Restraints, Crash and Safety Management (Overview) BMW M6 E63/E64

ADVANCED CRASH AND SAFELY MANAGEMENT (ASCM)

Model: E60/61/63/64/85

Production: from 9/2005 (1/2006 E85)

Introduction

Advanced Crash and Safety Management (ACSM) replaces Advanced Safety Electronics (ASE) in several model series.

ACSM will be used in the following vehicle models as of September 2005

1. BMW 5 Series E60 / E61 US
2. BMW 6 Series E63 / E64 US

ACSM will be also be introduced in the following model in January 2006

1. BMW Z4 - E85

The system functions of the previous ASE have been taken over. The essential structure of ACSM is the same as that of the Multiple Restraint Systems (MRS) in other vehicle models.

Because the basic control unit functions are the same for all ACSM systems and only differ in their respective configurations of the systems, the system functions will be described by way of example on one model only.

Many functions will be known to you if you already have system knowledge of Advanced Safety Electronics (ASE) or the Multiple Restraint Systems (MRS).

History of Restraint Systems at BMW

Passive safety was revolutionized by the introduction of the seat belt in the 1960s and the development of the airbag in the 1970s and 1980s.

Passive safety has been decisively improved ever since BMW introduced the driver's airbag in its vehicles in the mid-1980s.

In its capacity as an innovative pioneer in the field of passive safety systems, BMW was not satisfied just with the introduction of the airbag, and proceeded to develop its own all-encompassing safety concept F.I.R.S.T.

F ully I ntegrated R oad S afety T echnology is a safety concept which takes into account the environment, the vehicle and the person.

Great importance is attached to the avoidance of accidents. This is achieved by means of numerous active safety systems. These include

Scheme 49

1. Good headlight systems such as xenon lights or adaptive headlights.
2. Advanced chassis and suspension with powerful brakes.
3. Driver assist systems such as Dynamic Stability Control for directional stability in emergency situations.
4. Anti-lock braking systems with dynamic brake control in panic-braking situations.

Development of ISIS into ACSM

The number of interfaces to the control units have multiplied as a result of the rapid and continuous development of new passive safety components in the 1990s. At that time, the increase in the number of sensors and actuators in the control units were limited by the computing performance of the microcontrollers.

The sensors and actuators were spread out over various control units in order to make available to the customer the maximum possible levels of passive safety.

This resulted in the development of the Intelligent Safety Integration System (ISIS) in the E65. The control units were interconnected via an ultra fast optical bus system, the byteflight .

With the launch of the E60, Advanced Safety Electronics (ASE) was used as the passive safety system. ASE is based on the technology of Intelligent Safety Integration System (ISIS) with the byteflight .

Scheme 50

Due to the rapid further development of microcontrollers with ever greater computing performance and speed, it is now possible to process and calculate all the functions in one or two microcontroller in one control unit. Because of this, Advanced Crash and Safety Management (ACSM) will be introduced from 09/2005 in all 5 Series and 6 Series models and from 01/2006 in the E85 MU.

ACSM is characterized by the fact that it fulfills the same range of functions as the ASE system. The ASE system consists of seven individual ECUs. ACSM consists of only one ECU, the Crash Safety Module. The use of a single ECU delivers the following benefits

1. Reduced number of ECUs
2. Reduced weight
3. Easier diagnosis
4. Easier programming/updates.

Revised Bus Structure

The following bus overview provides you with an overview of the vehicle electrical system structure and the integration of Advanced Safety and Crash Management in the K-CAN.

Notice the byteflight bus has been eliminated.

Scheme 51

Purpose of ACSM

Advanced Crash and Safety Management

The task of ACSM is to detect accident situations critical for the vehicle occupants and to activate the necessary restraint systems selectively corresponding to the crash severity.

The Crash Safety Module performs internal diagnosis and monitors all inputs and outputs. Any faults that may occur are stored nonvolatile in the Crash Safety Module and indicated to the driver by way of the airbag warning lamp (AWL) in the instrument cluster.

Communication with other ECUs in the vehicle's system network is effected via the K-CAN in the 5 Series and 6 Series models and via the K-bus in the Z4.

In the event of a crash, a K-bus telegram is transmitted (provided ASSIST option operational) via an additional separate data line to the Telematic Control Unit (TCU) and the emergency call triggered.

The Crash Safety Module can be coded via the K-CAN or the K-bus.

Diagnosis of the Crash Safety Module is effected via the diagnosis bus to the gateway, which in K-CAN cars (5 Series, 6 Series) is located in the body gateway module (KGM) in the device holder behind the glovebox. In the Z4 the gateway is located in the instrument cluster, which then passes on the diagnosis commands to the K-bus.

Scheme 52

Scheme 53

Scheme 54

Scheme 55

Scheme 56

Scheme 57

Scheme 58

Scheme 59

Crash Safety Module

Advanced Crash and Safety Management essentially comprises the following components

1. Crash Safety Module
2. Sensors and switches
3. Actuators

The Crash Safety Module is located centrally on the transmission tunnel in the vehicle. It consists of a die-cast housing with integrated plug cover.

