3. Crashworthiness requirements decomposition

A vehicle-level safety target such as "meet FMVSS 208 unbelted occupant protection for the 50th-percentile male at 35 mph frontal barrier impact" is a statement of intent, not a test. Between that intent and a DVP&R entry that a technician can actually execute lies a decomposition chain: target → requirement → performance attribute → measurable parameter → test method → acceptance criterion. Each link must preserve traceability, and each link must be expressed in units, coordinates, and boundary conditions that a test engineer can reproduce without interpretation. This chapter shows how to perform that decomposition systematically and how to write the resulting DVP&R rows so they are verifiable rather than aspirational.

From regulatory intent to engineering requirement

Decomposition starts by separating what the regulation or internal target demands from what the vehicle must do physically to satisfy it. A regulation typically specifies a test configuration (barrier type, impact speed, dummy type, seating position, belt usage), a measurement (head injury criterion, chest deflection, femur load, intrusion), and a limit. The engineering requirement restates this as a design-controllable quantity with a margin. For example, FMVSS 208 limits HIC₁₅ to 700 for the driver in the 35 mph frontal rigid barrier test; an internal target of HIC₁₅ ≤ 560 (a 20% margin) becomes the requirement that flows into CAE correlation, restraint tuning, and finally the physical DVP&R entry.

Two conventions must be fixed before any number is written down, because they propagate through every downstream entry. First, the coordinate system: ISO 4130 vehicle coordinates (X forward, Y left, Z up, origin at the front axle centerline ground point) should be stated explicitly, and any occupant-relative measurement (e.g., chest deflection along the sternum-to-spine axis) must name its own local frame. Second, the sign convention for loads and accelerations: positive X acceleration is forward, positive chest deflection is toward the spine (compression). A DVP&R entry that omits these is not verifiable, because two labs can produce different signs from the same physical event.

The decomposition chain in practice

The figure below shows the decomposition for a frontal crashworthiness target, from the regulatory limit down to individual DVP&R entries with their measurement channels and acceptance criteria. Note that one vehicle target fans out into several entries at different levels — sled, subsystem, and full-vehicle — because each level verifies a different part of the physics.

Vehicle Safety Target FMVSS 208 frontal, 35 mph rigid barrier, 50M unbelted Occupant Kinematics Req. Head excursion ≤ 620 mm (target, 20% margin) Injury Metric Req. HIC₁₅ ≤ 560, chest defl. ≤ 50 mm femur load ≤ 7.0 kN Structure Req. Toe pan intrusion ≤ 120 mm Steering column rearward ≤ 90 mm DVP&R Entry — Sled Test: 35 mph frontal sled, 50M Channel: head CG accel (SAE J211 CFC 1000) Criterion: HIC₁₅ ≤ 560 Sample: n=3, all pass Owner: Restraint CAE / Test DVP&R Entry — Full Vehicle Test: 35 mph rigid barrier, 50M unbelted Channel: head CG, chest pot, femur load cell Criterion: HIC₁₅ ≤ 560, chest ≤ 50 mm Sample: n=2, both pass Owner: Vehicle Test DVP&R Entry — Structure Test: barrier impact, intrusion measurement Channel: string pot at toe pan, column Criterion: toe pan ≤ 120 mm, column ≤ 90 mm Sample: n=2, both pass Owner: Body Structure Verification Evidence & Traceability • Each entry links to a requirement ID and a CAE correlation case (same boundary conditions, same channels). • Pass/fail recorded per sample; margin tracked against target, not just against the regulatory limit. • Any deviation opens a corrective action with re-test scope defined before sign-off.

Writing the DVP&R row so it can be executed

A verifiable entry needs six fields that are often left vague. Consider the sled entry from the figure and how each field is made concrete:

  • Test configuration: "35 mph frontal sled, pulse per vehicle CAE correlation case FC-208-50M-01, 50th-percentile male Hybrid III, unbelted, seat at design position." The pulse must be referenced by document number, not described as "the standard pulse."
  • Measurement channel: "Head CG triaxial accelerometer, SAE J211 CFC 1000, sampled at 10 kHz, filtered per J211/1." Naming the filter class matters because HIC is sensitive to it.
  • Acceptance criterion: "HIC₁₅ ≤ 560 for each of three valid tests." State whether the criterion is per-sample or on the mean, and define "valid" (e.g., no channel clipping, pulse within ±3% of target).
  • Sample size and pass rule: "n = 3; all three must pass." A mean-based rule with n = 3 hides a single outlier that would fail in production.
  • Prerequisite / entry condition: "CAE correlation case within 10% on HIC and 15% on chest deflection before sled test is released." This prevents burning hardware on an uncorrelated model.
  • Owner and evidence location: "Restraint CAE / Test; report filed under DVP&R ID CR-208-SL-003."

The same discipline applies to the structure entry. "Toe pan intrusion ≤ 120 mm" is only verifiable if the measurement point is defined: a string potentiometer mounted at the toe pan centerline, referenced to the undeformed body, measured at maximum dynamic intrusion (not residual). If the entry says "intrusion" without specifying dynamic versus residual, two labs will report different numbers and the pass/fail will be ambiguous.

Handling the fan-out: one target, several entries

The decomposition in the figure deliberately produces three entries from one vehicle target. This is not redundancy; each entry verifies a different failure mode and a different part of the physics. The sled entry isolates the restraint system with a known pulse, so a HIC failure points at the airbag or belt. The full-vehicle entry captures the interaction between structure and restraint, so a HIC failure there with a passing sled points at intrusion or pulse shape. The structure entry isolates the body. When a full-vehicle test fails, the pattern of which lower-level entries passed tells the engineer where to look — this is the practical value of decomposing rather than writing a single "meets FMVSS 208" row.

A useful check before releasing any DVP&R row: hand it to a test engineer who has not seen the requirement. If they can set up the test, choose the channel, and state the pass/fail without asking a question, the row is verifiable. If they ask "which pulse?" or "dynamic or residual?", the row is still a target, not a requirement.

Common decomposition failures

Three failure patterns recur in crashworthiness DVP&R plans. The first is criterion drift: the regulatory limit (HIC₁₅ ≤ 700) is copied directly into the DVP&R row, so the plan verifies compliance but not the internal margin, and a vehicle that passes at 690 looks acceptable until a production variation pushes it over. The second is channel ambiguity: "chest deflection" without specifying the measurement axis or the potentiometer mounting, which produces lab-to-lab scatter larger than the margin. The third is missing entry conditions: a sled test released before CAE correlation, so the test result cannot be used to validate the model and the model cannot be used to explain the test. Each is fixed at the decomposition stage, not at the test stage.

Decomposition is therefore the quality gate of the whole DVP&R. A target that cannot be traced to a configuration, a channel, a criterion, a sample rule, and an owner is not yet a requirement — and a DVP&R built on such targets will produce reports that cannot be defended in a design review or a regulatory submission.

← Previous 📖 Contents Next →