The cap is over-the-air. The correction isn't.

Five thousand Volkswagen owners went to bed with one car and woke up with a slightly worse one. No recall letter, no workshop booking – a software push that caps their batteries at 80% state of charge while the company investigates a fire risk. The range they paid for is gone. Charging takes longer. Everything else looks normal. I have spent two decades in automotive and aerospace quality signing off containments – quarantine cages, sealed stock, three-shift sorting teams, airfreight to customers who never asked for it. Every one of those hurt, and every one showed up as a cost line on a Friday report, which is exactly why they got closed out. This is the most comfortable containment button the industry has ever built. That comfort is the problem.

What an 80% cap actually is

Read it through the 8D and there is no ambiguity. A charge derate is a D3 interim containment action: it protects the customer from the failure mode today while root cause analysis, permanent corrective actions and prevention of recurrence – D4 through D7 – remain owed. Derating itself is legitimate. Given a fire risk and a charging scenario, I would sign the cap in a heartbeat. A car that charges to 80% beats a car that burns.

The failure mode is not the derate. It is what the derate becomes. Software promotes itself: the cap ships as a configuration flag, the flag migrates into the control plan, someone writes "OTA charge limitation" into the detection column of the PFMEA, and eighteen months later nobody remembers that the permanent correction was never delivered. The hardware question – cell behaviour, charging logic, whatever the investigation lands on – stays open beneath a remedy that feels finished because the complaints stopped.

Containment that costs nothing never dies of natural causes.

At Witte Automotive I inherited containments that had quietly become the process. A 100% inspection station on a latch line, staffed for two weeks during some long-forgotten crisis, still standing two years later with headcount and a budget line of its own. It was in the control plan. The D5 it was meant to cover had simply evaporated. We used A3s and the Q-Wall to drag each one back into daylight and ask one question: which permanent correction is this interim action standing in for? Too many had no answer. The 8D had never closed – it had just stopped being discussed.

How the escape got out the door

An overcharge scenario leading to thermal runaway is not exotic. It is textbook PFMEA material – severity 9, because the effect is safety and regulatory, with warning. If a charging-related fire scenario escaped to five thousand vehicles, the interesting question is not what failed. It is what the detection ranking claimed upstream. Cell-level screening, end-of-line BMS verification, abuse testing on the high-voltage side – those controls are supposed to sit between a severity-9 failure mode and a customer's driveway. A field cap is a confession that they did not hold, or were never scored honestly.

The arithmetic is old and brutal. Additional screening at end of line costs cents per vehicle and a few engineering hours. A field escape over fire risk costs a regulatory notification, an investigation, an OTA programme, and warranty reserves against pack replacements that can run to five figures per vehicle in euros – plus whatever the word "fire" does to an electrification programme's credibility. Prevention is an invoice. Escape is a payment plan. Over-the-air delivery does not change that ratio. It hides the payment plan from the Friday report.

The customer still owns a changed product

There is a second conversation the overnight push conveniently skips. A permanent derate is a concession the customer never signed. The specification they purchased included range and charge time; the product in the garage no longer meets it. Software makes the change invisible – no sticker, no visit, nothing to acknowledge. For a private owner, that is an annoyed phone call. For a fleet buyer it is money: a taxi or delivery operator planning routes on full capacity just had their operating envelope redrawn while they slept.

Building the QA/QC function for a 900-plus-employee greenfield plant at SNOP taught me that de-escalation is mostly chronology. Call the customer before they discover the change themselves. Bring the failure data, bring the containment, and bring the date the real correction is due – plus what the customer is compensated in the meantime. We ran a quarter with zero critical customer escalations and 98% customer satisfaction, not because nothing went wrong, but because nothing went quiet. Customers forgive a downgraded product they were told about. They do not forgive learning about it from a forum.

Make every containment die on schedule

The 70% defect-cost reduction we delivered at SNOP did not come from cleverer containments. It came from containments with death dates. Every interim action entered QRQC with two fields nobody was permitted to remove: an expiry date, and a named owner for the permanent correction. When the date arrived, the containment died in front of the room – or someone explained in writing why D5 had not landed yet. That single rule did more for failure-cost reduction than any inspection we ever bought, because it made fossilisation visible the moment it started.

The cap is over the air. The correction is not. Until root cause closes on the hardware and prevention lands in the PFMEA, five thousand owners are driving an open 8D – and the industry has just watched how cheap containment can be. The discipline to finish the job now has to come from somewhere other than the cost report. One test fits any containment, over-the-air or nailed to the floor: would you sign it as permanent? If the fix travels through the air, closure discipline has to be wired on the ground.