E65 Passive Safety Systems

Transcription

1 E65 Passive Safety Systems Information status: May 2001 BMW Service Training

2 E65 Passive Safety Systems Chapter 1-6 Course contents/background material Contents Page CHAP 1 Intelligent Safety Integration System ISIS 1 Introduction 1 - History 1 - Why is a new system needed? 2 - Advantages of the new system 4 CHAP 2 Reference to existing documents 1 CHAP 3 Satellites 1 System overview ISIS 1 Triggering technology 4 Circuit diagram ISIS 6 Overview of components and functions 10 - Safety Information Module SIM 10 - A-pillar satellite, left/right (SASL / SASR) 36 - B-pillar satellite, left (SBSL) 42 - B-pillar satellite, right (SBSR) 45 - Seat satellite, driver / passenger (SSFA / SSBF) 51 - Seat satellite, rear (SSH) 56 - Door satellite, front, left / right (STVL / R) 62 - Vehicle satellite, centre (SFZ) 66 - Steering column switch centre (SZL) 68 - Central Gateway Module (ZGM) 72 CHAP 4 Restraint systems 1 Triggering strategy 1 - Introduction 1 Function and component description, airbags 7 - Introduction 7 - Driver airbag 8 - Passenger airbag 9 - Knee airbag (only US) 10 - Advanced ITS 13 - Thorax airbag (side airbag) 16 Function and component description, seatbelt systems 17 - Introduction 17 - Seatbelt tensioner 18 - Belt tension limiter 19 - End fitting tensioner 23

3 E65 Passive Safety Systems Chapter 1-6 Course contents/background material Sensors 27 - Seat occupation detection (sensor mat) 27 - Belt buckle switch 28 Actuators 29 - Active headrest 29 - Safety battery terminal 34 CHAP 5 Notes on safety 1 CHAP 6 Glossary 1

4 E65 Passive Safety Systems Chapter 1 P.1 Intelligent Safety Integration System ISIS Introduction - History BMW responds to the worldwide rise in safety requirements for motor vehicles with new, innovative development of active and passive safety components. Since 1991, the measures for active and passive safety have been merged in the BMW safety concept F.I.R.S.T. Fully Integrated Road Safety Technology. In order to minimize the consequences of accidents, an increasing number of new systems have been developed over the years at BMW, for example the thorax airbag, head airbag (ITS), etc. Fig. 1: E38 Maximum Airbag Equipment KT-2004 With the launch of the E65, a completely new passive safety system, the ISIS = Intelligent Safety Integration System, will be implemented. The MRS system (Multiple Restraint System) used so far consists of a central control unit with piezo-electrical acceleration sensors and the two external satellites for side crash detection. The centralization and the associated sequential processing of different signals via conventional wiring harnesses led to high loads on the computer unit, time losses and greater susceptibility to malfunction.

5 E65 Passive Safety Systems Chapter 1 P.2 Due to the limited performance of the microprocessor and interfaces, an expansion of the system to include other necessary sensors and trigger circuits for pyrotechnical actuators is not possible. The diagram below shows the development of the number of trigger circuits since Fig. 2: Development of the Requirement for Trigger Circuits since 1990 KT Why is a new system needed? The steadily growing number of functions, sensors and actuators leads to steadily increasing complexity of the vehicle electronics. The control units permanently interchange sensor data, control commands as well as diagnosis information. The increasing data volume can only be handled with comprehensive networking of the control units on a powerful data bus.

6 E65 Passive Safety Systems Chapter 1 P.3 At BMW, in co-operation with Motorola, Infineon and ELMOS, a data bus system based on optical waveguide technology has been developed: the byteflight. The byteflight is a part of the overall vehicle circuit in the E65. It is connected to the K-CAN S, PT-CAN and the diagnostic bus via the Central Gateway Module (ZGM). Diagnosis Fig. 3: System overview of the byteflight KT-7785

7 E65 Passive Safety Systems Chapter 1 P.4 - Advantages of the new system The ISIS system consists of the Safety Information Module SIM and several control units, so-called satellites, that are linked across the byteflight. In the case of the MRS system used to date, there was only one central control unit. On the E65, the acceleration sensors are integrated in the satellites. The actuators are directly connected to the satellites and are activated by the satellites. The satellites are fitted decentrally at strategic points in the car. The distributed sensor system in the car enables measurement of the accelerations occurring as close as possible to the outer shell of the body and at the location of the collision. The direct recording and processing of the information in the control unit mean that significantly shorter reaction times can be achieved. The mechanical time lag within the body to a central control unit is eliminated. The distributed sensors in the satellites provide redundant information that is interchanged via the byteflight. This leads to even more reliable trigger decisions. In comparison to the MRS systems used to date, the ISIS enables, for example in the event of a side-on collision, earlier triggering. In the network of satellites, the Safety Information Module SIM can be viewed as the central unit. The SIM has the following functions: - Connection via optical waveguides to the satellites - Voltage supply of the satellites - Electrical power supply in the event of a crash - Master function Each satellite permanently transmits its measured sensor signals to the SIM, where they are distributed to all the other satellites. This means that each satellite has the same information and is informed of the current status of the vehicle. The interchange of information on the byteflight is bidirectional.

8 E65 Passive Safety Systems Chapter 1 P.5 The ISIS system has the following advantages: - High transfer speed - Highest level of system security - Faster trigger decisions - Redundant information provided by the sensor - Software update via bus - Online diagnostic procedure - Mechanical safety switch is superfluous - No electromagnetic disturbances - No electrical connection between transmitter and receiver module - Lower weight than copper cable - Simple system upgrade

9 E65 Passive Safety Systems Chapter 2 P.1 Reference to existing documents Passive Safety Systems The basic principles of passive safety, sequence of events in accidents and accident research can be found in the trainer's guide Passive Safety Sec. 1. Driver airbag The technical description of the driver airbag can be found in the trainer's guide Passive Safety Sec. 9. Passenger airbag The technical description of the passenger airbag can be found in the trainer's guide Various Innovations / Changes MY 99 Sec. 13. Thorax airbag The technical description of the thorax airbag can be found in the trainer's guide Passive Safety Sec. 3. Safety battery terminal The technical description of the safety battery terminal can be found in the trainer's guide Passive Safety Sec. 7.

10 E65 Passive Safety Systems Chapter 3 P.1 Satellites System overview ISIS The Intelligent Safety Integration System ( ISIS ) consists of the following components that are linked by the byteflight. The graphic below shows the system overview: A I T S I A I T S I A I T S II A I T S II Fig. 4: ISIS system overview (grey fields are special equipment) KT-8135

11 E65 Passive Safety Systems Chapter 3 P.2 BUSES byteflight K-CAN PT-CAN DIAGNOSE MODULES ZGM SIM SATELLITES SASL SASR SZL SSFA SSBF STVL STVR SBSL SBSR SFZ SSH AIRBAGS FA BFA KA TA AITS I AITS II Safety bus Body bus Power train bus Diagnosis bus Central Gateway Module Safety Information Module A-pillar satellite, left, activates the knee airbag (US) and the Advanced ITS I / Advanced ITS II on the driver's side A-pillar satellite, right, activates the passenger airbag, the knee airbag (US) and the Advanced ITS I / Advanced ITS II on the passenger's side Steering column switch centre activates the driver airbag Driver seat satellite activates the active headrest and the seatbelt tensioner Passenger seat satellite activates the active headrest and the seatbelt tensioner Door satellite, front left activates the thorax airbag in the door, front left Door satellite, front right, activates the thorax airbag in the door, front right B-pillar satellite, left, activates the left-hand belt tension limiter B-pillar satellite, right, activates the right-hand belt tension limiter, the safety battery terminal and controls the electric fuel pump Vehicle centre satellite The rear seat satellite activates the thorax airbags for the rear seat passengers and the end fitting tensioner, rear left / right. The adjustment of the rear headrests is also integrated. Driver airbag, two-stage Passenger airbag, two-stage Knee airbag, only on US models Thorax airbag ( side airbag ), front and rear Advanced ITS I for front seat occupants (head airbag) Advanced ITS II for front seat and rear seat occupants (head airbag)

12 E65 Passive Safety Systems Chapter 3 P.3 ACTUATORS AKS GS GBK EBS SBK EKP SENSORS SBE GSS Active headrest Belt tensioner Belt tension limiter End fitting tensioner Safety battery terminal Electric fuel pump Seat occupation identification mat Belt buckle switch Acceleration sensor for X and Y direction KT-8382 Acceleration sensor for Y direction KT-8383 Pressure sensor KT-8384

13 E65 Passive Safety Systems Chapter 3 P.4 Triggering technology In the case of the ISIS system, a number of sensors are fitted at strategic points in the vehicle. They are located in the satellites, which are linked to the SIM via the byteflight. All the sensors are queried permanently and the data is distributed to all the satellites. Satellite with sensor Satellite with sensor Satellite with sensor Satellite with sensor Fig. 5: Data flow from the sensors to the SIM Fig. 2 shows how all of the data recorded by the sensors is transferred across the byteflight to the SIM. KT-8390 Fig. 3 shows how all of the data telegrams sent by the satellites are routed to all the satellites.

14 E65 Passive Safety Systems Chapter 3 P.5 Satellite with sensor Satellite with sensor Satellite with sensor Satellite with sensor Fig. 6: Data telegrams to the satellites KT-8391

15 E65 Passive Safety Systems Chapter 3 P.6 Circuit diagram ISIS Diagnosis Fig. 7: Circuitry principle diagram for all versions KT-8389

16 E65 Passive Safety Systems Chapter 3 P.7 Index Description 1 Instrument cluster with airbag warning lamps 2 Central Gateway Module SASR A-pillar satellite, right Acceleration sensor for X and Y direction KT Priming cap stages 1 and 2 for passenger airbag 4 Priming cap for Advanced ITS I / Advanced ITS II, right 5 Priming cap for the knee airbag, passenger side (only US version) STVR Door satellite, front right Pressure sensor KT Priming cap for thorax airbag, front right SSBF Passenger seat satellite 7 Seat occupation detection for passenger seat 8 Belt buckle switch, passenger seat 9 Priming cap for seatbelt tensioner, passenger seat 10 Priming cap for active headrest, passenger seat SBSR B-pillar satellite, right Acceleration sensor for Y direction KT Priming cap for belt tension limiter, right 12 Priming cap for battery safety terminal 13 Electric fuel pump SSH Rear seat satellite 14 Seat occupation detection, rear seat, right 15 Priming cap for thorax airbag, rear right 16 Priming cap for end fitting tensioner, rear right 17 Headrest adjustment, right 18 Headrest adjustment, left 19 Priming cap for end fitting tensioner, rear left 20 Priming cap for thorax airbag, rear left 21 Seat occupation detection, rear seat, left SFZ Vehicle centre satellite

17 E65 Passive Safety Systems Chapter 3 P.8 Acceleration sensor for X and Y direction KT-8382 SBSL B-pillar satellite, left Acceleration sensor for Y direction KT Priming cap for belt tension limiter, left SSFA Driver seat satellite 23 Buckle switch, driver 24 Seat occupation detection for driver 25 Priming cap for active headrest, driver seat 26 Priming cap for seatbelt tensioner, driver seat STVL Door satellite, front left Pressure sensor KT Priming cap for thorax airbag, front left SASL A-pillar satellite, left Acceleration sensor for X and Y direction KT Priming cap for the knee airbag, front left (only US version) 29 Priming cap for Advanced ITS I / Advanced ITS II, left SZL Steering column switch centre satellite (SZL) 30 Priming cap stages 1 and 2 for driver airbag TEL Telephone KL.30 Permanent positive supply KL.31 Earth supply KL.15 Power supply on

