Volkswagen has recalled close to 2.9 million cars because corrosion in the steering could, over years, take away the one control a driver cannot do without. Here is the uncomfortable part: every one of those parts almost certainly passed every gate it faced. PPAP approved, end-of-line green, audit clean, shipped. Corrosion doesn't slip past the gates – it waits them out. The failure matures on schedule, long after anyone has stopped looking.

I know the failure mode personally. At Witte Automotive, fastener and latch corrosion was my daily bread: salt-spray cabinets, zinc-flake systems replacing hexavalent chrome under REACH, galvanic pairs born the moment a steel fastener met an aluminium bracket. Two decades in automotive and aerospace taught me more about the limits of launch gates from rust than from any audit.

Every gate samples the moment

Walk the launch logic. PPAP wants a corrosion result – a lab report, dated, filed. The PFMEA lists corrosion with a severity and an occurrence, both inherited from the previous programme. The end-of-line test measures function today: torque, actuation force, continuity. Not one of these gates can measure a twelve-year promise, because every one of them samples the part as it exists at 14:37 on a Tuesday in week 34 of the programme.

720 hours of salt spray against a twelve-year perforation warranty is not proof. It is a correlation model. The cabinet compresses time, and the bet – rarely stated, never audited – is that accelerated attack preserves the ranking of processes: that a coating surviving 720 hours in the cabinet will outlast a competing system in the field by a proportional margin. The bet can be managed. The hours can be counted. Most plants manage the hours.

Corrosion is the failure mode that files its complaint after the evidence has expired.

The PPAP file says the part passed. What it actually says is that a sample passed, once, on a good day, from a process that has since moved on.

The drawing didn't change, the process did

The genuine escapes are rarely drawing changes; engineering change discipline catches those and re-runs them through APQP. The escapes are the changes that never touch the drawing. A cost-down trims two microns off a zinc-flake topcoat – perhaps €0.015 per part across a million-piece annual volume. Serious money at scale. Invisible on the drawing. Or the supplier's coater rebuilds the pretreatment line: new chemistry, new bath control, new cure profile, identical part number – and the validation still points at the old line. Or a bracket goes from steel to aluminium for weight, and nobody re-checks the fastener coating against the new cathode sitting millimetres away.

Each of these leaves the validated part number intact while quietly retiring the process that earned the validation. I lived the clean version during the REACH transition: hexavalent chromium out, zinc-flake in, the new system validated properly at introduction – cabinets, cyclic tests, field correlation. The cost-downs that followed were justified by datasheet comparison. A datasheet is not a cabinet.

Run the arithmetic the board never sees. A coating cost-down saves cents per part. Volkswagen's recall, at a conservative €200 per vehicle in parts, logistics and workshop time across 2.9 million cars, lands north of half a billion euros. That is the exchange rate between a microns-level spec relaxation and a decade-later invoice, with interest compounded.

Governing time you cannot compress

No cabinet gives you twelve honest years before launch. What you can govern is the process that ships today. Three moves, none of them costing a rounding error against one recall.

Tie re-validation to process change, not drawing change. Material substitution, coating system, pretreatment chemistry, joint geometry, line speed in the cure oven – any of these, at any tier, should trigger at minimum a delta-validation, and the trigger must reach the sub-tier coater. A VDA 6.3 process audit that never walks the coating line has audited half the corrosion plan.

Treat warranty returns as your slowest test rig. At SNOP we took defect costs down 70%, and the warranty-parts loop did a disproportionate share of the work: field parts on the QRQC table within days, claims coded by failure mechanism – crevice, galvanic, filiform, cosmetic – not merely by part number. A coded claims database is a twelve-year corrosion test you are already running for free. Most manufacturers run it and never read it.

Listen to the fleet. Corrosion announces itself years before perforation: rising actuator currents, sensor plausibility faults, connector resistance drift. That telemetry is corrosion data nobody has labelled as such. When the field signal arrives, run it through QRQC and 8D like any other escape – because that is exactly what it is.

Key takeaways

  • Salt-spray hours are a correlation model, not evidence – manage the correlation between cabinet ranking and field performance with the same rigour as the test itself.
  • The drawing is not the process: build re-validation triggers for coating, pretreatment, material and joint-geometry changes at every tier, not only for engineering changes.
  • Warranty claims coded by corrosion mechanism are a free long-duration test rig – put field parts through QRQC within days, not quarters.
  • Coating cost-downs must carry their future recall exposure in the business case: cents saved per part against €200-plus per vehicle if the correlation breaks.

The recall now running will cost Volkswagen more than every salt-spray cabinet it will ever buy. That is the economics of a quality system that samples only today: it performs beautifully through start of production, then apologises in year eight, to customers who never knew your launch date but know your brand. A quality system that governs process drift the way it governs drawings buys those years back. Somewhere in every plant sits the one machine that tells the truth about the future, and nobody has booked time on it since PPAP.