Jherrod ThomasThe Lion of Functional Safety™

June 22, 2026 · 14 min read

ISO 26262-3 HARAISO 21448 SOTIFFMVSS 214 / 226

When the Restraint Became the Hazard: The Honda Odyssey 26V227 Inadvertent Airbag Recall Through an ISO 26262 and ISO 21448 Lens

A side-curtain airbag is a safety mechanism. It exists to keep a head off a B-pillar in a 30 mph side impact. So when a minivan fires both the side and side-curtain bags because it drove over a pothole, you do not have a restraint problem — you have a discrimination problem dressed up as a restraint. The Odyssey recall is the cleanest example I have seen in a while of a protective function becoming the hazard, and the engineering lesson is buried in a single line of the chronology.

Most of my posts on inadvertent activation come from the ADAS world — phantom braking, a forward-collision system that brakes for an overpass shadow. This one lives in passive safety, in the supplemental restraint system (SRS), and it is worth the detour precisely because the failure shape is identical: a function with the authority to act suddenly and irreversibly, firing on an input it was never taught to reject.

The public record

On April 9, 2026, American Honda Motor Co. filed Part 573 Safety Recall Report 26V227, covering 440,830 model-year 2018-2022 Honda Odyssey minivans built between January 24, 2017 and June 3, 2022 (NHTSA Part 573 Safety Recall Report 26V227, April 9, 2026). The defect description is blunt: the SRS ECU "contains incorrect deployment parameters for the side and side curtain airbags, which may cause inadvertent deployment when the vehicle encounters strong road impacts, such as driving over potholes, speed bumps, or road debris."

The stated cause is the part engineers should read twice: "The SRS control logic for the second and third rows contain insufficient deployment threshold margin, allowing G-signal inputs to be misinterpreted as side impacts and causing inadvertent deployment of the side and side curtain airbags." The supplier is DENSO; the remedy is to reprogram or, where necessary, replace the SRS ECU with "improved airbag deployment parameters." The same correction went into series production at the start of the 2023 model year, on June 3, 2022. As of April 2, 2026, Honda had logged 130 warranty claims and 25 injury reports, with no deaths, over the full window from January 2017 (NHTSA Part 573 Safety Recall Report 26V227, April 9, 2026; Consumer Reports, Honda Odyssey Minivans Recalled to Fix Faulty Airbags, April 2026).

The chronology is the story. Honda received its first incident notification on November 15, 2017. By July 2021, its own investigation had "determined that, under certain conditions such as poor road surfaces, driving over debris or undercarriage impacts, the second and third-row airbag deployment thresholds could be reached, resulting in deployment of the side and side curtain airbags." Then, on October 27, 2021, Honda "analyzed and evaluated the issue and determined there were no safety concerns." The matter sat for four years until October 28, 2025, when NHTSA opened Preliminary Evaluation PE25-018 after receiving 18 complaints of inadvertent deployment. Honda responded in January 2026, ran additional market-data analysis in March, and on April 2, 2026 finally determined a safety-related defect existed and chose to recall (NHTSA Office of Defects Investigation, PE25-018, opened October 2025; WardsAuto, Honda recalls nearly 441K Odyssey minivans over unintended airbag deployment, April 2026).

Read that again. The mechanism was understood in 2021. The deployment thresholds "could be reached" on bad pavement. And the disposition was "no safety concerns." That sentence is the missing artifact.

The standards lens

Passive restraints are E/E safety functions, so ISO 26262 applies in full, and the relevant hazard is not "the airbag fails to deploy" — it is the commission case, unintended deployment. ISO 26262-3 Clause 7 (HARA) wants both directions of every actuation function evaluated: omission (no bag in a real crash) and commission (a bag in no crash). The Odyssey defect is a pure commission failure, and commission of a pyrotechnic restraint is not a minor hazard. An out-of-position third-row occupant — a child leaning against the trim in a minivan, the everyday case — sits inches from a curtain that inflates in a handful of milliseconds. Add the startle of two bags firing at highway speed with no warning and the driver-disturbance path, and the severity argument writes itself.

Run the rating honestly. Severity for an out-of-position occupant near the deploying curtain is S3; exposure to rough pavement, speed bumps and undercarriage strikes is the definition of an everyday condition, E4; and controllability of an instantaneous pyrotechnic event is C3, because there is nothing the driver or occupant can do in the millisecond the squib fires. S3 / E4 / C3 is ASIL D. Even the conservative baseline — a belted, in-position occupant, severity S2 — lands at S2 / E4 / C3 = ASIL C. There is no reading of this hazard that is QM. A function with ASIL C/D commission potential was carrying a deployment calibration whose margin against road shock was, in Honda's own words, "insufficient."

