Safety and Redundancy Hardware

fail-safe · fail-operational · ASIL D

When no human is ready to take over, safety has to be built from duplicated hardware. Moving from fail-safe to fail-operational roughly doubles the critical chain from sensors to brakes.

Two safety architectures. Fail-safe, used at Level 2, has a single chain of sensors, compute, low-voltage power and steering and braking; a fault triggers a controlled stop. Fail-operational, used at Level 4, has two independent chains, A and B, each with its own sensors, compute, low-voltage power and steering and braking, linked by cross-checks and failover. Standards listed: ISO 26262 ASIL A to D, ISO 21448 SOTIF, UL 4600 and UN R157. FAIL-SAFE (L2): ONE PATH; A FAULT TRIGGERS A CONTROLLED STOP Sensors Compute LV power Steer / brake FAIL-OPERATIONAL (L4): TWO INDEPENDENT PATHS, CROSS-CHECKED Sensors A Compute A LV power A Steer / brake A Sensors B Compute B LV power B Steer / brake B Dashed links: cross-checks and failover between paths Standards: ISO 26262 (ASIL A to D), ISO 21448 (SOTIF), UL 4600, UN R157
L2 pattern
Fail-safe
L4 pattern
Fail-operational
Top integrity level
ASIL D
Hub
Supply Chain

Finding

Driverless operation requires redundant steering, braking, power and compute, and that hardware, not the AI model, sets much of the cost floor of a robotaxi

A Level 2 system can hand control back to the driver or stop. A Level 3 or Level 4 system must keep control long enough to reach a minimal-risk condition, so every link - perception, compute, low-voltage power and actuation - needs an independent backup. Mercedes-Benz Drive Pilot (UN R157 Level 3) carries redundant steering, braking and power; Waymo's sixth-generation driver and Zoox's purpose-built robotaxi duplicate compute and actuation throughout.

The building blocks are well established: dual SoCs or an SoC plus an external safety MCU (Infineon AURIX, Renesas RH850, NXP S32, TI TMS570); lockstep CPU cores and ECC memory; independent 12 V or 48 V rails with dual DC-DC paths; overlapping camera and radar coverage; and steer-by-wire and brake-by-wire with dual motors or dual pressure sources. Steer-by-wire is in production on the Tesla Cybertruck, NIO ET9 and Lexus RZ; brake-by-wire units include Bosch iBooster with ESP, ZF Integrated Brake Control and Continental MK C2 (now Aumovio).

Functional safety (ISO 26262) and cybersecurity (ISO/SAE 21434, UN R155) are separate disciplines. ISO 21448 (SOTIF) covers hazards from sensor and algorithm limits when nothing has failed; UL 4600 sets the safety case for vehicles with no human driver.

Design modes

Fail-safe versus fail-operational

Safety design modes
ModeBehavior on faultTypical fitHardware implication
Fail-safeTransitions to a safe state, usually a controlled stop or handoverLevel 2 driver assistanceSupervision and safe-stop; limited redundancy
Fail-degradedContinues with reduced function for a bounded timeLevel 3 conditional automationRedundant power and actuation; supervised compute
Fail-operationalKeeps driving safely to a minimal-risk conditionLevel 4 robotaxis and trucksIndependent compute, power, sensing and actuation paths

Elements

Safety hardware elements

Safety and redundancy hardware map
ElementProtectsWhere it sitsExample suppliers
Redundant computePerception and planning correctnessCentral ADAS/AV computeNVIDIA, Mobileye, Qualcomm, Horizon Robotics, Huawei
Functional safety MCUCommand integrity, safe-state logicADAS DCU, gateway, central computeInfineon, Renesas, NXP, TI, ST; SemiDrive
Redundant LV powerCompute, steering and braking availabilityLV distribution, dual DC-DCInfineon, TI, Vicor; eFuse makers
Sensor redundancyPerception coverage under faultsCamera, radar and lidar suiteSony, onsemi, OmniVision; Bosch, Continental radar; Hesai, RoboSense lidar
Steer-by-wireLateral control authoritySteering rack actuatorsBosch, ZF, Nexteer, JTEKT; Bethel (China)
Brake-by-wireLongitudinal control authorityBrake actuatorsBosch, ZF, Aumovio, Brembo; Bethel, Tongyu (China)
Monitoring and isolation ICsFault containment between domainsCompute modules, power railsTI, ADI, Infineon, NXP; Novosense

Standards

Standards that set the requirements

Safety standards
StandardScope
ISO 26262Functional safety of E/E systems; integrity levels ASIL A to D
ISO 21448 (SOTIF)Hazards from intended function and sensor limits
UL 4600Safety case for autonomous products without a human driver
UN R157Automated lane keeping (Level 3) type approval
ISO/SAE 21434, UN R155Cybersecurity engineering and management systems

Sources

Sources and scope

Scope
EV Safety and Redundancy Hardware
Sources
ISO 26262, ISO 21448, UL 4600, UNECE R157; Mercedes-Benz, Waymo and supplier disclosures
Updated
October 2026