The missing failure mode in brake-by-wire's fail-safe logic

On 24 August 2026, America's road safety regulator escalated an investigation into more than 1.16 million General Motors vehicles to its most serious tier, the step that usually precedes a recall order. The vehicles share a single component: an electro-hydraulic brake booster called eBoost. GM has a clear, documented account of how this part fails and what the car is supposed to do about it. The problem, according to the National Highway Traffic Safety Administration, is that a meaningful share of the failures reported by owners do not match that account at all. That gap, between a manufacturer's engineered model of a fault and what is actually happening on the road, is the real story here, and it is a story about real-time diagnostics, not spindles.

A brake pedal that talks to a control loop

eBoost, introduced in 2019 and progressively rolled out across GM's line-up, dispenses with the mechanical linkage that traditionally connected a driver's foot to the vacuum-assisted booster behind the pedal. In its place is an electronic path: pedal travel is sensed, interpreted, and used to command an electric motor that provides brake assist, with GM able to tune brake feel across driving modes as a result. This is brake-by-wire for the boost function specifically, and like every by-wire system, it comes with an engineered contingency for when the electronics or the actuator itself fails.

GM's own account of that contingency, laid out in documents submitted to investigators, is specific and testable. The company has told regulators that the eBoost unit contains a metal spindle that can fracture under the loads generated during an anti-lock braking event. Crucially, GM says that when this happens, ABS, electronic stability control and traction control all remain fully functional until the vehicle comes to a complete stop. Only then does the control module log one of three diagnostic trouble codes, disable brake assist, and place the vehicle into a defined fail-safe mode that caps top speed at 43 mph. It is, on paper, a coherent real-time control design: detect the fault, preserve full function through the current manoeuvre, and hand a degraded but predictable and speed-limited vehicle back to the driver once it is safe to do so.

When the diagnosis doesn't match the failure

That design only works as a safety case if the detection logic actually catches every failure it claims to. NHTSA's Office of Defects Investigation says it has continued to receive complaints describing something different: an immediate loss of brake assist while the driver is actively braking to slow the car, not after it has already stopped. The agency has stated plainly that these reports are inconsistent with GM's own description of the spindle failure, and that the resulting loss of assist, which forces the driver to apply far higher pedal force through unassisted push-through braking, can extend stopping distance and raise the risk of a crash.

Two incidents in the investigation file illustrate what that looks like in practice. The driver of a 2025 Cadillac Lyriq reported losing brake assist while pulling into a parking space and drove over a kerb and through a shopfront. The driver of a 2024 Chevrolet Blazer EV described deliberately steering the car into a concrete kerb to bring it to a stop and avoid a collision at an intersection. Across the wider population, investigators have logged 745 unique failure reports, 22 crashes or fires, and six injuries, with no fatalities reported. GM, for its part, maintains that its internal investigation found the condition does not present an unreasonable safety risk.

What matters for readers who design or specify vehicle electronics is not which side turns out to be right, that is precisely what the new engineering analysis exists to determine, but what the disagreement reveals about the underlying architecture. A fault-detection system built around one identified failure path, spindle fracture confirmed only at standstill, cannot by definition catch a second, undiagnosed path that manifests earlier. If the field data holds up, eBoost's fail-safe logic is not wrong so much as incomplete, and an incomplete fault model is functionally indistinguishable from no fault model at all for the failure modes it does not know about.

Fail-safe is not fail-operational

It is worth being precise about what kind of redundancy eBoost was designed to offer, because a single electric boost path with a mechanical push-through fallback is a legitimate, widely used architecture choice, not a corner cut. ZF's Integrated Brake Control follows a broadly similar philosophy, reverting to a manual master-cylinder push when its electronics fail. Both are fail-safe designs: they guarantee the car can still be stopped, at the cost of dramatically higher pedal effort and longer stopping distances.

Contrast that with Continental's MK C1 booster, which is typically paired with a second, independent electro-hydraulic unit derived from its MK 100 stability-control hardware. If the primary booster fails, the secondary unit switches into what Continental calls a cooperative brake mode and keeps close to full power-assisted braking available, rather than dropping the driver into an unassisted pedal. That is a fail-operational architecture: it tolerates a single failure without materially degrading the vehicle's stopping performance. Fail-safe and fail-operational are both defensible engineering choices, but they carry very different obligations. A fail-operational system has to coordinate two live control paths in real time. A fail-safe system has only one job left after a fault: detect it, reliably, every time, and detect it fast enough that the transition to the degraded state happens before the driver needs the assist it just took away.

There is also a structural point worth flagging. eBoost is not confined to one nameplate or even one company. It is standardised across fourteen model lines and, through a joint-venture platform, into Honda's Prologue and Acura's ZDX. A diagnostic blind spot inside one control module's fault model does not stay contained within a single engineering organisation once that module becomes shared infrastructure across brands.

What the engineering analysis has to establish

The open questions for EA26006 are narrower than they might first appear, and grounded in what has already been disclosed. Investigators need to determine whether the mid-deceleration complaints point to a second, distinct fault mechanism inside eBoost that GM has not yet characterised, or whether the existing spindle-fracture path can in fact occur, and be detected, earlier than GM's current model assumes. Either finding has a different remedy: a genuinely new failure mode calls for new diagnostic coverage and likely new hardware, while a mistimed detection window is a control-logic and calibration problem. Worth watching, too, is how the population question resolves. GM's population estimate already spans five brands and two corporate structures; if the root cause proves to be shared silicon or shared firmware logic rather than a batch-specific manufacturing defect, the eventual remedy could extend further than the current 1.16 million vehicles under review.

The broader industry lesson does not depend on which way this particular case is resolved. As more of a vehicle's safety-critical functions move from mechanical linkages to sensed, computed, and actuated control loops, the credibility of a by-wire safety case rests less on whether a fail-safe mode exists on paper and more on whether the fault model behind it has actually been validated against the full range of ways the real world breaks things. Should regulators be requiring manufacturers to demonstrate that a by-wire fault model has been checked against independent field telemetry before it is allowed to stand as the entire safety argument for a single-path system?

---

This piece first appeared in ASG's Hello, Auto! newsletter on LinkedIn.