18 E65 Passive Safety Systems Chapter 3 P.9 Pin assignment of the SIM PIN Type Description 1-1 I/O byteflight connection to the Central Gateway Module (ZGM) 1-2 I/O byteflight connection to the steering column switch centre 1-3 I/O byteflight connection to the A-pillar satellite, left 1-4 I/O byteflight connection to the A-pillar satellite, right 1-5 I/O byteflight connection to the vehicle centre satellite 1-6 I/O byteflight connection to the door satellite, front left 2-1 I/O byteflight connection to the driver seat satellite 2-2 I/O byteflight connection to the B-pillar satellite, left 2-3 I/O byteflight connection to the door satellite, front right 2-4 I/O byteflight connection to the passenger seat satellite 2-5 I/O byteflight connection to the B-pillar satellite, right 2-6 I/O byteflight connection to the rear seat satellite 4-3 O Power supply for the steering column switch centre 4-4 O Power supply for the A-pillar satellite, left 4-5 O Power supply for the A-pillar satellite, right 4-6 O Power supply for the vehicle centre satellite 4-7 O Power supply for the door satellite, front left 4-8 O Power supply for the driver seat satellite 4-9 O Power supply for the B-pillar satellite, left 4-10 O Power supply for the door satellite, front right 4-11 O Power supply for the passenger seat satellite 4-12 O Power supply for the B-pillar satellite, right 4-13 O Power supply for the rear seat satellite 5-1 I Terminal 30 supply 15 A fuse 5-2 I Terminal 31, load earth 5-16 O Telephone emergency call signal

19 E65 Passive Safety Systems Chapter 3 P.10 Overview of components and functions - Safety Information Module SIM Introduction In the E65, the Safety Information Module SIM takes on three essential tasks: The power supply of the satellites and provision of an energy reserve in the event of failure of the voltage supply during an accident. The function of the intelligent star coupler and the bus master of the byteflight. Triggering an automatic emergency call by telephone. Fig. 8: Circuitry principle of the Safety Information Module KT-8392

20 E65 Passive Safety Systems Chapter 3 P.11 Number Description 1 Linear controller 2 Linear controller 3 byteflight bus master 4 Star coupler 5 Distributor with overcurrent fuses 6 Memory backup capacitor 7 Switching controller 8 Switching controller 9 Switch SHDN S/E S1-Sx ZGM Shut Down Transmitter/receiver module Satellites Central Gateway Module Power supply of the safety system in operation The SIM is supplied with voltage via terminals 30 and 31. If the vehicle voltage is sufficiently high, a switching controller (8) is supplied first, which in turn supplies voltage to the S/E (transmitter/receiver) modules (4) and the distributors (5). The second switching controller (7) is supplied by terminal 30 during operation and is controlled by the microprocessor via the cable SHDN 2. The capacitor is charged as of terminal R. The charging of the capacitor forms the energy reserve. The charge voltage is at 400 V. Electrical power supply in the event of a crash If the vehicle voltage falls below a value of approx. 8 V, the switching controller (7) is operated in the opposite direction with no delay. The switching controller generates the voltage to replace the supply from terminal 30 until the capacitor is fully discharged or the vehicle voltage returns. Operation of the switching controller is controlled by the microprocessor across the cable SHDN2. If terminal R is off, the switching controller is switched off again, but there is no defined discharge of the memory backup capacitor.

21 E65 Passive Safety Systems Chapter 3 P.12 Closed-circuit (standby) current cutout The switching controller (8), which supplies voltage to the S/E (transmitter/receiver) modules and satellites (via the distributor) (5), is switched by the microprocessor (3) in sleep mode via the signal SHDN1 (shut down) for reasons related to quiescent current. In order to ensure the necessary basic function also in sleep mode, a 9.8 V linear controller (1) is switched in parallel to the switching controller, and this is permanently in operation. The wakeable S/E (transmitter/receiver) modules (grey) and a downstream 5 V linear controller (2) are supplied with this voltage. This second linear controller supplies the microprocessor. The satellites ( SZL, ZGM ) are connected to the wakeable S/E modules, and the satellites are able to wake up the byteflight. The other S/E modules are supplied via the switch (9) by the switching controller (8) and are switched off in sleep mode. Power supply SIM Operating voltage V Full function Output voltage on SIM Intelligent distributor V Full function, but start of the switching controller not possible < 8 V Full function for approx. 3 s from the energy reserve of the voltage was greater than 9 V for a period of at least 4 s beforehand V Restricted function, no destruction, no undefined behaviour Min. 9.4 V Max. 9.9 V Power intake < 1m A In sleep mode Typ. 1.2 A Typ. 4 A Max. 6 A All distributor outputs of the connected satellites have a load of approx. 80 ma (SZL 120 ma) All distributors without load, SIM runs internally In normal operation, max. 4 A briefly After wake-up, for 4 s on charging the energy reserve The intelligent distributor is a system that performs the following tasks: - Power supply for each individual satellite - Current limitation for each individual satellite - Current shutdown for each individual satellite in the event of a fault

22 E65 Passive Safety Systems Chapter 3 P.13 In order to ensure reliable function of the safety system, all the satellites are supplied with voltage centrally via the SIM. To ensure that the system functions perfectly in the event of a short circuit or overload on one of the supply lines, there must be an intelligent current distribution. The distributor integrated in the SIM limits the current on each supply line to the satellites to 100 ma. An exception is the satellite for the steering column switch centre, which has a current intake of approx. 120 ma, as the steering wheel electronics also have to be supplied. If this current limit is exceeded, it causes a reduction in the offset current. It is also possible to switch off each individual distributor output from the microprocessor, and thus each individual satellite. Intelligent star coupler The transmitter and receiver module is a component that is able to convert electrical signals into optical signals and transmit these across optical waveguides (LWL). Each satellite has an electrical / optical transmitter and receiver module (S/E module). Each of the S/E modules is connected via the byteflight (LWL) with the intelligent star coupler in the SIM. In the SIM, there is also a transmitter and receiver module for each satellite. Fig. 9: Star coupler and satellites with transmitter and receiver module KT-6562

23 E65 Passive Safety Systems Chapter 3 P.14 All of the information transmitted across the byteflight consists of data telegrams in the form of light impulses. The S/E modules in the SIM receive the light impulses from each of the connected satellites. In the intelligent star coupler, the data telegrams are transmitted to all the satellites. Data exchange is possible in both directions. Fig. 10: Transmitter and receiver diode in chip-on-chip technology KT-8081 Index Description 1 Receiver amplifier and driver stage for transmitter 2 LED (transmit) 3 Photo diode (receive) The S/E modules consist of a light emitting diode (LED) and a photo diode mounted one above the other in chip-on-chip technology. This achieves optimum linking of both components to the optical waveguides. The transmitter/receiver module contains the LED for the driver circuit and the receiver amplifier for converting the optical signal into digital signals. Monitoring of the optical transfer quality is also integrated. If any of the following faults occur on one of the optical waveguides, the satellite is deactivated: - If no optical signal is received over a defined period of time - If a transmit diode transmits continuous light - If the attenuation is too high

24 E65 Passive Safety Systems Chapter 3 P.15 Attenuation is the loss of light intensity, comparable with electrical resistance of a cable. The light intensity transmitted is compared to that received. The permitted attenuation is specified in the system. If the permitted attenuation is exceeded, one of the following faults might have occurred: - Kinks in the optical waveguide (LWL) and thus an increase in attenuation - Pressure load on the LWL - Strain on the LWL (stretching) - Break in LWL - Damage to LWL

25 E65 Passive Safety Systems Chapter 3 P.16 Telegrams The telegram consists of data blocks, so-called bits and bytes. The general structure of a telegram is shown in the following graphic. Start sequence Start bit Stop bit Fig. 11: Structure of a data telegram KT-8393 Index Meaning Description ID Identifier Specifies the priority and content of data of the telegram LEN Length Contains the number of data bytes, max. 12 D 0 Data byte 0 First data byte D11 Data byte 11 Max. last data byte CRCH CRCL Cyclic Redundancy Check High Cyclic Redundancy Check Low A checksum is formed from ID, LEN, DATA with 15 bits A telegram always begins with the start sequence. This is followed by an identifier byte. This specifies the priority of the data telegram. A start bit precedes each byte. A stop bit follows each byte. The next byte is the length byte, specifying the number of data bytes. This is followed by the data bytes, up to a maximum of 12. This is followed by the checksum. The telegram is concluded by a double stop bit. The length of a telegram can vary between µs. Fig. 12: Telegram priorities KT-6635

26 E65 Passive Safety Systems Chapter 3 P.17 Index Meaning Description ID Identifier Specifies the priority of the telegram HPM High Priority Message Telegram with high priority LPM Low Priority Message Telegram with low priority t_cyc Cycle Time Cycle time of a synchronization pulse t_sync_n Synchronization pulse normal Synchronization pulse is error-free t_sync_a Synchronization pulse alarm Synchronization pulse in alarm status For telegrams, there is a distinction between high and low priority. The differentiation is by the identifier. The permitted range is from , whereby 1 represents the highest priority. Messages with high priority are, e.g. sensor data. Messages with low priority are e.g. status messages, diagnosis, etc.

27 E65 Passive Safety Systems Chapter 3 P.18 byteflight master The byteflight master has two tasks to perform: - Generation of the synchronization pulses (Sync Pulse) - Setting the satellites in alarm mode (Alarm Pulse) In the ISIS, the SIM is configured as byteflight master (bus master). In principle, any satellite can be configured by software as bus master. However, there may only be one bus master in the system. All other participants (bus slaves) use the sync pulse for internal synchronization. Each slave can transmit telegrams between the sync pulses on the byteflight. Synchronization pulses The byteflight bus master in the SIM provides the synchronization pulses at intervals of 250 µs. The alarm mode is transferred across the width of the sync pulse. The duration of a sync pulse in alarm status is approx. 2 µs. Normally, the sync pulse lasts approx. 3 µs. Sync Pulse Telegram Cycle 1 Cycle 2 Cycle 3 Cycle 4 Fig. 13: byteflight cycles Synchronization pulse alarm Synchronization pulse normal KT-6614

28 E65 Passive Safety Systems Chapter 3 P.19 On the basis of all the available information provided by the sensor, the bus master must decide whether the satellites are to be set in alarm mode. When the alarm mode is set by the bus master, all the trigger circuits of the safety system are placed on trigger standby. To trigger a stage, two separate signals must always be transferred on the byteflight. The high-side switch of the trigger circuit in the satellites is controlled via the alarm mode of the byteflight. The low-side switch is controlled by the microprocessor in the satellites. On the basis of the transmitted telegrams with the sensor signals, the trigger algorithm recognizes when the low-side switch has to be closed. The following graphic uses a trigger stage as an example to show signal paths necessary for triggering. G Fig. 14: Signal path for triggering a trigger circuit KT-7737 Index A B C D E F G Description Alarm mode pulse High-side switch Ignition capacitor Priming cap Low-side switch Microprocessor Satellite

29 E65 Passive Safety Systems Chapter 3 P.20 Watchdog function The intelligent distributor enables the SIM to deactivate the power supply for individual satellites. This possibility is used to implement a watchdog function. The relevant status telegram is used to monitor the satellites. If any of the following faults is detected by the bus master, the satellite is deactivated: - Internal fault in the satellite - System time incorrect - Status telegram not received Depending on the type of fault, up to two attempts are made to switch on again after 100 ms. If the power on reset in the satellite module that this triggers does not rectify the fault, the satellite remains off until the next wake-up of the bus system. System time The system time is used as a reference when events such as faults or triggering of pyrotechnical actuators are recorded. This enables time allocation of stored events in various control units. The SIM is the bus master in the ISIS system and thus responsible for generating the synchronization pulses. This is why it makes sense for the SIM to be the reference for the system time. In the ISIS system, there is a uniform system time for all participants (slaves). On production of the vehicle, the system time is started by means of a diagnosis command. This operation is only possible once, i.e. a reset of the system time is not possible. The resolution of this time is 250 µs and it is triggered by the sync pulses on the byteflight. This means that only the pure operation period during which the byteflight is active is recorded. The maximum time that can be represented is more than hours.

30 E65 Passive Safety Systems Chapter 3 P.21 The time is stored in the RAM of the microprocessor. Under the following conditions, there is also an entry in the EEPROM: - Once per hour - On transition into the sleep mode - When the battery is disconnected - When the overall system is supplied by the energy reserve Synchronization of the system time In order to ensure a uniform system time in all modules, a regular synchronization of all slaves is essential. In doing so, a distinction must be made between the synchronization in normal operation and synchronization of new modules fitted into the system as spare parts. Synchronization in normal operation When the byteflight is started following sleep mode and approx. every 16 s during operation, the SIM transmits a "system time" telegram. Due to the relatively low priority of the telegram, there is no assurance that the routing takes place immediately. This leads to asynchronism between the time in the SIM and the time in the satellites. As the SIM knows the time of the transmission of the telegram, a correction is possible. A second telegram "system time" with the correction value as content is sent. The correct system time is therefore the total of the values of the two system time telegrams. The control units (satellites) only adopt the system time when both system time telegrams have been received. Synchronization of new modules When new satellite modules are fitted, these modules have no system time. Transmission of the two system time telegrams allows the module to adopt the system time.

