2. Deployment Function and Failure Mode Mapping for Frontal Airbag
Why Function-to-Failure Mapping Comes Before Rating
In a frontal airbag DFMEA, the deployment function is not a single behavior. The module must decide (sense and discriminate a crash), actuate (fire the initiator), inflate (generate gas and fill the cushion), and vent/position (control pressure and cushion geometry relative to the occupant). Each of these sub-functions can fail in a distinct way, and each failure mode carries its own severity and occurrence logic. If you jump straight to severity numbers without first decomposing the function, you will produce ratings that are either duplicated across unrelated failure modes or missing entirely for partial-deployment cases.
This case builds the mapping layer: a structured function → failure mode → DFMEA criteria table for a driver-side frontal airbag module, with severity and occurrence criteria stated in a way that a later rating pass (Case 3 and Case 4) can consume directly. The deliverable is a working mapping sheet, not a final RPN.
Decomposing the Deployment Function
Use a functional decomposition that separates the electrical decision path from the pyrotechnic/mechanical inflation path, because their failure modes and detection mechanisms differ fundamentally. For a driver frontal airbag module the primary functions are:
- F1 — Crash discrimination: the SDM (airbag control module) classifies the crash event and issues a deployment command within the required time window.
- F2 — Firing path integrity: the initiator (squib) receives the firing current through the clock spring and harness without open or short.
- F3 — Gas generation: the inflator produces the specified gas mass at the specified rate.
- F4 — Cushion formation: the cushion unfolds, fills, and reaches the intended geometry and pressure.
- F5 — Pressure/venting control: venting or adaptive restraint behavior limits occupant loading to the intended level.
Each function maps to failure modes that are observable at the vehicle level — that is the test for a well-formed DFMEA failure mode. "Initiator resistance drift" is a failure cause, not a failure mode; the failure mode is "no deployment" or "late deployment."
Function-to-Failure-Mode Mapping Table
The table below is the core deliverable. Severity and occurrence criteria are stated as criteria (what evidence would place a failure mode in a given band), not as final assigned numbers — those are set in Cases 3 and 4. This keeps the mapping reusable and avoids premature anchoring.
| Function | Failure Mode | Effect at Vehicle Level | Severity Criterion (AIAG-VDA band logic) | Occurrence Criterion (evidence basis) |
|---|---|---|---|---|
| F1 Crash discrimination | No deployment command issued for a valid frontal crash | Occupant unrestrained by airbag; head/chest contact with steering wheel | Very high — potential for life-threatening injury; regulatory non-compliance | Based on SDM algorithm validation coverage and field return rate for missed-deploy events |
| F1 Crash discrimination | Late deployment command (outside timing window) | Cushion not fully inflated at occupant contact; reduced protection | High — increased injury risk, partial regulatory margin loss | Based on timing-margin test data across crash pulse variants |
| F2 Firing path integrity | Open circuit in firing loop (clock spring, connector, squib) | No deployment despite valid command | Very high — same as no-deploy effect | Based on connector/clock-spring durability test and field open-circuit rate |
| F2 Firing path integrity | Inadvertent firing (short to power, EMI-induced) | Uncommanded deployment; occupant startle, injury, loss of control | High — injury risk and customer-perceived safety failure | Based on EMC test results and short-to-power fault injection coverage |
| F3 Gas generation | Partial inflation (insufficient gas mass or rate) | Under-filled cushion; reduced energy absorption | High — degraded protection, possible regulatory margin loss | Based on inflator lot acceptance data and propellant aging test results |
| F3 Gas generation | Over-aggressive inflation (excess gas rate) | Excessive occupant loading; out-of-position injury risk | High — injury risk, especially for small occupants | Based on tank test pressure-curve distribution and OOP test results |
| F4 Cushion formation | Cushion fails to unfold / tether entanglement | Partial or no cushion coverage; occupant contacts structure | High — reduced protection | Based on module pack validation and deployment photography review |
| F5 Pressure/venting control | Vent blocked or stuck closed | Over-pressure in cushion; increased occupant loading | Medium–High — depends on occupant size and position | Based on vent durability and adaptive-restraint calibration data |
Reading the Mapping as a Signal and Energy Chain
The mapping is easier to apply consistently when you see it as a chain: the crash signal must propagate electrically to the squib, then chemically/thermally through the inflator, then mechanically through the cushion. A failure mode is anchored to the stage where the chain breaks or degrades. The SVG below shows this chain with the failure modes attached at their break points, and the two criteria axes (severity driver, occurrence evidence) called out per stage.
Applying the Mapping: A Worked Example
Take the failure mode "late deployment command" under F1. The mapping forces three concrete questions before any rating:
- What is the timing window? For a driver frontal airbag, the cushion must be inflated before the occupant's forward excursion reaches the steering wheel. In a 50 km/h frontal barrier test this is typically on the order of 30–50 ms from impact to full inflation, so the deployment command must be issued early in that window. State the window explicitly in the DFMEA so "late" has a measurable definition.
- What evidence bounds occurrence? Timing margin across crash-pulse variants (full frontal, offset, angular) and across SDM calibration versions. If the calibration has been validated across the pulse matrix with margin, occurrence is low; if margin is thin on offset pulses, occurrence rises.
- What is the severity driver? Late deployment degrades protection but does not eliminate it, so severity sits below no-deploy but remains high because the occupant may contact a partially inflated cushion.
Repeat this for each row. The output is a mapping sheet where every failure mode has a defined timing/performance threshold, an evidence source for occurrence, and a severity rationale tied to injury risk — which is exactly what the rating pass needs.
Common Mapping Errors to Avoid
- Collapsing partial and no-deploy into one row. They have different severity drivers and different occurrence evidence; keep them separate.
- Listing component-level defects as failure modes. "Squib resistance out of spec" is a cause; the failure mode is "no deployment" or "late deployment."
- Omitting inadvertent deployment. It is a deployment-function failure mode with its own severity and occurrence logic, and it is frequently missed when the team focuses only on "did it fire."
- Rating before mapping. Assigning severity numbers during mapping anchors the team and hides gaps; defer numbers to the dedicated rating cases.
Handoff Checklist for the Rating Pass
Before closing this case, confirm the mapping sheet contains, for every failure mode: the parent function (F1–F5), the observable vehicle-level effect, the stage of the signal/energy chain where it occurs, a stated performance or timing threshold that defines the failure, and the evidence source that will support occurrence. With those five fields populated, the severity and occurrence cases can proceed without re-deriving the function structure — and the resulting DFMEA rows will be traceable back to a specific deployment sub-function rather than to a generic "airbag fails" entry.