2. Restraint system architecture and requirements flowdown

An occupant restraint program is only as strong as the traceability between what the vehicle must achieve and what each subsystem is told to deliver. This chapter explains how the physical restraint architecture is organized, what each element contributes, and how vehicle-level targets are decomposed into measurable subsystem specifications that suppliers can design, test, and validate against.

Architecture Overview

A modern restraint system is a coordinated set of energy-absorbing and load-distributing devices, triggered and modulated by an electronic control unit. The core elements are:

• Seatbelts — the primary restraint. A three-point belt consists of lap and shoulder webbing routed through a retractor and a buckle, with an anchor point on the B-pillar or seat structure.
• Pretensioners — pyrotechnic or motorized devices that remove belt slack within milliseconds of a detected crash, pulling the occupant into the seat before the belt load builds.
• Load limiters — a torsion bar in the retractor or a stitch-rip in the webbing that allows controlled webbing payout once belt force reaches a threshold, capping chest deflection.
• Airbags — frontal (driver, passenger), side (thorax, pelvis), curtain, and knee bags that distribute impact forces over a larger area and reduce peak acceleration on the occupant.
• Child seat anchorage — ISOFIX/LATCH lower anchorages and top tether points that provide a rigid, standardized interface for child restraint systems (CRS).

These elements are not independent. A pretensioner that fires too early can increase chest loading; a load limiter set too high defeats the purpose of the pretensioner; an airbag that deploys without a fastened belt can cause injury. The architecture must therefore be tuned as a system, not as a collection of parts.

From Vehicle Targets to Subsystem Specifications

Vehicle-level targets originate from regulatory requirements (FMVSS 208, ECE R94/R95), consumer ratings (Euro NCAP, C-NCAP), and internal brand targets. A typical vehicle-level target set might include:

These targets are then cascaded. The flowdown process follows a structured path:

1. Define the load case matrix. Crash modes (full frontal, offset deformable barrier, side pole, rear), speeds, occupant sizes (5th percentile female to 95th percentile male), and seating positions.
2. Allocate targets to subsystems. Chest deflection is influenced by belt geometry, load limiter force level, pretensioner stroke, and airbag venting. Each subsystem receives a budget.
3. Translate budgets into specifications. For example, a load limiter specification might read: "Torsion bar yield force 3.5 ± 0.3 kN, payout length 120 mm minimum, activation time ≤ 15 ms after pretensioner fire."
4. Validate by simulation and physical test. CAE models (LS-DYNA, PAM-CRASH) predict occupant response; sled and full-vehicle tests confirm.

Interface and Timing Requirements

Subsystems must also agree on interfaces and timing. The airbag ECU sends a deployment command; the pretensioner must fire within a specified window (typically 10–20 ms after the crash pulse is detected). The load limiter must not activate before the pretensioner has completed its stroke, otherwise the belt will pay out before the occupant is properly positioned. These timing requirements are documented in the restraint system specification (RSS) and verified through sled tests with high-speed video and force/displacement sensors.

Child seat anchorage requirements are separate but equally critical. ISOFIX anchorages must withstand a force of 8 kN in a frontal impact without permanent deformation exceeding 10 mm. The top tether anchor must withstand 5 kN. These are static strength requirements that flow directly from ECE R14 and FMVSS 225.

Practical Flowdown Example: Side Impact

Consider a side pole impact at 32 km/h. The vehicle-level target is a rib deflection of ≤ 35 mm for a 50th percentile male occupant. The flowdown allocates:

• Side airbag: must deploy within 8 ms, cover a vertical range of 250 mm, and vent at a rate that limits rib deflection to 30 mm.
• Curtain airbag: must deploy within 12 ms, cover the window opening, and remain inflated for 200 ms.
• Seat structure: must absorb 2 kN of lateral force without excessive deformation.
• Belt: the pretensioner must fire within 6 ms to reduce lateral excursion.

Each specification is then verified independently: airbag deployment time by bench test, rib deflection by sled test with a side impact dummy (WorldSID), and seat strength by quasi-static push test.

Common Pitfalls in Requirements Flowdown

Visualizing the Flowdown

The following diagram shows how vehicle-level targets cascade into subsystem specifications, with the key interfaces and timing relationships.

Key Takeaways

Requirements flowdown is not a one-way street. It is an iterative process where subsystem specifications are proposed, simulated, tested, and refined until the vehicle-level targets are met with sufficient margin. The restraint system specification (RSS) is the living document that captures this process. Every specification must be traceable to a vehicle-level target, and every target must be verifiable through a defined test or analysis method. When a subsystem cannot meet its allocated budget, the program must either reallocate targets, change the architecture, or accept a trade-off — and document the decision with supporting evidence.

In the next chapter, we will examine how these specifications are translated into detailed design and validation plans, including the role of CAE correlation and physical test matrices.