The Crash Safety Module contains two acceleration sensors offset at an angle of 90°.

These acceleration sensors measure the longitudinal acceleration and transverse acceleration of the vehicle.

Crash Safety Module Variants

The E64 Convertible utilizes a different hardware variant than the E63 because of the additional rollover sensor system in the Crash Safety Module.

The E60, E63, and E85 vehicles use the same variant control unit. They differ in their coding.

Scheme 60

ROC ECU

In the E64 Convertible, Advanced Crash and Safety Management is equipped with an additional ROC control unit (Rollover Controller). It is connected to ACSM via a K-bus.

The task of the ROC control unit is to activate the actuators of the rollover protection system in the event of an imminent rollover situation.

Rollover detection takes place in the Crash Safety Module. Two telegrams are sent to the ROC control unit when the threshold values are reached.

The ROC control unit activates the two rollover protection bars in the event of the vehicle rolling over/overturning.

Scheme 61

Diagnosis

The ROC control unit is not directly diagnosis compatible. It monitors itself internally. The two circuits for the actuators are also monitored by the ROC. In the event of a fault, the ROC transmits the fault to the ACSM Crash Safety Module, where the fault is stored in the fault memory. ACSM activates the airbag warning lamp in the instrument cluster.

Sensors and Switches

In addition to the two sensors in the Crash Safety Module, the system makes further use of the following sensors and switches to evaluate the crash severity and the corresponding triggering strategy

1. B-pillar satellites
2. Up-front sensor
3. Door pressure sensor
4. OC3 mat
5. Seat belt buckle switches
6. Airbag switch
7. Emergency call button

B-pillar Satellite

The B-pillar satellite consists of a longitudinal acceleration sensor and a transverse acceleration sensor.

The acceleration sensors measure the positive acceleration and the negative acceleration (deceleration) in the X and Y directions. The resultant from the X and Y signals is the definitive factor in determining the direction of the impact.

The B-pillar satellites serve the purpose of detecting front-end, side-on and rear-end crashes.

The B-pillar satellites on the left and right are of identical design and are allocated by way of mechanical coding during installation.

Scheme 62

Note. Visually, the B-pillar satellites are similar to those of the E83 (MRS4 RD), however, these satellites must not be used as they transmit different data protocols. It is important to make sure the part number is correct. The airbag warning lamp AWL comes on if the incorrect satellites are installed.

Digital Data Transmission

The recorded acceleration values of the micro-mechanical acceleration sensors are converted in an ASIC (Application Specific Integrated Circuit) into digital signals. With the aid of a data telegram, the digital signals are transmitted unidirectionally to the Crash Safety Module.

The signals are transmitted via a current interface, which supplies the electronic circuitry with voltage.

The electronic circuitry receives a voltage level of approx. 5-10 mA via the current interface. The level rises at a step of 20 mA when a data telegram is transmitted so that only two lines per measurement channel are required.

The transmitted data are evaluated in the Crash Safety Module.

New sensor system for front-end, side-on and rear-end crash detection. Airbag switch and OC3 mat for deactivating the passenger airbags.

Up-front Sensors

The up-front sensors in the front end on the left and right sides serve to detect a front-end crash.

They deliver the initial information on the progress and severity of the collision to the Crash Safety Module.

Scheme 63

Each up-front sensor consists of an acceleration sensor for recording the deceleration, a signal conditioner and an ASIC for data transmission.

The values are sent in the form of a data telegram to the Crash Safety Module and are used in the calculation of the algorithm (transmitted same way as B-pillar satellites).

Door Pressure Sensors

The door pressure sensors in the front doors serve the purpose of verifying the plausibility of the acceleration signals from the B-pillar satellites and the Crash Safety Module during side-on crash detection.

Scheme 64

The door pressure sensors are situated in the inner panels of the front doors and measure the increase in pressure in the event of a side-on impact.

In the event of a side-on impact with the door, the outer door panel is pressed inward, thus reducing the inner door space and increasing the pressure. This change in pressure is measured by the door pressure sensors.

The door pressure sensor also includes an electronic module, which digitizes the pressure values and transmits them cyclically to the Crash Safety Module. The data are transmitted in the same way as the B-pillar satellites.

OC3 Mat

US legislation stipulates that the use of a child seat with a one-year old child on the front passenger's seat must be detected automatically and the front passenger airbag disabled.

Scheme 65

The OC3 mat can detect a child seat tested in accordance with the regulation (NHTSA FMVSS 208) on the basis of the pressure per unit area and disable the passenger airbag (front and side airbag). Deactivation is indicated by the Passenger Airbag OFF light.

Emergency Call Button

If fitted, the emergency-call button is directly attached to the TCU for initiating calls.

Scheme 66

Seat belt Buckle Sensors

The seat belt buckle sensors signal whether the seat belts are fastened or not. These transmit signals to the Crash Safety Module and are used for triggering the required restraint systems and for the seat belt reminder function.

The seat belt buckle sensors are located in the seat belt buckles of the driver's and front passenger's seat.

The seat belt buckle sensor is designed as a two-wire Hall-effect switch. The Crash Safety Module powers the Hall switch via a current interface. The current intake of the switch varies depending of whether the seat belt is fastened or not. The seat belt buckle switch is permanently monitored as from terminal R "ON".

