2. Airbag and seatbelt system architecture

Before any design change can be assessed with DRBFM, the assessor must be able to trace a complete causal path from a sensing event to a physical restraint action, and to identify every interface that path crosses. An airbag and seatbelt system is not a single subsystem but a coordinated set of sensors, an electronic control unit (ECU), initiators, gas generators, mechanical restraint hardware, and the wiring that binds them. A change to any one element propagates along this chain, and the risk of that propagation is exactly what DRBFM is designed to expose.

Key components and their functional roles

The restraint system can be grouped into four functional layers. The sensing layer contains frontal and side accelerometers, pressure sensors in the door cavity for side impact detection, seat occupancy and occupant classification sensors, seatbelt buckle switches, and seat position or weight sensors. The decision layer is the airbag control unit, which hosts the crash algorithm, safing logic, backup power, and the firing drivers. The actuation layer comprises the inflators (pyrotechnic, hybrid, or stored-gas), the airbag cushions and their venting, the seatbelt pretensioners (pyrotechnic or motorized), and load limiters. The structural and interface layer includes the clock spring for the driver airbag, the wiring harness and connectors, the grounding architecture, and the mounting brackets that define how each actuator is coupled to the vehicle body.

Each component carries a design specification that DRBFM treats as a set of functions and requirements. For example, a frontal inflator has a specified gas mass flow versus time, a peak pressure envelope, a burst pressure margin, and an operating temperature range. A pretensioner has a stroke, a force–stroke characteristic, and a trigger threshold. These are the quantities that a design change is most likely to disturb.

The deployment chain as a signal and energy path

Deployment is best understood as two parallel chains: a signal chain that carries information, and an energy chain that carries the force and gas needed to restrain the occupant. The signal chain begins at the accelerometer, whose analog output is filtered and digitized inside the ECU. The crash algorithm integrates and compares the signal against calibrated thresholds; a safing sensor provides an independent confirmation path so that a single faulty sensor cannot trigger deployment. Only when both the main and safing conditions are satisfied does the ECU close the firing driver, sending a current pulse to the initiator.

The energy chain begins at that initiator. The firing current heats a bridge wire or foil, igniting the primary charge, which in turn ignites the gas generant. The inflator produces gas that fills the cushion, while the pretensioner pyrotechnic charge drives a piston or rotary mechanism that retracts the belt. The two chains are coupled in time: the belt pretensioner is typically fired a few milliseconds before or simultaneously with the frontal airbag, and the load limiter then allows controlled belt payout as the occupant loads the belt.

Sensor-to-actuator interfaces and why they dominate change risk

Three interfaces deserve particular attention during a design change assessment. Interface A is the ECU-to-initiator connection: the firing loop has a specified resistance window (commonly on the order of 1.5–3.0 Ω for a single initiator, with the exact value defined by the squib specification), and the ECU performs a continuous loop-resistance check to detect open or short circuits. A change to connector type, wire gauge, or harness routing alters loop resistance and can push the diagnostic out of its valid window, producing a false fault or masking a real one. Interface B is the sensor-to-ECU path, where shielding, grounding, and harness length affect signal integrity; a change in grounding strategy can shift the accelerometer's zero-g offset and bias the crash algorithm. Interface C is the inflator-to-module and module-to-body interface, where mounting stiffness, sealing, and vent geometry determine how the cushion deploys and how the reaction force is transferred to the structure.

For DRBFM, each interface is a place where a change in one component's design characteristic can create a failure mode in another component's function. A new inflator with a different gas mass flow changes cushion fill time, which changes occupant loading, which changes the required load-limiter characteristic. The interface is where the coupling lives, and the assessment must name it explicitly.

Safety performance requirements relevant to design changes

Restraint performance is judged against regulatory and consumer-test requirements, and against the OEM's internal specifications. The most relevant categories are: frontal occupant protection in rigid-barrier and offset deformable-barrier tests; side impact pole and barrier tests; out-of-position occupant protection, particularly for the passenger airbag; child restraint interaction; and the no-fire and must-fire requirements that define the deployment envelope. Each requirement maps to a measurable quantity — head injury criterion, chest deflection, neck load, belt force, and airbag pressure — and each of those quantities is sensitive to specific design parameters.

Working example: tracing a change through the chain

Consider a proposed change from a 2.0 Ω initiator to a 2.6 Ω initiator in the driver airbag loop, with the ECU's diagnostic window set at 1.5–3.0 Ω. The nominal loop resistance rises from, say, 2.4 Ω to 3.0 Ω, which sits exactly at the upper diagnostic limit. A DRBFM assessment would proceed as follows. First, define the change precisely: the initiator's bridge resistance and its all-fire current. Second, identify the affected functions: firing current delivery, loop diagnostics, and EMC immunity. Third, for each function, ask what could go wrong — the firing current may fall below the all-fire threshold at low supply voltage, or the diagnostic may flag a false open circuit at high temperature where resistance rises further. Fourth, quantify: compute the firing current at the minimum supply voltage (for example, 9 V) with the new loop resistance, and compare it against the initiator's all-fire current with margin. Fifth, verify by bench test: measure loop resistance across the temperature range and confirm the diagnostic stays within its window, then confirm firing at the worst-case voltage.

The architecture described here is the reference against which every subsequent DRBFM worksheet is built. Once the assessor can name the component, the interface it crosses, the function it serves, and the requirement it must meet, the change can be decomposed into specific design characteristics and their potential failure modes — which is the subject of the next stage of the method.