2. Restraint system architecture

In a multi-vehicle occupant restraint platform, the restraint system is not a collection of independent parts but a coordinated architecture of five subsystem families: airbags, seat belts, pretensioners, load limiters, and occupant classification sensors (OCS). Each family has its own sensing, actuation, and diagnostic behavior, yet all must be planned as one platform so that a single restraint control module (RCM) calibration strategy can be reused, varied, or scaled across vehicle variants. This chapter explains what each subsystem contributes, how they interact at the platform level, and how to plan their interfaces, parameters, and verification so that the architecture remains consistent from a compact sedan to a mid-size SUV.

Subsystem Roles and Platform Interfaces

Airbags provide supplemental restraint: frontal airbags (driver, passenger), side airbags (thorax, pelvis), curtain airbags, and knee airbags. At platform level, the key planning variables are deployment zone, inflator type (pyrotechnic vs. hybrid), tether and venting strategy, and the number of firing loops supported by the RCM. Seat belts are the primary restraint; their platform parameters include geometry (anchor positions, D-ring height), retractor type (emergency locking retractor, ELR, or switchable), and webbing force-extension characteristics. Pretensioners remove belt slack at the retractor or buckle, while load limiters control the force transmitted to the occupant through torsion-bar or stitch-rip elements. OCS determines occupant presence, position, and classification (for example, adult, child seat, or empty) and gates airbag deployment and pretensioner firing.

The platform-level interface is the RCM, which receives crash signals from accelerometers and pressure or satellite sensors, receives OCS status over a dedicated bus, and commands firing loops. Planning must define a common connector and pinout philosophy, a shared diagnostic trouble code (DTC) structure, and a consistent deployment logic table across variants. A useful platform rule is to freeze the RCM pinout and loop assignment early, then allow variant-specific calibration rather than variant-specific wiring.

Platform Restraint Architecture — Signal and Actuation Flow Crash Sensing Front accelerometer Side pressure / satellite Occupant Classification Bladder / capacitive mat Belt tension / buckle switch Restraint Control Module Deployment logic table Loop drivers / safing DTC and event data OCS bus gateway Airbag Loops Front / side / curtain / knee Pretensioners Retractor / buckle pyrotechnic Load Limiters Torsion bar / stitch rip Seat Belt Hardware Retractor / anchor / webbing Platform planning checkpoints 1. Freeze RCM pinout and loop assignment across variants. 2. Define OCS classification thresholds and suppression logic. 3. Verify pretensioner + load limiter force profile against occupant mass targets.

Deployment Logic and Occupant Classification

Deployment logic is the heart of the platform architecture. A typical logic table maps crash severity, belt status, occupant classification, and seat position to a set of firing decisions. For example, a low-severity frontal event with a belted adult may fire the pretensioner and load limiter only, while a high-severity event adds the frontal airbag. If OCS reports an empty seat or a rear-facing child seat, the passenger frontal airbag is suppressed and a warning lamp is illuminated. Planning must define these thresholds once and then express them as calibration data, not as hard-coded logic in each variant.

OCS itself requires careful platform planning. Bladder-based systems measure pressure distribution and classify by weight and pressure pattern; capacitive systems measure dielectric coupling. Both must be calibrated for seat foam, trim, and occupant posture. A practical platform approach is to define a classification matrix with three or four classes and to specify the suppression boundary as a force or capacitance threshold with hysteresis. For example, a bladder system might classify below 12 kg as "empty or child," 12–35 kg as "small occupant," and above 35 kg as "adult," with a 3 kg hysteresis band to prevent chatter. These numbers are illustrative and must be validated for each seat design.

Pretensioner and Load Limiter Coordination

Pretensioners and load limiters are often treated as one belt force management subsystem. The pretensioner fires first to remove slack, typically within 10–20 ms of a valid crash signal. The load limiter then controls the belt force by allowing controlled webbing payout or torsion-bar deformation. At platform level, the key parameter is the force-limiting level, often expressed as a target belt force in the range of 2.5–4.5 kN for front occupants, with lower levels for smaller occupants. The RCM must coordinate pretensioner firing with airbag deployment so that the occupant is not loaded by the airbag before the belt has taken up slack.

A reproducible engineering example helps clarify the planning process. Suppose a platform team is defining a belt force management strategy for a mid-size SUV. The inputs are: occupant mass range 50–100 kg, seat track position range 200–400 mm, and a target chest deflection limit of 40 mm. The team selects a dual-stage pretensioner and a torsion-bar load limiter with two force levels: 3.0 kN for occupants below 70 kg and 4.0 kN for occupants above 70 kg. The RCM uses OCS classification and belt buckle status to select the level. The expected observable result is that chest deflection remains below 40 mm in a 56 km/h frontal barrier test, and the belt force profile shows a plateau at the selected level. If the plateau is too high, the occupant may experience excessive chest loading; if too low, the occupant may move too far forward and contact the airbag late. Typical failure symptoms include a force spike above the target, which usually indicates a torsion bar with the wrong diameter or a stitch-rip pattern that is too strong, and a force plateau that is too low, which often indicates a pretensioner that fired late or a load limiter that released too early.

Platform Verification and Diagnostics

Verification at platform level should cover electrical, functional, and crash performance. Electrical verification checks loop resistance, short-to-ground, and short-to-battery for each firing loop, with typical pass criteria of 1.8–2.5 Ω for a squib loop. Functional verification checks OCS classification accuracy across a defined occupant matrix, including an empty seat, a child seat, a small adult, and a large adult. Crash performance verification uses sled or full-vehicle tests to confirm that the deployment logic and force management strategy meet occupant injury criteria. Diagnostics must be planned as a common DTC set, for example B0001 for driver frontal loop resistance out of range and B0012 for passenger OCS communication fault, so that service tools and plant testers can be reused across variants.

When planning a new variant, start from the frozen RCM pinout and loop assignment, then adjust only the calibration data for OCS thresholds, pretensioner timing, and load limiter force level. This keeps the platform architecture stable and reduces validation effort.
Do not assume that a load limiter force level validated for a 50th-percentile male is safe for a 5th-percentile female. The platform plan must include occupant size variation and, where required, adaptive force limiting or dual-level load limiters.

In summary, the restraint system architecture is a platform-level contract among five subsystem families. Airbags, seat belts, pretensioners, load limiters, and OCS each have distinct roles, but their interfaces, deployment logic, and calibration data must be planned together. By freezing the RCM pinout, defining a shared deployment logic table, coordinating pretensioner and load limiter behavior, and verifying against a common occupant matrix, the platform team can deliver a restraint system that is consistent, diagnosable, and scalable across vehicle variants.

← Previous 📖 Contents Next →