Safety Requirements

Servotronic Safety Requirements

The CIM will output the Check Control message "Servotronic failed" to make the driver aware of a fault. In addition, a fault code will be stored in the CIM module. If the fault is still present upon the next engine start, the Check Control message will reappear.

Overvoltage: The CIM module will not apply power to the solenoid valve if a voltage value greater than 17 V is detected (failsafe).

Undervoltage: A momentary dip in voltage will self correct, the CIM functions will resume again after a delay time. The undervoltage fault code will not set during engine starting (crank signal).

- > 7.5 V CIM module operates normally
- 6.5 V...7.5 V Reset after 200 ms; CIM will assume sleep mode, woken by CAN Bus
- < 6.5 V Reset after 20 ms; CIM will assume sleep mode, woken by CAN Bus

Speed Signal Monitoring: The CIM module evaluates the vehicle speed signal for three different reasons and will produce different fault codes when faults are detected.

Timeout Vehicle Speed: The vehicle speed (V_DSC) is read cyclically (every 100 ms) by the CIM module via the K-CAN Bus. If an update is not received within 500 ms, the solenoid valve is deactivated. The sport characteristic (power assist reduced) will be in operation.

A CAN timeout fault code will be stored in the CIM after 10 failed messages. A Check Control message will be sent if an update is not received in 5 seconds. The timeout fault code is reset with the next engine start. The fault code counter will be cleared by a correctly received message within the 5 second monitoring period. When a general CAN fault is detected, the solenoid valve is deactivated and the speed monitoring is ignored.

Fault Value of Speed Message: The CIM is informed of speed faults detected by the DSC by a fault value. A Check Control message is sent and the solenoid valve is deactivated when the fault value is received ten times in succession.

Plausibility Check by Calculating the Acceleration: The acceleration is calculated based on the vehicle speed. The Servotronic is regulated to the speed up to an acceleration of 1.3 g. If the acceleration exceeds the value of 1.3 g:

- The speed is calculated internally during braking by deducting 4 km/h per 100 ms from the last speed and storing this value as the current speed.
- The speed is calculated internally during acceleration by adding 6 km/h per 100 ms to the last speed and storing this value as the current speed. As soon as an acceleration value less than 1.3 g is observed between the stored speed and the speed supplied on the Bus, the Servotronic regulation is resumed.

Solenoid Valve Circuit Monitoring: The circuit is monitored for shorts (B+ and ground) and breaks. If a fault is detected in the control circuit for the solenoid valve, the circuit and solenoid valve will be deactivated. Only minimum power assisted steering will be provided. This check is conducted within the initialization phase of 1 second. This function will repeat each time the ignition is cycled. The Servotronic will not operate during the engine start procedure it a fault is present for longer than 1 second.

Current Plausibility Check: The solenoid valve current is monitored by the CIM module and must be within a tolerance range. This takes place within the initialization phase and the output stage for the solenoid valve is deactivated if a fault is detected.

Damper Program Signal Status Monitoring: The EDC-K status is observed by the CIM module cyclically (every 200 ms) over the K-CAN Bus. The EDC-K provides the comfort or sport request. If a message is not received within 2 seconds, the comfort characteristic will be set and the fault code "timeout EDC-K status" will be stored. A Check Control message will not be sent.

Diagnosis Information

External Faults: All inputs, actuators and mechanical functions are monitored. Open or short circuits in the wires and actuators to the CIM module are monitored.

Internal Faults: The electronic function of the CIM module and the output stages are also monitored. When a fault occurs, the entire system is shut down and a fault code is stored. The cyclic CAN signal is also monitored.

Fault Generation: When a fault is detected in a function or component, that output function is deactivated. The fault information is stored in the fault code memory. If correct function of the component cannot be determined after a fault has occurred, the function will remain deactivated. After repairs, the fault can be deleted by the DIS plus.