question: How engineers can be sure that the hard shell of airbags won't hit someone during a crash?
comment: They're scored on the inside to allow them to tear predictably. Kinda like how some grenades have similar cuts to get even distribution ( looking at you takata).
passages: Unlike crash tests into barriers, real-world crashes typically occur at angles other than directly into the front of the vehicle, and the crash forces usually are not evenly distributed across the front of the vehicle. Consequently, the relative speed between a striking and struck vehicle required to deploy the airbag in a real-world crash can be much higher than an equivalent barrier crash. Because airbag sensors measure deceleration, vehicle speed is not a good indicator of whether an airbag should have deployed. Airbags can deploy due to the vehicle's undercarriage striking a low object protruding above the roadway due to the resulting deceleration.
   Today, airbag triggering algorithms are becoming much more complex. They try to reduce unnecessary deployments and to adapt the deployment speed to the crash conditions. The algorithms are considered valuable intellectual property. Experimental algorithms may take into account such factors as the weight of the occupant, the seat location, seatbelt use, and even attempt to determine if a baby seat is present.
  
  Section::::Operation.:Triggering conditions.:Inflation.
   Airbags are designed to deploy in frontal and near-frontal collisions more severe than a threshold defined by the regulations governing vehicle construction in whatever particular market the vehicle is intended for: United States regulations require deployment in crashes at least equivalent in deceleration to a 23 km/h (14 mph) barrier collision, or similarly, striking a parked car of similar size across the full front of each vehicle at about twice the speed. International regulations are performance based, rather than technology-based, so airbag deployment threshold is a function of overall vehicle design.
   Advanced airbag technologies are being developed to tailor airbag deployment to the severity of the crash, the size and posture of the vehicle occupant, belt usage, and how close that person is to the actual airbag. Many of these systems use multi-stage inflators that deploy less forcefully in stages in moderate crashes than in very severe crashes. Occupant sensing devices let the airbag control unit know if someone is occupying a seat adjacent to an airbag, the mass/weight of the person, whether a seat belt or child restraint is being used, and whether the person is forward in the seat and close to the airbag. Based on this information and crash severity information, the airbag is deployed at either at a high force level, a less forceful level, or not at all.
   The SAE International G-48 System Safety Committee held The Safety Case Workshop at APT Research in Huntsville, AL on 15 January 2014 with several DoD agencies and leading contractors present to further study and capture the Safety Case process and methods for refinement and possible future promulgation in several Safety Standards, as several already use as part of internal best practices. The G-48, composed of a NASA safety Office, DoD Agencies and several leading defense contractor representatives, cite several evidence based safety advantages of Safety Cases over ANSI/GEA-STD-010 and MIL-STD-882, including 1. Upfront articulation of Arguments (rationale and claims) to be used and (2) independent review to verify and validate. Since Safety Cases are structured, evidence based approaches to satisfy the safety argument established at the start of programs, they may find a good fit in augmenting existing and proven hazard analyses methods and techniques. It is envisioned as Safety Cases gain popularity and are included in current best practices they will not replace any current effective safety methods, such as Functional Hazard Assessments (FHA), but may be included in those up front and in more comprehensive and blended safety methodologies to argument and improve capturing and documenting objective safety evidence through the program. A final Safety Case should have all of the necessary and required specific artifacts such as test evidence supporting safety claims. A well balanced Safety Case must also allow for special safety directed verification, such as testing of credible failure conditions, testing of malfunctions to observe predicted safe states and planned behavior, fault insertion for expected functionality under worse case conditions, failure immunity to ensure system ignores corruption and rouge threats, and off nominal or modified conditions, out of bounds, and other type test results to prove safety requirements are met outside normal operation. 
   Section::::Limitations.
  
  Although the millions of installed airbags in use have an excellent safety record, some limitations on their ability to protect car occupants exist.
  
  The original implementation of front airbags did little to protect against side collisions, which can be more dangerous than frontal collisions because the protective crumple zone in front of the passenger compartment is completely bypassed. Side airbags and protective airbag curtains are increasingly being required in modern vehicles to protect against this very common category of collisions.
   Under some rare conditions, airbags can injure and in some very rare instances kill vehicle occupants. To provide crash protection for occupants not wearing seat belts, United States airbag designs trigger much more forcefully than airbags designed to the international ECE standards used in most other countries. Recent "smart" airbag controllers can recognize if a seatbelt is used, and alter the airbag cushion deployment parameters accordingly.
   NHTSA uses cost–benefit analysis for every safety device, system, or design feature mandated for installation on vehicles. No device, system, or design feature may not be mandated unless it will save more money (in property damage, health care, etc.) than it costs, or must cost no more than a specified amount of money per life saved. Requirements are balanced through estimated costs and estimated benefits to justify or reject regulation. For example, FMVSS #208 effectively mandates the installation of frontal airbags in all new vehicles in the United States, for it is written such that no other technology can meet the stipulated requirements. It has been argued that even using conservative cost figures and optimistic benefit figures, airbags' cost–benefit ratio so extreme that it may fall outside of the cost–benefit requirements for mandatory safety devices. Cost–benefit requirements have been used as the basis for lighting-related regulation in the U.S; for example, while many countries in the world since at least the early 1970s have required rear turn signals to emit amber light so they might be distinguished from adjacent red brake lamps, U.S. regulations permit rear turn signals to emit either amber or red light. This has historically been justified on grounds of lower manufacturing cost and greater automaker styling freedom in context of no demonstrated safety benefit to amber over red. More recent NHTSA-sponsored research has demonstrated that amber rear turn signals provide significantly better crash avoidance than red ones, and NHTSA has found there is no significant cost penalty to amber signals versus red ones, yet the agency has not moved to require amber—instead proposing in 2015 to award extra NCAP points to passenger vehicles with amber rear turn signals. As of July 2019, the agency has not put this proposal into effect.
   Airbags deploy at speeds up to and in some cases exert tremendous force on the windshield. Occupants can impact the airbag just 50  ms after initial deployment. Depending on vehicle design, airbag deployment and/or occupant impact into the airbag may increase forces on the windshield, dramatically in some cases.
  
