Part II

Crash Safety

CAS: Car Access System
The CAS control unit provides input signals for terminal voltages (such as Terminal 15 wake-up wire ON). The CAS control unit supplies voltage to the Crash Safety Module (ACSM) (starting at Terminal 30B ON).
Vehicles with front electronic module(FEM): The functions of the Car Access System (CAS) have been integrated in the Front Electronic Module (FEM).

DME or DDE: Digital Motor Electronics and/or Digital Diesel Electronics
The DME or DDE deactivates the electric fuel pump when an airbag deploys. The Crash Safety Module (ACSM) transmits the command through the CAN bus. The DME or DDE is on the bus.

ICM: Integrated chassis management
The networking of the suspension control systems by the ICM control unit provides a hierarchical function structure of all software-based driving dynamics functions.
The ICM control unit provides the systems in the entire vehicle with the dynamic driving state in the form of signals (e.g. data such as lateral and longitudinal acceleration, yaw velocity). The ICM control unit transmits these signals to other stations on the bus in the form of bus signals.
In addition to the sensors governing the vehicle dynamics control, the ICM control unit also contains longitudinal and lateral acceleration sensors to detect impacts.
Two wires provide a direct connection between the ICM control unit and the Crash Safety Module (ACSM) for transmission of the sensor signals.
Depending on vehicle equipment and the national-market version, the ICM control unit may also include a vertical acceleration sensor and a yaw rate sensor. Sensor signals are employed for vehicle dynamics systems as well as for impact detection. For impact detection the ICM control unit relays the sensor signals directly to the Crash Safety Module via two wires.







JBE: Junction Box Electronics
The JBE controls the central locking drive units. In the event of an accident with the corresponding severity, the central-locking system is unlocked.
Vehicles with front electronic module(FEM): The function has been integrated from the junction box electronics into the Front Electronic Module.

ZGM: Central gateway module
The Central Gateway Module links all main buses to one another. Examples of a main bus include the FlexRay, MOST, PT-CAN and K-CAN. This enables the Gateway function on the Central Gateway Module to exchange data between the various different bus systems.
When the diagnosis system is connected through the D-CAN (Diagnose-on-CAN), the central gateway module data requests from the diagnosis system to the internal buses. The response telegrams run through the process in the opposite direction.

FRM: Footwell module
The footwell module controls the interior lighting and exterior lighting. In the event of an accident with the corresponding severity, the interior lighting and hazard warning lights switch on automatically.
Vehicles with front electronic module(FEM): The functions of the footwell module have been integrated in the Front Electronic Module (FEM).

Front electronic module (FEM): Front Electronic Module
The front electronic module controls the interior lighting and exterior lighting. In the event of an accident with the corresponding severity, the interior lighting and hazard warning lights switch on automatically.
The Front Electronic Module provides input signals for terminal voltages (such as Terminal 15 wake-up wire ON).
The Front Electronic Module supplies the Crash Safety Module (ACSM) with voltage from terminal 30B ON.
The Front Electronic Module represents a new generation superseding existing control units and their functions.

The front electronic module safeguards functions from the following former control units:
- FRM: Footwell module
- CAS: Car Access System
- JBE: Junction Box Electronics
- ZGM: Central gateway module
The central gateway module (ZGM) is integrated in the Front Electronic Module (FEM). The central gateway module is seen as a control unit within the control unit, as the central gateway module (ZGM) acts as a self-sufficient control unit within the Front Electronic Module (FEM).

Instrument panel: Instrument panel
The instrument panel shows the visual seat belt warning and issues an acoustic seat belt warning. The Crash Safety Module (ACSM) controls the visual seat belt warning using a Check Control Message. The instrument cluster receives the status from the Crash Safety Module whenever the terminal status is Terminal 15 wake-up wire ON or higher. With the corresponding status, a visual and acoustic seat belt warning is issued as of terminal 15 On.
The instrument panel also contains the airbag indicator light. The PT-CAN (Powertrain CAN) connects the instrument cluster to the Crash Safety Module.