31 E65 Passive Safety Systems Chapter 3 P.22 This is only possible when the stored system time in the satellite modules is smaller that the time sent. If the system time in a module is greater that the time sent, e.g. adopted from another vehicle, the system time is not adopted and an entry is made in the fault memory. When the SIM is replaced, the system time must be entered anew. As the system time is available in all satellite modules, it must be transferred from there into the SIM. This takes place via the diagnosis interface. To do so, the diagnostic device requests the system time from all satellites and selects the largest. The diagnostic devices adds an amount to this time and transmits the result into the SIM as system time. The correction amount compensates for the run time between reading from the satellites and entry in the SIM. This prevents fault messages from the satellites to the effect that the system time transferred by the SIM is smaller than that stored in the satellites. Self-diagnosis of the ISIS The self-diagnosis of the overall system ISIS consists of a number of parts: - Self-diagnosis of the SIM - Pre-drive check, phase 1 - Pre-drive check, phase 2 - Self-diagnosis in operation Self-diagnosis of the SIM When terminal R is switched on, or on wake-up, an internal selfdiagnosis of the SIM is carried out first. The following components are tested: - Test of the analog / digital converter - Flash test - RAM test - EEPROM test - Test of the watchdog reset If a fault occurs during any of these tests, it is entered in the fault memory, stopping the program and disabling communication on the bus. As the instrument cluster now receives no signals, the airbag warning lamp (AWL) is activated.

32 E65 Passive Safety Systems Chapter 3 P.23 Pre-drive check When terminal R is switched on, a self-diagnosis of the overall systems, the so-called pre-drive check, is carried out. During this period, the system cannot be triggered. This is indicated by activation of the airbag warning lamp AWL. The total duration of a fault-free pre-drive check is less than five seconds. The predrive check is divided into two phases. The pre-drive check only starts when the SIM has received the first control unit status messages from all of the modules known by coding and no fault has been communicated. If the status message of a module is not received or if a fault has been communicated, the power supply of the satellite module is switched off. Only then is the pre-drive check started. Pre-drive check, phase 1 In phase 1 of the pre-drive check, the igniter output stages are tested - with the exception of the high-side transistor, which is controlled via the alarm pulse. During phase 1, no alarm pulse is generated. In addition, the sensors are stimulated and thus tested. On conclusion of this test, the result is communicated in the control unit status telegram. An OK signal is only transmitted if all the tests have run without faults. If any faults occur during the pre-drive check, these are stored in the fault memory. Pre-drive check, phase 2 In phase 2 of the pre-drive check, the alarm path from the SIM to the igniter output stages is checked. The SIM transmits an alarm pulse, which is taken back after 30 ms waiting period. Now each satellite transmits a status telegram with OK signal to the SIM. If the alarm mode is not correctly received, a fault entry is made in the fault memory. This concludes the pre-drive check and the modules can now take up normal operation. This means above all for the control units with igniter output stages that the ignition capacitors can now be charged. If all ignition capacitors are fully charged, this is notified in the status telegram to the SIM. The AWL is switched off when all the modules report full ignition capacitors and no fault is determined.

33 E65 Passive Safety Systems Chapter 3 P.24 Self-diagnosis in operation During operation, SIM continuously monitors itself as far as possible. The contents of the flash memories of the satellites are checked using a checksum. If a fault is found, the byteflight communication is halted and the power supply of the satellites is switched off by the SIM. (See watchdog function) The S/E modules provide the possibility to diagnose the optical signal quality. Here, a warning signal is generated when the optical reception quality falls below a certain threshold. The communication still functions without faults. If this warning signal occurs during operation, an entry is made in the fault memory. During operation, the reception of safety-relevant byteflight telegrams is monitored. If one of these telegrams is not received within a defined period, an entry is made in the fault memory. The SIM and all satellites continuously check the VIN received across the byteflight against the VIN entered in the control units. If there is no match or an entry is missing, the AWL is switched on. This ensures that control units swapped between two vehicles, with possibly incorrect coding data, do not remain undiscovered. The kilometre reading (mileage) is also stored in the SIM. In order to set up a relation between the system time and kilometre reading, the current kilometre reading is saved during the synchronization of the system time.

34 E65 Passive Safety Systems Chapter 3 P.25 Airbag warning lamp AWL and Check Control messages The E65 has a variety of systems for the display of faults in the ISIS. These include control lamps, graphic symbols and check control messages. The control lamps include the airbag warning lamp AWL and the "seatbelt mannikin". Fig. 15: "Seatbelt mannikin" and airbag warning lamp The "seatbelt mannikin" is used as a seatbelt warning in some country versions. The airbag warning lamp is activated in the pre-drive check and is switched on in the event of the following system faults: - Fault in the self-diagnosis of the SIM - Communication fault in the byteflight - Fault during the pre-drive check - Vehicle identification number incorrect or missing The graphic symbols appear in the information display of the instrument cluster. The following symbols are possible: KT-8118 Fig. 16: Airbag symbol in red or yellow and service message The red airbag symbol is activated when there is a fault in the driver or front passenger airbag. KT-8119 The yellow airbag symbol is activated in the event of faults in the side airbags, the head airbags as well as the seatbelt tensioner or belt tension limiter.

35 E65 Passive Safety Systems Chapter 3 P.26 The yellow service symbol is activated in the event of faults on the fuel pump. In addition, fault messages can also be displayed in the Check Control module. Fig. 17: Instrument cluster with information display and Check Control module KT-8108 The faults in the control unit or corresponding peripherals detected by the satellites are transmitted to the SIM as a status telegram. These messages are transferred from the SIM via the byteflight to the Central Gateway Module and via the K-CAN to the information display. Activation of the airbag warning lamp AWL, the graphic symbols and the Check Control messages are controlled by the instrument cluster on the basis of the data received from the SIM. If the functions in the overall system that are relevant to safety are operating correctly, the SIM transmits a message to the instrument cluster at regular intervals, approx. every 200 ms. If this signal fails for longer than 2 seconds, the information display indicates this as a fault in the system by causing the airbag warning lamp to light up. In the composite system, up to 32 Check Control messages are involved. At the moment, the following messages are implemented:.

36 E65 Passive Safety Systems Chapter 3 P.27 ID Check Control message Supplementary note on the CD 77 Activation of "seatbelt mannikin" 92 Fault in passenger restraint system Protection restricted in the event of an accident. Function of seatbelt tensioners and belt tensioner limiters not ensured. Fasten seatbelt notwithstanding. Contact BMW Service immediately. 93 Driver restraint system fault Protection restricted in the event of an accident. Function of seatbelt tensioners and belt tensioner limiters not ensured. Fasten seatbelt notwithstanding. Contact BMW Service immediately. 94 Fault in restraint system, rear left Protection restricted in the event of an accident. Function of seatbelt tensioners and belt tensioner limiters not ensured. Fasten seatbelt notwithstanding. Contact BMW Service immediately. 95 Fault in restraint system, rear right Protection restricted in the event of an accident. Function of seatbelt tensioners and belt tensioner limiters not ensured. Fasten seatbelt notwithstanding. Contact BMW Service immediately. 97 Fault in safety system In the event of an accident, the level of protection is severely restricted. Function of airbags, seatbelt tensioners and belt tensioner limiters not ensured. Refer to Owner's Manual. Contact BMW Service immediately. 106 Fault in side airbags, rear left The function of the side airbag, rear left, is not ensured. If possible, do NOT occupy the seat. Contact BMW Service immediately. 107 Fault in side airbags, rear right The function of the side airbag, rear right, is not ensured. If possible, do NOT occupy the seat. Contact BMW Service immediately. 108 Fault in driver airbags The function of the driver airbag is not ensured. Contact BMW Service immediately. 109 Fault in passenger airbag The function of the passenger airbag is not ensured. If possible, do NOT occupy the seat. Contact BMW Service immediately. 216 Fault in fuel pump There is the possibility that the vehicle will break down. Contact BMW Service immediately.

37 E65 Passive Safety Systems Chapter 3 P.28 Fault memory The control unit is equipped with a fault code memory set up in the EEPROM. The fault code memory is divided into the areas of primary fault code memory and shadow memory. Primary fault code memory In the primary fault code memory, all of the faults relevant to safety are stored, e.g. if individual functions have to be shut down. This is indicated by the airbag warning lamp AWL or Check Control messages. Shadow memory Faults which, although they have been detected have no influence on the functional safety of the system, e.g. deterioration of the optical data transmission, are stored in the shadow memory. Fault code memory entry Each fault detected within the framework of the self-diagnosis is stored here, but each fault code only once. If the same fault code occurs once again, there is an update of the entries. The control unit can store a maximum of 20 different fault codes. Additionally occurring faults are not stored and are lost. If all the possible fault code memory spaces are already occupied, any entries that might be present in the shadow memory are overwritten by new entries of the primary fault code memory. Deleting the fault code memory On the one hand, the fault code memory can be completely deleted; on the other hand, it is possible to delete each fault code memory entry separately. The separate fault code deletion is for the purposes of diagnosis. If a number of faults are set, one of these can be deleted following repair to check whether it recurs.

38 E65 Passive Safety Systems Chapter 3 P.29 ISIS emergency call functions Two different emergency calls are possible by telephone. An automatic emergency call triggered by the SIM, which has detected a corresponding crash severity, as well as a manually triggered emergency call via the emergency call button. To place an emergency call by telephone, the telephone and the telephone interface, including aerial system, must be on standby and supplied with sufficient power. After triggering of the emergency call, an SMS message (Short Message Service) is sent to the service provider and a voice connection is set up. Two numbers are set for the two emergency call functions; these are dialled alternately until a connection is set up. If no connection has been set up after 60 seconds, the telephone dials the emergency number in accordance with the GSM standard (112 in Germany / 999 in UK). To support any recovery activity that might be necessary, the light module switches on the passenger-compartment lighting and the hazard warning system. The central locking system is also unlocked by the CAS (Car Access System). Automatic emergency call serial connection KT-8533 Fig. 18: If a satellite detects a crash, the SIM transmits a signal across a serial cable to the telephone, which triggers the automatic emergency call.

39 E65 Passive Safety Systems Chapter 3 P.30 Index A B C ZGM SIM CD TELEFON Description Emergency call button Telephone aerial Satellite Central Gateway Module Safety Information Module SIM Control Display Telephone module If the ISIS system detects a crash of sufficient severity, the emergency call by telephone is triggered automatically. If the special equipment navigation system is installed, the emergency call contains data concerning the location of the vehicle. When the emergency call reaches the service provider, this is displayed on the Control Display. serial connection KT-8528 Fig. 19: If the serial connection is disrupted or fails in a crash, the signal is transmitted via the bus assembly to the telephone.

40 E65 Passive Safety Systems Chapter 3 P.31 There is a direct, serial, single-wire connection between the SIM and telephone. If the connection is disrupted or fails, the overall bus system is used to trigger the emergency call. The telegram then goes from the SIM to the Central Gateway Module via the K-CAN to the Control Display and the MOST bus to the telephone. (ECE version) Once an emergency call has been triggered, it cannot be cancelled. To ensure that the emergency call has reached the provider, an acknowledgement is transmitted, and this is stored in the system. The service provider sets up a voice connection to the vehicle and receives confirmation of the emergency call. If no voice connection is set up or the occupants are unable to respond, the rescue services are notified automatically. Automatic emergency call, Japan For the Japanese version, a flexible bus interface (FBI) is connected to the MOST bus. There is a serial line from the FBI to the telephone. On reception of the telegram "Transmit emergency call" across the serial cable, or in the event of interruption via the MOST bus, the Japanese version telephone sets up an emergency call voice connection to the police. serial connection TELEFON Fig. 20: Automatic emergency call for Japanese version telephone KT-8526

41 E65 Passive Safety Systems Chapter 3 P.32 Manual emergency call TELEFON serial connection Fig. 21: The emergency call button can be used to manually trigger an emergency call. KT-8530 In the event of an emergency, the driver or passenger presses the emergency call button, which is indicated by green button lighting. The current vehicle position is then displayed in the onboard monitor along with a message indicating that the emergency call has been placed. The service provider sets up a voice connection to the vehicle and receives confirmation of the emergency call. Once the voice connection to the provider has been set up, the green button display flashes. The rescue services are then notified and this is indicated on the Control Display.