  Forces of occupants on the airbags - and hence the potential forces on the windshield - are lower for belted occupants. As consequence, adhesive suppliers usually inform their customers about the level of security achieved:
  
  1) Example: Security exceeding FMVSS 212/208 belted
  
  2) Example: Security exceeding FMVSS 212/208 unbelted
   During a crash, the vehicle's crash sensors provide crucial information to the airbag electronic controller unit (ECU), including collision type, angle, and severity of impact. Using this information, the airbag ECU's crash algorithm determines if the crash event meets the criteria for deployment and triggers various firing circuits to deploy one or more airbag modules within the vehicle. Working as a supplemental restraint system to the vehicle's seat-belt systems, airbag module deployments are triggered through a pyrotechnic process that is designed to be used once. Newer side-impact airbag modules consist of compressed-air cylinders that are triggered in the event of a side-on vehicle impact.
   From the onset of the crash, the entire deployment and inflation process is about 0.04 seconds. Because vehicles change speed so quickly in a crash, airbags must inflate rapidly to reduce the risk of the occupant hitting the vehicle's interior.
  
  Section::::Operation.:Triggering conditions.:Variable-force deployment.
   Some major programs in the US Department of Defense, such as the F-35 Vehicle Management System (VMS) are using Model Based System Engineering (MBSE) effectively on highly complex, software intensive and safety-critical airborne system functions, along with Goal Structuring Notation (GSN). Safety Assessments and more elaborate and comprehensive Safety Cases with GSN are effective so long as Refuting Arguments and much scrutiny using traditional hazard analyses and safety approaches are included and models used to depict system behavior. More elaborate models and formal methods are being used for collective safety evidence. In the UK, GSN as part of Safety Cases have proven to be useful for providing objective safety evidence. A Safety Case is an ideal way to reflect the MBSE model, software use cases, safety architecture, safety critical functional behavior, safe states, and sequencing in the safety domain. Functional behavior is often better understood, expressed and defended when graphically displayed every step of the way in MBSE vs. traditional development with enormous paperwork that is very difficult to correlate into an effective Safety Case. 
   Adaptive airbag systems may utilize multi-stage airbags to adjust the pressure within the airbag. The greater the pressure within the airbag, the more force the airbag will exert on the occupants as they come in contact with it. These adjustments allow the system to deploy the airbag with a moderate force for most collisions; reserving the maximum force airbag only for the severest of collisions. Additional sensors to determine the location, weight or relative size of the occupants may also be used. Information regarding the occupants and the severity of the crash are used by the airbag control unit, to determine whether airbags should be suppressed or deployed, and if so, at various output levels.
   Improvements in sensing and gas-generator technology have allowed the development of third-generation airbag systems that can adjust their deployment parameters to size, weight, position, and restraint status of the occupant. These improvements have demonstrated a reduced injury risk factor for small adults and children, who had an increased risk of injury with first-generation airbag systems.
   A definition by UK Defence Standard 00-56 Issue 4 states: Such an evidence-based approach can be contrasted with a "prescriptive" approach to safety certification, which require safety to be justified using a prescribed process. Such standards typically do not explicitly require an explicit argument for safety and instead rest on the assumption that following the prescribed process will generate the required evidence for safety. Many UK standards are non-prescriptive and call for an argument-based approach to justify safety, hence why a safety case is required. 
   BULLET::::1. "Failures of any system should be assumed for any given flight regardless of probability and such failures "should not prevent continued safe flight and landing" or otherwise significantly reduce safety."
  
  BULLET::::2. "Subsequent failure during the same flight should also be assumed."
  
  The AC lists design principles or techniques used to ensure a safe design. Usually, a combination of at least two safe design techniques are needed to provide a fail-safe design; i.e. to ensure that Major Failure Conditions are Remote, Hazardous Failure Conditions are Extremely Remote, and Catastrophic Failure Conditions are Extremely Improbable.
  
