1. DRBFM fundamentals for airbag and seatbelt systems

Design Review Based on Failure Mode (DRBFM) is a structured engineering method for evaluating the risk introduced when a proven design is changed. Rather than auditing an entire product from scratch, DRBFM concentrates engineering attention on the change points — the specific geometry, material, process, interface, or requirement that differs from a validated baseline — and asks a disciplined sequence of questions about each one: what function does this element perform, what could go wrong because of the change, what is the effect on the customer, and what evidence proves the risk is controlled. For airbag and seatbelt systems, this focus is not a convenience; it is a safety necessity.

Definition and Scope

DRBFM is best understood as a change-point risk assessment layered on top of a functional model of the product. It originated within Toyota's design-quality framework, where it was used to prevent recurrence of design problems by forcing engineers to reason explicitly about how a modification perturbs a previously stable design. The method is closely related to GD³ (Good Design, Good Discussion, Good Dissection) and to the Failure Mode and Effects Analysis (FMEA) family, but it differs in emphasis: FMEA tends to enumerate failure modes across a whole system, while DRBFM starts from the delta and works outward to the affected functions and interfaces.

In restraint systems, the "design" under review is rarely a single part. An airbag module comprises the inflator, housing, cushion, cover, retainer, wiring, and mounting strategy; a seatbelt system comprises the retractor, webbing, tongue, buckle, anchor, pretensioner, and load limiter. A change to any one of these — a new inflator output curve, a revised tear seam, a different webbing weave, a relocated buckle stalk — propagates through interfaces and can alter occupant kinematics in ways that are not obvious from the changed part alone. DRBFM's scope therefore must include the changed item, every interface it touches, and the downstream functions those interfaces serve.

Why Change-Point Risk Assessment Is Critical Here

Restraint systems are safety-critical and largely irreversible in the field. An airbag that deploys with excessive or insufficient pressure, a seatbelt that fails to lock or releases under load, or a pretensioner that fires out of sequence can cause injury rather than prevent it. Three properties make change-point assessment especially important:

  • Latent, non-obvious coupling. A cushion fabric change may alter fold-pack density, which changes deployment timing, which changes out-of-position occupant loading. The causal chain crosses several subsystems and is invisible in a part-level drawing review.
  • Validation cost and sample sensitivity. Sled tests, static deployment tests, and component-level inflator tests are expensive and statistical. A change that shifts a response by a small margin may pass a limited sample yet fail in the field; DRBFM forces the team to state the margin and the evidence before testing, not after.
  • Regulatory and traceability obligations. Changes affecting compliance (FMVSS 208, FMVSS 209/210, ECE R94/R16) require documented justification. DRBFM produces that justification as a by-product of the review.
DRBFM is not a replacement for FMEA or for physical validation. It is the front-end reasoning layer that decides where validation effort should be concentrated and what the acceptance criteria must demonstrate.

The Core Reasoning Loop

Each change point is processed through a compact but rigorous loop. The engineer first restates the function the element and its interfaces must deliver, in measurable terms where possible (for example, "restrain a 50th-percentile male occupant with chest deflection below the injury criterion at 56 km/h frontal impact"). Next, the change is described precisely — what was, what is now, and why. The team then asks what failure modes the change could introduce or worsen, tracing each to an effect on the occupant or on system function. Finally, each credible failure mode is assigned a verification action with a defined method, sample, and pass criterion, and a responsible owner.

The discipline that distinguishes DRBFM from a general brainstorming session is the insistence on evidence before conclusion. A failure mode is not closed because the team believes it is unlikely; it is closed when a specified test, analysis, or inspection demonstrates control, or when the risk is formally accepted with rationale.

DRBFM change-point reasoning loop for a seatbelt retractor change Diagram showing a baseline design, a change point, affected interfaces, failure modes, effects, and verification actions with pass criteria. Change-Point Reasoning Loop — Example: Retractor Load-Limiter Revision Baseline Design Validated retractor, torsion-bar load limiter Change Point Torsion-bar diameter reduced 3.2 → 3.0 mm Affected Interfaces Spool, webbing tension, buckle load path Function Limit chest load ≤ target Failure Modes • Load limit too low → excessive excursion • Bar yield scatter → inconsistent force curve Effects • Increased forward excursion, contact risk • Chest deflection outside target band Verification Actions • Sled test, 3 samples, chest deflection ≤ limit • Component force-curve band check, n = 10 Closure Decision Pass criteria met → close change point Not met → redesign or formal risk acceptance

Working the Loop: A Concrete Example

Consider a retractor load-limiter revision in which the torsion-bar diameter is reduced from 3.2 mm to 3.0 mm to lower chest loading for a small occupant. The change point is the bar diameter; the affected interfaces are the spool, the webbing tension path, and the buckle/anchor load path. The function to preserve is "limit chest load to the target band while keeping forward excursion within the packaging allowance."

A credible failure mode is that the reduced bar yields earlier and with greater scatter, producing a force curve that falls below the lower band for some samples. The effect is increased forward excursion and possible contact with the steering wheel or instrument panel. The verification action is a component-level force-curve test on ten samples, checking that the plateau force stays within the band, plus a sled test on three samples confirming chest deflection and excursion. The pass criterion is stated numerically before testing. If the component test shows the plateau drifting low, the team does not proceed to sled testing; it revises the bar specification or the heat treatment and re-runs the loop.

Practical Guidance for Restraint Engineers

  • Describe the change in engineering terms, not change-request terms. "Bar diameter 3.2 → 3.0 mm, material unchanged" is reviewable; "optimize load limiter" is not.
  • Trace interfaces explicitly. List every mating part, fastener, connector, and software calibration that the change touches, and confirm each is either unaffected or assessed.
  • State pass criteria before testing. A criterion written after the data arrives is not a criterion; it is a rationalization.
  • Record the rationale for accepted risks. When a failure mode is judged acceptable, document the analysis, the margin, and the approving authority.
A common failure pattern in DRBFM reviews is treating the change as isolated. If the review does not name the interfaces and the downstream functions, it will miss the coupling effects that matter most in restraint systems — deployment timing, occupant kinematics, and load-path redistribution.

DRBFM's value in airbag and seatbelt work comes from its narrowness. By forcing the team to reason from a specific change through its interfaces to occupant-level effects, and by requiring evidence before closure, it converts a vague "review the change" into a traceable, testable argument that the modified restraint system remains safe.

← Previous 📖 Contents Next →