CBX-MEDIA and CBX-ECALL: Combox multimedia and Combox emergency call
The Crash Safety Module (ACSM) responds to accidents beyond a specified severity by transmitting a signal over a data wire and to the Combox. The Combox automatically initiates an emergency call which also contains the location of the vehicle. With High equipment, the Combox consists of 2 components:
- Main board: Combox multimedia (CBX-MEDIA)
- Emergency call printed circuit board: Combox emergency call (CBX-ECALL)

In principle, these are 2 separate control units in one housing. These two control units also respond during the vehicle test in the diagnosis.
The high equipment version of the Combox is the only version with telematics capability (automatic emergency call).

Driver's airbag and front passenger airbag
The driver's airbag and front passenger airbag reduce the risk of head or chest injuries to the occupants in the case of a head-on collision. The driver airbag is located under the centre pad on the steering wheel. The front passenger airbag is built into the dashboard above the glove box.

Side airbag
The side airbags reduce the risk of injuries to the occupants in the lap or torso area in the event of a side-on collision. The side airbag are fitted in the armrest side sections of the front seats.

Crash-active headrest
The crash-active head restraint is available for the driver's seat and front passenger seat.
On activation, the crash-active head restraint reduces the distance between the head restraint and head in order to reduce the load on the cervical vertebrae during a rear-end collision.

Head airbag
The head airbag prevents direct contact of the head against the side structure or an object entering the vehicle.
The head airbag stretches continuously at head height from the A-pillar to the C-pillar.
The shape and stability of the head airbag are retained for several seconds after deployment. The head airbag deflates more slowly than the front and side airbags. thus providing longer protection for the head in lateral rollover situations.
A head airbag is installed on the driver's side and on the front passenger side.

Knee airbag
When triggered, the knee airbag provides support for the knee if the front passenger is not wearing a seat belt. This initiates controlled forward displacement of the upper body. The upper body is cushioned by the respective airbag (driver's airbag or front passenger airbag).

Seatbelt tensioners for driver belt and passenger belt
As a rule, the seat belt does not fully tighten around the body. The so-called "belt slack" of the seat belt ensures that the occupants can move comfortably to an adequate degree. In the event of a collision, the pyrotechnic seatbelt tensioner pulls the belt buckle a number of centimeters downwards (bear the national version in mind), thus pulling the seat belt tight into the occupant's shoulder and pelvis.

Retractor tensioners for driver's seat belt and passenger belt
The effect of the reel tensioners is that in the event of a collision the occupants' shoulder region is fixed more strongly on the seat. The reel tensioner is connected to the reel mechanism. When the reel tensioner triggers, the seat belt is reeled in, pulling it taut.

Anchor fitting tensioner
The end fitting pretensioner prevents the driver's pelvis moving too far forward in the event a head-on or rear-end collision. The end fitting pretensioner is installed in addition to the seat belt tensioner on the driver's seat. In principle, the end fitting pretensioner functions in the same way as a seat belt tensioner.

REMAFA resp. REMABF: Reversible electromotive automatic reel, left and right
After evaluation of various signals and messages, the control unit recognizes whether the seat belt has to be pretensioned.

The reversible electromotive automatic reel system includes the following functions:
- Minimization of belt slack
(the seat belt lies optimally against the driver's resp. front passenger's body)
- Stabilization of the seat position in a critical driving situation or in the event of a possible accident
(pretensioning of the seat belt for optimizing the restraint system)

The reversible electromotive automatic reel consists of a automatic reel, electric motor with gearbox and an integrated control unit. The control unit is a bus user on the PT-CAN. After evaluation of various signals and messages, the control unit recognizes whether the seat belt has to be pretensioned. For example, the belt slack is thus removed after buckling up depending on the speed signal.
When a seat belt is put on, the control unit activates the respective reversible electromotive automatic reel one time over a specific period. Above an encodable driving speed (currently 10 Km/h), the seat belt strap is rolled up by the drive thus removing the belt slack.
In critical driving situations or in the event of a possible accident, the control unit also activates the drive. An algorithm calculates the driving condition and can issue the request for belt tensioning. The duration is set in such a way that the drive is activated by the control unit until a collision occurs or until a critical driving situation ends.

