2. Restraint system architecture and key components

Before a restraint maturity gate can be evaluated without a full vehicle prototype, the team must have a precise mental model of what the restraint system is made of and how its parts interact. A modern frontal restraint system is not a collection of independent devices; it is a coordinated chain in which sensing, decision logic, and energy management must agree within milliseconds. This chapter establishes the component vocabulary and the architectural relationships that later gate criteria will reference.

The restraint chain as a signal and energy path

It helps to separate the system into two coupled paths. The signal path begins at crash sensors and occupant sensors, passes through the airbag control unit (ACU), and ends at the actuators: pyrotechnic initiators for airbags and pretensioners, plus switching elements for adaptive functions. The energy path begins at the vehicle structure, which deforms and decelerates the occupant, and continues through the belt and airbag as they absorb and redistribute occupant kinetic energy. A restraint that fires correctly but manages energy poorly still produces injury; a restraint that manages energy well but fires late produces the same outcome. Maturity gates must therefore test both paths.

Seat belts and pretensioners

The three-point belt remains the primary restraint. Its job is to couple the occupant to the decelerating structure as early and as gently as possible. The retractor contains a spool, a locking mechanism, and — in most modern systems — a pretensioner. Pyrotechnic pretensioners use a small gas generator or a piston to rotate the spool and pull roughly 40–80 mm of webbing out of the retractor within about 10–20 ms of the firing command. Motorized retractors achieve reversible tensioning and are often used for comfort and pre-crash functions. The key architectural question for a maturity gate is whether the pretensioner is a standalone device or integrated into the retractor, because that determines how it can be tested on a bench.

Belt force limiting is the counterpart to pretensioning. A load limiter — typically a torsion bar inside the retractor or a tearing stitch in the webbing — allows controlled webbing payout once belt force exceeds a threshold, usually in the range of 3–6 kN for a front occupant. This reduces chest deflection at the cost of slightly increased forward excursion. Adaptive load limiters can switch between two force levels based on occupant size or crash severity, which makes the occupant-sensing input directly relevant to the energy path.

Airbags and inflators

Frontal airbags are the secondary restraint. The module consists of the inflator, the cushion, the housing, and the cover. Inflators are either pyrotechnic (solid propellant), hybrid (compressed gas plus pyrotechnic heater), or cold-gas stored-gas types. The inflator's output — mass flow and gas temperature over time — determines fill rate and cushion pressure. A typical driver airbag fills to roughly 60–80 litres within 30–50 ms. Passenger airbags are larger, often 100–150 litres, and may use dual-stage inflators where the second stage is fired later to tailor pressure to severity or occupant position.

For bench-level maturity work, the important architectural facts are the firing loop resistance (typically 1.7–2.5 Ω per initiator), the arming and safing logic, and the shorting clips that prevent inadvertent deployment during handling. These are the parameters a bench harness must replicate faithfully.

Occupant sensing and its architectural role

Occupant sensing converts physical state into suppression or adaptation decisions. Common inputs include seat weight (occupant classification by weight threshold, often around 30 kg for child/adult discrimination), belt buckle status, seat track position, and in some systems, capacitive or camera-based position sensing for out-of-position detection. The ACU uses these to decide whether to suppress the passenger airbag, fire only stage one, or adjust pretensioner and load-limiter strategy.

Architecturally, occupant sensing sits on the signal path but its outputs modify the energy path. This is why a maturity gate that only checks deployment timing is incomplete: it must also verify that suppression and adaptation logic responds correctly to the sensed state.

What a bench-level architecture must reproduce

When a full vehicle is not available, the restraint architecture is reproduced as a hardware-in-the-loop bench: real ACU, real initiators replaced by equivalent resistive loads or instrumented simulators, real sensors or signal-level substitutes, and a real belt and retractor assembly mounted on a rigid fixture. The table below summarizes the substitution strategy and the parameter that must be preserved.

Practical example: verifying pretensioner and load-limiter interaction on a bench

Consider a bench configured with a production retractor, a 50th-percentile dummy torso on a sled fixture, and a force transducer in line with the webbing. The ACU is triggered by a synthesized 50 km/h frontal pulse. Expected observable behaviour: pretensioner fires within 15 ms of the command, webbing is pulled in by 50–70 mm, belt force rises to the limiter plateau of about 4 kN, and webbing then pays out as the torso moves forward. If the force trace shows no plateau, the torsion bar may be the wrong variant or the webbing path may be binding. If pretensioner stroke is short, check gas generator output and spool free rotation. These are the kinds of symptoms a maturity gate is designed to catch before vehicle-level testing.

The next chapter builds on this component map to define the gate criteria themselves: what must be measured, at what tolerance, and how pass/fail is judged when the full vehicle is absent.