Airbag Switch

E85 vehicles are equipped with an airbag switch which can be used to manually disable the passenger front airbag and the passenger side airbag.

Scheme 67

The airbag switch is located on the outer right side of the instrument panel.

The airbag switch is also a two-wire Hall-effect switch that is powered by the Crash Safety Module via a current interface.

Actuators

The Crash Safety Module is responsible for activating the following actuators

1. Front airbag, 2-stage, driver's side
2. Front airbag, 2-stage, passenger side
3. Head airbag, left and right
4. Side airbag, front, left and right
5. Side airbag, rear, left and right
6. Knee airbag, front, left and right
7. Seat belt tensioner, front, left and right
8. Seat belt tensioner, rear, left and right
9. Anchor-fitting tensioner, driver's side
10. Active head restraint
11. Safety battery terminal
12. Rollover protection bars

The following warning lamps are additionally activated

1. Airbag warning lamp AWL
2. Seat belt mannikin
3. Passenger Airbag OFF light (POL)

Front Airbag, Driver

In conjunction with the seat belt, the driver's front airbag is designed to reduce the risk of serious injury to the driver's head or thorax during a head-on collision. The front airbag for the driver's side is located in the hub cushion of the steering wheel. The driver front airbag is equipped with a 2-stage inflator assembly.

Scheme 68

The two stages of the airbag are triggered with a time delay depending on the crash severity.

The two stages of the inflator assembly facilitate a restraint function adapted to the crash severity and consequently reduce additional stress on the occupants during the development phase.

Front Airbag, Passenger

Together with the seat belt, the task of the front airbag on the passenger's side is to reduce the risk of serious injury to the front passenger during a frontal crash. The 2-stage front airbag on the passenger's side is located under the instrument panel.

Inflation of the front passenger airbag breaks the instrument panel at defined points and opens a flap, which is connected to the instrument panel by means of a fabric strap.

The passenger airbag opens in the direction of the windscreen. The passenger airbag emerges in an upward direction and is supported on the windscreen and on the instrument panel.

Head Airbag

The tried-and-tested Advanced ITS (Advanced Inflatable Tubular Structure) is used as the head airbag in the E60, E61 and E63 vehicles.

The Advanced ITS extends from the A-pillar up to the C-pillar and covers the entire side section at head level. The head airbag inflates between the occupants and side windows or side trim panels.

In conjunction with the side airbags at front and rear, it offers optimum protection for the occupants on the impact side in the event of a side-on collision.

The Advanced ITS reduces the outward movement of the head during a side-on crash.

This results in lower neck shear forces as well bending moments in the cervical vertebrae. It additionally avoids direct contact with the side structure or the obstacle thus reducing the risk of head injuries.

The Advanced ITS is housed in the roof area. It consists of a fabric tube, around which an additional sail has been fastened. The sail is secured to the roof frame and is fastened in a downward direction by the fabric tube.

In the event of a side-on collision, the gas generator (inflator) mounted on the A-pillar is fired. The gas flows out of the pressurized container through the gas lance into the fabric tube. The fabric tube expands to a diameter of approx. 130 mm and in so doing shortens in length.

The head airbag is brought into position because the fabric tube is mounted on the A-Pillar and the C-pillar. The sail extends between the side window and side trim panel and the occupants. The high tensile forces in the fabric tube pull the sail downwards, which increases the stability of the sail.

The closed system retains the structural strength and stability of the Advanced ITS curtain for several seconds. This is particularly advantageous when the vehicle rolls over.

Side Airbag

For many years now, the side airbag has been used at BMW as an important integral part in occupants safety and protection systems. The task of the side airbags is to minimize the risk of injury to the driver/front passenger in the trunk/torso area in the event of a side impact.

The side airbag is located folded up with the gas generator in an aluminium housing with plastic cover, the airbag module. The airbag module is secured in the inner door panel behind the door trim panel. The door trim panel has a tear seam through which the side airbag emerges in the event of a crash.

The side airbag is triggered in response to a sufficiently strong pulse from the side. The side airbag emerges through the tear seam and inflates between the door and occupant. The air cushion between the door and occupant provides controlled damping and therefore reduces load/strain on the occupant.

Knee Airbag

Knee airbags are used on the driver and passenger sides in the E63, E64 and E85.

In the event of a crash, the knee airbag is intended to support the knees, particularly if the driver or front passenger is not wearing their seat belt. This initiates a controlled forward shift of the upper body, which is cushioned by the relevant airbag.

The knee airbag on the driver's side is located behind a cover under the steering column.

The knee airbag on the front passenger side is located in the E63 and E64 behind a cover in the glovebox flap. In the E85 it is located above the glovebox.

Scheme 69

The gas generator is fired in the event of a crash of sufficient severity. The inflow of gas fills the airbag located between housing and cover. The airbag forces the cover towards the occupant as it inflates. Several retaining straps hold the cover in position in front of the air cushion.

The passenger's knees make contact with the cover. The load is distributed over the airbag through the cover, thus supporting the passenger.