Then there is the part ISO 26262 deliberately does not cover, which is where ISO 21448 (SOTIF) earns its keep. A pothole is not a random hardware fault. The accelerometer worked. The ECU worked. The algorithm did exactly what its calibration told it to do — and the calibration could not separate a vertical, road-induced transient from a lateral crash pulse. That is a functional insufficiency of the intended functionality meeting a triggering condition (rough road) in the operating environment. In SOTIF's two-by-two, the moment Honda confirmed in July 2021 that bad pavement could cross the threshold, this scenario moved out of "Unknown Unsafe" and into Known Unsafe. The standard is explicit about what you do with a Known Unsafe scenario: you change the design or you justify the residual risk against a quantitative acceptance criterion. "No safety concerns" is neither.

On the regulatory side, the side-thorax and side-curtain stages trace to FMVSS 214 (side impact protection) and FMVSS 226 (ejection mitigation), with FMVSS 208 governing advanced air-bag deployment logic generally. None of these were cited as a noncompliance — the Part 573 leaves the FMVSS fields blank — because this is a defect, not a standards violation. That distinction matters: the discrimination requirement that failed here is not written into any FMVSS pass/fail test. It only exists if your own HARA and SOTIF work products put it there.

A worked snippet — HARA row and discrimination FMEA

First the HARA row for the commission hazard, using the standard guide-word approach (unintended actuation):

| ID | Item / function | Operating scenario | Malfunction (guide word) | S | E | C | ASIL | Safety Goal | |---|---|---|---|---|---|---|---|---| | HZ-SRS-01 | SRS ECU side / side-curtain deployment, rows 2-3 | Normal driving over pothole, speed bump, or undercarriage debris strike; occupants belted, 3rd-row occupant possibly out-of-position | Unintended actuation (commission): deployment commanded with no genuine side-impact event | S3 (out-of-position occupant near curtain; pyrotechnic at close range) | E4 (rough pavement is everyday) | C3 (instantaneous, not controllable) | ASIL D | SG-SRS-01: The SRS shall not command side or side-curtain deployment in the absence of a genuine side-impact crash event. |

Now the discrimination-algorithm FMEA, scored with the AIAG-VDA Action Priority lookup rather than a raw RPN:

| Function | Failure mode | Effect | S | O | D | AP | Mitigation | |---|---|---|---|---|---|---|---| | Classify lateral crash vs. non-crash G-input (rows 2-3) | Road-shock transient (pothole / speed bump / curb strike) classified as side impact | Inadvertent side + curtain deployment in service; injury, startle, possible loss of control | 9 | 4 | 8 | High | Add directional plausibility + multi-channel corroboration before fire | | Set deployment-threshold margin | Threshold window too permissive for vertical / undercarriage transients | Marginal robustness; false fire on common road inputs | 9 | 4 | 7 | High | Re-calibrate against road-roughness corner cases; verify to ASIL D | | Disposition field deployments | Recurring inadvertent fires observed (2017-2021) closed as "no safety concern" without numeric argument | Latent commission hazard persists across model years | 9 | 5 | 9 | High | Mandatory ISO 26262-7 anomaly record with quantitative disposition |

The third row is not a software bug. It is a process failure, and it scores High because its detectability is the worst of the three — nothing downstream catches a hazard that the organization has formally decided is not a hazard.

Derived requirements (excerpt)

Five traceable requirements that close the gap, with stable IDs:

That last requirement is the one I would print and tape above the field-quality desk. It is the difference between the 2021 disposition and the 2026 recall.

What the headline really tells us

The headline says "Honda recalls 440,000 minivans because airbags deploy over potholes." The engineering reads differently. The accelerometer was fine. The squib was fine. The bag inflated exactly as designed. What was missing was a row in a table — a commission entry in the HARA that rated unintended side-restraint deployment at the ASIL it actually carries, and a SOTIF triggering-condition entry that said, in writing, that rough pavement and undercarriage strikes are inputs the discrimination algorithm must reject, not events it may treat as crashes.

And then there is the deeper miss, the one that turned a 2017 signal into a 2026 recall: in July 2021 the team had the failure mechanism in hand and in October 2021 closed it as "no safety concern." A protective function had been shown to actuate without a crash, and the disposition recorded no quantitative argument for why that was acceptable. The right artifact existed in the standards the whole time — ISO 26262-7 calls it a safety anomaly, SOTIF calls it a Known Unsafe scenario — and the only thing that stops a known commission hazard from aging four model years in the field is the discipline to make "no concern" a number rather than a sentence. The pothole did not write that number. Neither did NHTSA's eighteen complaints, until they had to.

— Jherrod Thomas, The Lion of Functional Safety™

Sources