3. Test facility design

Static inflation testing releases the full stored energy of an inflator in a fraction of a second. A driver-side inflator may contain 60–120 g of propellant and pressurize a 60–80 L cushion to roughly 200–300 kPa gauge within 30–50 ms; a side inflator can reach peak pressure even faster. The facility must therefore be designed around one governing principle: the inflator is treated as an explosive device, and the test cell is the primary barrier between that energy and personnel. This section covers the physical layout of the test cell, the containment structures that absorb and redirect the pressure wave, and the safety interlock architecture that prevents an unintended deployment.

Test Cell Layout and Zoning

A static inflation cell is normally organized into three concentric functional zones. The blast zone is the interior volume where the module, fixture, and instrumentation reside. The barrier zone is the containment envelope — walls, roof, viewing window, and penetrations. The control zone is the operator area, physically separated and connected only through feedthroughs for cabling, gas lines, and data. The control room must never share a wall with the blast zone unless that wall is itself a rated barrier.

Cell dimensions are driven by the standoff distance and the expected fragment envelope. A practical starting point for a driver-side module is an interior of at least 3 m × 3 m × 3 m, with the module mounted at least 1.5 m from any wall. For passenger-side or curtain airbag work, the cell is typically longer (4–6 m) to accommodate the deployed cushion and to keep the cushion from striking the barrier at full velocity. The floor should be a separate structural slab, not a suspended deck, and should be sloped slightly toward a drain if water deluge is used.

Fixtures must be rigid enough that the reaction force does not become a secondary projectile. A common design uses a heavy steel base plate (≥ 200 kg) bolted to the floor slab through cast-in anchors, with the module adapter plate bolted to the base. The fixture should be designed so that the cushion deploys into free space, not into a wall or instrument, and so that the reaction load path goes directly into the slab.

Containment Structures

Containment is not a single wall; it is a system. The most common construction is reinforced concrete with a minimum thickness of 200–300 mm, often with a steel liner on the interior face to resist fragment impact and to simplify cleaning. The roof must be rated for the same overpressure as the walls, because the pressure wave expands upward as well as outward. Where a concrete roof is impractical, a steel plate roof with stiffeners is used.

Viewing windows are the weakest point and must be treated as engineered penetrations. Laminated polycarbonate or acrylic of 25–50 mm thickness, mounted in a steel frame with a gasket and retained by bolts, is typical. The window should be smaller than the wall area it replaces, and the frame should be designed so that the window cannot be pushed inward. A useful rule of thumb is to keep the window area below 10% of the total barrier area.

Penetrations for cables, gas lines, and instrumentation must be sealed. Each feedthrough should be a welded or bolted steel sleeve filled with a fire-resistant sealant, and the sleeve should be long enough that a pressure wave cannot travel directly through it. Cable trays inside the cell should be anchored to the wall, not suspended from the ceiling, to avoid becoming a projectile.

Ventilation is a design conflict: the cell needs air exchange for personnel entry and for gas dilution, but an open vent is a pressure leak. The standard solution is a blast relief vent — a louvered or flap-type opening that is normally closed but opens at a set pressure (typically 5–15 kPa) to relieve the internal pressure wave. The vent must discharge to a safe area, not into the control room or a corridor.

Safety Interlocks

Interlocks are the electrical and logical layer that prevents the inflator from receiving a fire command when the cell is not safe. A robust interlock architecture is series-connected and fail-safe: every safety condition must be satisfied before the firing circuit can be energized, and the loss of any condition must immediately de-energize the circuit.

The typical interlock chain includes:

• Door position switches on every access door, wired so that an open door breaks the firing circuit.
• Cell occupancy detection — motion sensors, light curtains, or a keyed personnel badge reader — to confirm no one is inside.
• Barrier integrity — a pressure or strain sensor on the blast vent, or a simple limit switch confirming the vent is closed.
• Firing circuit continuity — a low-current loop that verifies the firing line is intact and not shorted.
• Control room enable — a keyed switch or two-hand control that requires deliberate operator action.
• Emergency stop — a hardwired, normally-closed circuit that removes power from the firing relay and, where used, triggers the deluge system.

The firing relay itself should be a normally-open, positively-guided contact relay, and the firing energy should come from a dedicated supply that is isolated from the control electronics. A common practice is to use a two-channel architecture: two independent relays in series, each controlled by a separate logic channel, so that a single fault cannot cause an unintended fire. The firing command is a short pulse (typically 10–50 ms) generated by the data acquisition system, and the pulse should be optically isolated from the control room ground.

Interlock logic should be documented as a truth table and verified before every test campaign. A simple verification method is to deliberately defeat each interlock one at a time and confirm that the firing circuit cannot be energized. This is a proof test, not a functional check, and it should be recorded.

Practical Design Example: Interlock Proof Test

Consider a cell with four door switches, one motion sensor, one vent limit switch, and a firing line continuity loop. The interlock logic is a series AND: FIRE_ENABLE = D1 · D2 · D3 · D4 · OCC · VENT · CONT. Before a test campaign, the following proof test is performed with the firing line disconnected from the inflator and connected to a dummy load (a 2 Ω, 50 W resistor).

Step 1: Close all doors, clear cell, confirm OCC = 0 (no motion).
Step 2: Confirm VENT = 1 (vent closed) and CONT = 1 (continuity OK).
Step 3: Arm the firing circuit from the control room key switch.
Step 4: Open door D1. Expected: FIRE_ENABLE = 0, relay de-energized.
Step 5: Close D1, repeat for D2, D3, D4.
Step 6: Enter cell (OCC = 1). Expected: FIRE_ENABLE = 0.
Step 7: Open vent manually. Expected: FIRE_ENABLE = 0.
Step 8: Disconnect dummy load. Expected: CONT = 0, FIRE_ENABLE = 0.
Step 9: Restore all conditions. Expected: FIRE_ENABLE = 1.
Step 10: Fire a 20 ms pulse into the dummy load. Verify pulse width and
         current on the oscilloscope; confirm no relay chatter.

Typical failure symptoms and their causes: if the relay energizes with a door open, the door switch is likely wired normally-open or bypassed; if the relay chatters during the pulse, the firing supply may be undersized or the relay coil is not suppressed; if continuity reads OK with the load disconnected, the continuity loop is shorted to the firing line. Each of these should be corrected and the proof test repeated before any live inflator is connected.

In summary, a static inflation facility is a layered safety system: the cell layout keeps people away from the blast, the containment structure absorbs the energy, and the interlock chain prevents the firing command from reaching the inflator unless every safety condition is satisfied. Each layer must be designed, verified, and documented independently, because no single layer is sufficient on its own.