3. Change categorization and triggers in restraint systems
In DRBFM, the value of a change classification is not administrative neatness — it is the amount of design-review rigor the change is allowed to consume. A restraint system that treats every revision as "minor" will eventually ship a safety-critical deviation with a two-line review record; a system that escalates everything to full cross-functional review will collapse under its own weight and, worse, train engineers to route around it. The practical task of this chapter is to build a defensible, repeatable rule set that separates minor, major, and safety-critical changes across the four dominant restraint hardware families: airbag modules, seatbelt retractors, buckles, and anchoring structures.
What the three classes actually mean
The classification must be tied to two independent axes: whether the change can alter the deployed restraint performance or the occupant's protection envelope, and whether the change touches a validated interface or a certified characteristic. A change that moves neither axis is minor. A change that moves one axis in a bounded, well-understood way is major. A change that can move either axis in a way that is not fully characterized by existing validation evidence is safety-critical.
- Minor change — no effect on restraint function, timing, force level, geometry of the occupant interaction surface, or any homologated/certified characteristic. Existing validation evidence remains valid without re-test. Example: a colorant change in an airbag module housing that is not in the occupant path, or a supplier change of a retractor's internal return spring with identical load-deflection and fatigue life, verified by component-level equivalence data.
- Major change — a bounded change to a non-certified characteristic or to a validated interface, where the effect is predictable and can be closed by targeted verification (component test, sub-system test, or analysis) rather than full system re-validation. Example: a 10% increase in retractor spool diameter with unchanged webbing and geometry envelope, requiring re-verification of spool strength and lock timing but not a full sled matrix.
- Safety-critical change — any change that can alter occupant kinematics, deployment timing, restraint force limiting, buckle release force, anchor load path, or a certified/homologated characteristic, or that invalidates the assumptions of the existing validation evidence. Example: a change to the airbag inflator output curve, a change to the buckle release-force spring rate, or a change to anchor bolt grade or weld schedule.
Triggers by component family
The classification is only as good as the trigger list behind it. The table below is a working trigger set — the kind of thing that should sit in the DRBFM worksheet header so that an engineer cannot quietly reclassify a change by describing it differently.
| Component family | Typical minor triggers | Typical major triggers | Safety-critical triggers |
|---|---|---|---|
| Airbag module | Housing colorant, non-occupant-path label, connector keying with identical pinout | Module mounting bracket stiffness change within validated envelope; cover tear-seam geometry tweak verified by component burst test | Inflator output/pressure curve, gas generant lot change without equivalence data, cover tear-seam change affecting deployment timing, module position relative to occupant |
| Seatbelt retractor | Return-spring supplier with equivalent load-deflection; non-structural housing rib | Spool diameter change; webbing thickness change within validated range; lock pawl material substitution with equivalent hardness | Lock timing, load-limiter torsion bar rate or profile, pretensioner charge or stroke, webbing strength/elongation grade |
| Buckle | Buckle housing colorant; non-functional trim | Release-button travel change within validated range; latch spring rate change verified by release-force test | Release force outside validated band, latch engagement depth, buckle stalk length/angle, anti-submarine geometry |
| Anchoring structure | Fastener coating; non-structural bracket hole position within tolerance | Anchor bracket thickness change within validated load path; weld schedule change verified by pull test | Anchor bolt grade, weld schedule affecting load path, anchor position change, floor-pan reinforcement change, any change to the certified anchorage strength |
Two rules keep this table honest. First, a change is classified by its worst credible effect, not by its intent. A "cosmetic" cover change that alters tear-seam initiation is safety-critical regardless of how it was requested. Second, classification is a property of the change-plus-context pair. The same spool diameter increase is major on a retractor with generous margin and safety-critical on one already at the load-limiter limit. The DRBFM worksheet must therefore record the baseline configuration and the margin state, not just the delta.
Applying the rule set: a worked example
Consider a retractor change: the spool diameter is increased from 28 mm to 30 mm to improve packaging, with webbing, housing envelope, and lock mechanism unchanged. The engineer's first instinct is "major." The DRBFM review should test that instinct against the trigger list and the margin state.
- Identify the affected characteristics. Spool diameter affects webbing pack radius, extraction force, lock-pawl engagement geometry, and — critically — the effective radius at which the load limiter acts. If the load limiter is a torsion bar inside the spool, the torque-to-force relationship changes with radius.
- Check the margin state. If the baseline load-limiter force is 4.0 kN ± 0.3 kN and the radius change scales force by 30/28 ≈ 1.07, the predicted force moves to ≈ 4.28 kN — outside the validated band. That single calculation reclassifies the change from major to safety-critical, because the certified force-limiting characteristic is no longer covered by existing evidence.
- Record the evidence gap. The DRBFM worksheet should state: "Existing sled and component evidence does not cover load-limiter force at 30 mm spool; re-validation of force-limiting characteristic required."
- Define the closure path. Component-level force-limiting test at the new radius, plus a targeted sled run at the worst-case occupant size, before the change can be downgraded.
This is the core discipline: the classification is not a label applied after the fact — it is the output of a short, explicit engineering check that either confirms the existing evidence still applies or names the gap.
Where classification goes wrong
The most common failure is classification drift: a change is described in the language of the smallest plausible effect ("minor bracket tweak") while the actual delta is larger. The second is context blindness: the same delta classified differently on two programs because the margin states differ, but the worksheet records only the delta. The third is trigger omission: a component family has no trigger for a characteristic that later turns out to matter — for example, no trigger for buckle stalk angle, so a 5° change passes as minor and later shows up as a release-force deviation in a sled test.
The countermeasure is structural, not motivational. Every DRBFM worksheet should carry the trigger table for its component family, a mandatory margin-state field, and a sign-off line where the reviewer confirms the classification against the worst credible effect rather than the stated intent. The SVG below shows how the classification decision and its evidence gap feed the review depth.
Recording the classification so it survives review
A classification that lives only in a meeting is not a control. The DRBFM worksheet should carry, for each change, a compact record with four fields: the change description in physical terms (dimension, material, supplier, process), the affected characteristic and its baseline margin, the classification with the trigger that drove it, and the evidence status (covered / gap named / re-validation required). The worked retractor example would read: spool diameter 28→30 mm; affected characteristic load-limiter force, baseline 4.0 ± 0.3 kN, predicted 4.28 kN; classified safety-critical by certified-characteristic trigger; evidence gap — force-limiting characteristic not covered at new radius; closure — component force test + targeted sled.
That record is what makes the classification auditable. It also makes the escalation defensible: when a program manager asks why a 2 mm diameter change triggered a sled test, the answer is a number, not an opinion. And when the same change appears on a second program with a different margin state, the record shows immediately that the earlier classification cannot simply be copied across.
The classification discipline described here is the input to everything that follows in the DRBFM workflow: the depth of the function–failure analysis, the choice of verification method, and the sign-off authority all derive from the class assigned at this step. Getting the class right — and recording why — is the cheapest risk reduction available in the entire change process.