The knee support results in controlled forward displacement of the upper body that is taken up by the driver or passenger airbag.

Seat Belt Tensioners

The task of the pyrotechnic seat belt tensioner is to minimize the seat belt slack in the pelvis and shoulder areas in the event of a crash, thus also preventing "submarining", i.e. slipping under a slack seat belt.

The seat belt tensioners are located on the driver's, front passenger's and left and right rear seats. The seat belt tensioners are fired in the event of a front- or rear-end crash. In the E64 they are also activated in the event of an imminent rollover.

The mechanical seat belt force limiter in the seat belt retractor reduces the chest load on the occupant. The seat belt tensioner and force limiter are mutually matched.

Scheme 70

Active Head Restraint

All E60 and E61 vehicles equipped with comfort seats come with active head restraint.

Comfort seats offer a wealth of adjustment options to provide the customer with the ultimate possible levels of comfort. These include adjustment of the backrest head. The head restraint, the height of which is electrically adjustable, is secured to the backrest head.

The option of adjusting the backrest head means that there is the possibility that the gap between the head and head restraint increases. In the event of a crash, the gap would be relatively large, leading to greater strain on the cervical vertebrae.

The active head restraint is used for this reason. In the event of a crash, this reduces the gap between head restraint and head and thus the strain on the cervical vertebrae.

The active head restraint consists of a support tube which is fitted on bearings on the side of the head restraint. The support tube serves to accommodate the head restraint and the adjustment mechanism.

The adjustment mechanism consists of a retaining plate and a sliding element. Between these two parts is the gas generator. The gas generator has a plunger and plunger rod. In the event of a rear-end crash, the firing pellet is activated and burns off the solid propellant; the gas created in this process presses against the plunger. The plunger rod moves out and shifts the sliding element.

The support tube and thus the head restraint are moved forwards via the connecting link.

This reduces the gap between the head restraint and the occupant's head.

Note. If the active head restraint has been triggered in a crash, only the gas generator needs to be replaced to return the system to normal function.

Safety Battery Terminal

The safety battery terminal is triggered at different thresholds when the Crash Safety Module detects a front-end, side-on or rear end crash of sufficient severity. The connection between battery and starter/alternator cable is then separated by pyrotechnical teams. At the same time, the alternator is switched off by means of a crash telegram sent to the DME. The safety battery terminal is located directly at the positive terminal of the battery.

Rollover Protection System

The rollover protection system consists of two extendable rollover bars which are housed in a carrier structure behind the two rear seats. The carrier structure is bolted to the rear seat panel.

Scheme 71

Airbag Warning Lamp

The airbag warning lamp (AWL) is located in the instrument cluster. Advanced Crash and Safety Management system operability is indicated by the AWL going out. The AWL is controlled by means of a telegram on the K-CAN.

Scheme 72

Passenger Airbag OFF Light

In the E60, E61, E63 and E64 vehicles the Passenger Airbag OFF light is located in the central roof area of the vehicle (FZD) at the front next to the interior lights. In the E85 the Passenger Airbag OFF light is located in the center console.

The Passenger Airbag OFF light is activated and lights up yellow when the front passenger airbag and the side passenger airbag are deactivated.

The brightness of the Passenger Airbag OFF light is regulated by the automatic display lighting.

Scheme 73

Scheme 74

Principles of Operation

The task of Advanced Crash and Safety Management is to evaluate permanently all the sensor signals in order to identify a crash situation. As a result of the sensor signals and their evaluation, the Crash Safety Module identifies the direction of the crash and the severity of the impact.

Also included is information on the occupants and whether they have their seat belts fastened or not. From this information, measures are taken to selectively trigger the necessary restraint systems.

In order to ensure ACSM operational availability at all times, the system monitors itself and indicates that it is ready for operation when the airbag warning lamp (AWL) goes out.

If a fault occurs during operation, this is stored in a fault memory, which can then be read out for diagnostic purposes.

In the event of a crash, this is communicated to the other users in the bus-system network by way of a bus telegram. The relevant control units respond to this telegram by executing their own activities.

These activities include

1. Opening the central-locking system
2. Activating the hazard warning flashers
3. Switching on the interior lights
4. Deactivating the fuel pump
5. Switching off the alternator
6. Automatic emergency call

The functions of the ACSM Control unit are

1. Monitor the battery cable leading to the engine compartment for short circuits. This monitoring function is required in vehicles whose battery cable is laid directly next to the fuel line along the underbody. In the event of a short circuit, the battery cable is disconnected by the safety battery terminal.
2. Seat belt reminder function, which uses optical and acoustic signals to remind the driver and front passenger to fasten their seat belts. If a child seat is to be used on the front passenger seat, the front and side airbags on the front passenger side can be deactivated by means of a key-operated switch (E85 Z4).
3. Detect accident situations critical for the vehicle occupants and to activate the necessary restraint systems selectively corresponding to the crash severity. ACSM performs an internal diagnosis procedure and monitors all input and output signals.

The E64 Convertible has an additional sensor system in the Crash Safety Module for rollover detection. In the event of an imminent rollover scenario, the ROC ECU receives a signal via the K-bus to activate the rollover protection system.

