Jherrod ThomasThe Lion of Functional Safety™

October 3, 2026 · 11 min read

ISO 26262-3 §6 / -4 §6 / §8ISO 26262-2 §7 / -8 §5 / -6 §926V588 / 26V160 / 49 CFR 573

When the Recall Didn't Reach the Sibling: Hyundai's Ioniq 9 26V588 Power-Seat Entrapment Through an ISO 26262 Extent-of-Condition Lens

A seat folds itself flat. A child is in the way. The seat is supposed to notice, stop, and back off, and it does not. That is a hazard with a severity rating nobody argues about, and it was a known defect class at Hyundai on March 17, 2026. On September 10, 2026 it turned up again in a different vehicle.

The engineering question here is not "why did a seat fail to detect a person." It is "why did a fatal-injury finding on one platform take 177 days to become a recall on its sibling, while the sibling kept rolling off the line."

1. The public record

The first recall. Hyundai's Palisade campaign, 26V160, carries a manufacturer report date of March 17, 2026. It covers 61,093 model-year 2026 Palisade and Palisade Hybrid vehicles in Limited and Calligraphy trims. NHTSA's wording of the consequence: "A person, especially a child, may become trapped by a rear powered seat, increasing the risk of injury." The first remedy was an interim software update, with a permanent remedy still in development (NHTSA Part 573 acknowledgement, 26V160). Press reporting ties the campaign to the death of a two-year-old girl in Ohio on March 7, 2026, involving a third-row seat, and says the seats were supplied by Nidec Mobility Korea. Treat the supplier name as secondary-source: the NHTSA acknowledgement does not name it (Gumtree/Newsquest, 2026).

The second recall. Hyundai's 26V588 carries a report date of September 10, 2026 and covers 5,360 model-year 2026 Ioniq 9 vehicles in Limited, Calligraphy and Calligraphy Design trims, built March 17, 2025 through May 4, 2026. The consequence statement is word for word the Palisade's (NHTSA Part 573 acknowledgement, 26V588). The defect, from Hyundai's own filing: the "2nd row power seat assemblies ... may not respond to contact with an occupant or object as intended during activation of certain powered seat functions, including the automatic power-folding (stow) function." The stated cause: "In certain situations, the current 2nd row power seat logic may not detect contact with an occupant or object as intended." All 5,360 units are presumed defective (NHTSA Part 573 report, 26V588).

The chronology Hyundai filed. This is the part worth reading slowly.

| Date | Event (26V588 Part 573 chronology) | |---|---| | Mar 10, 2026 | Investigation begins with benchmarking results | | Spring to summer | Subjective evaluations; biomechanical test method developed | | Aug 4 to 6, 2026 | Fixture testing: measured forces exceed limits for second-row systems | | Sep 2, 2026 | Hyundai decides to recall | | Sep 10, 2026 | Part 573 report filed |

Hyundai had received five consumer complaints by the decision date, including two reports of minor injuries; no crashes or fires (NHTSA Part 573 report, 26V588). The remedy is a seat-controller software inspection and update revising the occupant-detection and anti-pinch logic, over the air through Bluelink or at a dealer. Owner letters are expected November 9, 2026 (electrive, September 23, 2026). This is the Ioniq 9's third recall of 2026, after a high-voltage bus bar and rear-suspension fasteners (same source).

The arithmetic. The Ioniq 9 investigation opened three days after the Ohio death. The fixture test that quantified the problem ran 150 days after that, and the recall decision came 179 days after the death. Production of affected units continued for 48 days after the Palisade Part 573 was filed. I am not suggesting anyone sat on information. I am saying the process ran at the speed of a benchmarking project, and the hazard did not.

2. The standards lens

There is a regulatory oddity worth stating first. FMVSS 118 covers power-operated windows, partitions and roof panels, with defined requirements to stop and reverse on contact. I am not aware of an equivalent federal standard for power seats. The requirement was therefore entirely self-imposed, which means the safety argument lived in Hyundai's and its supplier's own engineering documents. Those are exactly the documents ISO 26262 describes.

ISO 26262-3 §6 (HARA). Entrapment of a child by a folding seat: severity is plausibly S3, the Ohio death being the proof. Exposure depends on how often the function is used with an occupant present, and controllability for a small child is close to nil. Whether Hyundai or its supplier rated this function ASIL or QM is not public. A QM rating on a comfort function with a child in the loop is the kind of decision that deserves a second look; I'll say no more than that because I can't see the document.