For calculating whether a critical driving situation exists, for example, vehicle oversteering, both control units (REMAFA and REMABF) use the data from the following systems:
- Integrated chassis management
The ICM control unit provides the systems in the entire vehicle with the dynamic driving state in the form of signals (e.g. data such as lateral and longitudinal acceleration, yaw rate).
- Dynamic Stability Control
The DSC control unit supplies information about brake pressure, for example.
- Crash safety module
The Crash Safety Module (ACSM) sends a message with the status of the seat belt buckle switches. The request for tensioning the seat belt occurs from the Crash Safety Module (ACSM).
- Camera-based driver assistance systems
The camera-based driver support systems (KAFAS) supply the signals of the lane departure warning and object detection. The request for tensioning the seat belt occurs through the camera-based driver support system.
- Active cruise control
The Active Cruise Control (ACC) processes the signals about distance and speed about objects moving away from the vehicle in front of the vehicle and sends these to the Integrated Chassis Management (ICM). The request for tensioning the seat belt is sent via the PT-CAN to the respective reversible electromotive automatic reel (REMAFA and REMABF) via the Integrated Chassis Management.

A failure of a control unit has no effect on the restraining function of the seat belt.

Seat belt force limiter
The seat belts are the primary restraint system for all occupants. To minimize the force in the chest area of the occupants in the event of a severe frontal collision, the front seat belts are equipped as-series standard with belt tension limiters. The mechanical belt tension limiters ensure that the seatbelt strap has a defined flexibility as of a certain force. The danger of injury due to belt forces exerted on the body is reduced.

Adaptive belt force limiter, front left and front right
The pyrotechnic belt force limiter minimizes the load on the upper torso of the front-seat occupants in the event of a severe head-on collision. The danger of injury due to belt forces exerted on the body is reduced.
There are 2 torsion shafts installed in the automatic reel. The torsion shafts are intermeshed. Up to a certain load, the belt force is specifically limited by the two torsion shafts. From a certain load, a gas generator is used to decouple the torsion shafts. Only one of the torsion shafts is connected to the seat belt. This allows the belt force to be smoothly limited for the entire duration of the crash.

Safety battery terminal
Depending on the severity of the accident, the safety battery terminal may disconnect the starter motor, the alternator and the remote battery terminal from the battery. This prevents the risk of electrical short-circuits in a serious accident.
Even if the safety battery terminal is disconnected, the system ensures that voltage continues to be supplied to all safety-relevant electrical equipment, such as the hazard warning flashers, interior lamps and phone.

Airbag control lamp
The airbag indicator lamp indicates the safety system's current operational status. The instrument cluster's airbag indicator lamp is controlled by the Crash Safety Module (ACSM) over the PT-CAN.

Seat belt warning lamp
The seat belt warning lamp is the visual seat belt warning. The visual seat belt warning tells the occupants to fasten their seat belts. The visual seat belt warning is started as of terminal 15 On (bear national version in mind).
The visual seat belt warning is displayed as follows:
- The seat belt warning lamp lights up in the instrument panel
- Check Control message in the instrument panel

Indicator lamp for front passenger airbag deactivation
When the indicator lamp for front passenger airbag deactivation is lit, this means that the following passenger-side airbags have been deactivated:
- Front passenger airbag
- Side airbag (in the armrest side section of the passengers seat)
- Crash active headrest
- Knee airbag (if present)

The Crash Safety Module (ACSM) continuously monitors the indicator lamp for the passenger airbag deactivation. A fault in the voltage supply or a defective light is stored in the fault memory of the Crash Safety Module. If this occurs, the airbag indicator light is switched on.

Fuel pump
Depending on the severity of the accident, the flow of fuel is also interrupted. The DME or DDE switches the electric fuel pump off in response to commands from the Crash Safety Module.

