3. Perform Severity and Occurrence Ranking for Airbag Inflator Failure Modes
Why Inflator S/O Ratings Cannot Be Looked Up
An airbag inflator is a pyrotechnic pressure vessel. Its failure modes sit at the extreme end of the severity scale, and their occurrence rates are governed by process capability, lot-to-lot propellant variation, and field exposure rather than by design intent. Copying a generic "Severity = 10, Occurrence = 3" row from a template produces a rating that cannot survive a design review, a supplier PPAP challenge, or a regulatory audit. The task in this case is to derive S and O for four inflator failure modes — no-deploy, late deploy, over-pressure, and housing rupture — using the AIAG-VDA scales, then calibrate each occurrence rating against field data and recall history so the number is defensible.
Step 1 — Fix the Severity Anchor Before Ranking Anything
AIAG-VDA Severity (S) is scored on the effect on the end user or the vehicle, not on the failure mode itself. For restraint systems the anchor is unambiguous: any effect that compromises occupant protection in a crash, or that creates a hazard independent of a crash, is S = 9–10. The distinction between 9 and 10 is whether the effect is a potential safety hazard without warning (10) or a loss of primary function with warning or degraded protection (9). Apply that rule to each mode:
| Failure mode | Effect at vehicle level | AIAG-VDA S | Rationale |
|---|---|---|---|
| No-deploy | Occupant unrestrained by airbag in a deploy-required event | 10 | Loss of primary safety function, no warning to occupant |
| Late deploy | Bag out of position relative to occupant; OOP injury risk, reduced cushioning | 9 | Degraded protection; timing window missed |
| Over-pressure | Excess bag pressure; increased occupant loading, possible OOP injury | 9 | Degraded protection, injury potential |
| Housing rupture | Fragment ejection into occupant compartment; metal shrapnel hazard | 10 | Hazard independent of crash outcome; potential fatality |
Note that severity is not adjusted for how often the mode occurs. A housing rupture that happens once in ten million inflators is still S = 10. This separation is what makes the occurrence rating the real engineering work.
Step 2 — Build the Occurrence Evidence Base
AIAG-VDA Occurrence (O) is scored on the likelihood that the cause occurs and produces the failure mode, using prevention controls as the primary input and detection only as a secondary modifier. For inflators, the defensible evidence sources are:
- Propellant lot data — burn-rate and mass variation across lots, expressed as Cpk against the deploy-timing window.
- End-of-line (EOL) test rejects — bridge-wire continuity, squib resistance, leak rate, and burst-test results per lot.
- Field return / warranty data — no-deploy and late-deploy claims per vehicle-year, normalized to inflators in service.
- Recall history — NHTSA recall campaigns for inflator rupture (the Takata campaigns are the canonical reference) establish that a "rare" mode can occur at fleet scale when a latent process cause exists.
Convert each source into a rate, then map the rate to the AIAG-VDA O scale. The scale is logarithmic in spirit: O = 10 is ≥ 1 in 10; O = 1 is ≤ 1 in 1,000,000 (with prevention controls proven). The mapping table below is the calibration step — it is what turns raw data into a rating.
Step 3 — Calibrate O Against Field and Recall Data
| Failure mode | Dominant cause | Evidence (example data) | Rate | O |
|---|---|---|---|---|
| No-deploy | Squib/bridge-wire open, connector disengagement | EOL continuity rejects 12 ppm; field no-deploy claims 0.4 per 100k inflators | ~4 × 10⁻⁶ | 3 |
| Late deploy | Propellant burn-rate drift, lot-to-lot mass variation | Burn-rate Cpk = 1.1 against timing window; 2 late-deploy claims per 100k | ~2 × 10⁻⁵ | 4 |
| Over-pressure | Propellant overcharge, filter blockage | Burst-test margin 1.6×; 0 field events in 3 years, but no lot-level Cpk proof | < 1 × 10⁻⁶ (unproven) | 4 |
| Housing rupture | Weld porosity, moisture ingress, propellant degradation | Recall history shows fleet-scale rupture under latent moisture cause; supplier weld Cpk = 0.9 | Latent, not rare | 6 |
Step 4 — Record the Rationale, Not Just the Number
Each S/O cell in the DFMEA worksheet must carry a one-line justification tied to a named evidence source. The pattern is: mode → effect → S anchor → cause → prevention control → evidence rate → O. If any link is missing, the rating is not defensible. The SVG below shows the calibration logic as a signal chain from evidence sources through the rating decision to the worksheet cell, including the housing-rupture override path.
Step 5 — Verification and Common Failure Symptoms
Before releasing the S/O ratings, run three checks. First, severity independence: confirm no S value was lowered because O was low. Second, evidence traceability: every O cell must name a data source and a date range; "engineering judgment" alone is not acceptable for S = 9–10 modes. Third, recall cross-check: for any mode with a known industry recall, confirm the O rating reflects the latent-cause risk, not just the current field rate.
Typical symptoms of a weak rating set, and their fixes:
- All four modes rated O = 2–3 — the analyst used a generic table. Fix: pull actual lot Cpk and field claim rates; expect housing rupture to rise to O = 5–7.
- Housing rupture rated O = 2 because "no field events" — ignores latent moisture/weld cause. Fix: apply the override path; document weld Cpk and recall precedent.
- Late deploy rated S = 7 — severity was discounted for timing rather than effect. Fix: re-anchor to occupant protection loss; S = 9.
- No rationale column populated — rating will not survive review. Fix: one line per cell linking mode → effect → S anchor → cause → evidence → O.