2. System boundary definition

A DFMEA is only as trustworthy as the boundary it is built on. Before a single failure mode is written, the team must agree on exactly which hardware, interfaces, and functions fall inside the analysis scope and which are handled by other documents. For a seatbelt retractor with pretensioner and load limiter, the boundary question is deceptively difficult: the retractor is a mechanical assembly, the pretensioner is a pyrotechnic actuator, the load limiter is a force-limiting mechanism, and all three share structure, sensing lines, and fasteners with the seat frame, buckle, and vehicle electrical system. If the boundary is drawn too loosely, the DFMEA becomes a vehicle-level hazard analysis; if drawn too tightly, critical interface failures disappear between documents.

Defining the item under analysis

The recommended approach is to define the item as the complete retractor assembly as delivered to the seat or vehicle plant, including the spool, frame, locking mechanism, webbing guide, pretensioner module, and load limiter element, plus the electrical connector and mounting features that are part of that part number. Everything the assembly physically contains is in scope. Everything it merely touches is an interface, and interfaces are analyzed as boundary characteristics rather than as separate items.

A practical way to fix the boundary is to anchor it to three artifacts that already exist in the program: the part drawing and bill of materials, the interface control document (ICD) or seat-to-vehicle interface agreement, and the system-level safety concept. The BOM gives the physical extent; the ICD gives the mating surfaces, fastener specifications, and electrical pinout; the safety concept gives the functional allocation, for example whether pretensioner firing is commanded by the airbag ECU or by a dedicated restraint controller. The DFMEA boundary statement should cite all three, because a boundary that contradicts the ICD will produce failure modes that the design team cannot act on.

Functional decomposition inside the boundary

Within the item, four functional blocks are normally distinguished, and each carries its own failure behavior:

• Retractor structure and spool: houses the webbing, provides controlled payout and retraction, and carries the reaction loads during locking. Its failure modes are typically structural (frame deformation, spool fracture) or functional (failure to retract, excess extraction force).
• Locking mechanism: senses webbing acceleration and vehicle deceleration and locks the spool. It is a state machine with distinct unlocked, locked, and blocked states, and its failure modes include failure to lock, premature lock, and false lock during normal driving.
• Pretensioner: a pyrotechnic or motor-driven actuator that removes slack in the webbing early in a crash. Its failure modes are dominated by no-fire, delayed fire, and over-retraction, and it introduces a pyrotechnic hazard that must be treated explicitly in the DFMEA.
• Load limiter: a force-limiting element, typically a torsion bar, a tearing stitch, or a friction clutch, that allows controlled webbing payout above a threshold force to limit chest loading. Its failure modes are failure to limit (excessive force transmitted to the occupant) and premature or excessive limiting (excess forward excursion).

The interaction between pretensioner and load limiter deserves special attention at the boundary stage, because the two functions act in sequence and share the same load path. The pretensioner must pull slack before the load limiter begins to pay out; if the load limiter yields too early, pretensioner effectiveness is lost, and if it yields too late, the occupant experiences excessive chest force. This is a timing and force-threshold relationship, not a simple component property, and it must be captured as an interface characteristic inside the boundary.

Interfaces and boundary characteristics

Each arrow crossing the dashed boundary in the figure represents an interface that must be described in the DFMEA with concrete, verifiable characteristics. The most consequential interfaces for this item are:

Note that the pretensioner-to-load-limiter row is an internal interface, yet it is treated with the same rigor as an external one. This is a deliberate boundary decision: the two functions are physically separate parts but functionally inseparable, so the DFMEA must analyze their interaction even though both sit inside the item.

What stays outside the boundary

Equally important is an explicit out-of-scope list, because it prevents duplicated or contradictory analysis across documents. For this item, the following are normally excluded and referenced to their owning DFMEA or hazard analysis: the seat structure and its attachment to the floor, the buckle and its anchor, the airbag and its deployment logic, the occupant classification system, and the vehicle wiring harness beyond the retractor connector. The DFMEA should state these exclusions with a reference to the document that covers them, so a reviewer can trace the allocation rather than assume an omission.

Boundary statement as a working deliverable

The boundary should be recorded as a short, reviewable statement at the front of the DFMEA, not left implicit in the team's understanding. A workable format includes the item name and part number, the revision level analyzed, the included sub-assemblies, the excluded items with references, the interface list with characteristic specifications, and the operating and environmental conditions assumed (for example, temperature range, supply voltage, and crash pulse class). The following excerpt illustrates the level of specificity expected:

Item: Retractor assembly, P/N 8R2-857-101-C, rev C
In scope: spool, frame, locking mechanism, pretensioner module,
          torsion-bar load limiter, connector, mounting bosses
Out of scope: seat frame (DFMEA SEAT-014), buckle (BKL-007),
              airbag module (ABM-022), harness beyond connector
Interfaces:
  - Seat frame: 2 x M10 grade 10.9, 45 Nm, hole pitch 180 mm
  - ECU: 2-pin sealed connector, loop resistance 1.8-2.6 ohm at 20 C
  - Power: 9-16 V operating, ground return via seat frame
  - Webbing: 48 mm width, routing per ICD figure 4
Internal interface: pretensioner stroke 120 mm before limiter payout,
                    limiter threshold 3.5 kN +/- 0.4 kN
Assumed conditions: -40 to +85 C, 32 km/h and 56 km/h frontal pulses

With this statement agreed and signed off by the seat, restraint electronics, and vehicle integration functions, the DFMEA team can proceed to structure analysis and function analysis knowing that every failure mode has a clear owner and every interface has a measurable characteristic. The boundary is not paperwork; it is the contract that keeps the analysis actionable.