3. Design Failure Mode and Effects Analysis (DFMEA) for restraint systems

Design Failure Mode and Effects Analysis (DFMEA) is the structured method that converts restraint-system design intent into a ranked list of risks. For airbag modules, buckle assemblies, and crash sensors, the analysis must be performed at the component-and-interface level, because most field failures in restraint systems originate at interfaces: connector seating, mounting torque, weld quality, and signal plausibility. This chapter explains how to identify failure modes for these three subsystems and how to apply severity (S), occurrence (O), and detection (D) ratings consistently, so that Risk Priority Numbers (RPN) and Action Priority (AP) rankings drive real design changes rather than documentation.

Scoping the DFMEA Before Rating Anything

A restraint DFMEA begins with a boundary definition. For an airbag module, the boundary includes the inflator, housing, cushion, cover, wiring harness pigtail, and the mounting interface to the steering wheel or instrument panel. For a buckle assembly, it includes the latch mechanism, release button, position switch, pretensioner (if integrated), and the anchor bolt interface. For a crash sensor, it includes the sensing element, ASIC, connector, mounting boss, and the vehicle-level bus interface.

Each boundary item is then decomposed into functions. A typical airbag module function statement is: "Deploy the cushion within the specified time window and pressure envelope when the deployment command is received, while retaining the housing to the vehicle structure." Failure modes are then derived by negating each function: no deployment, late deployment, over-pressure deployment, partial cushion inflation, or housing separation. This function-to-failure-mode mapping is the core discipline that prevents the DFMEA from becoming a generic checklist.

Failure Modes Specific to Airbag Modules

Airbag module failure modes cluster into four groups. First, deployment failures: inflator initiator open circuit, initiator short to ground, or insufficient gas generant. Second, timing failures: slow burn rate caused by propellant moisture ingress or by a blocked gas passage. Third, structural failures: housing weld crack under deployment load, cover retention tab fracture, or cushion seam rupture. Fourth, interface failures: pigtail connector not fully seated, terminal fretting corrosion, or mounting bolt torque loss.

For each failure mode, the DFMEA records the local effect, the next-higher-level effect, and the end effect. A useful example is the inflator initiator open circuit. The local effect is "no current path through initiator." The next-higher-level effect is "module does not deploy." The end effect is "occupant unrestrained in a frontal impact," which drives severity to 10. This chain must be written explicitly, because severity is assigned to the end effect, not to the local effect.

Failure Modes Specific to Buckle Assemblies

Buckle assemblies are mechanical and electrical simultaneously. Mechanical failure modes include latch pawl not engaging the tongue, release button stuck in the depressed position, and spring fatigue reducing latch retention force. Electrical failure modes include buckle switch open when latched, switch short when unlatched, and harness chafing against the seat frame. A representative failure mode is "buckle switch indicates latched when the tongue is not inserted," which produces a false seat-belt-reminder suppression and, in some architectures, incorrect airbag suppression logic.

Buckle DFMEA must also consider misuse and environment. A spilled beverage can cause sticky latch behavior; a foreign object in the buckle slot can prevent full insertion. These are design-robustness concerns, and they are captured as occurrence drivers rather than as separate failure modes.

Failure Modes Specific to Crash Sensors

Crash sensors include front satellite sensors, side pressure sensors, and central accelerometers. Failure modes include no output (open die or broken wire), stuck output (saturated signal), shifted sensitivity (offset drift), and delayed response (filter lag). A stuck-high satellite sensor is particularly dangerous because it can cause unnecessary deployment; a stuck-low sensor can cause non-deployment. Both must be analyzed separately, because their severity and detection profiles differ.

Sensor DFMEA also covers mounting and orientation. A sensor rotated 90 degrees during assembly may still pass electrical test but produce a wrong-axis signal. This is a design-interface failure mode, and it is mitigated by keyed connectors and poka-yoke mounting features.

Severity Rating Criteria for Restraint Systems

Severity in restraint DFMEA is anchored to occupant outcome, not to repair cost. A practical 1–10 scale for this domain is:

Severity is assigned once per failure mode and is not reduced by detection controls. A common error is to lower severity because a diagnostic monitor exists. That is incorrect: severity reflects the consequence if the failure occurs, regardless of whether it is detected.

Occurrence Rating Criteria

Occurrence is rated from the expected frequency of the cause, using production data, reliability predictions, or field return rates. For restraint components, the following anchors are practical:

• O = 1: Failure rate below 1 ppm, supported by Cpk ≥ 2.0 and no field returns.
• O = 3: Failure rate around 10–100 ppm, Cpk between 1.33 and 1.67.
• O = 5: Failure rate around 1,000 ppm, Cpk between 1.0 and 1.33.
• O = 8: Failure rate around 10,000 ppm, Cpk below 1.0, or new technology with no field history.
• O = 10: Failure rate above 100,000 ppm, or a known design weakness without countermeasure.

For a new inflator design with no field data, occurrence should be rated conservatively (O = 8) until reliability testing demonstrates otherwise. This is a deliberate bias toward safety, and it is consistent with AIAG-VDA guidance for new technology.

Detection Rating Criteria

Detection rates the ability of the design verification and production controls to detect the failure mode before the vehicle leaves the plant, or before the customer experiences it. For restraint systems:

• D = 1: Failure mode is impossible to produce, or is detected by 100% end-of-line test with proven gauge R&R.
• D = 3: Detected by 100% automated test, but the test is indirect (for example, resistance measurement instead of functional deployment).
• D = 5: Detected by sampling inspection or by a test that requires disassembly.
• D = 8: Detected only by vehicle-level crash test, which is destructive and sampled.
• D = 10: No detection control exists; failure is discovered only in the field.

A key discipline is that detection ratings must reference a specific control. "Visual inspection" without a defined fixture, lighting condition, and acceptance criterion is not a valid detection control and should be rated D = 10.

Worked Example: Initiator Open Circuit

Consider an airbag module with a pyrotechnic initiator. The failure mode is "initiator open circuit." The cause is a broken bridge wire due to thermal cycling. The end effect is non-deployment, so S = 10. Based on supplier data showing 200 ppm bridge-wire failures during thermal shock, O = 6. The detection control is a 100% end-of-line resistance check with a limit of 2.0 ± 0.2 Ω, which detects open circuits reliably, so D = 2. RPN = 10 × 6 × 2 = 120. Under AIAG-VDA Action Priority, this combination is AP = High, requiring action. A reasonable countermeasure is to add a redundant bridge wire or to tighten the thermal shock specification, which reduces O to 3 and RPN to 60.

Common Pitfalls and How to Avoid Them

Three pitfalls recur in restraint DFMEA reviews. First, severity is assigned to the local effect instead of the end effect, which understates risk. Second, occurrence is copied from a similar program without adjusting for process capability differences. Third, detection is rated based on the existence of a test rather than on its demonstrated effectiveness. Each of these can be caught by requiring the DFMEA team to cite the specific data source for every O and D rating, and by reviewing the effect chain for every S = 9 or S = 10 line item.

A well-constructed restraint DFMEA is therefore not a paperwork exercise. It is the design record that links each failure mode to a measurable cause, a verified detection control, and a prioritized action. When the ratings are anchored to real data and the effect chains are written explicitly, the DFMEA becomes the primary tool for preventing restraint-system field failures before they reach the vehicle.