3. Occupant restraint system architecture
An occupant restraint system is not a collection of independent safety devices. It is a tuned energy-management chain in which every element — belt geometry, retractor behavior, pretensioner stroke, load limiter force level, airbag venting, and seat structure stiffness — shares responsibility for a single physical task: converting the occupant's kinetic energy into controlled deformation and heat over a defined time window. That time window is set by the crash pulse. Change the pulse shape and the entire chain must be re-tuned, because each element's contribution is a function of when and how quickly deceleration is delivered to the occupant.
The Restraint Chain as a Series of Energy Converters
Consider a 50th-percentile male occupant (78 kg) in a frontal impact at 56 km/h delta-v. The occupant's kinetic energy at t=0 is approximately 9.4 kJ. The restraint system must absorb this energy without allowing the chest to experience more than roughly 3.5–4.0 kN of belt force (the approximate threshold for AIS 2+ rib fracture risk in a mid-size male), while keeping forward excursion within the packaging envelope defined by the steering wheel, IP, and knee bolster.
The chain works in sequence, but with deliberate overlap:
- Belt geometry and fit determine how force is distributed across the pelvis, thorax, and shoulder. A lap belt anchored too high loads the abdomen; a shoulder belt routed too far outboard allows the torso to roll out of the belt. Geometry sets the boundary conditions for everything downstream.
- Retractor locking and pretensioner firing remove slack. A pyrotechnic pretensioner typically strokes 60–120 mm in 10–20 ms, pulling the occupant into the seat and coupling them to the decelerating vehicle earlier. This is critical for stiff, short-duration pulses where the occupant would otherwise still be moving forward when the airbag has already begun to deflate.
- Load limiter (force limiter) caps belt force by allowing the belt webbing to pay out through a torsion bar, friction clutch, or tear stitch. A typical torsion-bar limiter might be set at 3.0–4.5 kN at the retractor, with the force level chosen to balance chest deflection against forward excursion.
- Airbag provides a secondary, distributed load path to the head and chest. Its venting and fabric permeability determine how quickly it absorbs energy and how it interacts with the belt-limited occupant trajectory.
- Seat structure — including recliner, track, and cushion — must react the belt and airbag loads without excessive deformation, while also providing a stable platform for the occupant's pelvis.
How Pulse Shape Rewrites the Tuning Problem
Pulse shape is characterized by three parameters that matter most to restraint tuning: peak deceleration (g), duration (ms), and the time to peak (rise time). A stiff, short pulse — for example, a 40 g peak reached in 15 ms and lasting 60 ms — delivers a high deceleration early. The occupant's torso begins loading the belt almost immediately. A pretensioner that fires at 10 ms is well-timed; a load limiter set too low will pay out webbing while the occupant still has significant velocity relative to the vehicle, increasing forward excursion. Conversely, a soft, long pulse — 20 g peak, 40 ms rise, 120 ms duration — gives the pretensioner more time to work and allows a lower load limiter setting without excessive excursion, but demands that the airbag remain inflated longer to manage the later occupant ride-down.
The interaction is not linear. A 10% increase in pulse duration can change the optimal load limiter force by 15–20%, because the occupant's ride-down time scales with the pulse integral. This is why a restraint system tuned for a 56 km/h FMVSS 208 pulse may perform poorly on a 64 km/h Euro NCAP ODB pulse, even though the delta-v is only 14% higher. The ODB pulse is typically softer and longer, shifting the occupant's peak forward velocity later in the event.
Key insight: The restraint system does not respond to delta-v alone. It responds to the time history of vehicle deceleration. Two crashes with identical delta-v but different pulse shapes can produce chest deflections that differ by 30–40% with the same hardware.
Architecture-Level Interactions and Trade-offs
Pretensioner and load limiter are not independent. A pretensioner that pulls 80 mm of slack out of the belt effectively increases the occupant's coupling stiffness. If the load limiter is set at 4.0 kN, the pretensioner's benefit is partially wasted because the belt pays out as soon as the force reaches the limit. The correct sequence is: pretensioner fires and locks the occupant to the seat early, then the load limiter modulates force during the ride-down phase. The timing gap between pretensioner full stroke and load limiter activation is typically 5–15 ms, and it must be matched to the pulse rise time.
