, vehicle stability, minimum-risk manoeuvres, and a defined safe state.
This is why the One-box plus RBU architecture has become an important technical direction.
The One-box provides compact integration and strong normal-operation performance. The RBU provides an independent pressure source and limited backup stability control. Redundant wheel-speed sensors provide the information needed to manage wheel slip after a fault.
The complete safety solution is not one component.
It is the coordinated result of hydraulic design, master-cylinder sizing, valves, motors, electronic control, sensor redundancy, diagnostic logic, automated-driving strategy, and regulatory validation.
That is the real safety requirement for intelligent braking.
Frequently Asked Questions
Is a One-box braking system the same as brake-by-wire?
A One-box system is a type of integrated electronically controlled braking architecture, but the terms are not always identical. One-box usually refers to combining pressure generation and stability-control functions in one unit. Brake-by-wire is a broader concept that includes electronic brake-command transmission and may use different hydraulic or electromechanical designs.
Can a One-box system stop a vehicle after losing electrical power?
A One-box system may retain a mechanical backup path that allows the driver to move the master-cylinder pistons directly. The available braking performance depends on pedal force, master-cylinder dimensions, hydraulic integrity, wheel-end fluid demand, and vehicle design. Level 3 and higher systems also need an independent automated backup path.
Why can Level 3 vehicles not rely only on mechanical backup?
Mechanical backup normally depends on a human pressing the brake pedal. In Level 3 or higher automated driving, the automated system must manage certain failures and move the vehicle toward a safe state. It therefore needs an independent pressure source, such as an RBU, that can brake without immediate driver input.
What is the main purpose of an RBU?
An RBU provides an independent brake-pressure source if the primary One-box system fails. It can route hydraulic pressure to the wheel cylinders and may also provide limited wheel-slip and longitudinal stability control while the vehicle performs a minimum-risk stop.
Why does the RBU control only two wheels at a time?
The report describes current RBU designs as reduced-function versions of ESC systems. They can control two wheel ends through an X-split or H-split hydraulic layout instead of independently controlling all four wheels. This reduces cost, and the lower capability is considered acceptable because backup operation should last only until the vehicle reaches a safe state.
About the Author
Johnny Liu is the CEO of Dowway Vehicle. He focuses on vehicle technology, automotive components, engineering communication, and solutions for the global automotive industry.
This article was prepared to explain the engineering logic contained in R&D Report No. 218 in clear English for automotive engineers, suppliers, researchers, and intelligent-vehicle professionals.
Author: Johnny Liu
Role: CEO at Dowway Vehicle
Publication date: August 7, 2026
Last reviewed: August 7, 2026
Technical Editorial Note
This article preserves the technical claims, terminology, performance figures, valve states, and regulatory references contained in the supplied report.
The original report includes a unit inconsistency between 500 N and 500 Nm for brake-pedal input. Before publication as a formal regulatory or engineering reference, Dowway Vehicle should verify the value against the official version of ECE R13, GB 21670, the relevant vehicle category, and the original Bosch IPB technical documentation.
The report’s description of the Bosch “three-level ABS” concept should also be checked against a current Bosch primary source before adding details beyond those stated here.
Disclaimer
This article is provided for technical education and general industry discussion. It is not a homologation opinion, functional-safety assessment, system-design approval, or substitute for official regulations, standards, OEM specifications, supplier documentation, testing, or engineering validation.