EEVblog #517 - Car Airbag Controller Teardown

[Kompost]

Most likely the latter. Logic behind being, that even a small plane crash can cause many times as much damage as even the largest and heaviest truck.

Can't see what more could be done to make it even more reliable. Considering the whole controller may fail and the system will still do it's work.

[free_electron]

I wonder if avionics would have similar safety characteristics, or be even more stringent...

go read up how the ARINC 429 bus works...

[poorchava]

I would also guess that all the assemblies have to withstand much more severe overvoltage conditions and power surges. In automotive setting I think most violent event of thatnature is so called 'load dump' which occurs after very heavy load (eg. battery) gets disconnected from alternator and there are voltage spike until regulator catches - up to 500V or so.

Now an aircraft has a pretty healthy chance of being struck by lightning... I have no idea against what overvoltage levels are avionic electronics devices specified.

[BravoV]

Now an aircraft has a pretty healthy chance of being struck by lightning... I have no idea against what overvoltage levels are avionic electronics devices specified.

I always thought Faraday cage effect takes care of that ? 

[hikariuk]

Yea well the EU has a little more respect to privacy than on this side of the pond.

You apparently missed the furore when people figured out that GCHQ and the NSA share data

(It's almost like no-one had ever heard of UKUSA before)

[JackOfVA]

Yea well the EU has a little more respect to privacy than on this side of the pond.

You apparently missed the furore when people figured out that GCHQ and the NSA share data

(It's almost like no-one had ever heard of UKUSA before)

Although the agreement is titled "UKUSA," Australia and NZ are participants and share signals intelligence data, or so I've read.

[Stonent]

Well, in the UK now it is an MOT (roadworthiness) failure to have a lit airbag fault light. I'd imagine that maybe the lesser microcontroller is perhaps only for fault detection? The documentation I could find seems to suggest a lot of DSP algorithms involved in calculating the angle and deceleration to determine if and what airbags should deploy. I'm not sure how the little processor could do that all.

Check the block diagram, whilst the main MCU has SPI bus to the firing banks, the failsafe only has a "single" line, i think that the failsafe just fires everything(i mean, it's failsafe after all, what's safer than "in case of failure, deploy all", you can't go wrong with that) and since it doesn't needs to calculate direction, it only has a threshold that might be higher than the main DSP(so that it doesn't overrides it on any impact with it's "fire all" signal) or maybe the banks inhibit the failsafe line if they receive valid firing "data" signals.
At least that's what i can think of the top of my head...
wait.. i figured out one that would work more easily: if the banks receive the failsafe fire signal and have no valid "data/SPI" fire signal then after a timeout they fire(assuming main MCU failure), that way you satisfy all conditions!

Well maybe not.  A coworker's wife's Honda suddenly fired all the airbags while she was driving down the road. She almost got in a wreck trying to control the car without seeing anything.

Honda wouldn't fix it because the car was out of warranty and she had to use her insurance to cover the repair.

[NiHaoMike]

http://techno-fandom.org/~hobbit/cars/batbox/
Scroll all the way to the bottom and you'll see the inside of the backup capacitor pack used for an ABS system.

[cosmos]

Well, in the UK now it is an MOT (roadworthiness) failure to have a lit airbag fault light. I'd imagine that maybe the lesser microcontroller is perhaps only for fault detection? The documentation I could find seems to suggest a lot of DSP algorithms involved in calculating the angle and deceleration to determine if and what airbags should deploy. I'm not sure how the little processor could do that all.

Check the block diagram, whilst the main MCU has SPI bus to the firing banks, the failsafe only has a "single" line, i think that the failsafe just fires everything(i mean, it's failsafe after all, what's safer than "in case of failure, deploy all", you can't go wrong with that) and since it doesn't needs to calculate direction, it only has a threshold that might be higher than the main DSP(so that it doesn't overrides it on any impact with it's "fire all" signal) or maybe the banks inhibit the failsafe line if they receive valid firing "data" signals.
At least that's what i can think of the top of my head...
wait.. i figured out one that would work more easily: if the banks receive the failsafe fire signal and have no valid "data/SPI" fire signal then after a timeout they fire(assuming main MCU failure), that way you satisfy all conditions!

Well maybe not.  A coworker's wife's Honda suddenly fired all the airbags while she was driving down the road. She almost got in a wreck trying to control the car without seeing anything.

Honda wouldn't fix it because the car was out of warranty and she had to use her insurance to cover the repair.

