4. System architecture and partitioning
An airbag system is not a single component but a distributed restraint network whose behavior is governed by a strict partitioning of sensing, decision-making, energy release, and diagnostics. In program management terms, architecture and partitioning decisions made in the concept phase determine cost, harness complexity, validation effort, and serviceability for the entire vehicle lifecycle. This section explains what each subsystem does, how the boundaries between them are drawn, and how to translate those boundaries into concrete interface definitions and diagnostic behavior.
Functional Partitioning of the Restraint System
The system can be partitioned into five functional domains. The Airbag ECU (ACU) is the central arbitration unit: it hosts the crash algorithm, safing logic, squib drivers, backup energy reserve, and the event data recorder. Satellite and peripheral sensors provide acceleration, pressure, and roll-rate inputs. Initiators (squibs) convert electrical energy into pyrotechnic ignition. Modules package the inflator, cushion, and housing into a mountable assembly. Wiring and connectors carry power, sensor signals, and squib firing current, while the diagnostic interface exposes fault status and service data through the vehicle network.
A useful partitioning rule is that anything whose failure could cause an unintended deployment must be monitored continuously, and anything whose failure could suppress a required deployment must be detectable before the next ignition cycle. This rule drives the placement of the safing sensor inside the ECU rather than in a satellite, and it drives the requirement that squib circuits be measured for resistance and short-to-ground even when the vehicle is parked.
ECU Architecture and Internal Partitioning
Inside the ACU, the main microcontroller runs the crash discrimination algorithm, while a separate safing ASIC or a second processor path provides an independent arming decision. The two paths are logically ANDed before any squib driver can be enabled. This dual-path structure is the architectural answer to the single-point-failure requirement: a faulty main path cannot fire a squib unless the safing path also agrees.
The energy reserve is typically a capacitor bank sized to fire all squibs for a defined hold-up time after battery disconnect. A representative sizing target is 150 ms of hold-up at 12 V nominal, with the capacitor charged to at least 23 V and the firing loop able to deliver the required current at end-of-life. The squib driver stage is partitioned per loop, so a shorted loop can be isolated without disabling unrelated loops.
Sensor Placement and Signal Chain
Frontal crash detection usually combines an ECU-integrated accelerometer with front satellite sensors mounted near the radiator support or on the crash box. Side impact detection uses pressure satellites in the door cavity or B-pillar accelerometers. The signal chain is: sensor element → analog front end → A/D conversion → filtering and plausibility check → crash algorithm. Each stage has a defined bandwidth and latency budget; for example, a front satellite may be specified to report a valid acceleration signal within 2 ms of event onset, and the ECU algorithm must issue a deployment decision within 10–15 ms for a 50 km/h frontal barrier event.
Partitioning sensors between ECU-integrated and remote locations is a trade study. Remote satellites improve crash discrimination for offset and pole impacts but add harness length, connector count, and EMC exposure. A common compromise is one integrated accelerometer plus two front satellites and two side pressure satellites, giving five sensing channels without excessive harness mass.
Inflators, Modules, and Wiring
The inflator is a pyrotechnic or hybrid gas generator whose output is matched to cushion volume and venting. Module partitioning defines the mechanical interface to the vehicle: mounting points, tear seams, and clocking. The wiring harness must carry squib firing current, typically 1.2–2.0 A for 2 ms, while maintaining loop resistance below a specified limit, often 2.0 Ω per loop including connectors. Connector keying and shorting bars are architectural features that prevent mis-mating and accidental firing during service.
Twisted-pair or shielded conductors are used for squib loops to reduce induced noise. The harness routing must avoid sharp edges and high-temperature zones; a typical specification limits continuous exposure to 85 °C and peak exposure to 125 °C for short durations.
Diagnostic Interfaces and Fault Partitioning
The diagnostic interface is not an afterthought; it is part of the architecture. The ACU exposes fault codes through UDS (ISO 14229) on CAN or CAN FD, with DTCs partitioned by subsystem: sensor circuit faults, squib loop faults, ECU internal faults, and communication faults. A representative DTC set includes B0100 (squib circuit high resistance), B0101 (squib circuit short to ground), and U0151 (lost communication with restraints control module).
Each DTC has a defined detection condition, confirmation counter, and healing criterion. For example, a squib loop resistance above 4.0 Ω for 500 ms may set a pending DTC; the same condition persisting across three ignition cycles confirms it and illuminates the airbag telltale. The diagnostic interface must also support end-of-line (EOL) testing, where each loop is measured and the result is written to the ECU production data.
- Is every squib loop independently measurable and isolatable?
- Does the safing path have a separate power supply and ground reference?
- Are sensor and squib harnesses routed on separate branches to avoid common-mode damage?
- Are DTC detection thresholds and confirmation counters defined per loop?
- Is the energy reserve hold-up time verified at end-of-life capacitance?
Worked Example: Defining a Squib Loop Interface
Consider a driver frontal airbag loop. The interface specification might read: loop resistance 1.8–2.4 Ω at 23 °C; firing current 1.4 A minimum for 2 ms; isolation resistance greater than 100 kΩ to ground; connector keying unique to the driver loop. During EOL, the tester injects a known resistance and verifies that the ECU reports the correct loop status within 200 ms. If the measured resistance is 3.5 Ω, the ECU should set a pending high-resistance DTC; if it is 0.5 Ω, a short-circuit DTC. This example shows how partitioning decisions become measurable acceptance criteria.
Program Management Implications
Partitioning decisions must be frozen early because they cascade into harness drawings, connector part numbers, ECU pinouts, and diagnostic specifications. A late change from a two-satellite to a three-satellite front sensing scheme can invalidate crash algorithm calibration, harness routing, and EOL test sequences. The program manager should therefore treat the interface control document (ICD) as a configuration-managed artifact with a formal change board.
Another practical point is that diagnostic coverage targets must be allocated per partition. If the program requires 90% diagnostic coverage for squib loops, that target must be decomposed into detection thresholds, confirmation counters, and test intervals for each loop. Without this decomposition, the coverage claim cannot be verified during validation.
In summary, architecture and partitioning define the physical and logical boundaries that make the restraint system testable, diagnosable, and safe. The ECU, sensors, inflators, modules, wiring, and diagnostic interface must be specified as an integrated set of interfaces, not as independent components. The next phase of the program builds on these boundaries to define validation plans and production test strategies.