Any faults are stored and indicated to the driver.

Crash-Relevant Functions

The Crash Safety Module must fulfill the following crash-relevant functions

1. Evaluating the sensor signals
2. Detecting a crash and determining the triggering times and the order
3. Triggering the output stages of the firing circuits
4. Output of a crash telegram for other users in the communication system network
5. Crash entries
6. Emergency call functions
7. E64 Convertible rollover protection system

Evaluating the Sensor Signals

The sensor system of Advanced Crash and Safety Management is essentially the same in all models. It differs only in terms of the different crash-test requirements for specific markets (example: EU and US vehicles).

The Crash Safety Module incorporates a longitudinal-acceleration sensor and a lateral acceleration sensor. The sensors serve to detect and verify front-end, side-on and rear-end crashes.

In the E64 Convertible the Crash Safety Module has additional sensors for rollover detection.

Satellites are also integrated in the B-pillars. The satellites each consist of a longitudinal acceleration sensor and a lateral acceleration sensor.

Together with the lateral acceleration sensor in the Crash Safety Module, the lateral acceleration sensors serve to detect side-on crashes.

Door pressure sensors are also used in the front doors to detect side-on crashes.

Together with the longitudinal-acceleration sensor in the Crash Safety Module, the longitudinal-acceleration sensors serve to detect front- and rear-end crashes.

The acceleration sensors measure the positive acceleration (+) and the negative acceleration (- / deceleration) in the X and Y directions. The resultant from the X and Y signals is the definitive factor in determining the direction of the impact.

The vehicles have additional up-front sensors for front-end crash detection.

Scheme 75

Detecting a Crash

The Crash Safety Module uses the values transmitted by the sensors to determine the direction and severity of the crash.

The threshold values of two independent sensors must be detected in order to detect a crash. In the case of a front-end crash, for example, the acceleration values from the B- B-Pillar satellite and from the longitudinal acceleration sensor must be detected in the Crash Safety Module.

Based on the crash severity and direction, an algorithm determines the triggering (firing) points and the order of the restraint systems to be activated.

Triggering the Output Stages

The firing-circuit output stages are only triggered if the corresponding thresholds are detected by two different sensors, e.g. the B-pillar satellite and the Crash Safety Module.

From terminal status R "ON" the Crash Safety Module is supplied with power by Comfort Access System 2 (CAS2) and is ready for operation on completion of the system self-test.

The firing capacitors, which also serve as an energy reserve, are charged up by a switching controller. These capacitors make the firing energy available in the event of a crash. If the voltage supply is interrupted during a crash, the firing capacitors serve briefly as an energy reserve.

The output stages of the firing circuits consist of a high-side and a low-side power circuit breaker. The high-side power circuit-breaker controls the firing voltage, while the low-side power circuit-breaker switches to ground. The output stages of the firing circuits are controlled by the microprocessor.

The high-side and low-side power circuit breakers also serve the purpose of checking the firing circuits during the system self-test.

Output of Crash Telegram

In the event of a crash involving triggering of the restraint systems, the Crash Safety Module sends a crash telegram to the users in the bus-system network.

As a result, the respective control units perform the following functions corresponding to the crash severity

CONTROL UNITS FUNCTIONS CHART

Crash Entries

In the event of a crash where one or more actuators are triggered, a crash entry is stored in a non-erasable memory. After three crash entries, a non-erasable fault entry is stored in the fault memory with the instruction to replace the Crash Safety Module.

Note. The three crash entries could also be stored during the course of an accident. Each crash entry is assigned a system time. The ECU remains capable of firing even after three crash entries. The crash entries cannot be erased and serve the purpose of subsequent device diagnosis. A maximum of three crash entries can be stored. The control unit must then be replaced.

Emergency Call Functions

If the vehicle is equipped with a TCU, the vehicle will have a manual and automatic emergency-call functions. In addition, the customer also has the option of activating a breakdown call.

Automatic Emergency Call

The Crash Safety Module sends a crash telegram to the TCU in the event of a crash of corresponding crash severity. The TCU places an emergency call, which at the same time contains the location of the vehicle.

Parallel to this, attempts are made to set up a voice connection with the vehicle occupants to obtain more information on the accident (severity of the accident, number of injured) so that further rescue operations can be initiated.

Manual Emergency Call

The emergency-call button is located in the roof console. The emergency-call button is connected directly to the TCU. Pressing the emergency-call buttons establishes a voice connection with the relevant country provider.

The voice connection is indicated by a flashing LED in the switch.

Rollover Protection System (E64)

The rollover protection system is of vital importance to the passive safety of an E64 Convertible. The rollover protection system helps to try and maintain sufficient survival space for the occupants in the event of the car overturning or rolling over.

There are different factors which can cause a car to overturn or roll over. The most common causes are

1. The car hits a ramp (e.g. a crash barrier) on one side. The car rotates about its longitudinal axis as a result of the high angular velocity.
2. The car skids sideways off the road surface and buries itself with its wheels in the soft soil. The kinetic energy could be sufficient to upend and overturn the car.
3. The car skids sideways off the road into the curb and is upended.

