4. Develop Detection Ratings for Seatbelt Pretensioner and Load Limiter Failure Modes
Why Detection Ratings Are the Weakest Link in Restraint DFMEA
In a seatbelt restraint system, the pretensioner and the load limiter are two distinct but coupled safety functions. The pretensioner removes webbing slack within milliseconds of a crash signal; the load limiter then pays out webbing at a controlled force to cap chest loading. Both are pyrotechnic or mechanically irreversible, both are non-repairable in the field, and both are effectively invisible to the occupant until a crash occurs. That combination makes detection the most fragile column in the DFMEA worksheet: a failure mode that produces no symptom during normal driving will only be caught if a deliberate detection control exists and actually exercises the failure path.
Detection ratings (D) in the AIAG-VDA and SAE J1739 frameworks answer one question: how likely is the current design control set to detect the failure mode or its cause before the vehicle leaves the plant, or before the effect reaches the occupant? The scale runs 1 (almost certain detection) to 10 (no detection control; failure is undetectable). The trap in restraint work is that teams routinely assign D = 2–4 because "we have diagnostics" or "we run an end-of-line test," without checking whether that control can physically observe the specific failure mode. This case builds a defensible detection rating for each pretensioner and load-limiter failure mode by auditing the three real control layers and writing the rationale down.
The Three Detection Layers You Must Audit Separately
Before assigning any number, decompose the available controls into three layers, because each layer has a different observation window and a different blind spot.
- End-of-line (EOL) test — executed once at the plant. Typically a resistance/bridge-wire check on the squib circuit, a pretensioner gas-generator continuity measurement, and a functional check of the retractor locking mechanism. It observes electrical integrity and mechanical function at time zero, but it cannot observe degradation, and it cannot observe a load-limiter torsion bar that is dimensionally correct but metallurgically out of spec.
- In-vehicle diagnostics — the airbag control unit (ACU) continuously monitors squib loop resistance, short-to-ground/short-to-battery, and (on some architectures) a pretensioner "ready" status. It observes open/short circuits and some connector faults, but it cannot detect a mechanically seized pretensioner piston, a wrong-force torsion bar, or a load limiter that has been assembled with the wrong webbing payout geometry.
- Validation test coverage — DVP&R sled tests, component-level firing tests, and environmental aging. These observe the failure mode only if the test is designed to provoke it (e.g., a torsion-bar yield test at temperature extremes). Coverage is real only when the test sample, the stimulus, and the acceptance criterion actually map to the failure mode.
The critical discipline is to rate each failure mode against the strongest layer that genuinely observes it, not the strongest layer that exists in the program.
Worked Example: Rating Four Failure Modes
The table below is a teaching example using representative parameters for a pyrotechnic pretensioner with a torsion-bar load limiter. The ratings are illustrative and must be re-derived against the actual program's control plan; they are not measured results.
| Failure mode | Cause | EOL test | In-vehicle diagnostics | Validation coverage | D | Rationale |
|---|---|---|---|---|---|---|
| Pretensioner fails to fire | Squib open circuit / high-resistance bridge wire | Yes — loop resistance vs. spec window | Yes — continuous squib loop monitor | Firing test at temperature | 2 | Two independent electrical layers observe the cause directly; EOL catches assembly defects, diagnostics catch in-service opens. |
| Pretensioner fires late (> target window) | Gas-generator propellant lot variation | No — EOL does not fire the unit | No — timing not observable until deployment | Partial — lot sampling firing test | 7 | Only destructive lot sampling observes timing; a non-sampled lot escapes undetected. Do not rate 3 just because a firing test exists. |
| Load limiter pays out at wrong force (too high) | Torsion bar hardness out of spec | No — dimensional/electrical check only | No — force not observable in service | Yes — torsion-bar yield test with hardness traceability | 5 | Validation observes it, but only on sampled bars; EOL and diagnostics are blind. Rating reflects sampling escape risk. |
| Load limiter seized (no payout) | Webbing jam / guide interference | Partial — retractor spooling check | No | Yes — sled test with payout measurement | 4 | EOL spooling check catches gross jams; sled test catches the rest. Two layers, but neither is continuous. |
Reading the Detection Logic as a Signal Chain
The SVG below maps each failure mode to the control layer that can actually observe it, and shows where the observation window closes. The key visual point is the gap column: failure modes whose cause is only observable by destructive sampling have a wide gap between the control and the escape path, which is exactly what drives the D rating up.
Documenting the Rationale So It Survives Review
A detection rating without a written rationale is an opinion. The DFMEA reviewer, the DVP&R author, and the safety case auditor all need to see which control was credited and why the other layers were not. Use a compact rationale record per row with these fields:
- Failure mode and cause — copied verbatim from the worksheet so the rationale cannot drift.
- Credited control(s) — name the specific test or diagnostic, not the category. "EOL squib loop resistance check, spec 1.8–2.6 Ω" beats "EOL test."
- Observation window — when the control runs (100% of units at EOL, continuous in service, sampled per lot, one-time DVP&R).
- Escape path — what a defective unit looks like if the control misses it. This is the sentence that justifies a high D.
- Rejected controls — explicitly state which layers were considered and why they do not observe the cause. This is what prevents the next engineer from "upgrading" the rating later.
For the "pretensioner fires late" row, the rationale record reads: credited control = quarterly lot firing test (sampled, not 100%); observation window = one lot per quarter; escape path = an out-of-spec propellant lot ships and deploys late in a crash, producing increased occupant excursion; rejected controls = EOL (does not fire the unit) and diagnostics (timing not observable until deployment). That record makes D = 7 defensible and blocks the optimistic D = 3 that a reviewer might otherwise push for.
Quick Reference: Detection Rating Decision Card
| If the credited control is… | …and it observes the cause on… | Typical D band |
|---|---|---|
| 100% EOL functional/electrical test | Every unit, at time zero | 2–3 |
| Continuous in-vehicle diagnostic | Every unit, in service | 2–4 |
| EOL test + diagnostic, independent | Every unit, two windows | 1–2 |
| DVP&R validation test, 100% design coverage | Design, not production units | 4–5 |
| Lot sampling / destructive test | Sampled units only | 6–8 |
| No control observes the cause | — | 9–10 |
Apply the card as a sanity check, not a lookup: the rationale record is the authoritative source, and any rating that disagrees with the card must explain why in the rejected-controls field. When the pretensioner and load-limiter rows are rated this way, the resulting D values feed directly into the action-priority (AP) calculation and into the DVP&R test-case selection in the next stage of the workflow, ensuring that high-AP rows are backed by verification activities that actually exercise the failure mode rather than merely existing on paper.