2. Crisis triage framework

When a restraint defect surfaces — whether from warranty data, a field return, a supplier notification, or a crash investigation — the first hours determine whether the program stays in controlled engineering containment or escalates into a regulatory recall. A triage framework converts that pressure into a repeatable sequence: classify severity, contain the population, escalate across functions, and decide on recall. This chapter defines the criteria and the mechanics of each stage.

Severity Classification: From Symptom to Safety Risk

Severity classification is not a judgment about how bad the defect looks in a lab; it is an assessment of the injury risk the defect creates in the field. The classification drives every downstream action, so it must be anchored to observable failure modes and their effect on restraint performance.

A practical four-level scheme for restraint defects:

Level Definition Restraint Example Response Window
S1 — Critical Defect can cause restraint non-deployment, inadvertent deployment, or reduced occupant protection in a crash Airbag ECU fails to fire on a valid crash pulse; seat belt pretensioner fires without command Immediate; containment within 24 h
S2 — Major Defect degrades restraint performance or creates a secondary hazard, but a crash is required to expose it Buckle latch does not fully engage; load limiter releases at wrong threshold Containment within 72 h
S3 — Minor Defect affects function or customer perception without measurable injury risk Seat belt reminder chime inoperative; airbag warning lamp intermittent Containment within 2 weeks
S4 — Observation Anomaly with no confirmed safety effect; monitor for trend Single field report of a stiff buckle release with no pattern Trend review at next quality gate

Two inputs sharpen the classification. First, the failure mode effect: does the defect remove a restraint function, delay it, or trigger it unintentionally? Second, the exposure: how many vehicles carry the suspect part, and in what build window? A defect that is S1 by effect but confined to 40 pre-production vehicles is handled differently from the same defect across 200,000 units. The classification is therefore a pair — severity level plus population size — not a single label.

Classification discipline: Assign severity from the failure mode, not from the number of reports. A single confirmed non-deployment on a valid crash pulse is S1 even if it is the only report. Report count drives exposure and urgency, not the severity level itself.

Containment Actions

Containment stops the defect from reaching more vehicles while the root cause is still unknown. It operates on three fronts simultaneously.

Product containment freezes the suspect population. In the plant, this means quarantining suspect stock by part number and date code, stopping shipment of affected vehicles, and screening finished goods with a targeted check. In the field, it means identifying the VIN range from build records and, if the defect is S1, preparing a customer notification or a stop-drive recommendation. The VIN list is built from the bill of materials plus the supplier's date-code traceability — if traceability is incomplete, the containment boundary must be widened until it is defensible.

Process containment prevents recurrence at the source. The suspect station is audited, the suspect tool or fixture is tagged out, and the process parameter that could produce the defect is locked or monitored. For a restraint defect, typical process containment includes verifying torque on anchor bolts, confirming connector seating force, and checking that the airbag ECU calibration part number matches the released level.

Information containment controls what is claimed. Until root cause is confirmed, external communication states only verified facts: the symptom, the affected population, and the interim action. This prevents premature root-cause statements that later have to be retracted — a common source of regulatory friction.

Cross-Functional Escalation

Restraint defects cross organizational boundaries by nature: the failure may originate in a supplier's process, appear in the vehicle assembly plant, and surface through warranty or field reports. Escalation must therefore be structured, not ad hoc.

A workable escalation path for an S1 or S2 restraint defect:

  1. Detection and initial report — the receiving function (warranty, plant quality, or field service) logs the symptom, VIN or part trace, and date, and notifies the restraint safety engineer within the response window.
  2. Safety triage meeting — within 24 h for S1, the restraint safety engineer, design engineer, supplier quality engineer, manufacturing engineer, and regulatory affairs representative review the evidence and confirm or revise the severity level.
  3. Technical review — the cross-functional team examines the failed part, reviews the design and process history, and defines the containment boundary and the investigation plan.
  4. Management escalation — if the defect is confirmed S1, or if containment cannot be achieved within the window, the issue escalates to the program manager and the safety decision board, which owns the recall recommendation.

The escalation trigger is not seniority but criteria: confirmed S1 effect, containment failure, regulatory reporting threshold, or a supplier that cannot provide traceability. Each trigger has a named owner and a time limit. Without time limits, escalation becomes a meeting series rather than a decision path.

Safety Recall Decision Criteria

The recall decision is a regulatory and legal determination, but it rests on engineering evidence. The decision board evaluates four criteria.

1. Safety-relatedness. Does the defect affect a restraint system's ability to protect occupants in a crash? A defect in the airbag, seat belt, pretensioner, load limiter, or occupant classification system is safety-related by definition. A defect in a comfort feature is not.

2. Population and exposure. How many vehicles are affected, and how likely is the failure to occur in service? A defect with a confirmed field failure rate above the threshold defined in the program's safety plan, or with a failure mode that is not detectable by the customer before a crash, weighs toward recall.

3. Detectability and warning. If the defect produces a warning lamp or a customer-observable symptom before a crash, the risk is lower and a service campaign may be sufficient. If the defect is silent — a non-deploying airbag with no warning — the risk is higher.

4. Regulatory and legal exposure. Does the defect meet the reporting threshold in the applicable market? In the United States, a safety-related defect triggers a reporting obligation within five working days of the determination. The decision board must document the determination date and the evidence behind it.

Do not let cost drive the recall decision. The decision criteria are safety-relatedness, population, detectability, and regulatory exposure. Cost is a consequence of the decision, not an input to it. A recall decision that cannot be defended on the four criteria will not survive regulatory or legal review.

Putting the Framework Together

The four stages form a closed loop. Severity classification sets the clock. Containment buys time and limits exposure. Escalation brings the right functions to the decision. The recall decision closes the loop with a documented, criteria-based determination. The diagram below shows how a defect moves through the framework and where the decision points sit.

Restraint Defect Triage Flow Detection Warranty / plant / field Symptom + trace logged Severity Classification S1 / S2 / S3 / S4 Effect + exposure Containment Product / process / info Freeze suspect population Escalation Cross-functional review board Recall decision Decision Criteria Safety-relatedness Population & exposure Detectability / warning Regulatory exposure Safety Recall Regulatory report Service Campaign Customer notification Monitor / Close Trend review New evidence / field data re-enters triage Response Windows by Severity S1 Critical — containment within 24 h, escalate immediately S2 Major — containment within 72 h, cross-functional review S3 Minor — containment within 2 weeks, standard CAPA S4 Observation — trend review at next quality gate

The framework is only as strong as its weakest input. If traceability is incomplete, containment boundaries widen and cost rises. If severity is assigned by report count rather than failure mode, S1 defects get treated as S3 and the program loses control of the clock. If escalation lacks time limits, the decision board receives stale evidence. The discipline of the framework is what keeps a restraint defect from becoming a restraint crisis.

← Previous 📖 Contents Next →