The crucial factors which determine whether the car overturns are not just the angle but also the angular velocity at which the car is set into the roll. All these vehicle movements can also occur after a front-end, side-on or rear-end crash.

The rollover protection system consists of two extendable rollover bars which are housed in a carrier structure behind the two rear seats.

Rollover Detection

The E64 Convertible is equipped with a special Crash Safety Module. The module incorporates a special sensor system for detecting rollover situations. On top of the two sensors (4) for longitudinal (X-axis) and lateral acceleration (Y-axis), there is a yaw-rate sensor (2) and a LOW g sensor (3) for the Z-axis and for the Y-axis.

The longitudinal - and lateral-acceleration sensors (4) record the positive and negative vehicle acceleration in a measuring range of 0-100 g. They serve to detect heavy acceleration and deceleration in a crash.

The two LOW-g sensors (3) have a small measuring range of 0-2 g and can therefore detect small accelerations and decelerations with great accuracy. For example, when the vehicle skids sideways off the road surface and buries itself with its wheels in soft ground.

The sensors provide a voltage as measured variable. This voltage is a measure for the acceleration and is converted directly into digital signals in the sensor. The digital values are sent to the processor for evaluation.

The processor evaluates the signals from the longitudinal - and lateral-acceleration sensors and the two LOW g sensors. The yaw-rate sensor is also included in the calculation. The results are compared with the stored algorithm. When the processor detects that a rollover is imminent, it sends two telegrams within a defined timeframe to the ROC ECU with the instruction to trigger the actuators.

Scheme 76

Yaw-Rate Sensor

A yaw-rate sensor is used to detect rollover.

The yaw-rate sensor has a comb-like structure. It consists of a fixed comb structure (3) and a rotational oscillator (2) with a moving comb structure. Together, the comb structures for a capacitor. The rotational oscillator is fitted on bearings on a shaft (1) in its center.

Scheme 77

When the vehicle is in a horizontal position, the rotational oscillator turns within the comb structure and detects the change of direction (left/right). If the vehicle is brought into a tilting position (e.g. on a slope), the rotational oscillator is moved out of the comb structure due to the Coriolis effect.

This causes a change in capacity, which in turn creates a change in voltage proportional to the deflection of the rotational oscillator in the mV range, which is evaluated as the measured variable.

The voltage change is directly related to the angle and, in the same way, the speed of the voltage change is directly related to the angle velocity. The angle and the angle velocity are the measurements used for the algorithm calculation.

The voltage values are directly converted into digital values in the yaw-rate sensor and sent to the main processor for evaluation.

Triggering the Rollover Protection Bars

The ROC control unit is supplied with load current via terminal 30. Terminal R ON is applied as the switching signal and enables the power circuit-breaker (7). In this way, the voltage regulator (8), the microprocessor (10) and the switching controller (4) are supplied with voltage. The switching controller transforms the voltage into 35 V and charges up the two firing capacitors (3).

When the processor in the Crash Safety Module detects an imminent rollover, it sends two telegrams within a defined time window via the K-bus.

The first telegram instructs the ROC ECU to make itself ready for firing (arming telegram).

The ROC ECU incorporates two firing capacitors (3) connected in parallel for providing the firing energy. Each actuator has one high-side and one low-side power circuit breaker.

The second telegram contains the firing command (firing telegram). The low-side power circuit-breakers (6) are connected to ground and the two high-side power circuit breakers (2) are switched through. The ROC ECU now discharges the two firing capacitors and the two actuators are supplied with voltage.

Scheme 78

In normal operating mode, the protection bars are retracted in the support structure. They are pre-tensioned in the direction of their extension by a spring and held in place by a lock on the actuator. The ROC ECU activates the two actuators via the output stages.

Each actuator consists of a single-acting solenoid with a lock for disengaging and engaging its rollover protection bar. The solenoid actuates the lock and releases the spring-loaded protection bar.

The locking pawls on the protection bar press the toothed strip back mechanically as the bar extends. When the protection bar is extended, the locking pawls are supported on the tooth strip. When the car is in the overturned position, the force is transmitted via the locking pawls on the protection bars to the toothed strip.

The rollover protection system may be triggered as follows

1. Automatically when an imminent rollover situation is detected
2. By a defined crash severity in a front-end, side-on or rear-end crash
3. Via the diagnostic interface
4. By a mechanical emergency release mechanism

In order to return the triggered rollover protection bar back into its initial position, it is necessary to press the toothed strap back so that the bar can be pushed in.

Triggering by Diagnosis

To check the function of the rollover protection system, it is necessary to trigger the system using DISplus or GT1. The output stages of the actuators are activated here with the aid of a test module.

1. Open the convertible top
2. Make sure no-one is situated in the immediate vicinity of the protection bars.

Mechanical Emergency Release

The RSS should be triggered if it has to be removed for repair work. If this cannot be done electrically, e.g. for repair work following an accident, the system must be triggered mechanically in order to avoid the risk of injury.