42 E65 Passive Safety Systems Chapter 3 P.33 Installation location and pin assignment The installation position of the SIM is at the front right in the device carrier, behind the glovebox. ZGM SIM SIM Fig. 22: Device carrier with SIM and Central Gateway Module Note: when removing and installing the SIM, particular care must be taken to ensure that the optical waveguides are not twisted. KT-7031 Fig. 23: Plug connector details of the SIM module KT-7906

43 E65 Passive Safety Systems Chapter 3 P.34 SIM connector 1, LWL connector 6-pin, coding A, X PIN Type Remarks 1 I/O byteflight connection to the ZGM, X I/O byteflight connection to the steering column switch centre, X I/O byteflight connection to the A-pillar satellite, left, X I/O byteflight connection to the A-pillar satellite, right, X I/O byteflight connection to vehicle centre satellite, X I/O byteflight connection to the door satellite, front left, X10340 SIM connector 2, LWL connector 6-pin, coding B, X PIN Type Remarks 1 I/O byteflight connection to the driver seat satellite, left, X I/O byteflight connection to the B-pillar satellite, left, X I/O byteflight connection to the door satellite, front right, X I/O byteflight connection to the passenger seat satellite, left, X I/O byteflight connection to the B-pillar satellite, right, X I/O byteflight connection to rear seat satellite, X SIM connector 3, LWL connector 6-pin, coding c, X PIN Type Remarks 1 I/O byteflight connection not defined 2 I/O byteflight connection not defined 3 I/O byteflight connection not defined 4 I/O byteflight connection not defined 5 I/O byteflight connection not defined 6 I/O byteflight connection not defined SIM connector 4, hybrid connector 16-pin, coding A X10326 PIN Type Remarks O Power supply for the steering column switch centre, X O Power supply for the A-pillar satellite, left, X O Power supply for the A-pillar satellite, right, X O Power supply for vehicle centre satellite, X O Power supply for the door satellite, front left X O Power supply for the seat satellite, front left X O Power supply for the B-pillar satellite, left X 10335

44 E65 Passive Safety Systems Chapter 3 P.35 SIM connector 4, hybrid connector 16-pin, coding A X10326 PIN Type Remarks 10 O Power supply for the door satellite, front right, X O Power supply for the seat satellite, front right, X 12 O Power supply for the B-pillar satellite, right, X O Power supply for the seat satellite, rear, X SIM connector 5, hybrid connector 16-pin, coding B X10325 PIN Type Remarks 1 I Terminal 30 supply 15 A fuse 2 I Terminal 31, load earth O Telephone emergency call signal

45 E65 Passive Safety Systems Chapter 3 P.36 - A-pillar satellite, left/right (SASL / SASR) The satellites of the A-pillar left / right are virtually identical; for this reason, only one is shown. Any differences are indicated. The satellites are installed to the left and right under the A-pillar trim panel in the footwell. Fig. 24: Installation position A-pillar satellite ( 1 ) KT-8073 The following graphic shows the circuitry principle of the A-pillar satellites. The components highlighted in grey are only fitted in the case of the right-hand A-pillar satellite (SASR). Fig. 25: Circuitry principle of the satellites A-pillar left SASL / right SASR KT-7738

46 E65 Passive Safety Systems Chapter 3 P.37 Index VS LWL S/E SASR Description Power supply for the satellites from the SIM byteflight Transmitter/receiver module A-pillar satellite, right 1 Voltage regulator 2 Igniter output stage for AITS I / AITS II and knee airbag 3 Priming cap for AITS I / AITS II (optional) 4 Priming cap for the knee airbag (US) 5 Igniter output stage for front passenger airbag ( only for SASR ) 6 Priming cap stage 1 for passenger airbag ( only for SASR ) 7 Priming cap stage 2 for passenger airbag ( only for SASR ) 8 Longitudinal acceleration sensor 9 Transverse acceleration sensor 10 Transmitter/receiver module 11 Microprocessor Functional description The satellite SASL /R is connected to the SIM via the byteflight. The power supply of the satellites is also from the SIM and it is buffered by the memory backup capacitor. In sleep mode of the byteflight, the power supply of the SASL/R is deactivated by the SIM. The watchdog function is run via the SIM. Power supply SASL / R Operating voltage V Full function V Restricted function, diagnosis of trigger circuits not possible Power intake Typ. 80 ma In normal operation The SASL/R controls and monitors the priming caps for the knee airbag ( US ) as well as for the Advanced ITS ( AITS I ) for the driver and passenger head area. If the special equipment side airbags for rear seat passengers - is fitted, the AITS II for the rear head area of each side is also monitored and activated. In addition, the SASR takes on the control unit and monitoring of stages 1 and 2 of the front passenger airbag.

47 E65 Passive Safety Systems Chapter 3 P.38 Sensor system One acceleration sensor for the longitudinal acceleration and one for the transversal acceleration are integrated in the SASL/R. The sensors provide a variable voltage. This voltage is a measurement of the vehicle acceleration. This voltage signal is filtered, amplified, converted and transferred as a data telegram. The strategic arrangement of acceleration sensors in the vehicle and the sensor data recognized in satellites, enable recognition of the direction and crash severity. For the ISIS system, a detected crash severity and direction of the impact are distinguished according to frontal, side, or rearend collision. With the involvement of the seat occupation detection, the seatbelt buckle query, and using the stored trigger algorithm, accident-relevant triggering of the pyrotechnic actuators (e.g. seatbelt tensioner, airbags) is intended to achieve the greatest possible degree of occupant protection. The priming caps are diagnosed by igniter ICs and ignited by means of an ignition capacitor. Self-diagnosis of the trigger circuits during the pre-drive check During the pre-drive check, the entire trigger circuits are checked. If no faults occur during the check, the ignition capacitors are charged and the satellites are ready for triggering. Selfdiagnosis includes following: - Check of the coding of the trigger circuit for plausibility - Check of the trigger circuit for short circuit to earth or positive - Check of the trigger circuit for interruption - Check of the ignition capacity and ignition voltage - Check of the trigger circuit resistance - Test of the low-side switch - Test of the high-side switch and the alarm path

48 E65 Passive Safety Systems Chapter 3 P.39 The check of the high-side and low-side switches takes place with the ignition capacitor discharged. If any of the faults listed below are detected in a trigger circuit, the ignition capacitor remains discharged. This prevents accidental deployment of the trigger circuit if another fault occurs. - Short circuit to earth or positive - Short circuit / interruption of the low-side transistor - Short circuit / interruption of the high-side transistor - Incorrect coding of a trigger circuit - Fault in the alarm path For all other faults, there is no danger of accidental deployment. The fault is indicated by the AWL and stored in the fault code memory. Self-diagnosis in normal operation In normal operation, there is a permanent check of the trigger circuits. A fault message is issued, but only when the fault is confirmed over a specified period of time. If a short circuit to earth or positive is detected, the corresponding ignition capacitor is discharged. In normal operation, the self-diagnosis is restricted to the following checks. - Check of the trigger circuit for short circuit to earth - Check of the trigger circuit for short circuit to positive - Check of the trigger circuit for interruption

49 E65 Passive Safety Systems Chapter 3 P.40 Pin assignment Fig. 26: Plug connector details of the A-pillar satellites left/right are identical KT-6709 SASL connector 1, LWL hybrid connector, coding B X10331 PIN Type Remarks 1 I/O byteflight connection to Safety Information Module 2 I Voltage supply from Safety Information Module 3 I Terminal 31, electronics earth 4 O + from priming cap for AITS I / II, front left 5 O - from priming cap for AITS I / II, front left SASL connector 2, ELO 6-pin, coding A X13353 PIN Type Remarks 1 O + for priming cap from knee airbag, front left 2 O - for priming cap from knee airbag, front left SASL connector 3, ELO 4-pin with KS contact, coding A PIN Type Remarks

50 E65 Passive Safety Systems Chapter 3 P.41 SASR connector 1, LWL hybrid connector, coding A X10332 PIN Type Remarks 1 I/O byteflight connection to Safety Information Module 2 I Voltage supply from Safety Information Module 3 I Terminal 31, electronics earth 4 O + from priming cap for AITS I / II, front right 5 O - from priming cap for AITS I / II, front right SASR connector 2, ELO 6-pin, coding A X13355 PIN Type Remarks 1 O + for priming cap from knee airbag, front right 2 O - for priming cap from knee airbag, front right 3 O + for priming cap stage 1 from passenger airbag 4 O - for priming cap stage 1 from passenger airbag 5 O + for priming cap stage 2 from passenger airbag 6 O - for priming cap stage 2 from passenger airbag SASR connector 3, ELO 4-pin with KS contact, coding A PIN Type Remarks

51 E65 Passive Safety Systems Chapter 3 P.42 - B-pillar satellite, left (SBSL) The B-pillar satellite, left, is installed in the B-pillar above the seatbelt inertia reel. 1 Mounting points for the satellites KT-8052 KT-8074 Fig. 27: The following graphic shows the circuitry principle of the SBSL. Fig. 28: Circuitry principle of the B-pillar satellite, left, with transversal acceleration sensor KT-6878

52 E65 Passive Safety Systems Chapter 3 P.43 Index VS LWL S/E Description Functional description The SBSL satellite is connected to the SIM via the byteflight. The power supply of the satellites is also from the SIM and it is buffered by the memory backup capacitor. In sleep mode of the byteflight, the power supply of the SBSL is deactivated by the SIM. The watchdog function is run via the SIM. The SBSL controls and monitors the priming cap for the belt tension limiter of the seatbelt on the driver's side. Sensor system Power supply for the satellites from the SIM byteflight Transmitter/receiver module 1 Voltage regulator 2 Igniter output stage belt tension limiter 3 Priming cap for belt tension limiter 4 Transverse acceleration sensor 5 Transmitter/receiver module 6 Microprocessor Power supply SBSL Operating voltage V Full function V Restricted function, diagnosis of trigger circuits not possible Power intake Typ. 80 ma In normal operation An acceleration sensor for the transversal acceleration is integrated in the SBSL. The sensor provides a voltage as measured variable. This voltage is a measurement of the vehicle acceleration. The priming caps are diagnosed by igniter ICs and ignited by means of ignition capacitors. The self-diagnosis of the trigger circuits during the pre-drive check and in normal operation is the same for all satellites. (See SASL)

53 E65 Passive Safety Systems Chapter 3 P.44 Pin assignment Fig. 29: Plug connector details, B-pillar satellite, left KT-6717 SBSL connector 1, LWL hybrid connector, coding B X10335 PIN Type Remarks 1 I/O byteflight connection to Safety Information Module 2 I Voltage supply from Safety Information Module 3 I Terminal 31, electronics earth 4 O + from priming cap for belt tension limiter, front left 5 O - from priming cap for belt tension limiter, front left

54 E65 Passive Safety Systems Chapter 3 P.45 - B-pillar satellite, right (SBSR) The B-pillar satellite, right, is installed in the B-pillar above the seatbelt inertia reel. 1 Mounting points for the satellites 2 SBSR with electric fuel pump controller KT-8052 KT-8053 Fig. 30: Installation position for B-pillar satellite, right The following graphic shows the circuitry principle of the SBSR. KT-6879 Fig. 31: Circuitry principle of the B-pillar satellite, right, with transverse acceleration sensor and fuel pump control

55 E65 Passive Safety Systems Chapter 3 P.46 Index VS LWL S/E Description 9 V power supply for the satellites from the SIM byteflight Transmitter/receiver module 1 Voltage regulator 2 Igniter output stage belt tension limiter and safety battery terminal 3 Priming cap for belt tension limiter 4 Priming cap for battery safety terminal 5 Final stage for fuel pump control 6 Electric fuel pump 7 Transverse acceleration sensor 8 Transmitter/receiver module 9 Microprocessor Functional description The satellite SBSR is connected to the SIM via the byteflight. The power supply of the satellites is also from the SIM and it is buffered by the memory backup capacitor. The voltage supply of the electric fuel pump is by means of a separate terminal 30. In the sleep mode of the byteflight, the power supply of the SBSR is switched off by the SIM; the operating voltage of the electric fuel pump is unaffected by this. The watchdog function is run via the SIM. Power supply SBSR Operating voltage V Full function V Restricted function, diagnosis of trigger circuits not possible Power intake (SBSR without EKP) Typ. 80 ma In normal operation Operating voltage Electric fuel pump Power intake Electric fuel pump V Full function <50 µa With fuel pump shut down 8 A Max. current intake of fuel pump The SBSR controls and monitors the priming cap for the belt tension limiter of the seatbelt on the passenger side and the safety battery terminal. Another integrated function is the control of the electric fuel pump ( EKP ).