Airbag interaction adds another layer. A belt-limited occupant moves forward at a controlled rate. The airbag must be positioned and vented so that the occupant's head and chest contact it during the ride-down phase, not after it has deflated. For a stiff pulse, the airbag may need to be larger or have a slower vent rate to remain effective during the short, high-energy event. For a soft pulse, a smaller airbag with faster venting can reduce the risk of "punch-out" — where the airbag's own deployment force injures an out-of-position occupant.
Seat structure closes the loop. The seatback and recliner must withstand the belt's rearward pull during pretensioning and the occupant's forward load during ride-down. A seat that deflects excessively under belt load allows the occupant to move further forward than the restraint model predicts, effectively increasing the required airbag coverage. Conversely, an overly stiff seat can transmit high loads to the occupant's spine and pelvis. The seat is not a passive mounting point; it is an active participant in the energy-management chain.
Practical Tuning Example: Same Hardware, Two Pulses
Suppose a restraint system is initially tuned for a 56 km/h FMVSS 208 pulse (approximately 35 g peak, 25 ms rise, 80 ms duration). The load limiter is set at 3.8 kN, the pretensioner fires at 12 ms, and the airbag vent is sized for a 45 ms ride-down. Now the same vehicle is evaluated on a 64 km/h ODB pulse (approximately 28 g peak, 35 ms rise, 110 ms duration).
What happens? The softer, longer pulse means the occupant's forward velocity relative to the vehicle peaks later. The pretensioner at 12 ms is still early enough, but the load limiter at 3.8 kN begins paying out webbing while the occupant still has 15–20 ms of forward motion remaining. The airbag, vented for a 45 ms ride-down, begins losing pressure before the occupant's head reaches it. The result is increased forward excursion — potentially 30–50 mm more than on the FMVSS 208 pulse — and a higher risk of contact with the steering wheel rim or IP.
The fix is not to stiffen the load limiter (that would increase chest deflection on the stiffer pulse). Instead, the tuner can:
- Increase pretensioner stroke or fire it earlier (8–10 ms) to couple the occupant sooner.
- Raise the load limiter to 4.2 kN for the ODB pulse only if chest deflection remains within target — this is a calibration trade-off, not a hardware change.
- Reduce airbag vent area or use a dual-stage inflator that sustains pressure longer.
- Adjust seat recliner stiffness to reduce seatback deflection under the longer belt load.
Calibration rule of thumb: For every 10 ms increase in pulse rise time, expect to extend the airbag ride-down window by 5–8 ms and consider a 0.2–0.4 kN increase in load limiter force if chest deflection margin allows. Always verify with a sled test or validated CAE model — these are starting points, not final settings.
Failure Symptoms and Diagnostics
When a restraint system is mismatched to the pulse, the symptoms are observable in sled test data or CAE output:
| Symptom | Likely Cause | Diagnostic Check |
|---|---|---|
| Chest deflection exceeds 50 mm | Load limiter too high for pulse stiffness | Plot belt force vs. time; check if limiter plateau is reached before peak occupant velocity |
| Head contacts steering wheel despite airbag | Airbag deflates before ride-down completes | Compare airbag pressure decay curve with head forward displacement curve |
| Occupant submarines under lap belt | Pretensioner timing too late or lap belt geometry too high | Check pelvis forward displacement at 30 ms; verify lap belt angle (45–55° from horizontal) |
| Seatback yields excessively | Recliner or track stiffness insufficient for belt load | Measure seatback rotation under 3 kN belt pull; compare with pulse duration |
The diagnostic logic is always the same: compare the timing of each restraint element's action against the occupant's kinematic response. If the occupant is still moving forward when an element has finished its stroke or deflated, that element is mistimed for the pulse. The fix may be a calibration change, a hardware change, or — in some cases — an acknowledgment that the pulse family requires a different restraint architecture entirely, such as a dual-stage load limiter or an adaptive airbag vent.
Understanding these interactions is the foundation for the robustness engineering that follows. A restraint system that performs well across pulse families is not one with the most aggressive hardware, but one whose elements are timed and tuned to the specific energy delivery profile of each crash mode.