Jherrod ThomasThe Lion of Functional Safety™

July 26, 2026 · 14 min read

ISO 26262-7IATF 16949 / AIAG 8DFMVSS 135 / Part 573

When the Remedy Needed a Recall: BMW's Third Integrated-Brake Campaign (26V422) Through an ISO 26262-7 and IATF 16949 Lens

Most recalls are a story about a defect. NHTSA campaign 26V422 is a story about a remedy. It is BMW's third U.S. recall on the same Continental integrated brake unit in twenty-nine months, it covers only 428 vehicles, and it contains the most quietly damning sentence a Part 573 filing can carry: vehicles already repaired under the two prior campaigns need the new remedy completed. The defect survived two fixes. That is not a component problem. That is a work-product problem.

The functional safety community spends most of its energy on the left side of the V — HARA, safety goals, architecture, verification. This story lives on the far right, in the part of ISO 26262 almost nobody blogs about: Part 7, production and operation. Because everything upstream of production apparently worked. The hazard analysis existed. The degraded mode worked as designed. What failed — three times — was the guarantee that the physical unit bolted into the car, and later the physical unit handed to the service technician, actually conformed to the design that was assessed.

The public record

The chronology, from regulator filings and BMW's own dealer bulletins:

December 20, 2023 — BMW AG issues a delivery stop on certain 2023–2024 vehicles built between June 29, 2022 and October 26, 2023, citing the Integrated Brake (IB) system. On February 8, 2024 the delivery stop is upgraded to safety recall 24V104, filed with NHTSA on February 12, covering 79,670 U.S. vehicles across the 5 Series/i5, 7 Series/i7, X1, X5, X6, X7, XM, and the Rolls-Royce Spectre. BMW's stated cause: the IB "may not have been produced by the supplier according to specifications." The failure presentation: loss of power brake assist, and ABS and Dynamic Stability Control (DSC) functions unavailable. The remedy: replace the IB unit.

BMW's dealer bulletin for 24V104 (SIB 34 04 23) is where the engineering detail hides. Before installing a replacement IB, technicians were instructed to run an incoming inspection on the new service part: place the unit on a bench, back out each sealing plug with a torque wrench, and verify the breakaway torque stays below defined limits — a maximum of 40 Nm for the M10 plugs and 20 Nm for the M12 plugs. A plug that lets go above the limit, damaged threads, or "metallic particles inside" meant the brand-new replacement part was itself rejected. Parts that had been screened upstream carried a green dot on the label and the housing and could skip the check. Affected vehicles also had to accumulate at least 170 miles before the repair could even be performed.

September 2024 — the problem goes global. BMW issues recalls and delivery stops covering roughly 1.5 million vehicles worldwide over the Continental-supplied braking system and cuts its full-year profit outlook, citing warranty provisions in the high three-digit millions of euros. Trade coverage puts the affected total at 1.53 million units.

October 2, 2024 — recall 24V739. The population: 11,579 U.S. vehicles that had already received the 24V104 remedy. The replacement IB modules installed under the first campaign "may not provide sufficient power brake assist." BMW acknowledged the earlier fix may not have worked as intended for that population. Failure presentation identical; the vehicle drops into a default mode with sharply increased pedal effort and longer stopping distances.

July 1, 2026 — recall 26V422, acknowledged by NHTSA on July 8. It covers 428 vehicles spanning 2023–2025 BMW models, the 2024 Rolls-Royce Spectre, and — new to the party — the 2025 MINI Cooper S, 2025 MINI Countryman S ALL4, and 2025 BMW X2. Same defect description: the IB may malfunction and cause loss of power brake assist or leave ABS and DSC nonfunctional. The remedy is inspection and, where necessary, another replacement. And then the sentence that motivates this post, verbatim from the NHTSA acknowledgment: "Vehicles previously repaired under recall 24V739 or 24V104 will need to have the new remedy completed."

One design. Three campaigns. Two remedy populations re-opened. To BMW's credit, the fail-safe chain has worked throughout: mechanical push-through braking is preserved when the IB electronics fail, the parking brake is automatically activated to assist deceleration and stability, and the driver gets an explicit check-control message. Nobody should confuse this with a runaway-hazard story. But "the degraded state kept working" is the floor of a safety concept, not the ceiling — and 428 vehicles in 2026 are still carrying a nonconformity first flagged in a December 2023 delivery stop.

The standards lens

The IB is a one-box brake-by-wire unit: booster, brake actuation, ABS, and ESC integrated into a single electro-hydraulic assembly. When the box degrades, assist and stability functions degrade together — that concentration is a deliberate architecture trade, and it is exactly why the item's safety concept leans on the mechanical push-through fallback and the auto-applied parking brake. The concept phase is not where this story's gap lives.

The gap lives in three places the standards name precisely:

ISO 26262-7, Clauses 5 and 6 — production planning and production. Part 7's entire reason to exist is the requirement that series production reproduce, for every unit, the safety characteristics that were established during development. That means safety-related special characteristics identified in the design phase flow into a production control plan, with process capability evidence and traceable inspection on exactly those features. BMW's own recall language — "may not have been produced by the supplier according to specifications" — is a Clause 6 sentence. A hydraulic manifold that ships with over-torqued sealing plugs, damaged threads, or metallic debris in its bores is not exhibiting a design weakness; it is exhibiting a production process that stopped conforming to its control plan, and an end-of-line test that did not screen the escape.