System functions
Descriptions of the following safety system functions are provided:
- Functional networking
- Self-test
- Impact detection
- Activation the safety system
- Message to other control units
- Visual and audible seat belt warning

Functional networking
The following graphic illustrates the operating networks of the safety systems in the Europe and in the US versions using the example F25.







The following graphic illustrates the operating networks of the safety systems in the Europe and in the US versions using the example F06, F12, and F13 .












The following graphic illustrates the operating networks of the safety systems in the Europe and in the US versions using the example F30.












Self-test
In addition to all the inputs and outputs, the Crash Safety Module (ACSM) also monitors the internal components (self-test). Possible fault codes are stored in the Crash Safety Module. In the event of a system error or a fault in a component, the airbag warning lamp lights up.
The Crash Safety Module performs a self test after the ignition is switched on. The airbag indicator lamp in the instrument cluster remains on during this period (of roughly 3 to 5 seconds). The airbag indicator lamp goes out as soon as the safety system is ready for operation.
If the instrument cluster fails to receive a CAN message from the Crash Safety Module in this period the airbag indicator lamp will light up.
The airbag indicator light remains on if the Crash Safety Module detects an existing fault or one that has been stored during the self-test or while driving.

If a fault is detected in the safety system, the operability of the safety system is partially maintained under the following conditions:
- If a fault is detected in a circuit of the safety system, only the function of the circuit concerned is disabled. The other airbag and seatbelt tensioners remain functional.
- In the event of a fault in the circuit of the airbag warning lamp, the lamp does not light up in the self-test. With the precondition that no other fault is present, the safety system remains functional without restriction.

In the event of an internal malfunction or a fault in the power supply in the Crash Safety Module, the entire safety system will be disabled (airbag indicator and seat belt warning lamps light up, Check Control message in the instrument cluster).

Impact detection
The Crash Safety Module (ACSM) detects all impacts throughout a 360° range.
Within the Crash Safety Module the direction and severity of the impact are determined based on inputs from the following external sensors:
- Front airbag sensor on left and front airbag sensor on right (note national version)
- Airbag sensor for left front door and airbag sensor for right front door (note national-market version)
- Left B-pillar airbag sensor and right B-pillar airbag sensor
- Longitudinal acceleration sensor and lateral acceleration sensor for impact recognition in the ICM control unit
- Vertical acceleration sensor in the ICM control unit (note vehicle equipment level and national-market version)
- Yaw rate sensor in the ICM control unit (note vehicle equipment and national-market version)

The Crash Safety Module processes all acceleration data. This determines the direction of a collision and the severity of the accident.

Activation the safety system
Comprehensive tests are used to define triggering thresholds for all possible types of accident. This results in different trigger thresholds for activation of the various restraint systems (airbags, seatbelt tensioners, etc.). The restraint systems are only triggered if 2 independent sensors simultaneously detect the corresponding threshold values.
The Crash Safety Module (ACSM) processes acceleration data from the sensors. The Crash Safety Module relies on acceleration data to determine the direction and severity of an impact. In the event of an impact the Safety Module determines whether deployment is required and which gas generators (belt tensioner, airbags, etc.) should be ignited. For example, the seatbelt tensioners have a lower trigger threshold than the front airbags. This means that depending on accident severity, only the belt tensioner may be activated by the Crash Safety Module.

Message to other control units
The Crash Safety Module (ACSM) transmits a message to other bus users when the restraint systems are triggered. Depending upon accident severity the responsible control units can carry out functions such as the following:
- Switching off the electric fuel pump (via the Digital Motor Electronics control unit)
- Switching off the alternator (via the Digital Motor Electronics control unit)
- Opening the central-locking system (via the junction box electronics)
- Switching on the interior lighting (via the footwell module)
- Switching on the hazard warning lights (via the footwell module)

Visual and acoustic seat belt warning for driver belt and passenger belt
For the seat belt warning, the signals of the 2 belt buckle switches (driver belt, passenger belt) are monitored separately. If the seat occupancy detection indicates that the front passenger seat is occupied, the passenger belt must also be inserted in the belt buckle. The seat belt warning then goes out.

