4. Sensing and crash detection architecture

An occupant restraint system is only as good as its deployment decision. The airbag ECU must decide, within roughly 10–30 ms of impact, whether a crash is severe enough to fire a frontal airbag, a side airbag, a seatbelt pretensioner, or a rollover curtain — and it must not fire when it should not. That decision rests on a sensing architecture that combines several physically different measurement principles, each with its own strengths and blind spots. This chapter examines the sensor types used in modern restraint systems, how their signals are conditioned and fused, and how the resulting deployment logic is validated.

Why one sensor type is never enough

A single accelerometer cannot reliably distinguish a severe frontal crash from a hard curb strike, a pothole, or a hammer blow during repair. The fundamental problem is that acceleration alone is ambiguous: a 30 g pulse lasting 5 ms and a 30 g pulse lasting 60 ms look similar in peak amplitude but have completely different injury consequences. Discriminating between them requires either a longer observation window (which costs deployment time) or additional, independent physical evidence. That is the architectural reason restraint systems use heterogeneous sensors.

Sensor types and their roles

The central accelerometer is the reference channel. Because it is mounted on the vehicle body near the center of gravity, it measures the actual deceleration the occupant experiences, and it is the sensor whose signal is compared against the calibrated crash severity thresholds. Satellite sensors exist to buy time: a sensor on the B-pillar or front longitudinal member sees the crash pulse several milliseconds earlier than the central sensor, because the crash wave has less distance to travel. That time advantage is what allows side airbags to deploy within the very short window available in a pole or barrier side impact.

Pressure sensing for side impacts

A pressure sensor mounted inside the door cavity measures the rate of pressure rise when the outer door panel is crushed inward. Because the cavity is partially sealed, even a small intrusion produces a rapid pressure spike — typically tens of millibars within a few milliseconds — that is much faster and more unambiguous than the acceleration signal measured at the same location. The pressure signal is therefore used as a fast trigger, while the satellite accelerometer confirms the event and provides severity information. This two-sensor arrangement is a classic example of complementary sensing: pressure gives speed, acceleration gives confidence.

Rollover sensing

Rollover detection is fundamentally different from frontal or side crash detection because it is a slow, orientation-based event. The ECU uses a combination of a roll-rate sensor (gyroscope) and a low-g accelerometer to estimate the vehicle's roll angle and roll rate. A typical algorithm integrates roll rate to obtain angle, then compares the trajectory in the roll-angle/roll-rate phase plane against a deployment boundary. If the trajectory crosses the boundary — indicating the vehicle will continue past the point of no return — the curtain airbag and pretensioners are deployed. The accelerometer provides the gravity vector, which is used to correct the integrated angle for sensor drift and to distinguish a true rollover from a steep bank or a vehicle on a lift.

From raw signals to a deployment decision

The fusion stage is where the architecture earns its keep. A representative implementation proceeds in three layers. First, each channel is conditioned: anti-alias filtering, offset compensation, and a plausibility check against the sensor's own self-test. Second, a crash severity index is computed. For frontal impacts this is often a filtered and integrated acceleration value — effectively an estimate of Δv — compared against a speed-dependent threshold. For side impacts, the pressure rate and satellite acceleration are combined in a weighted sum whose coefficients are calibrated per vehicle. Third, a voting or cross-check stage compares the independent channels; if the central accelerometer and the satellite disagree beyond a calibrated tolerance, the system either delays deployment or sets a fault code rather than firing on ambiguous evidence.

Rough-road rejection deserves specific mention because it is the most common source of false-positive risk. A vehicle driving over cobblestones can produce vertical accelerations of several g at frequencies around 10–20 Hz. The discrimination strategy is frequency-domain: crash pulses have significant energy below about 10 Hz and a characteristic rise time, while road-induced vibration is concentrated at higher frequencies. A low-pass filter with a cutoff near 20–30 Hz, combined with a minimum-duration requirement on the threshold crossing, rejects most rough-road events without delaying genuine crash detection.

Calibration and validation

Deployment thresholds are not derived analytically alone; they are calibrated against a matrix of crash tests and then validated against misuse cases. A typical calibration matrix includes full frontal rigid barrier at multiple speeds, offset deformable barrier, pole impact, side MDB (moving deformable barrier) at multiple angles, and rollover sled tests. Each test produces a recorded sensor time history that is replayed through the fusion algorithm offline. The engineer adjusts thresholds until every required deployment occurs within the timing budget and no non-deployment event crosses the boundary.

Fault handling and fail-safe behavior

Because a restraint ECU cannot be repaired after the fact, sensor faults must be detected and handled deterministically. Common strategies include:

• Open/short detection on each sensor line, checked continuously at startup and during operation.
• Plausibility comparison between redundant channels — for example, the central accelerometer and a satellite should agree on the sign and rough magnitude of a crash pulse.
• Watchdog and self-test of the ECU's own signal chain, with a fault lamp and a stored DTC if any channel fails.
• Degraded-mode logic that continues to deploy on the remaining valid channels where possible, rather than disabling the entire system.

The design principle is that a single sensor failure must not cause an unwanted deployment, and should not cause a missed deployment if the remaining channels carry enough information. This is why the architecture deliberately uses physically independent measurement principles — acceleration, pressure, and angular rate — rather than three copies of the same accelerometer.

Key takeaways

• Restraint sensing uses complementary physical principles because acceleration alone is ambiguous.
• Satellite and pressure sensors buy the milliseconds needed for side-impact deployment.
• Rollover detection is an orientation problem solved in the roll-angle/roll-rate phase plane.
• Fusion combines severity estimation, rough-road rejection, and cross-channel plausibility voting.
• Calibration must preserve a discrimination margin between the lowest required deployment and the highest non-deployment event.