  BULLET::::- Highly integrated systems
   An extremely dangerous situation occurs during "underride collisions", in which a passenger vehicle collides with the rear of a tractor-trailer lacking a rear underride guard, or hits the side of such a trailer not equipped with a side underride guard. The platform bed of a typical trailer is roughly at the head height of a seated adult occupant of a typical passenger car. This means not much of a barrier exists between a head and the edge of the trailer platform, except a glass windshield. In an underride collision, the car's crush zones designed to absorb collision energy are completely bypassed, and the airbags may not deploy in time because the car does not decelerate appreciably until the windshield and roof pillars have already impacted the trailer bed. Even delayed inflation of airbags may be useless because of major intrusion into the passenger space, leaving occupants at high risk of major head trauma or decapitation in even low-speed collisions. Western European standards for underride guards have been stricter than North American standards, which typically have allowed grandfathering of older equipment that may still be on the road for decades.
   From around 2000, side-impact airbags became commonplace on even low- to mid-range vehicles, such as the smaller-engined versions of the Ford Fiesta and Peugeot 206, and curtain airbags were also becoming regular features on mass-market cars. The Toyota Avensis, launched in 2003, was the first mass-market car to be sold in Europe with nine airbags.
  
  Variable force-deployment front airbags were developed to help minimize injury from the airbag itself.
   In 2013, Peter Halldin and Daniel Lanner from MIPS AB, Richard Coomber from Revision Military, Inc, Montreal Canada, and Sven Kleiven from KTH published a paper describing both a numerical and an experimental approach to measuring the blunt-impact protection offered by military helmets.
   The first known accident between two airbag-equipped automobiles took place on 12 March 1990 in Virginia, USA. A 1989 Chrysler LeBaron crossed the center line and hit another 1989 Chrysler LeBaron in a head-on collision, causing both driver airbags to deploy. The drivers suffered only minor injuries despite extensive damage to the vehicles.
   In December 2014, a Lifan 320 model with no airbags was crash tested by Latin NCAP and received zero stars out of five. The comments from the press release cited: "The protection offered to the driver's head and chest was poor due to contact with the steering wheel. The passengers' knees could impact with dangerous structures in the dashboard lie the Tran fascia tube. The bodyshell was rated as unstable."
   Safety cases are typically documented in both textual and graphical notations, e.g. using the Goal Structuring Notation (GSN).
  
  Safety Cases are becoming more popular on civil/commercial aircraft and Department of Defense (DoD) weapon systems as complexity and criticality increase. A paradigm shift is often necessary to accept Safety Cases as traditional system safety and software safety analysis and verification approaches and processes are not adequately structured to present an effective safety argument on some more modern architectures using modern development tools and formal methods.
   Ideally, future Safety Case concepts, that are evolving as software intensive and high technology systems of systems gets more complex, must contain a focused data package with comprehensive safety artifacts and must be inclusive of all safety analyses, findings and determination of total summation of system risk. Safety Cases must go beyond the current MIL-STD-882 Safety Assessment Reports that are more general summary of hazard and risk based findings. Safety Cases with structured arguments, goals and objectives need to be more inclusive of various modern safety aspects, usually including requirements based safety (INCOSE), model based safety, software based safety (IEEE STD-1228), function based safety (IEC-61508, design based aerospace recommended practices for safety (SAE ARP 4761/4754A). 
   Because of the airbag exit flap design of the steering wheel boss and dashboard panel, these items are not designed to be recoverable if an airbag deploys, meaning that they have to be replaced if the vehicle has not been written off in an accident. Moreover, the dust-like particles and gases can cause irreparable cosmetic damage to the dashboard and upholstery, meaning that minor collisions which result in the deployment of airbags can be costly accidents, even if there are no injuries and there is only minor damage to the vehicle structure.
  
  Section::::Regulatory specifications.
  
  Section::::Regulatory specifications.:United States.
   The term "ATA case" is frequently used to describe cases that resemble those that comply with ATA Specification 300 category I or II, but have not been certified by the independent testing defined in ATA Specification 300. Category I and II cases are required to be tested both as a pre-production prototype and as a sample selected from the first production lot. Tests include stackability, drop or impact, water resistance, vibration (category I only), and penetration (category I only). Of these, the drop test, stackability, and vibration tests are probably the most severe. For cases under gross (loaded) the drop test requires 160 face drops from , 80 edge drops from , and 40 corner drops from 36 inches. The face drop distance is reduced to up to , , or more. Category II cases are dropped one-tenth as many times from and at 50 pounds, and proportionally for heavier cases. The stackability test requires every case face over to support centered on of the face for 24 hours. The vibration test searches for the four strongest resonances between 5 and 50 Hz, and then tests each at for 2 hours on each principal axis. The penetration test is a 6-kilogram steel bar 3.2 centimeters in diameter with a hemispherical end dropped 0.5 meters on the weakest point. For all tests no degradation or functional damage is allowed.
  