Case file
- What happened: Takata airbag inflators ruptured during deployment after the ammonium-nitrate propellant degraded through long-term heat and humidity exposure, spraying metal fragments into vehicle occupants.
- Scale: The largest automotive recall in history — roughly 100 million vehicles across 19+ automakers, with multiple deaths and hundreds of injuries reported worldwide.
- Root cause: A cost-driven propellant with a known environmental vulnerability, compounded by internal test data anomalies that were identified years before the first recall but never escalated into corrective action.
- The bill: Takata filed for bankruptcy in 2017. Total industry recall and settlement costs are estimated in the tens of billions.
The situation
Takata was one of the largest airbag suppliers in the global automotive industry, delivering inflators to Honda, BMW, Toyota and roughly nineteen other manufacturers. To meet aggressive cost and volume targets, the company used ammonium nitrate as the propellant in its inflators – cheaper than alternatives, but with a known characteristic: it is hygroscopic. It absorbs moisture from the air and changes behaviour over time.
This is not obscure chemistry. Ammonium nitrate's sensitivity to humidity and temperature cycling is documented in materials science literature going back decades. The engineering question was never "will it degrade?" but "how fast, under what conditions, and is that rate within acceptable tolerance for the full service life of the vehicle?"
How it unfolded
The first known rupture incidents began surfacing in the mid-2000s. Field failures – inflators that exploded rather than deflating in a controlled manner – went through the standard automotive quality loop: 8D reports, customer complaints, field-return analysis. The pattern was treated as isolated. Regional recalls began around 2008, initially limited to high-humidity markets. The assumption was that the problem was geographically bounded.
It wasn't. As vehicles aged, the same degradation appeared in temperate climate zones. Internal testing had already produced anomalous results – degradation rates that exceeded design assumptions – but those results did not trigger a design change, a propellant substitution, or a systemic escalation. The recall expanded repeatedly. By 2013, NHTSA was investigating. By 2015, the scale was undeniable. Takata filed for bankruptcy in 2017.
Root-cause anatomy
The technical root cause is straightforward. Ammonium nitrate, exposed to long-term thermal cycling and humidity, breaks down. The degraded propellant burns faster than intended during deployment. Over-pressurisation exceeds the burst strength of the inflator housing. The housing ruptures, and metal fragments exit through the airbag cushion into the occupant compartment.
The organisational root cause is more disturbing. Internal test data – including results that showed abnormal degradation – existed years before the scale of the problem was publicly acknowledged. The data was there. The escalation was not. On the technical side, the propellant degraded under environmental conditions not fully captured in design validation. On the organisational side, anomalous test results never triggered a corrective-action loop with the authority to change the design.
A quality system that generates the right data but lacks the governance to act on it is not a quality system – it is a liability with a dashboard.
Where the quality system failed
The propellant's humidity sensitivity was a known failure mode. Any honest PFMEA should have rated severity at 10 – this can kill the occupant. With occurrence and detection driving the RPN, that rating should have forced a mandatory design change. Whether the cost advantage of ammonium nitrate created pressure to under-rate the risk is a question for investigators. The rating was wrong either way.
APQP environmental robustness testing should simulate long-term humidity and thermal cycling representative of real-world service life. Not just the qualification test window. If the protocol tests for months but the vehicle lives fifteen years in Florida, the gate failed.
Then there is the CAPA loop. Anomalous test results are audit triggers. What escalation threshold exists for a test anomaly that contradicts the design assumption? If there isn't one, the loop is broken by design. And the OEMs received inflators from Takata with limited visibility into sub-tier material choice – supplier quality blind to the propellant chemistry inside a safety-critical component.
What would have caught it
Three mechanisms. Any one would have changed the trajectory.
A formal design-review gate where the propellant choice is challenged against long-term environmental data – not just qualification results. Materials-science expertise in the room, with the authority to reject. The cost benefit weighed against documented degradation behaviour, not assumptions.
A hard rule in the quality manual: any test result exceeding design assumptions by a defined margin triggers an automatic 8D and a temporary production hold pending review. No exceptions, no management override.
And long-term field correlation – a structured programme that correlates warranty data, field returns and regional climate data with original design assumptions, fed back into the PFMEA annually. Not a reporting exercise. A governance input.
My take
I've spent twenty years in automotive and aerospace quality – SNOP, WITTE Automotive, Airbus, consulting for ArcelorMittal and others. I have never seen a catastrophic failure that wasn't visible in the data beforehand. I have seen several where the data was ignored, buried, or routed around.
The pattern is always the same. Someone in testing knows. The anomaly shows up. A report is filed. The report lands in a queue. The queue has no owner with the authority to stop production. Commercial pressure – launch dates, cost targets, customer commitments – creates a gravitational field that pulls every anomaly toward "acceptable risk" until the field failure makes it undeniable.
At SNOP, I built a greenfield quality department for 900+ employees. The first rule I established: every anomaly exceeding a defined threshold hits my desk within 24 hours. Not because I'm smarter than the engineers – because authority has to live somewhere, and if it doesn't, commercial pressure fills the vacuum. At Airbus, I've seen what happens when routing-verification KPIs are treated as governance rather than reporting. A 97% reduction in internal lead time, because the data actually drove decisions instead of decorating a wall.
Takata had the data. What it didn't have was a governance structure that could override the cost incentive.
What this means on your floor
- If your PFMEA carries a failure mode with severity 9 or 10 that you haven't designed out, your design is not complete – it is deferred.
- Define a hard escalation threshold for anomalous test data. Write it down. Give it an owner with stop-production authority. Audit it.
- Ask whether your APQP validation represents the full service environment – fifteen years in humidity – or only the qualification window.
- Map your sub-tier component risks. If your supplier quality team cannot name the critical material in a safety-critical component, you have a blind spot.
Takata didn't fail because the chemistry was unknown. It failed because the system that was supposed to act on it had no mechanism and no mandate. The deaths were preventable. The bankruptcy was the terminal Cost of Poor Quality, paid in lives first and money second. When the data tells you something you don't want to hear, does anyone on your floor have the authority to act on it?