56 E65 Passive Safety Systems Chapter 3 P.47 Sensor system An acceleration sensor for the transversal acceleration is integrated in the SBSR. The sensor provides a variable voltage. This voltage is a measurement of the vehicle acceleration. The priming caps are diagnosed and controlled by igniter ICs. The self-diagnosis of the trigger circuits during the pre-drive check and in normal operation is the same for all satellites. (See SASL) Electronic control of the fuel pump The SBSR of the ISIS system contains the control operation of the fuel supply quantity during operation of the vehicle and fuel supply cutoff in the event of a crash. The advantages of an EKP delivery rate control are: - Reduction of tank warming => emission reduction - Reduction of the power consumption by approx. 50 W alternator power and thus reduction of the fuel consumption - Increase of the EKP service life - Integration of crash deactivation - Elimination of the EKP relay Fuel is supplied depending on consumption. The DME (digital engine electronics) determines a fuel requirement in litres per hour (l/h) Fig. 32: Signal path of the fuel requirement KT-7872 The SBSR receives the fuel requirement from the DME via the PT-CAN and the byteflight. If the fuel requirement from the DME fails, or the bus system is defective, the fuel pump is operated at maximum rotation speed by reading in terminal 15.

57 E65 Passive Safety Systems Chapter 3 P.48 Fig. 33: Circuitry principle of the EKP control KT-7871 Index DME SBSR EKP - Controller Description DME control unit B-pillar satellite, right EKP control µp Microprocessor EKP Electric fuel pump + / - Setpoint/actual-value comparison U Tmot Imot PWM Control voltage Fuel requirement Engine current Pulse-width-modulated signal The delivery volume of the fuel pump is regulated by the electronic control of the EKP voltage supply. In the microprocessor, the required quantity is converted into a pulse-widthmodulated signal (PWM) and transmitted to the EKP controller. The adjustable pulse width produces a variable voltage that is used to activate the EKP. The current intake of the pump is measured in the EKP controller, thus determining the rotation speed of the EKP. The rotation speed is transmitted to the microprocessor, which calculates the current delivery volume. The delivery volume is checked using a setpoint / actual comparison and the control voltage is corrected.

58 E65 Passive Safety Systems Chapter 3 P.49 Fuel cutoff in an emergency If the ISIS system detects a crash of sufficient severity, the fuel pump is shut down to prevent secondary damage as a result of leaking fuel. The fuel pump can then be reactivated by switching the ignition off and on. Thereafter, the fuel pump is again ready for operation. Emergency operation characteristics If the fuel quantity requirement signal from the DME fails, or the bus connection to the SBSR is disrupted, a separate terminal 15 is sensed. In this case, the fuel pump is activated with full operating voltage and supplies the maximum delivery volume.

59 E65 Passive Safety Systems Chapter 3 P.50 Pin assignment Fig. 34: Plug connector details, B-pillar satellite, right KT-6724 SBSR connector 1, LWL hybrid connector, coding A, X10336 PIN Type Remarks 1 I/O byteflight connection to Safety Information Module 2 I Voltage supply from Safety Information Module 3 I Terminal 31, electronics earth 4 O + from priming cap for belt tension limiter, front right 5 O - from priming cap for belt tension limiter, front right SBSR connector 2, ELO 8-pin, coding A, X10510 PIN Type Remarks 1 I Terminal 30 for electric fuel pump with 20 A fuse 2 O + for electric fuel pump 3 I - for electric fuel pump 4 I Terminal 31, load earth 5 O - for priming cap of safety battery terminal 6 O + for priming cap of safety battery terminal 7 8 I Terminal 15 redundancy for electric fuel pump (emergency operation)

60 E65 Passive Safety Systems Chapter 3 P.51 - Seat satellite, driver / passenger (SSFA / SSBF) The satellites of the driver and passenger side are identical; for this reason, only one is shown. The satellite is located below the seat frame between the seat runners. It is fitted with the seat module beneath a cover in a plastic basin. Fig. 35: Installation position for front seat satellite KT-8055 Index Description 1 Driver / passenger seat satellite 2 Seat module

61 E65 Passive Safety Systems Chapter 3 P.52 The following graphic shows the circuitry principle of the SSFA / SSBF. Fig. 36: KT-7045 Index Description KL 30 Voltage supply, terminal 30 KL 31 Earth supply + SBE Voltage supply for seat occupation detection DATA-SBE Signal of seat occupation detection - SBE Earth of seat occupation detection VS 9 V power supply for the satellites from the SIM LWL byteflight S/E Transmitter/receiver module 1 Voltage regulator 2 Igniter output stage, seatbelt tensioner and active headrest 3 Priming cap for seatbelt tensioner 4 Priming cap for active headrest 5 Interface for belt buckle switch 6 Belt buckle switch 7 Transmitter/receiver module 8 Microprocessor

62 E65 Passive Safety Systems Chapter 3 P.53 Functional description The satellite SSFA / SSBF is connected to the SIM via the byteflight. The power supply of the satellites is also from the SIM and it is buffered by the memory backup capacitor. In sleep mode of the byteflight, the power supply of the SSFA / SSBF is deactivated by the SIM. The watchdog function is run via the SIM. Power supply SSFA / SSBF Operating voltage (SIM) V Full function V Restricted function, diagnosis of trigger circuits not possible Power intake (SIM) Typ. 80 ma In normal operation Operating voltage (terminal 30) Power intake (terminal 30) V Typ. 30 ma <100 µa In normal operation In sleep mode The satellites SSFA / SSBF control and monitor the trigger circuits of the seatbelt lock tensioners and the active headrests. Furthermore, the belt buckles are monitored by a Hall sensor. The Hall switches are identical to those of the E38 since 3/97. The seat occupation detection is monitored via an interface in the voltage regulator. Sensor system With the involvement of the seat occupation detection, the seatbelt buckle query, and using the stored trigger algorithm, accident-relevant triggering of the pyrotechnic actuators (e.g. seatbelt tensioner, headrest) is intended to achieve the greatest possible degree of occupant protection. The priming caps are diagnosed and controlled by igniter ICs. The self-diagnosis of the trigger circuits during the pre-drive check and in normal operation is the same for all satellites. (See SASL)

63 E65 Passive Safety Systems Chapter 3 P.54 Pin assignment Fig. 37: Plug connector details of the driver / passenger satellites KT-6709 SSFA connector 1, LWL hybrid connector, coding B X10344 PIN Type Remarks 1 I/O byteflight connection to Safety Information Module 2 I Voltage supply from Safety Information Module 3 I Terminal 31, electronics earth 4 I Terminal 30, supply 5 SSFA connector 2, ELO 6-pin, coding A X13404 PIN Type Remarks 1 O Voltage supply for seat occupation detection 2 O Earth supply for seat occupation detection 3 I/O Data from seat occupation detection 4 5 O + for priming cap, active headrest 6 O - for priming cap, active headrest SSFA connector 3, ELO 4-pin with KS contact, coding A X PIN Type Remarks 1 O + for priming cap, seatbelt tensioner, driver 2 O - for priming cap, seatbelt tensioner, driver 3 O Power supply for belt contact, driver 6 O Belt contact, driver

64 E65 Passive Safety Systems Chapter 3 P.55 SSBF connector 1, LWL hybrid connector, coding A X10345 PIN Type Remarks 1 I/O byteflight connection to Safety Information Module 2 I Voltage supply from Safety Information Module 3 I Terminal 31, electronics earth 4 I Terminal 30, supply 5 SSBF connector 2, ELO 6-pin, coding A X13406 PIN Type Remarks 1 O Voltage supply for seat occupation detection 2 O Earth supply for seat occupation detection 3 I/O Data from seat occupation detection 4 5 O + for priming cap, active headrest 6 O - for priming cap, active headrest SSBF connector 3, ELO 4-pin with KS contact, coding A X PIN Type Remarks 1 O + for priming cap, seatbelt tensioner, passenger 2 O - for priming cap, seatbelt tensioner, passenger 3 O Power supply for belt contact, passenger 6 O Belt contact, passenger

65 E65 Passive Safety Systems Chapter 3 P.56 - Seat satellite, rear (SSH) The rear seat satellite is optional and integrated in the special equipment 261 "Side airbags for rear seat passengers." The special equipment also includes the Advanced ITS ( AITS ) for rear seat passengers, but these are triggered by the SASL / R. The rear seat satellite is fitted beneath the rear seat cushion in the middle area. Fig. 38: Installation position for rear seat satellite KT-7038

66 E65 Passive Safety Systems Chapter 3 P.57 The following graphic shows the circuitry principle of the SSH. left right KT-8399 Fig. 39: Rear seat satellite ( with special equipment 460 "comfort seat," the functions highlighted in grey are integrated in the seat module ) Index Description + SBE Voltage supply for seat occupation detection DATA-SBE Signal of seat occupation detection - SBE Earth of seat occupation detection VS Power supply for the satellites from the SIM

67 E65 Passive Safety Systems Chapter 3 P.58 Index KL 31 LWL S/E KL 30 Description Earth supply byteflight Transmitter/receiver module + voltage supply for headrests and seat occupation detection 1 Voltage regulator 2 Igniter output stage for thorax airbag and belt tension limiter, rear right 3 Priming cap for thorax airbag, rear right 4 Priming cap for belt tension limiter, rear right 5 Igniter output stage for thorax airbag and belt tension limiter, rear left 6 Priming cap for thorax airbag, rear left 7 Priming cap for belt tension limiter, rear left 8 Output stage for headrest adjustment, right 9 Motor for headrest adjustment, right 10 Output stage for headrest adjustment, left 11 Motor for headrest adjustment, left 12 Switch for headrest adjustment 13 Transmitter/receiver module 14 Microprocessor Functional description The satellite SSH is connected to the SIM via the byteflight. The power supply of the satellites is also from the SIM and it is buffered by the memory backup capacitor. In sleep mode of the byteflight, the power supply of the SSH is deactivated by the SIM. The power supply for the headrests is unaffected by this. The watchdog function is run via the SIM. Power supply SSH Operating voltage (SIM) V Full function V Restricted function, diagnosis of trigger circuits not possible Power intake (SIM) Typ. 80 ma In normal operation Operating voltage Headrest adjustment Power intake Headrest adjustment V Full function <50 µa In sleep mode 12 A Max. current intake of headrest

68 E65 Passive Safety Systems Chapter 3 P.59 The SSH controls and monitors the trigger circuits for the end fitting tensioner and the thorax airbag, rear left/right. The seat occupation detection left/right is also evaluated by the SSH. In addition, the control unit for the headrest adjustment is also integrated. With special equipment 460 ( comfort seats ), the adjustment of the headrests is via the seat module. Rear headrests The rear headrests are moved out automatically by an electric motor if the seat occupation detection detects an occupant and terminal R is on. The return of the headrest to its resting position is started when terminal R is switched off or an empty seat is detected. Sensor system With the involvement of the seat occupation detection, and using the stored trigger algorithm, accident-relevant triggering of the pyrotechnic actuators (e.g. end fitting tensioner, thorax airbag) is intended to achieve the greatest possible degree of occupant protection. The priming caps are diagnosed and controlled by igniter ICs. The self-diagnosis of the trigger circuits during the pre-drive check and in normal operation is the same for all satellites. (See SASL)

69 E65 Passive Safety Systems Chapter 3 P.60 Pin assignment Fig. 40: Plug connector details of the rear seat satellite KT-6782 SSH connector 2, hybrid 16-pin, coding A X10533 PIN Type Remarks 1 I Positive supply, terminal 30 2 I Load earth, terminal 31 3 I/O Data from seat occupation detection, rear left 4 O Power supply for seat occupation detection, rear left 5 O Earth supply for seat occupation detection, rear left 6 I/O Data from seat occupation detection, rear right 7 O Power supply for seat occupation detection, rear right 8 O Earth supply for seat occupation detection, rear right 9 O +/- motor headrest, left 10 O +/- motor headrest, left 11 O +/- motor headrest, right 12 O +/- motor headrest, right 13 I Button for rear left headrest UP 14 I Button for rear left headrest DOWN 15 I Button for rear right headrest UP 16 I Button for rear right headrest DOWN