ISO 26262-7, Clause 7 — operation, service, decommissioning. Here is the part that makes this recall genuinely instructive: the service parts were also suspect. When your field remedy instruction tells a technician to bench-test a brand-new replacement unit for breakaway torque and internal contamination before installing it, you have formally admitted that the spare-parts pipeline cannot be trusted to deliver conforming units — so the conformity check gets pushed to the last possible control point, a dealership workbench, executed with a hand torque wrench. Clause 7 requires that service parts and service procedures maintain functional safety. A green-dot label taxonomy separating "screened" from "unscreened" safety-critical brake units in the same parts stream is a live demonstration of that requirement being back-filled after the fact.

IATF 16949 §10.2 and the 8D discipline — corrective action and its verification. Recall 24V739 exists because the corrective action for 24V104 was not verified effective before deployment: the remedy population received modules carrying (a variant of) the same nonconformity. In 8D terms, D5 chose a permanent corrective action, D6 was supposed to validate its effectiveness — and the validation evidence evidently did not bound the remedy-part population. 26V422 then re-opens both prior populations, which tells you the effectiveness verification loop still had not closed two years later. IATF 16949 also demands PPAP-style re-approval when a process or part changes; a redesigned or re-sourced remedy IB is a changed product that needs its own conformity evidence, not a wave-through under the urgency of an open recall.

There is also a quieter ISO 26262-2 point: field monitoring worked. BMW states it caught the original issue through its quality control procedures, and a delivery stop landed before the recall did. The intake side of the field-observation loop functioned. It is the output side — the verified-effective fix — that kept slipping.

A worked snippet

First, the hazard context in one HARA-style row, so the ASIL stakes are on the table (illustrative ratings, standard passenger-car braking item):

| ID | Operating scenario | Malfunction | S | E | C | ASIL | Safety goal | |---|---|---|---|---|---|---|---| | HZ-BRK-02 | Highway approach to stopped traffic, loaded vehicle | Loss of brake assist; ABS/DSC unavailable; mechanical push-through retained at elevated pedal force | S3 | E4 | C2 | C | Vehicle deceleration capability shall not fall below the degraded-mode minimum, and the driver shall be alerted before the next braking demand. |

Full loss of service braking would rate ASIL D; the retained push-through and auto parking brake are what pull the residual hazard down — which is precisely why the presence and conformity of that hardware in every produced and every serviced unit is itself a safety-related special characteristic.

Now the part of the analysis this recall actually indicts — a process FMEA excerpt (AIAG-VDA, Action Priority) for the production and remedy chain:

| Process step | Failure mode | Effect | S | O | D | AP | Current controls / gap | |---|---|---|---|---|---|---|---| | Manifold machining and plug installation | Sealing plug over-torqued; thread damage | Latent leak path; IB degradation in service | 8 | 4 | 5 | High | Torque monitoring on tool, but breakaway torque not verified end-of-line | | Hydraulic block cleaning | Metallic particles remain in bores | Valve contamination; loss of assist / ABS-DSC function | 8 | 4 | 6 | High | Cleanliness spec (ISO 16232 class) exists; audit frequency insufficient to catch drift | | End-of-line test | EOL functional test passes a unit carrying the latent defect | Nonconforming unit ships as conforming | 8 | 3 | 7 | High | EOL exercises function at time zero; does not screen wear-out initiators | | Service-part release | Nonconforming lot released to spare-parts stream | Recall remedy installs a defective unit | 8 | 3 | 8 | High | No incoming re-verification — until SIB 34 04 23 moved it to the dealer bench | | Remedy validation (D6) | Effectiveness verified on process paper, not on remedy-population product | Second and third recall on same defect | 9 | 3 | 7 | High | Campaign closure tracked administratively; no conformity sampling of installed remedy units |

And the remedy chain as a small fault tree, because the recall-on-recall structure is easier to see drawn:

Top: Vehicle in service carries a nonconforming IB in July 2026
        OR
        ├── A. Never remedied (open-campaign population)
        ├── B. Remedied under 24V104 with a service part from the
        │      suspect stream (no green dot, no bench check)
        ├── C. Remedied under 24V739 with a unit later judged
        │      nonconforming (26V422 re-opens this population)
        └── D. Built after the production "clean point" that
               was declared too early
                 AND
                 ├── D1. Clean-point evidence based on process
                 │       audit, not product re-qualification
                 └── D2. Lot traceability too coarse to bound
                         the suspect population precisely

Branch D is the one to sit with. Every recall declares a clean point — the build date or serial break after which units are presumed good. Three campaigns on one unit means the clean point was declared early at least twice, and a 428-vehicle third campaign that still spans three model years and three brands suggests the traceability granularity needed to bound the suspect population tightly was never available.

Derived requirements (excerpt)

Five requirements a production-and-service safety file for this unit should carry. Numeric values are illustrative of the class of limit, not any manufacturer's internal figures.

What the headline really tells us

A 428-vehicle recall looks like a footnote. It is closer to a confession. The functional safety concept for this brake unit did its job — degraded braking was preserved, the driver was warned, and no injury narrative drives these filings. What failed, serially, was the least glamorous artifact chain in the standard: the production control plan that guarantees unit N matches the design that was assessed, the service-parts conformity evidence that guarantees the fix is not a reroll of the defect, and the corrective-action effectiveness verification that is supposed to make a second campaign impossible. ISO 26262 does not end at SOP, and this is what it looks like when the industry treats Part 7 as paperwork: the remedy needed a recall, and then the remedy's remedy did too.

Sources

Field Notes — Jherrod Thomas, The Lion of Functional Safety™. Written from the public record; no proprietary BMW or Continental information is used or implied. Numeric requirement bands are illustrative of the class of limit, not the manufacturer's internal specifications.