ISO 26262-4 §6 and §8 (technical safety concept, safety validation). Automatic stow is an actuator that can crush; the safety mechanism is contact detection plus stop-and-reverse. A mechanism whose threshold passes in the lab but fails with a child's limb, a soft backpack or a seatback pad was never validated against the hazard. Hyundai's own timeline says the biomechanical test method was developed in spring and summer 2026. That is the safety validation artifact, and it arrived after the first recall.

ISO 26262-8 §5 (distributed development) and ISO 26262-6 §9 (software unit verification). If detection logic is a supplier deliverable, the Development Interface Agreement is where force limits, test fixtures, and the obligation to propagate a field finding to every product using the same logic should live. The Ioniq 9 supplier is not disclosed in the filings I read, so I make no claim that the two vehicles share a supplier; the shared defect text suggests they share, at minimum, a design intent.

ISO 26262-2 §7 (field monitoring and safety anomaly handling). This is the clause that matters most. A confirmed fatality on one product should trigger an extent-of-condition analysis across every product with the same function, the same logic family, or the same supplier. The output is a list with dates, not a lesson learned.

Cross-domain parallel: ISO/TS 15066. Robotics solved the underlying problem years ago. For collaborative robots the requirement is a permissible force and pressure per body region, verified with a measurement fixture before deployment. Hyundai's August fixture test is the same instrument. The difference is the order of operations: in a cobot program that test is a release gate, not a field investigation.

3. A worked snippet

An illustrative HARA row and fault tree for the function. These are mine, built from the public record, not Hyundai's.

| ID | Function | Malfunction | Situation | S | E | C | Rating | Safety goal | |---|---|---|---|---|---|---|---|---| | H-SEAT-01 | Auto fold-and-stow, row 2 | Seat continues motion after contact with occupant | Child in seat or footwell, parent loading cargo | S3 | E3 | C3 | ASIL B (illustrative) | Seat motion shall stop and reverse within a bounded time and force when contact with a person occurs | | H-SEAT-02 | One-touch tilt-and-slide | Same | Child positioned between seatback and tailgate-side structure | S3 | E3 | C3 | ASIL B (illustrative) | Same as above |

TOP: Occupant entrapped by powered seat while folding
 |
 +-- AND
      +-- Motion command active (auto-stow or one-touch)
      +-- Contact not acted on
           +-- OR
                +-- Contact not detected
                |    +-- Threshold above person-contact force (calibration)
                |    +-- Soft or low-stiffness body not seen by sensing method
                |    +-- Detection enabled only in some travel segments
                +-- Contact detected, reaction suppressed
                |    +-- Debounce / blanking window too long
                |    +-- Reversal inhibited at end-stops
                +-- Contact detected, reaction too slow
                     +-- Motor inertia plus drive ratio exceed stop distance

Hyundai has not said which branch failed, beyond "logic may not detect contact." Notice what the tree says about test design: the detection branch alone has three independent causes, and a single hard-obstacle bench test covers at most one.

4. Derived requirements (excerpt)

My drafts, not Hyundai's. Numeric values are illustrative and would need biomechanical justification.

SEAT-SR-588-05 is the requirement the public record suggests was missing. The other four are what a TSC normally contains; the fifth is what a safety management process has to enforce.

5. What the headline really tells us

"Hyundai recalls 5,360 Ioniq 9 over power-seat logic" reads as a software bug. The thing that failed is quieter: the Palisade recall closed a defect on one vehicle, and nothing forced the same question onto every other vehicle with a similar seat, in a bounded time, with a named owner.

Hyundai deserves credit for building a biomechanical test method and acting on what it measured. The interim Palisade remedy, as press reports describe it, requires the tailgate open before folding functions run and requires press-and-hold actuation (Gumtree/Newsquest); that is exposure reduction, a sensible stopgap. But exposure reduction on one platform is not a fix on the next. The missing artifact is an extent-of-condition register, owned by the safety manager, that turns every fatal-injury finding into a dated checklist against every sibling program, production line included. Without it, the safety case for the second vehicle is a quiet assumption that the first one's problem was local.

Sources

— Jherrod Thomas, The Lion of Functional Safety™