70 E65 Passive Safety Systems Chapter 3 P.61 SSH connector 1, ELO 12-pin, coding A X10530 PIN Type Remarks O + priming cap for thorax airbag, rear left 8 O - priming cap for thorax airbag, rear left 9 O + priming cap for end fitting tensioner, rear left 10 O - priming cap for end fitting tensioner, rear left 11 O + priming cap for end fitting tensioner, rear right 12 O - priming cap for end fitting tensioner, rear right SSH connector 3, LWL hybrid connector, coding A, X PIN Type Remarks 1 I/O byteflight bus connection to Safety Information Module 2 I Voltage supply from Safety Information Module 3 I Terminal 31, electronics earth 4 O + priming cap for thorax airbag, rear right 5 O - priming cap for thorax airbag, rear right

71 E65 Passive Safety Systems Chapter 3 P.62 - Door satellite, front, left / right (STVL / R) The door satellites are installed together with the door module in the front section of the door. Fig. 41: Installation position, front door satellite with door module KT-8056 Fig. 42: Front door satellite with pressure sensor KT-8057 Index Description 1 Door satellite 2 Door module 3 Measuring connection for pressure sensor

72 E65 Passive Safety Systems Chapter 3 P.63 The left/right satellites are identical. The following graphic shows the circuitry principle of the STVL / R. Fig. 43: Circuitry principle of the front door satellite with pressure sensor KT-6882 Index Description VS Power supply for the satellites from the SIM LWL byteflight S/E Transmitter/receiver module 1 Voltage regulator 2 Igniter output stage for thorax airbag 3 Priming cap for thorax airbag 4 Pressure sensor 5 Transmitter/receiver module 6 Microprocessor

73 E65 Passive Safety Systems Chapter 3 P.64 Functional description The satellite STVL / R is connected to the SIM via the byteflight. The power supply of the satellites is also from the SIM and it is buffered by the memory backup capacitor. In sleep mode of the byteflight, the power supply of the STVL / R is deactivated by the SIM. The watchdog function is run via the SIM. Power supply STVL / R Operating voltage V Full function The STVL / R controls and monitors the priming cap for the front thorax airbags. Sensor system V Restricted function, diagnosis of trigger circuits not possible Power intake Typ. 80 ma In normal operation A pressure sensor is integrated in the front door satellite. The sensor reacts to a rise in pressure. In the event of a crash, penetration of the door outer skin reduces the volume of the door, which leads to a significant rise in pressure. The relative pressure change and rise in pressure evaluated over time are the most important factors for the crash evaluation. The priming caps are diagnosed and controlled by igniter ICs. The self-diagnosis of the trigger circuits during the pre-drive check and in normal operation is the same for all satellites. (See SASL)

74 E65 Passive Safety Systems Chapter 3 P.65 Pin assignment Fig. 44: Plug connector details, door satellite, front left / right KT-6717 STVL connector 1, LWL hybrid connector, coding B X10340 PIN Type Remarks 1 I/O byteflight bus connection to Safety Information Module 2 I Voltage supply from Safety Information Module 3 I Terminal 31, electronics earth 4 O + priming cap for thorax airbag, front left 5 O - priming cap for thorax airbag, front left STVR connector 1, LWL hybrid connector, coding B X PIN Type Remarks 1 I/O byteflight bus connection to Safety Information Module 2 I Voltage supply from Safety Information Module 3 I Terminal 31, electronics earth 4 O + priming cap for thorax airbag, front right 5 O - priming cap for thorax airbag, front right

75 E65 Passive Safety Systems Chapter 3 P.66 - Vehicle satellite, centre (SFZ) The vehicle centre satellite is located on the centre tunnel in the area of the centre console. The following graphic shows the circuitry principle of the SFZ. Fig. 45: Circuitry principle of the vehicle centre satellite KT-6883 Index Description VS Power supply for the satellites from the SIM GND Earth supply LWL byteflight S/E Transmitter/receiver module 1 Voltage regulator 2 Microprocessor 3 Longitudinal acceleration sensor 4 Transverse acceleration sensor 5 Transmitter/receiver module

76 E65 Passive Safety Systems Chapter 3 P.67 Functional description The satellite SFZ is connected to the SIM via the byteflight. The power supply of the satellites is also from the SIM and it is buffered by the memory backup capacitor. In sleep mode of the byteflight, the power supply of the SFZ is deactivated by the SIM. The watchdog function is run via the SIM. Power supply SFZ Operating voltage V Full function V Restricted function Power intake Typ. 60 ma In normal operation Sensor system The vehicle centre satellite only records sensor data; it has no triggering functions. One acceleration sensor for the longitudinal acceleration and one for the transversal acceleration are integrated in the SFZ. The sensors provide a variable voltage. This voltage is a measurement of the vehicle acceleration. Pin assignment Fig. 46: Plug connector details, vehicle centre satellite KT-6717 SFZ connector 1, LWL hybrid connector, coding A X10354 PIN Type Remarks 1 I/O byteflight bus connection to Safety Information Module 2 I Voltage supply from Safety Information Module 3 I Terminal 31, electronics earth 4 5

77 E65 Passive Safety Systems Chapter 3 P.68 - Steering column switch centre (SZL) All the components on the steering wheel and the steering column belong to the steering column switch centre system unit (SZL). The SZL is divided into two electronic modules. One is located in the steering wheel and the other in the steering column. Both units are interconnected by means of spiral spring. Fig. 47: Steering column switch centre KT-7844 Index Description 1 MFL with function keys 2 Turn signal and dipped-beam switch (FAS) 3 Selector lever 4 Wiper switch 5 Switch for cruise control system 6 Button for steering wheel heating 7 Button for steering-column adjustment The components in the steering wheel include: - The steering wheel heating with temperature sensor - The buttons for Steptronic - The horn buttons for the fanfares - The multifunction key blocks left/right - The driver airbag - The priming caps for the airbag triggering are located in the driver airbag - The steering wheel electronics with connection to the coil springs

78 E65 Passive Safety Systems Chapter 3 P.69 The components in the steering column include: - The steering column electronics with connection to the byteflight - The steering-angle sensor - The turn signal and dipped-beam switch - The wiper switch - The switch for cruise-control system - The selector lever - The switch for steering wheel heating - The switch for steering wheel lock - The switch for steering wheel adjustment - The coil springs The connection between the two components is the coil spring for signal and power transmission. Fig. 48: Circuitry principle of the steering column switch centre satellite KT-8523 Index Description A Satellite with steering column electronics B Steering wheel electronics C Airbag module VS Power supply for the satellites from the SIM KL.31 Earth SI-Bus byteflight 1 Voltage regulator 2 Microprocessor 3 Coil spring

79 E65 Passive Safety Systems Chapter 3 P.70 4 Igniter output stage for driver airbag 5 Priming cap for driver airbag stage 1 6 Priming cap for driver airbag stage 2 Functional description The satellite SZL is integrated in the steering column electronics (LSE) and linked to the SIM via the byteflight. The power supply of the satellites is also from the SIM and it is buffered by the memory backup capacitor. In addition, there is a terminal 30 for the supply of circuit elements not relevant to safety (steering wheel heating) and a terminal 15 for reasons of redundancy. Moreover, for reasons of redundancy, there are serial communication links to the Adaptive Gearbox Control (AGS) and to the lights switching centre (LSZ). In sleep mode of the byteflight, the power supply of the SZL is deactivated by the SIM. The watchdog function is run via the SIM. Power supply SZL Operating voltage V Full function The SZL controls and monitors the priming caps for the first and second stages of the driver airbag. Activation is via the coil spring to the steering wheel and to the priming cap in the airbag triggering unit. Pin assignment V Restricted function Power intake Typ. 120 ma In normal operation Fig. 49: Plug connector details, steering column switch centre KT-6724

80 E65 Passive Safety Systems Chapter 3 P.71 SZL connector 1, LWL hybrid connector, coding A, X10334 PIN Type Remarks 1 I/O byteflight bus connection to Safety Information Module 2 I Voltage supply from Safety Information Module 3 I Terminal 31, electronics earth 4 5 SZL connector 2, ELO 8-pin, coding A, X1880 PIN Type Remarks 1 I Terminal 31, load earth 2 I Terminal 30 with 20 A fuse 3 O Fanfare 4 O Fanfare 5 6 O Serial connection to lights switching centre (LSZ) 7 I Terminal 15 8 O Serial connection to the electronic gearbox control (EGS)

81 E65 Passive Safety Systems Chapter 3 P.72 - Central Gateway Module (ZGM) The Central Gateway Module is installed in the device carrier behind the glovebox. (See page 33, Installation Position of SIM) The following graphic shows the circuitry principle of the ZGM. Fig. 50: Circuitry principle of the Central Gateway Module KT-8396 Index Description KL.30 Voltage supply KL.31 Earth supply LWL byteflight S/E Transmitter/receiver module 1 Voltage regulator 2 Microprocessor 3 Data memory 4 Driver for diagnostic bus 5 Driver for body CAN 6 Driver for power train CAN 7 Transmitter/receiver module 8 Wakeup logic

82 E65 Passive Safety Systems Chapter 3 P.73 Functional description The ZGM has the task of co-ordinating the various data transfer rates of the telegrams between the buses and interchanging messages between the individual buses. The following bus systems are connected to the ZGM: - byteflight - K-CAN, body-can - PT-CAN, Power Train CAN - PT wake-up line - Diagnosis bus The corresponding driver modules enable conversion of the messages to each bus or the diagnosis lead. All the connected buses and the diagnosis lead can wake up the gateway. To achieve this, there is a wake-up logic that controls the voltage supply of the module. Furthermore, a non-volatile data memory is integrated in the ZGM, and this can be used to store configuration, diagnosis and crash data. The following graphic shows the implementation principle of the telegrams in the ZGM. Diagnosis PT wake-up line Fig. 51: Signal implementation in the ZGM KT-8136

83 E65 Passive Safety Systems Chapter 3 P.74 Pin assignment Fig. 52: Plug connector details of the Central Gateway Module KT-6838 ZGM connector 1, LWL hybrid connector, coding A, X 1997 PIN Type Remarks 1 I/O byteflight bus connection to Safety Information Module ZGM connector 12, ELO 12-pin, coding A, X1998 PIN Type Remarks 1 I Wake-up line of the PT-CAN bus 2 I Terminal 30, voltage supply 3 4 I/O PT-CAN H 5 6 I/O K-CANSYS H 7 I Terminal 31, electronics earth 8 I/O Diagnosis lead to OBD II connector 9 10 I/O PT-CAN L I/O K-CANSYS L

84 E65 Passive Safety Systems Chapter 4 P.1 Restraint systems Triggering strategy - Introduction A completely new safety system, the ISIS, has been developed for the E65. With its decentralized satellites fitted at strategic points in the vehicle, it is possible for the first time to implement 100%, all-round detection on the vehicle. Triggering thresholds Numerous crash and road tests under extreme conditions have been used to set the BMW triggering thresholds for all possible types of accidents. The triggering thresholds are divided according to crash severity (CS). There are four types of crash severity: CS 0 Light collision No airbag activation CS 1 Medium collision Possible airbag triggering, stage 1 CS 2 Severe collision Airbag triggering, stage 1 CS 3 Very severe collision Airbag triggering, stage The triggering thresholds are set depending on the crash severity as well as various other factors, e.g. 0º, 30º, or offset crash. Other important information is also included, e.g. whether the occupant is wearing a seatbelt or not. This results in the trigger thresholds for the activation of the various restraint systems.

85 E65 Passive Safety Systems Chapter 4 P.2 Depending on the type of accident, different crash severities have been specified. Frontal crash CS 0, CS 1, CS 2, CS 3 Side-on crash CS 0, CS 1, CS 2 Rear crash CS 0, CS 1, CS 2 The following examples illustrate the actuators that can be activated. Note! If a fault is detected in the seat occupation detection system, it is assumed that the seat is occupied and the restraint systems are activated. If a fault is detected in the seatbelt buckle detection system, it is assumed that the seatbelt is not fastened and the restraint systems are activated with CS1. In spite of this an attempt is made to activate the seatbelt lock tensioner. The diagram below shows the sequence of events in a 0º wall impact with crash severity 3 in the ECE version.