Follow the procedure set out below

1. Open the convertible top
2. Open the rear lid/hatch
3. Remove the luggage compartment floor mat and the luggage compartment trim panel of the partition wall
4. Access the actuator by inserting a hook (3 mm diameter.) through the opening in the cross-member
5. The actuator has an opening in the middle, by means of which the rollover protection bar can be triggered using the hook (very difficult).

System Monitoring Functions

The Crash Safety Module must execute the following system monitoring functions

1. System self-test (pre-drive check)
2. Cyclic monitoring
3. Indication of system operability
4. Fault indication and fault storage
5. Fault output (diagnosis)
6. Battery-cable monitoring
7. Seat belt reminder function
8. Deactivation of passenger airbags
9. E64 Convertible seat-back locking

System Self-Test (pre-drive check)

ACSM performs a system self-test as from terminal R "ON". The airbag warning lamp is activated for approx. 5 seconds. during the system self-test.

When the system self-test is concluded and no fault has been found, the airbag warning lamp goes out and the system is ready for operation.

Cyclic Monitoring

Once the system self-test has been successfully concluded and the system is ready for operation, a cyclic monitoring procedure is performed for fault monitoring purposes.

Cyclic monitoring serves the purpose of internal diagnosis of the ECU and the overall airbag system. Cyclic monitoring is carried out for as long as the system is at terminal R "ON".

Indication of System Operability

ACSM system operability is indicated by the airbag warning lamp (AWL) going out in the instrument cluster.

Fault Indication and Fault Storage

The Crash Safety Module has a non-volatile fault memory. The airbag warning lamp indicates any entry in the fault memory.

A distinction is made between internal and external faults when entering the fault code.

Events such as triggering of the airbag or seat belt pre-tensioner are also stored in the fault memory.

Note. The entry of a triggered restraint system in the fault memory does necessarily mean that the system was defective in a crash situation, it only means that the restraint system is not available for further triggering.

Fault Output (diagnosis)

With the aid of the diagnostic tools (DIS plus, GT1), the fault memory can be read out via the diagnosis interface. After rectifying the faults or after replacing the triggered components, the fault memory can be cleared with the diagnosis command "Clear fault memory".

Battery Cable Monitoring

If the battery-cable insulation is damaged in an accident or when driving over an obstacle (e.g. crash barrier), the battery cable is disconnected from the battery and the generator is switched off. This prevents short circuiting and the possible formation of sparks.

Design of Monitored Battery Cable

Depending on the vehicle type, the battery cable is composed of copper or aluminium and plastic insulation. The plastic insulation is covered with a low-resistance metal mesh, which is called the monitoring shield.

Finally, the battery cable is covered with a second layer of plastic insulation, which forms the outer insulation. The monitoring shield is insulated against both the battery cable and body ground/earth.

Scheme 79

Battery Cable Monitoring Principle

Battery-cable monitoring is performed by means of the low-resistance monitoring shield (2). A connecting cable is led out at both ends of the monitoring shield. One connecting cable is connected to the safety battery terminal in the luggage compartment while the other is connected to the jump-start connection point in the engine compartment.

Both connecting cables are connected to the Crash Safety Module.

The Crash Safety Module incorporates one pull-up resistor and one pull-down resistor or equal size. The internal measuring voltage (UM) is applied at the pull-up resistor (5).

Ground is applied at the pull-down resistor (6). The very low-resistance monitoring shield and the resistors of equal size produce approximately half the internal measuring voltage (approx. UM/2).

In the event of the monitoring shield being damaged and a short circuit to positive or negative, different voltages are applied suddenly at the resistors.

In the event of a short circuit to positive or ground, the safety battery terminal (3) would be triggered and the battery cable (1) disconnected from the battery (4). Likewise the alternator (11) and the fuel pump (9) would be deactivated.

Scheme 80

The safety battery terminal would not be triggered in the following cases

1. Interruption of a connecting cable
2. Damage to the outer insulation and a slow drop in voltage on account of moisture

In these cases, the entry "Implausible measured value" would be stored in the fault memory and the airbag warning lamp (AWL) in the instrument cluster would be activated.

Seat Belt Reminder

The seat belt reminder function in US vehicles differs from its counterpart in EU vehicles in only two respects.

1. Monitoring for the driver is required by law.
2. Monitoring and warning already begin with the vehicle stationary and not after an initial distance of 200 m has been covered.

If with terminal15 the seat belt contact on the driver's side is not closed, an acoustic warning is issued and the seat belt warning lamp activated for 6 seconds.

Deactivation of Passenger Airbags

The front and side passenger airbags must be automatically disabled when a child roughly one year old is sitting on the front passenger seat.

Deactivation and activation of the front passenger airbags is the responsibility of the vehicle driver.

Airbag deactivation is indicated by the yellow symbol lighting up in the Passenger Airbag

Mechanically Deactivating (E85)

The airbag switch is located on the outer right side of the instrument panel. The airbags can only be deactivated when the vehicle is stationary and with the front passenger door open.

Scheme 81

Automatic Deactivation of Airbag (OC3 mat)

The OC3 mat (Occupant Classification) used for the seat-occupancy detector distinguishes between a tested child seat holding a child roughly one year old and a lightweight person.

