3. DV-PV test matrix design

A DV-PV test matrix is not a list of tests. It is a structured argument that the restraint system — airbags, pretensioners, load limiters, seat belts, anchors, and the occupant classification system — will perform its safety function across the full range of conditions the vehicle can legitimately experience in the field. The matrix is the instrument that converts DFMEA and PFMEA risk into physical evidence. If the matrix is poorly designed, no amount of careful execution will recover the lost coverage.

The core design question is always the same: which combinations of design parameters, process parameters, and environmental conditions produce the most severe credible loading on each failure mode? Everything else — sample size, pass/fail versus test-to-failure, cost and timing optimization — follows from answering that question honestly.

Boundary Conditions and Worst-Case Selection

Boundary conditions are the extremes of each independent variable that the system must survive. For a frontal airbag module, typical boundary variables include:

• Deployment temperature: −35 °C (cold gas generator performance, brittle cover behavior) and +85 °C or higher (elevated internal pressure, accelerated inflator burn).
• Supply voltage: 9 V (worst-case low, slow initiator rise time) and 16 V (worst-case high, fast rise time and higher peak current).
• Occupant position: 5th percentile female in the full-forward out-of-position (OOP) position, and 95th percentile male in the nominal seated position.
• Seat track position: full forward and full rearward, which change the geometry between the module and the occupant.
• Environmental preconditioning: thermal shock, humidity, vibration, and corrosion exposure prior to deployment.

Worst-case selection means choosing the combination of these extremes that maximizes the stress on the specific failure mode under investigation. This is not the same as testing every extreme simultaneously. For an inflator over-pressure failure, the worst case is high temperature plus high voltage plus a blocked or restricted deployment path. For a cover tear failure, the worst case is low temperature plus low voltage plus a cold, brittle cover material. These two failure modes demand different corner combinations, and a competent matrix separates them.

Design and Process Variation

Design variation comes from tolerances in the nominal design: inflator output gas mass, cover score depth, tether length, bracket thickness, and sensor threshold. Process variation comes from manufacturing and assembly: weld nugget size, crimp diameter, adhesive bead width, torque scatter, and inflator lot-to-lot burn rate. Both must be represented in the matrix, but they are not interchangeable.

A practical approach is to treat design variation as a set of continuous parameters with known tolerance bands, and process variation as a set of discrete lot or supplier conditions. For example, an inflator propellant lot with the lowest burn rate and one with the highest burn rate should both appear in the matrix, because the resulting pressure-time curve shifts the entire deployment event. Similarly, a cover with minimum score depth and one with maximum score depth bracket the tear initiation behavior.

The matrix should explicitly state which variation is being exercised in each test. A test that claims to cover "worst-case inflator" but uses only nominal propellant lot is not covering the variation it claims to cover.

Sample Size Rationale

Sample size in DV-PV is driven by three factors: the required confidence level, the expected failure rate, and the consequence of failure. For safety-critical restraint components, the industry commonly uses attribute sampling plans that demonstrate a reliability target with a specified confidence. A typical target is 95% reliability at 50% confidence for DV, and higher confidence for PV.

For a pass/fail attribute test with zero failures allowed, the relationship between sample size n and demonstrated reliability R at confidence C is:

n = ln(1 - C) / ln(R)

Example: C = 0.90, R = 0.95
n = ln(0.10) / ln(0.95) = -2.3026 / -0.05129 ≈ 45 samples

This means 45 samples with zero failures demonstrate 95% reliability at 90% confidence. If the test is destructive and expensive, the matrix may use a smaller sample size with a higher allowed failure count, or it may use test-to-failure to extract more information per sample.

Sample size must also account for the number of distinct corner combinations. If the matrix has six critical corners and each requires 45 samples, the total is 270 deployments. That is often impractical. The optimization is to reduce the number of corners by grouping failure modes that share the same governing stress, and to use test-to-failure on the most severe corner to reduce the required sample count.