86 E65 Passive Safety Systems Chapter 4 P.3 Setup phase Priming phase Restraint phase Start of return shift Seatbelt tensioner Driver / passenger Belt tension limiter, left Belt tension limiter, right Driver airbag stage 1 Stage 2 Fig. 53: 0º wall impact with crash severity 3 Passenger airbag stage 1 Stage 2 End fitting tensioner, left Right Safety battery terminal Trigger algorithm KT-8631

87 E65 Passive Safety Systems Chapter 4 P.4 Frontal crash CS 1 The table below shows the activated actuators with crash severity 1 on a left-hand drive vehicle. Actuators Seatbelt fastened Seatbelt not fastened Remarks Driver airbag stage 1 X Driver airbag stage 2 X Front passenger airbag, stage 1 X Front passenger airbag, stage 2 X Seatbelt tensioner, driver X Seatbelt tensioner, passenger X if occupied End fitting tensioner, left X X if occupied End fitting tensioner, right X X if occupied Note! If the driver and passenger are wearing seatbelts, no airbag would be triggered. Frontal crash CS 2 / CS 3 The activation of the airbag stages and the belt tension limiter takes place via differentiation of the crash severity with various decelerations on activation. Actuators Seatbelt fastened Seatbelt not fastened Remarks for Triggering Driver airbag, stage 1 X X Driver airbag, stage 2 X X Front passenger airbag, stage 1 X X if occupied Front passenger airbag, stage 2 X X if occupied Knee airbag, left X X only US Knee airbag, right X X only US, if occupied Belt tension limiter, left X Belt tension limiter, right X if occupied Seatbelt tensioner, driver X Seatbelt tensioner, passenger X if occupied End fitting tensioner, left X X if occupied End fitting tensioner, right X X if occupied Safety battery terminal Stop electrical fuel pump Emergency call telephone

88 E65 Passive Safety Systems Chapter 4 P.5 Side-on collision, left CS 1 Actuators Remarks AITS I / II, left Thorax, front left Thorax, rear left if occupied Side-on collision, left CS 2 Actuators Remarks AITS I / II, left Thorax, front left Thorax, rear left if occupied Safety battery terminal Stop electrical fuel pump Emergency call telephone Side-on collision, right CS 1 Actuators AITS I / II, right Thorax, front right Thorax, rear right Remarks if occupied if occupied if occupied Side-on collision, right CS 2 Actuators AITS I / II, right Remarks if occupied AITS I / II, right if the seat is not occupied ( driver protection ) Thorax, front right Thorax, rear right if occupied if occupied Safety battery terminal Stop electrical fuel pump Emergency call telephone Rear crash CS 1 Actuators Remarks Active headrest, driver Active headrest, passenger if occupied

89 E65 Passive Safety Systems Chapter 4 P.6 Rear crash, CS 2 Actuators Remarks Active headrest, driver Active headrest, passenger if occupied Seatbelt tensioner, driver Seatbelt tensioner, passenger End fitting tensioner, left End fitting tensioner, right if occupied if occupied if occupied Safety battery terminal Stop electrical fuel pump Emergency call telephone

90 E65 Passive Safety Systems Chapter 4 P.7 Function and component description, airbags - Introduction The most up to date safety technology is fitted on the E65. 2-stage airbags are used for the driver and front passenger. Another new feature is the knee airbag for US models. The well proven head airbag ITS has been improved once again and expanded by a sail to achieve an even greater protective effect. An extended version is also offered for protection of rear seat passengers. Thorax airbags are integrated in the doors, as standard equipment in the front and as an option in the rear. The size of the airbags has been modified. The airbags have the following volumes: Airbag Volume Stages Use Driver approx. 62 l 2 ECE / US Front passenger approx. 135 l 2 ECE / US Knee approx. 16 l 1 US Thorax, front approx. 12 l 1 ECE / US Thorax, rear approx. 12 l 1 ECE / US AITS I approx. 12 l 1 ECE / US AITS II approx. 24 l 1 ECE / US

91 E65 Passive Safety Systems Chapter 4 P.8 - Driver airbag The 2-stage driver airbag, the so-called SMART airbag, which has been available since 3/99, is used on the E65. It has a volume of approx. 62 l and is fitted with a four-spoke steering wheel. There is only one design for all models. Depending on the crash severity detected, the two priming caps of the 1st stage and 2nd stage are ignited. The faster the two ignitions succeed one another, the faster the airbag is filled. to eliminate hazards during rescue operations or disposal, both priming caps are always triggered, with a slight delay. New on the E65 is the colour matching of the airbag unit to the interior colour trim. Airbag units in the following colours are offered: black, beige, grey and blue. KT-8059 KT-8058 Fig. 54: View of driver airbag, front and rear Index Description 1 Connection for priming cap, 1st stage 2 Connection for priming cap, 2nd stage The technical description of the driver airbag can be found in the trainer's guide Passive Safety.

92 E65 Passive Safety Systems Chapter 4 P.9 - Passenger airbag The front passenger airbag is a 2-stage SMART airbag with a volume of approx. 135 l. It is designed in hybrid technology. The gas generator is a combination of solid fuel and gas. The passenger airbag module consists of a gas generator, airbag and housing. It is fitted beneath the instrument panel, above the glovebox and behind the CD changer. The instrument panel has been designed in such a way that it tears open at defined points in the event of a crash and the airbag can emerge upwards. There is no separate cover for the airbag. Fig. 55: Two-stage passenger airbag KT-8985 The technical description of the driver airbag can be found in the trainer's guide for model year 1999.

93 E65 Passive Safety Systems Chapter 4 P.10 - Knee airbag (only US) For the USA version of the E65, there is a worldwide innovation, the knee airbag. The knee airbag is available for the driver and passenger side. In the event of a crash, the knee airbags support the knee, especially if the driver or passenger are not wearing seatbelts. This initiates a controlled forward shift of the upper body, which is cushioned by the relevant airbag. The knee airbag on the driver's side is located below the steering column, beneath a cover. Fig. 56: Knee airbag on driver's side, front view KT-8188 Fig. 57: Knee airbag on driver's side, rear view KT-8187

94 E65 Passive Safety Systems Chapter 4 P.11 The knee airbag on the passenger side is located in the lid of the glovebox, beneath a cover. Fig. 58: Glovebox cover with knee airbag, passenger side KT-8189 Fig. 59: Glovebox module of the knee airbag, passenger side KT-8190 Functional description The knee airbag is a one-stage airbag with gas generator. The volume is approx. 16 l. The airbag module on the driver's side consists of a plastic housing, the gas generator and the airbag. On the passenger side, it consists of a metal plate housing, the gas generator and the airbag. For the passenger knee airbag, the glovebox lid is the mounting for the airbag module.

95 E65 Passive Safety Systems Chapter 4 P.12 In the event of a crash of sufficient severity, the gas generator is ignited. The escaping gas fills the airbag located between the housing and the cover. The filling airbag presses the cover towards the passenger. Several retaining belts fix the cover in its position in front of the air cushion. The passenger's knees touch the cover. Over the surface of the cover, the load is distributed across the airbag and the passenger is supported. The support of the knee initiates a controlled forward shift of the upper body, which is cushioned by the driver or passenger airbag. The knee airbags can only be seen by the lettering "AIRBAG" on the top right of the glovebox lid or top left on the driver's side and on the cable connection for the airbag module.

96 E65 Passive Safety Systems Chapter 4 P.13 - Advanced ITS New on the E65 is the Advanced ITS, AITS, the extended head airbag. The ITS Inflatable Tubular Structure (head airbag) familiar from the E38/E39 has been extended by a sail. There are two versions of the AITS. Fig. 60: Advanced ITS I for front seat occupants The Advanced ITS I for the head area of the driver and passenger (series). It runs from the A-pillar to behind the B-pillar, as before. The volume is approx. 12 l. KT-8181 Fig. 61: Advanced ITS II for front seat and rear seat occupants KT-8182 As an option, there is the Advanced ITS II for the head area at the front and rear in conjunction with the rear compartment protection package or the comfort seat. The AITS II runs from the A-pillar to the C-pillar and covers the entire side section. The volume is approx. 24 l.

97 E65 Passive Safety Systems Chapter 4 P.14 In conjunction with the thorax airbags in the front and rear doors, it provides optimum side protection for all passengers. The Advanced ITS prevents the head and other extremities of the occupants from swinging outwards. This leads to less severe neck backlash forces and less severe head injuries. Advantages of the system: - Extended covered area for side windows front and rear. - Protection against glass splinters and penetrating objects. - Optimized protection area also for very large occupants. Functional description The Advanced ITS is fitted in the roof zone. It consists of a woven tube with an additional sail wrapped around. The sail is secured to the roof frame and is tensioned downwards by the woven tube. In the event of a side-on collision, the generator is ignited and the gas flows through the gas lance into the woven tube. The woven tube expands to approx. 130 mm in diameter and its length is thus reduced. Secure fitting of the woven tube on the A-pillar as well as on the C-pillar AITS II or on the roof frame (AITS I) brings the head airbag into position. In the process, the sail tightens between the side window or pillar trim and the occupant. The high tensioning force in the woven tube pulls the sail downwards, which increases the stability of the sail. The closed system means that the structural firmness and stability remain for several seconds. This is a particular advantage if the vehicle rolls over.

98 E65 Passive Safety Systems Chapter 4 P.15 Fig. 62: Size comparison of gas generators for AITS I and AITS II KT-8097 Index Description 1 Gas generator AITS II for front and rear 2 Gas generator AITS I for front

99 E65 Passive Safety Systems Chapter 4 P.16 - Thorax airbag (side airbag) On the E65, thorax airbags are installed in the front doors as standard and optionally in the rear doors. The thorax airbags reduce the risk of occupant injury in the torso region of the body in the case of a side-on crash. Compared to the AITS, the thorax airbags deflate relatively quickly, with a precisely geared damping effect. In conjunction with the Advanced ITS, it provides optimum side protection. The airbag shape is geared to the various occupant positions and sizes. The principle of the thorax airbags is identical to that used so far in the model series. A new feature is that the airbags are fitted in a function unit with the door trim. This significantly improves the effect if the inflation is obstructed, e.g. occupants leaning heavily on the panelling. Moreover, the airbag no longer emerges into the passenger compartment by opening a cover in the door trim, but by tearing a seam in the area of the middle panel. This greatly improves the functionality of the system. As before, a one-stage gas generator with a high proportion of cold gas is used. The volume is approx. 12 l. The front and rear airbags are identical parts. The front thorax airbag is bolted at two points, the rear at another additional point to the door frame. The technical description can be found in the trainer's guide Passive Safety.

