2. Change classification and impact assessment
Every restraint design change begins with a classification decision, and that decision drives the entire downstream workflow: who must approve, which analyses must be repeated, which validation tests are mandatory, and how much documentation is required. Misclassifying a change is one of the most expensive errors in restraint program management — a minor change treated as major wastes resources, while a safety-critical change treated as minor can escape the validation it needs and create field risk. This section establishes a practical framework for classifying changes and scoping their impact using DFMEA and interface analysis.
Why Classification Comes First
Restraint systems — airbags, seat belts, pretensioners, load limiters, occupant classification sensors, and their electronic control units — are safety-critical by definition. However, not every change to a restraint system carries the same risk. Changing the thread pitch on a mounting bolt is fundamentally different from changing the inflator output curve or the deployment timing algorithm. Classification is the mechanism that separates these cases and routes each to the appropriate level of rigor.
A workable classification scheme uses two independent axes: change magnitude (minor vs. major) and safety criticality (safety-critical vs. non-critical). These axes are orthogonal. A change can be minor in magnitude but safety-critical in nature — for example, a small dimensional adjustment to a seat belt anchor that affects load path geometry. Conversely, a major change such as relocating the entire airbag module may be non-critical if it is a prototype-only modification for a non-production vehicle.
Distinguishing Minor vs. Major Changes
Magnitude is assessed by the extent to which a change alters form, fit, function, or interface. A practical decision framework uses four questions:
- Does the change alter the physical envelope or mounting interface? If yes, it is likely major.
- Does the change affect performance output (deployment force, timing, restraint load, or sensing threshold)? If yes, it is major.
- Does the change affect a regulated or homologated characteristic? If yes, it is major regardless of physical size.
- Does the change affect only documentation, labeling, or non-functional cosmetic attributes? If yes, it is minor.
In practice, a minor change typically involves tolerance adjustments within existing design margins, material substitutions that are form-fit-function equivalent, or supplier process changes that do not alter the delivered part. A major change alters at least one of: geometry, material specification, electrical interface, software calibration, or the validated performance envelope.
Safety-Critical vs. Non-Critical
Safety criticality is determined by the potential effect on occupant protection. A change is safety-critical if a reasonably foreseeable failure or performance deviation could increase injury risk. This includes changes to:
- Deployment logic, timing, or thresholds
- Inflator output, gas composition, or pressure curve
- Structural load paths (anchors, brackets, retractors, pretensioners)
- Occupant sensing or classification algorithms
- Any component whose failure mode appears in the DFMEA with a Severity rating of 9 or 10
Non-critical changes affect attributes such as appearance, packaging efficiency, manufacturing ergonomics, or cost — without altering the safety function. Note that a non-critical change can still be major in magnitude (e.g., a complete redesign of a plastic trim cover that does not affect deployment).
Using DFMEA to Scope Impact
The Design Failure Mode and Effects Analysis (DFMEA) is the primary tool for determining which failure modes a change can influence. The scoping process works as follows:
- Identify the changed item and its function. State the function of the component or subsystem being modified.
- Map the change to potential failure modes. For each function, ask: could this change introduce a new failure mode, or alter the likelihood or detectability of an existing one?
- Evaluate Severity, Occurrence, and Detection. If the change affects any failure mode with Severity ≥ 9, the change is safety-critical. If it affects Occurrence or Detection ratings, the change is at least major.
- Determine the required actions. The DFMEA entry defines what must be re-analyzed, re-tested, or re-validated.
For example, consider a change from a 50 mm to a 55 mm seat belt anchor bolt length. The DFMEA for the anchor assembly lists "anchor separation under load" with Severity 10. The change affects the thread engagement length, which is a contributing factor to that failure mode. Therefore, the change is safety-critical and major, even though the dimensional delta is small. Required actions would include thread engagement calculation, torque-tension verification, and possibly a pull test.
Interface Analysis
Restraint systems are densely interfaced. A change in one component propagates through mechanical, electrical, and data interfaces. Interface analysis systematically identifies these propagation paths.
For each change, enumerate the interfaces:
- Mechanical: mounting points, brackets, clearances, load paths, fastener specifications
- Electrical: connectors, pinouts, signal levels, power requirements, grounding
- Data/Communication: CAN/LIN messages, sensor fusion inputs, calibration dependencies
- Environmental: temperature, vibration, moisture exposure at the interface
For each interface, ask: does the change alter the interface definition, or does it alter the loads, signals, or conditions that the interface must withstand? If either answer is yes, the interfacing component must be included in the impact scope.
A common example: changing the airbag ECU mounting location. The mechanical interface changes (new bracket, new bolt pattern), but the electrical interface may also change (harness routing, connector orientation), and the data interface may be affected if the ECU orientation affects sensor calibration. Interface analysis ensures none of these are missed.
Putting It Together: A Scoping Example
Consider a change to the seat belt retractor: the supplier proposes a new torsion bar material with higher yield strength. The change is major (material specification change affecting performance). The DFMEA for the retractor lists "excessive belt payout under load" with Severity 9. The change directly affects the torsion bar's energy absorption, so it is safety-critical. Interface analysis identifies the following affected interfaces:
| Interface | Affected Element | Required Action |
|---|---|---|
| Mechanical | Torsion bar to retractor frame spline | Verify spline engagement and torque capacity |
| Mechanical | Belt load path to anchor | Re-calculate anchor loads with new payout curve |
| Data | ECU calibration for pretensioner timing | Confirm timing remains within validated window |
| Environmental | Corrosion resistance of new material | Run salt spray per existing spec |
The output of this scoping exercise is a defined impact scope: the torsion bar itself, the retractor frame spline, the anchor bracket, the ECU calibration, and the corrosion test. Each item is then assigned to the appropriate validation activity. This scope becomes the baseline for the change management plan.
Documenting the Classification Decision
The classification and impact scope must be recorded in a controlled document — typically a Change Impact Assessment form. At minimum, it should capture: the change description, the magnitude determination with justification, the criticality determination with DFMEA reference, the interface analysis results, the affected components list, and the required validation activities. This record becomes the audit trail that demonstrates due diligence and supports regulatory compliance.
When the classification is ambiguous, the conservative approach is to classify upward. The cost of over-validating a minor change is far lower than the cost of under-validating a safety-critical one. Document the rationale either way, so that future reviewers can understand the decision basis.