The following situations are taken into account for output of a seat belt warning:
- Front seat belt not fastened and distance driven less than 200 m
With a driven distance below 200 m, only a visual seat belt warning is displayed (the seat belt warning lamp lights up). The vehicle can e.g. be driven out of the garage without triggering an acoustic seat belt warning.
- Front seat belt not fastened and distance travelled more than 200 m
The seat belt warning lamp lights up (visual seat belt warning). The acoustic seat belt warning is switched on for approx. 90 seconds. Once the seat belt has been fastened, the visual seat belt warning disappears. The acoustic seat belt warning is switched off. If the seat belt has not been fastened by the end of the audible seat belt warning, the seat belt indicator light lights up.
- Unfastening the front seat belt when the vehicle is in motion
If a belt buckle is opened while the vehicle is being driven, the seat belt warning lamp lights up immediately. A brief acoustic warning signal sounds. After approx. 15 seconds, an additional acoustic seat belt warning is switched on for approx. 90 seconds. Once the seat belt has been fastened, the visual seat belt warning disappears. The acoustic seat belt warning is switched off. If the seat belt has not been fastened by the end of the audible seat belt warning, the seat belt indicator light lights up.

Notes for Service department

General notes
The following general instructions have been issued for servicing the safety system:

NB: After disconnecting the battery terminals, wait 1 minute before starting work on the safety system.
Following disconnection of the battery terminals, personnel must allow at least one minute to elapse before starting work on the safety system. The waiting period ensures that the capacitors with the energy reserve of the system are completely discharged. This prevents inadvertent triggering of airbags or seatbelt tensioners.

NB: Install only officially-approved seat covers
Never install seat covers, seat cushions or other objects on the front seats unless they have been specifically approved for seats with integral side airbags. Do not hang articles of clothing, e.g. jackets, over the front seat backrests. This severely impairs or disables the airbag function.

Diagnosis instructions

NOTE: Replace the Crash Safety Module after 3 crash signals followed by deployment of the safety system

When the safety system is triggered, the crash safety module stores data in a non-erasable memory. The data is relevant to accident research (no access for service). After 3 crash signals, the data memory is full. The airbag warning lamp lights up. The Crash Safety Module must be replaced.

Notes on encoding/programming

NOTE: Deactivating the acoustic seat belt warning

The acoustic seat-belt warning can be deactivated by encoding. This does not affect a legally prescribed seat belt warning.

NOTE: Code crash safety module

Following replacement the Crash Safety Module must be encoded.

National-market versions

National-market version for US

2-stage driver's airbag and front passenger airbag with pyrotechnically activated discharge hole
The driver's airbag and front passenger airbag are each equipped with a 2-stage gas generator. The discharge hole in the airbag serves to adapt the hardness of the airbag in an optimal way in the event of an accident. The discharge hole is pyrotechnically activated. Depending on the accident severity, both stages of the airbag as well as the ignition squib for opening the discharge hole are activated with a time delay. This enables adaptation of the restraint function of the airbag to the severity of each accident, thus minimising the additional load on the occupants during the unfolding phase of the airbag.

Visual and audible seat belt warning
As of terminal 15 On, a visual and acoustic seat belt warning is issued. The seat belt warning has a time limit (6 seconds).
The further progression of the seat belt warning is identical to that of the seat belt warning in Europe vehicles.

Enable seat occupancy mat
Following replacement of the seat-occupancy mat with capacitive sensor system, the seat-occupancy mat must be enabled. A service function is available for initialization.

National version Japan / Gulf states

Visual and audible seat belt warning
As of terminal 15 On, a visual and acoustic seat belt warning is issued. The seat belt warning has a time limit (6 seconds).

We can assume no liability for printing errors or inaccuracies in this document and reserve the right to introduce technical modifications at any time.