Test-to-Failure vs. Pass/Fail

Pass/fail testing answers a binary question: did the system meet the requirement at the specified condition? It is simple, auditable, and directly linked to the specification. Its weakness is that it provides no information about margin. A system that passes at 85 °C with 0.1 mm of remaining cover thickness is very different from one that passes with 2 mm remaining, but both are recorded as "pass."

Test-to-failure testing increases the stress until the failure mode occurs, then records the failure level. This reveals the margin between the specification limit and the actual capability. It is especially valuable for new designs, for supplier changes, and for failure modes where the DFMEA severity is high and the detection rating is low.

In practice, a hybrid matrix is most effective. Use pass/fail at the specification corners for formal DV-PV sign-off, and use test-to-failure at the most severe corner to quantify margin and to validate the DFMEA's assumed detection and severity ratings. The test-to-failure data also feeds back into the DFMEA to update occurrence and detection rankings.

Matrix Optimization for Cost and Timing

Full factorial testing across all boundary variables is rarely feasible. The optimization strategy is to use a structured design of experiments approach:

1. Screen: Use a fractional factorial or Plackett-Burman design to identify which variables actually affect the response. This reduces the variable list before committing to expensive full-scale deployments.
2. Characterize: Use a response surface or central composite design around the critical variables to map the failure boundary.
3. Confirm: Run the final pass/fail matrix at the confirmed worst-case corners with the required sample size.

Cost and timing optimization also means sharing samples across tests where possible. A single deployment can yield data on cover tear, inflator pressure, occupant kinematics, and sensor timing if the instrumentation is designed correctly. This reduces the total number of builds and test cell hours.

Linkage to DFMEA and PFMEA

The test matrix is the verification arm of the FMEA process. Every failure mode with a severity of 9 or 10, or with an RPN above the action threshold, must have a corresponding test in the matrix. The DFMEA identifies design failure modes — cover tear, inflator over-pressure, tether separation, sensor mis-trigger. The PFMEA identifies process failure modes — missing weld, wrong inflator lot, reversed connector, insufficient crimp. The matrix must cover both.

The linkage is bidirectional. The FMEA tells the matrix what to test. The matrix results tell the FMEA whether the assumed occurrence and detection ratings are correct. If a test-to-failure result shows a smaller margin than the DFMEA assumed, the occurrence rating must be increased and the design or process must be improved. This feedback loop is what makes the matrix a living document rather than a one-time deliverable.

Practical Matrix Construction Example

Consider a driver-side frontal airbag module. The DFMEA identifies three high-severity failure modes: cover tear failure (severity 9), inflator over-pressure (severity 10), and tether separation (severity 8). The PFMEA identifies two process failure modes: insufficient weld on the module bracket (severity 9) and wrong inflator lot (severity 10).

The matrix must cover all five. A practical construction is:

This matrix requires 45 × 5 + 20 = 245 deployments if every corner is tested independently. In practice, the tether separation and insufficient weld tests can often be combined with the inflator over-pressure test because they share the same high-temperature, high-voltage preconditioning. This reduces the total to approximately 180 deployments, a 27% reduction in test cost and several weeks of schedule.

Closing the Loop

The matrix is not complete until the results are fed back into the DFMEA and PFMEA. A test-to-failure result that shows a margin of only 5% above the specification limit is a signal that the occurrence rating in the DFMEA is too low. A process capability study that shows a Cpk below 1.33 on a critical weld dimension is a signal that the PFMEA detection rating is too optimistic. The matrix is the evidence that either validates or corrects the FMEA assumptions.

In the next stage of the program, the validated matrix becomes the baseline for PV. The PV matrix is typically a subset of the DV matrix, focused on the production process and the confirmed worst-case corners, with sample sizes sized to demonstrate ongoing process capability rather than design capability. The transition from DV to PV is not a repetition; it is a shift in the question being asked — from "can the design survive?" to "can the production process consistently deliver the design?"