3. Occupant safety targets and requirements cascade
Vehicle-level occupant safety targets are meaningless to a seat frame engineer, an airbag inflator supplier, or a restraint control module (RCM) calibration team until they are decomposed into quantities those teams can design, measure, and sign off against. The cascade is the disciplined process that performs this decomposition. It is not a single document but a traceable chain: each link states a requirement, names the responsible party, defines the verification method, and preserves the numerical relationship to the parent target. When the chain breaks, the failure mode is predictable — a subsystem meets its own specification while the vehicle still fails the occupant criterion.
Starting Point: What a Vehicle-Level Target Actually Contains
A well-formed vehicle-level target is more than a star rating or a pass/fail statement. It specifies the occupant population (for example, a 50th-percentile male Hybrid III, a 5th-percentile female, or a THOR-50M), the crash mode and severity (full frontal rigid barrier at 56 km/h, offset deformable barrier at 64 km/h, side MDB at 60 km/h, or a pole impact), the injury criterion and its limit, and the regulatory or consumer-program reference. A typical frontal target might read: "50th-percentile male, driver position, 56 km/h full frontal rigid barrier: HIC15 ≤ 700, chest deflection ≤ 42 mm, femur axial force ≤ 7.6 kN, with a design margin of 15% below the regulatory limit."
Two conventions must be fixed before any decomposition begins, because they propagate through every downstream document. First, the sign convention for forces and accelerations — SAE J211 specifies that vehicle longitudinal acceleration is positive in the forward direction, and this must be stated explicitly so that a subsystem team does not invert a load path. Second, the margin policy: whether the 15% margin is applied at the vehicle level only, or re-applied at each subsystem level. Applying it twice silently consumes design freedom; applying it nowhere leaves no room for production variation. Most programs apply the margin once at the vehicle target and then allocate a separate, smaller robustness allowance at subsystem level.
The Decomposition Logic
The cascade follows the physical load path, not the organizational chart. For a frontal impact, the chain runs from barrier → vehicle structure → occupant compartment deceleration → restraint system → occupant. Each transition is a place where a vehicle-level injury number becomes a subsystem-level physical quantity.
Consider chest deflection. The vehicle target of ≤ 42 mm is produced by the interaction of three contributors: the deceleration pulse transmitted through the body structure into the seat and floor, the belt load limiting force, and the airbag pressure–time history. A first-cut allocation might assign the belt retractor to limit shoulder belt force to 4.0 kN ± 0.4 kN, the airbag to reach a peak internal pressure of 180 kPa within 35 ms, and the seat structure to limit rearward displacement of the occupant reference point to 25 mm. These are not arbitrary: they are derived from a validated MADYMO or LS-DYNA occupant model where each parameter is perturbed to establish sensitivity.
The sensitivity study is the technical heart of the cascade. By running a design of experiments (DOE) around the nominal restraint configuration, the team obtains a response surface that quantifies how much chest deflection changes per unit change in each subsystem parameter. A representative result might show that a 0.5 kN reduction in shoulder belt force limit reduces peak chest deflection by approximately 3 mm, while a 10 mm increase in seat rearward compliance adds roughly 1.5 mm. These coefficients become the allocation rationale and are recorded so that later change requests can be evaluated against them.
Worked allocation example (illustrative, not measured data): Vehicle target chest deflection ≤ 42 mm with 15% margin → design target ≤ 35.7 mm. Occupant model baseline predicts 38 mm. Required reduction: 2.3 mm. Sensitivity: belt force limit −0.5 kN → −3.0 mm; airbag vent increase → −1.2 mm. Selected allocation: belt force limit 4.0 kN (from 4.5 kN), airbag vent area +8%. Predicted result: 38 − 3.0 − 1.2 = 33.8 mm, leaving 1.9 mm robustness allowance.
From Allocation to Specification
An allocation becomes a specification only when it is written in a form a supplier or internal team can verify. Each subsystem requirement should carry five fields: the parameter and nominal value, the tolerance, the verification method (test, analysis, or inspection), the verification stage (component, sled, or full vehicle), and the traceability identifier linking back to the vehicle target. A belt retractor specification derived from the example above would read: "Shoulder belt force limit: 4.0 kN ± 0.4 kN, verified by component dynamometer test per the program's belt pull procedure, at component stage, traceable to vehicle target VS-01-FR-03."
The verification stage matters because it determines when a deviation is detectable. A component-level force limit test can be run in weeks; a sled test takes months; a full vehicle test takes longer still and consumes expensive hardware. The cascade should push verification as far upstream as the physics allows, so that failures surface before full vehicle builds. This is why the allocation must be accompanied by a correlation plan: evidence that the component or sled result predicts the full vehicle outcome within a stated confidence band.
Common Failure Modes in the Cascade
- Orphan requirements: a subsystem specification exists with no traceable parent, usually inherited from a previous program. These consume mass and cost without serving the current target.
- Double-counted margin: the 15% vehicle margin is re-applied at subsystem level, leaving the occupant model unable to meet the sum of allocations.
- Missing interface requirements: the seat, belt, and airbag each meet their own numbers, but the belt-to-seat geometry tolerance is unspecified, so the real build differs from the model.
- Verification gap: a requirement is allocated but no test or analysis is defined to confirm it, so the deviation is discovered only at full vehicle stage.
When a full vehicle test fails an occupant criterion, the first diagnostic step is to compare the measured subsystem parameters against their allocated values — not to re-run the occupant model. If the belt force limit measured on the vehicle was 4.8 kN against a 4.0 kN allocation, the cascade worked and the component is out of specification. If the belt force was 4.0 kN and the occupant still failed, the allocation itself was wrong and the sensitivity study must be revisited.
Traceability in Practice
Traceability is maintained through a requirements management structure, typically a parent–child link in a tool such as Polarion, DOORS, or a structured spreadsheet for smaller programs. Each vehicle target is a parent; each subsystem specification is a child; each component specification is a grandchild. The link is bidirectional: from the vehicle target you can list every specification that serves it, and from any component specification you can walk up to the vehicle target it supports. When a target changes — for example, a mid-program switch from a 56 km/h to a 64 km/h offset requirement — the impact analysis is a query on this structure, not a manual search.
Closing the Loop: Change Control and Sign-Off
The cascade is a living structure. When a supplier reports that a 4.0 kN force limit cannot be held within the available package, the change request must be evaluated against the sensitivity coefficients, not against intuition. If the belt force rises to 4.3 kN, the predicted chest deflection increases by roughly 1.8 mm, which may still fit within the 1.9 mm robustness allowance — or may not. The decision is made with the numbers the cascade produced. Sign-off occurs at each level: the subsystem owner confirms the specification is achievable and verifiable, and the vehicle safety lead confirms the sum of allocations still meets the vehicle target with margin intact. Without this discipline, the cascade degrades into a collection of disconnected specifications, and the vehicle-level target becomes a hope rather than an engineering commitment.