100 E65 Passive Safety Systems Chapter 4 P.17 Function and component description, seatbelt systems - Introduction The seatbelt is known worldwide as the most effective protection system for vehicle occupants in traffic accidents. The rate of seatbelt use, and the system acceptance of seatbelts, is determined mainly by the comfort features of the inertia reel seatbelt and the geometry of the running course of the seatbelt. The aim of development for the seatbelt system is to optimize the wearing comfort to increase the rate of seatbelt use as well as to improve the restraint effect, e.g. in conjunction with a seatbelt tension limiter. Functional description In the event of a crash, the impact decelerates the vehicle. The seatbelt binds the occupants to the vehicle, ensuring that the occupants participate in the vehicle deceleration. Deceleration peaks are dampened by the flexibility of the seatbelt strap, and impact of body parts on the steering wheel, dashboard etc. is largely avoided. On the E65, the belt system on the driver and passenger side consists of the following components: - Pyrotechnical belt tensioner with seatbelt buckle identification - Upper seatbelt inertia reel with two-stage belt tension limiter - Belt deflection fitting

101 E65 Passive Safety Systems Chapter 4 P.18 - Seatbelt tensioner On the E65, pyrotechnical seatbelt tensioners are used for the driver and passenger seat. The principle of the seatbelt lock tensioner is the same as that used in the E38/E39. The seatbelt tensioner has the task in the event of a crash to remove or reduce any belt slack in the pelvic and shoulder region. The belt slack comes about mainly due to the motion of the occupants or due to clothing, especially when jackets and coats are worn in winter. This ensures that the occupant is restrained firmly on the seat and prevents so-called "submarining", slipping under a slack seatbelt. There is also earlier restraint and thus earlier binding to the vehicle. The seatbelt tensioner forms a unit with the seatbelt buckle. It consists of a priming cap, generator, plunger and cable. The belt buckle switch is integrated in the seatbelt buckle. In the event of a crash of sufficient severity, the gas generator is ignited. The gas spreads and shifts the plunger in the tensioning pipe. The cable connected to the plunger thus pulls the seatbelt buckle downwards and the belt slack from the belt system. On the E65, there are the following technical changes. The priming cap is no longer directly connected onto the gas generator but rather the connection comes out on a cable together with the belt buckle switch cable and is plugged under the seat. If the seatbelt tensioner needs replacing, the seat no longer needs to be removed. Fig. 63: Seatbelt tensioner, front seat KT-8075

102 E65 Passive Safety Systems Chapter 4 P.19 - Belt tension limiter The belt tension limiters for driver and passenger are inertia reel seatbelts with adaptive force limitation. A gas generator is used to switch from a high degree of force to a lower degree of force. This also has to be possible during an accident to achieve a regressive force reduction. The advantage of the adaptive belt tension limiter is the considerable reduction of the load on the chest in the event of a crash. With optimum co-ordination to the airbag, the kinetic energy of the occupant is reduced evenly across the duration of the crash, thus achieving low occupant load values. Fig. 64: Inertia reel seatbelt with pyrotechnical belt tension limiter KT-8060 Index Description 1 Connection for the priming cap of the belt tension limiter Functional description The adaptive force limitation is based on a two-stage torsion bar (stage shaft). The torsion bar consists of the two head ends left and right, the stages and the centre head. The belt force is transferred to the seatbelt roller. The seatbelt roller is connected to a sleeve that contains the torsion bar. There is a shaft ring with locking pawls on the sleeve. The locking pawls transfer the torque to the torsion bar.

103 E65 Passive Safety Systems Chapter 4 P.20 Fig. 65: Flow of forces in the first stage ( high degree of force ) KT-8183 Index Description 1 Seatbelt strap 2 Seatbelt roller 3 Shaft ring 4 Locking pawls 5 Housing 6 Sleeve 7 Centre head 8 Torsion bar In the first stage, with the preset high level of force, the torque of the seatbelt roller is transferred via the locking pawls to the centre head of the torsion bar. If the seatbelt roller is turned relative to the fixed torsion bar, the force is transferred to the thicker part of the torsion bar. This produces the high power level.

104 E65 Passive Safety Systems Chapter 4 P.21 Fig. 66: Flow of forces in the second stage (low degree of force) KT-8184 In the event of a crash, the gas generator is ignited and a plunger moves out, shifting the shaft ring axially. The locking pawls are now no longer held by the sleeve and transfer no more torque to the centre head of the torsion bar. The belt force is now passed across the right-hand head end into the stage shaft and runs through the entire torsion bar. The lower diameter on the right-hand side means that the torsion bar is turned further and thus the force is reduced to a low level.

105 E65 Passive Safety Systems Chapter 4 P.22 Belt deflection fitting Using new simulation methods with regard to installation and ergonomics, it was determined that there is an optimal area for all occupants to secure the belt deflection fitting. The belt deflection fitting is now designed as a roller. The low friction power of the seatbelt increases wearing comfort. Fig. 67: Belt deflection fitting with seatbelt roller KT-8079

106 E65 Passive Safety Systems Chapter 4 P.23 - End fitting tensioner If the special equipment comfort seat or rear safety package are ordered with the E65, end fitting tensioners are fitted on the outer rear seats. In the middle, a three-point automatic belt is fitted. The basic version has 3 three-point automatic belts. With the comfort seat, the rear seatbelt consists of the following components: Fig. 68: Rear belt system (comfort seat) KT-8062 Index Description 1 Inertia reel seatbelt with one-stage mechanical force transmission 2 Belt tongue 3 End fitting tensioner 4 Moving seatbelt buckle

107 E65 Passive Safety Systems Chapter 4 P.24 The rear end fitting tensioners have the same task as the seatbelt tensioners at the front: removing the belt slack in the crash as well as early binding of the occupant to the vehicle deceleration. As the space available beneath the rear seat means that a solution similar to the front seatbelt tensioner cannot be achieved, a new solution had to be found: the belt slack is removed by drawing in the seatbelt strap at the end fitting. The inertia reel seatbelt forms the upper attachment point, the end fitting tensioner is the lower attachment point. The end fitting tensioner consists of the following components: Fig. 69: End fitting tensioner KT-8116 Index Description 1 Tensioning tube 2 Gas generator 3 Connection for seatbelt strap priming cap 4 Belt roller shaft 5 Seatbelt strap 6 Housing 7 Roller coupling 8 Cable pulley 9 Cable

108 E65 Passive Safety Systems Chapter 4 P.25 Functional description If the seat has been detected as occupied, the rear seat satellite ignites the priming cap in the event of a crash. When the generator ignites, the rise in pressure shifts a plunger in the pipe. The cable end is drawn in the pipe in a linear direction by the plunger. The other cable end is wound by a cable pulley and thus turns the belt winding shaft. A roller coupling blocks the belt winding shaft so that when force is applied into the belt system after the tensioning process this can no longer be turned back. Their design means that the end fitting tensioners tighten the pelvic belt slack first and then the chest belt slack. The tensioning path is determined by the cable pulley diameter and the usable plunger travel. The maximum tensioning path is approx. 150 mm. Moving seatbelt buckle The moving seatbelt buckle guarantees for adjustable rear seats that the occupants always have the optimum belt geometry, as in every seat position the distance to the retaining point remains the same. Functional description The seatbelt buckle is on a sliding element that can be shifted according to the seat adjustment in a rail secured to the car body by fittings. Each position of the seatbelt buckle in relation to the seat is guaranteed by a catch on the seat. If a load is applied, a locking lever mounted in the sliding element swings out and a stop aperture locks the seatbelt buckle in the rail. This prevents the seatbelt buckle from shifting under load.

109 E65 Passive Safety Systems Chapter 4 P.26 Fig. 70: Moving seatbelt buckle KT-8117 Index Description 1 Sliding element with locking lever 2 Stop aperture 3 Fittings 4 Fastening point 5 Rail 6 Seatbelt buckle

110 E65 Passive Safety Systems Chapter 4 P.27 Sensors - Seat occupation detection (sensor mat) A seat occupation detection mat is installed in the seat cushion of the driver and passenger seat and, with special equipment 261, in the left and right rear seats in the E65. The sensor mat is technically identical to the mats used until now for the MRS systems. The sensor system consists of pressure sensors that use an electronic evaluation unit to detect whether there is a load on the seat. As of a weight of approx. 12 kg, the seat is recognized as occupied. The electronic evaluation units of the seat occupation mats are connected to the relevant satellites. The information regarding seat occupation is required for activation of the following actuators: - Airbag activation - Triggering the priming caps for the seatbelt tensioners and/or end fitting tensioners - Triggering the active headrests - Extending the rear headrests KT-8067 KT-8064 Fig. 71: Seat occupation mats front and rear with electronic evaluation unit

111 E65 Passive Safety Systems Chapter 4 P.28 - Belt buckle switch The belt buckle switch is a two-wire Hall switch, as already in use in various models since 3/97. As of the E65, the belt buckle switches are evaluated in all models. The airbags are triggered at different times depending on the crash severity and depending on whether the seatbelt has been fastened or not. The belt buckle switch is located in the seatbelt buckle on the driver and passenger seat. It is used to detect whether the seatbelt has been fastened or not. The detection arrives as a signal at the relevant satellites. The detection serves to trigger the pyrotechnic actuators in the event of a crash, e.g. seatbelt tensioner, airbags. In the Japan/Gulf State country versions, the belt buckle switch also serves as a seatbelt warning in case the vehicle is started without a seatbelt having been fastened.

112 E65 Passive Safety Systems Chapter 4 P.29 Actuators - Active headrest Introduction Another innovation on the E65 is the active headrest for driver and passenger with multifunction seat. No active headrest is installed on the basic seat, as the fixed positioning of the backrest and headrest mean that the head is always near the headrest. In a rear-end collision, the occupants are accelerated along with the vehicle. The upper torso and pelvis of the occupants rest against the backrest and thus absorb this acceleration at an early stage. In this case, the head is the most unresponsive part of the occupants. In the initial phase of the crash, the head remains in its initial position. Viewed in relation to the body, which moves forwards, the head moves backwards. It is only when the head makes contact with the headrest that this relative movement between head and body is limited and the head is accelerated to the same extent as the body. This pitching motion of the head leads to cervical vertebrae injuries (whiplash syndrome). The danger of cervical vertebrae injuries is higher the greater the distance between the head and headrest in the initial position. The headrests are intended to prevent the dangerous pitching motion of the head to the greatest possible extent. Functional description In the case of the multifunction seat, the adjustment of the headrest means that there is the possibility that the gap between the headrest and head increases. In the event of a crash, the gap would be relatively large, leading to greater strain on the cervical vertebrae. For this reason, the active headrest was developed. In the event of a crash, this reduces the gap between the headrest and head and thus the rate of cervical vertebrae injuries.

113 E65 Passive Safety Systems Chapter 4 P.30 Fig. 72: Backrest with active headrest KT-8071 Index Description 1 Mounting of the active headrest 2 Connection for priming cap 3 Gas generator 4 Support tube 5 Centre of rotation 6 Headrest height adjustment On the multifunction seat, the active headrest system is located in the backrest. It consists of a support tube, which is fitted on bearings on the backrest. The retaining plate attaches the system firmly with the backrest. The support tube serves as fixture for the headrest, the adjustment mechanism of the active headrest as well as the headrest height adjustment. The adjustment mechanism consists of a retaining plate and a sliding element. The sliding element is a moveable part connected to the gate located on the support tube. The retaining plate is firmly attached to the backrest. The generator is located between the retaining plate and the sliding element.

114 E65 Passive Safety Systems Chapter 4 P.31 The generator consists of a casing, plunger, priming cap and connection and is attached to the retaining plate and the sliding element by spring retainers. In the event of a crash, the priming cap is activated, the solid fuel burns; the gas this produces presses the plunger. The plunger rod moves out and shifts the sliding element. The support tube is moved forwards via the slanted, elongated holes in the support tube which the sliding element enters. This means that the headrest attached to the support tube is also moved in the direction of travel. The adjustment range of the headrest is approx. 9 degrees. Depending on the vertical adjustment of the headrest, different adjusting paths result. The adjustment of the headrest, measured on the cushion, is approx. 40 mm when the headrest is retracted. When the headrest is fully extended, the adjustment is approx. 60 mm. Fig. 73: Adjustment range of the active headrest KT-7858 If the active headrest has been triggered in a crash, only the generator needs to be replaced to return the system to normal function.

115 E65 Passive Safety Systems Chapter 4 P.32 Rear view and plan view of the active headrest in operation Fig. 74: Active headrest in the standby state KT-7855 Index Description Index Description 1 Headrest 6 Generator 2 Headrest guide 7 Priming cap with connection 3 Support tube 8 Mounting points 4 Retaining plate 9 Sliding element 5 Piston rod 10 Centre of rotation

116 E65 Passive Safety Systems Chapter 4 P.33 Active headrest in the triggered state Fig. 75: Active headrest in the triggered state KT-7856

117 E65 Passive Safety Systems Chapter 4 P.34 - Safety battery terminal The safety battery terminal (SBK) is technically identical to the MRS systems. The technical description can be found in the trainer's guide Passive Safety. If the ISIS system detects a crash of sufficient severity, the priming cap of the safety battery terminal is triggered via the B-pillar satellite, right (SBSR). A small quantity of solid fuel electrically and mechanically cuts the starter and alternator line from the positive terminal of the battery. This prevents short circuits. A separate vehicle electrical system connection ensures that the remaining vehicle circuit retains its function when the SBK is triggered. This ensures the operation of all the important functions such as lights, hazard warning lights, telephone emergency call, etc. Fig. 76: Safety battery terminal E65 KT-8072 Index Description 1 Starter line 2 Battery terminal at positive terminal 3 Ignition capsule 4 Sensing for the vehicle circuit power supply