The OC3 mat consists of conductors in a pressure-sensitive resistance grid, so-called FSR elements (Force Sensitive Resistance).

The conductors are connected to the electronic evaluation unit.

Scheme 82

The FSR elements are wired in such a way that they can be sampled individually. When the mechanical load on a sensor element increases electrical resistance decreases and the measurement current changes accordingly.

By analyzing the signals from the individual sensors, the analyzer can map the occupancy of the seat surface and identify local concentrations of weight. The relationship between the areas and the load points indicates whether there is a person or a child seat holding a child roughly one year old present.

The electronic evaluation unit of the OC3 mat sends a telegram via a separate K-bus to the Crash Safety Module. The front passenger airbags (front and side airbags) are disabled when a child seat with a one-year old child is detected. The Crash Safety Module activates the Passenger Airbag OFF light in the front roof console or on the Z4 in the center console.

Note. The front passenger airbags are not deployed when the front seat is not occupied. However, this is not indicated by the Passenger Airbag OFF light.

Particulars for the BMW Z4

There is the possibility that a customer does not use a tested child seat on the front of the E85 and therefore this seat may not be detected by the OC3 mat.

In this case, the customer must have the option of deactivating the passenger airbags.

For this reason, the BMW Z4 US is fitted with an airbag switch for manual deactivation as well as the OC3 mat.

E64 Convertible Seat Back Locking

Because it has no B-pillars, the E64 Convertible makes use of seats with integrated 3-point seat belts in the seat backs. If the seat back is not correctly locked, there is the danger of the occupant being propelled forwards with the seat back and thus without a restraining action. This would be equivalent to the occupant not having their seat belt fastened.

Scheme 83

Because of this, the driver and front passenger seat backs are monitored for correct locking.

The driver/front passenger seat modules use Hall sensors in the seat backs to monitor the positions of the seat backs. The information is communicated to the Crash Safety Module via the K-CAN connection. This information is used to calculate the triggering algorithm.

The effect on the triggering response of an incorrectly locked seat back would be the same as that of occupant whose seat belt was not fastened.

If the seat backs are not correctly locked, the driver/front passenger seat modules generate the following Check Control messages, which are then sent via the K-CAN to the instrument cluster and the central information display.

INSTRUMENT CLUSTER AND CENTRAL INFORMATION DISPLAY REFERENCE Fixed indicator lamp Variable indicator lamp CC message Text in central information display Driver's seat back not locked! Driver's seat back not locked. Increased risk of injury in a crash because seat belt ineffective! Lock seat back. Passenger seat back not locked! Passenger seat back not locked. Increased risk of injury in a crash because seat belt ineffective! Lock seat back

Scheme 84

Scheme 85

Scheme 86

Scheme 87

General Safety Regulations

The safety information provided in the repair instructions must be complied with whether working on the safety system, particularly on the airbag units and the seat belt tensioners.

This requirement applies particularly to disassembly and assembly jobs.

1. Only qualified and specially trained personnel are permitted to perform testing and assembly jobs on the safety systems.
2. All work on components of the airbag system must be carried out with the negative terminal disconnected.
3. The specified waiting time must be allowed to elapse to discharge the capacitors (> 30 sec)
4. The battery must be disconnected when performing electric welding work on the vehicle.

In the event of a crash where one or more actuators are triggered, a crash entry is stored in a non-erasable memory. After three crash entries, a non-erasable fault entry is stored in the fault memory with the instruction to replace the Crash Safety Module.

Fault Entries

The entry of a triggered restraint system in the fault memory does not mean that the restraint system was defective in the crash situation, rather it only means that the restraint system is not available for further triggering.

POL Indications

The front passenger airbags are not deployed when the front seat is not occupied.

However, this is not indicated by the Passenger Airbag OFF light.

Triggering the rollover protection system by means of diagnosis To check the function of the rollover protection system, it is necessary to trigger the system using DISplus or GT1.

The output stages of the actuators are activated here with the aid of a test module.

It is absolutely essential to comply with the safety regulations featured in the repair instructions.

The RSS should be triggered if it has to be removed for repair work. If this cannot be done electrically, e.g. for repair work following an accident, the system must be triggered mechanically in order to avoid the risk of injury.

It is absolutely essential to comply with the safety regulations featured in the repair instructions.

It is absolutely essential when working on the safety system to comply with the general safety regulations. The service information is a summary of all the important points pertaining to Advanced Crash and Safety Management.

Diagnosis Particulars

There are a few particulars to keep in mind in relation to diagnosis for the ROC control unit.

The ROC control unit is not directly diagnosis compatible. It monitors itself internally. The two circuits for the actuators are also monitored by the ROC. In the event of a fault, the ROC transmits the fault to the ACSM Crash Safety Module, where the fault is stored in the fault memory. ACSM activates the airbag warning lamp in the instrument cluster.

Visually, the B-pillar satellites correspond to those of the E83 (MRS4 RD), however, these satellites must not be used as they transmit different data protocols. It is important to make sure the part number is correct. The airbag warning lamp AWL comes on if the incorrect satellites are installed.

If the active head restraint has been triggered in a crash, only the gas generator needs to be replaced to return the system to normal function.