4. Occurrence and Detection Rating for Inflator and Sensor Interfaces

Scope of the Rating Task

This case assigns Occurrence (O) and Detection (D) ratings to the failure modes that sit on the two electrical interfaces of a frontal airbag deployment chain: the inflator initiator (squib) interface and the crash sensor interface. Severity was fixed in the previous case; here we must justify O and D with evidence rather than intuition. The AIAG-VDA DFMEA framework expects occurrence to be derived from field and validation data (not from a subjective "how likely does it feel" judgement), and detection to be derived from the effectiveness of the current design controls — the detection measures that exist in the design today, before any recommended action.

Two interface families are in scope:

• Initiator interface — squib pins, the shorting clip, the connector position assurance (CPA) feature, and the firing-loop continuity path monitored by the airbag ECU.
• Crash sensor interface — the sensor signal and return lines, the sensor supply, the communication bus (for satellite/PSI5 or CAN-based sensors), and the plausibility/safing logic that consumes them.

The failure modes carried forward are: open firing loop (no deployment), inadvertent firing-loop closure (uncommanded deployment), loss of sensor signal (no or late deployment), and corrupted sensor signal (wrong deployment decision).

Occurrence: From Data to a Rank

Occurrence is the likelihood that the cause occurs and produces the failure mode during the design life, given the design as released. The practical workflow is to convert whatever evidence exists into a common frequency basis, then map that frequency to the AIAG-VDA occurrence table (1 = eliminated, 10 = extremely high).

Use a consistent exposure denominator. For a vehicle fleet, incidents per vehicle-year is convenient; for validation, failures per test sample or per test cycle. Convert field incidents to a rate before ranking:

occurrence_rate = incidents / (vehicles_in_field × years_in_service)

Example (illustrative data, not measured):
  open firing loop:      3 incidents / (120,000 vehicles × 3 yr) = 8.3 ppm/vehicle-yr
  loss of sensor signal: 11 incidents / (120,000 vehicles × 3 yr) = 30.6 ppm/vehicle-yr
  inadvertent closure:   0 incidents / (120,000 vehicles × 3 yr) = 0 observed

Zero observed incidents is not occurrence 1. Apply the rule of three for a 95% upper bound when no events are seen in n exposures: upper bound ≈ 3/n. With 360,000 vehicle-years of exposure, the inadvertent-closure upper bound is about 8.3 ppm/vehicle-yr — the same order as the observed open-loop rate. This prevents the classic error of rating an unobserved failure mode as "impossible".

Validation data supplements field data and often dominates for low-exposure modes. A design validation (DV) test that runs 60 samples through thermal shock, vibration, and connector mating cycles with zero open-loop failures gives an upper bound of 3/60 = 5% per sample under those stresses — useful for ranking the cause (e.g., pin fretting) even though it does not translate directly to field ppm. Where a validated accelerated test exists, state the acceleration assumption explicitly; if it is not defensible, use the test result only to compare causes, not to claim a field rate.

Map the resulting rate to the occurrence table using the anchor bands, and record the evidence next to the rank so the rating is auditable:

Detection: Rating the Current Controls

Detection is rated on the ability of the current design controls to detect the cause or failure mode before the vehicle is delivered or before the effect occurs. For these interfaces the controls fall into three tiers, and the tier drives the D rank:

1. Continuous electrical monitoring in the ECU — firing-loop continuity and squib resistance windows, sensor supply and signal-range checks, and bus CRC/timeout supervision. These run every ignition cycle and can set a diagnostic trouble code (DTC) and, for some faults, inhibit deployment.
2. Plausibility and safing logic — cross-checks between sensor channels and the safing sensor that gate the firing decision. This detects corrupted signals at the decision level, not at the wire level.
3. End-of-line (EOL) and DV test only — connector pull-force, continuity, and EMC tests that catch a cause at the plant or in the lab but not in service.

A cause caught by continuous monitoring with a defined resistance window and a DTC is a strong detection control (low D, typically 2–3). A cause caught only by EOL continuity is a moderate control (D around 5–6). A cause with no in-service detection and only a lab test is weak (D 7–8). The inadvertent-closure cause is the hardest: the shorting clip is a prevention feature, not a detection feature, and chafe-to-ground may only be revealed by the continuity monitor — so its detection depends entirely on whether the monitor's window is tight enough to flag a partial short before it becomes a full closure.

Consistency Checks Before Release

Before the O and D ranks are entered into the DFMEA, run three checks that catch the most common rating errors on these interfaces:

• Detection must reference a control that exists in the released design. If the only detection is a proposed test, the D rank must reflect the current state (weak), and the proposed test becomes a recommended action — not a justification for a low D.
• Prevention is not detection. The shorting clip, CPA, and twisted-pair routing reduce occurrence; they do not detect anything. Do not let a prevention feature lower the D rank.
• Occurrence and detection must not double-count the same evidence. A field rate already reflects the effect of the current controls on how often the failure reaches the customer; use it for O, and use the control's diagnostic capability for D, without crediting the same monitor twice.

Deliverable: Rating Justification Record

The following record is the working output of this case. It is structured so each rating can be traced to its evidence and reviewed independently.

Repeat this record for each of the five causes in the SVG. The completed set gives a defensible O/D pair for every interface failure mode, with the evidence and the current control stated explicitly so that a reviewer can challenge the rank without re-deriving the data.