Goes to show that safety systems can and will fail ... it is just that the rate is reduced (strange how many think that safe means it can suddenly never fail) .
Put enough cars/trains/robots/etc  in service for enough time and faults will start to surface.

[hikariuk]

Yea well the EU has a little more respect to privacy than on this side of the pond.

You apparently missed the furore when people figured out that GCHQ and the NSA share data

(It's almost like no-one had ever heard of UKUSA before)

Although the agreement is titled "UKUSA," Australia and NZ are participants and share signals intelligence data, or so I've read.

Correct, so are Canada.  It's basically the English speaking intelligence club.

[brainwash]

Here's more than you'd want to know about this:

Parts
The automotive parts like these sell in the millions so it makes sense to have dedicated product lines. Another requirement is that car manufacturers need to have certain certifications (someone mentioned MISRA but there are also SPICE/ISO, CMMI and others) and all those certification requirements trickle down to the last component. So if you really want to use jellybean parts you will be responsible for the mishaps, because the certification implies complete traceability.

Certain automotive parts are the exact technical equivalent of their hobby-grade stuff but they went through some cert tests and are proven automotive-capable. You sometimes pay 5x the price without getting anything extra. Obviously you cannot use other parts (even better and much cheaper) since the manufacturers did not go through the trouble of getting things certified. That's a sure way of getting easy money. Case in point: harddrives made for entertainment units.

Software
The airbag logic is very complex and it's usually done by a specialized company or outsourced from some universities. That's because big auto parts companies employ generally mediocre people. That's because they need a lot of them and cannot afford the best ones nor are they able to find so many. It's just how corporations work.

The designers/developers responsible with the product mostly change parameters and write them to the EEPROM.
There are well over 20 inputs for each of these units (accelerometers, crash sensors, speed, engine, doors, seatbelt, occupancy/weight, roll-over, ...) and AFAIK the default fail-safe behavior is to NOT trigger the airbag.


The airbag units involved in a crash that resulted in deployment generally cannot be reused. They blow some fuses up or make some other irreversible changes to the unit. I'm sure enterprising individuals can restore them but hopefully that is not happening. Usually the units get exchanged for a new one or from a another car. With newer cars the units need to be coded as well so that the CAN gateway can recognize them.

On a lot of [european] cars the battery also has a pyro charge that interrupts the positive lead in case of a crash. I am not sure if the detonation happens before airbag deployment or after, but I would guess the later.


Regarding the code, AFAIK there is absolutely no ASM allowed, no pointers, no C++ crazy features, no "funny" obfuscation, no multithreading and a few other "hacker" things which I forgot about. Exceptions have to be heavily reviewed and innovations (algorithm, optimisations) are most often discouraged.

Design
On the electronics side, most of the automotive supply stuff is heavily over-engineered. All kinds of watchdogs are put into place and all possible recordable errors are written to the EEPROM and counted. The generic OBD stuff cannot find all of them but a car-specific tool can.


Misc
IANAL but I haven't heard of any case where the data stored in the EEPROM was being used to monitor someone or make a spectacular legal case.

I find it more interesting that for motorcycles the stuff is less regulated and generally less safe and reliable, with the exception of [big] BMW motorcycles which share a lot of technology with their car counterparts from 5-10 years before.

Interesting
A bit off-topic but on my 2001 BMW I can access at least 100 individual CAN-speaking chips giving me access to thousands of parameters. They tell me how many times the electric windows have had an overload (trying to lower while frozen), wiper failures, ~20 PID parameters for the cruise control (I don't even have the buttons for that), 10 parameters for the auxiliary heating unit (no control over that either), >15 parameters for the interior heating, at least 4 points of calibration data for each parking sensor (8 of them). And that's just the small stuff.
Interestingly enough, the 2007 BMW K1200 motorcycle entertainment unit has the same innards as my original one. Including the cassette drive! And it speaks the same CAN protocol that has been made obsolete since 2004.

[mikeselectricstuff]

The airbag units involved in a crash that resulted in deployment generally cannot be reused. They blow some fuses up or make some other irreversible changes to the unit. I'm sure enterprising individuals can restore them but hopefully that is not happening.

http://www.airbagreset.com/[/quote]
I'd be highly surprised if it's anything other than eeprom data. 

[NiHaoMike]

Well, in the UK now it is an MOT (roadworthiness) failure to have a lit airbag fault light. I'd imagine that maybe the lesser microcontroller is perhaps only for fault detection? The documentation I could find seems to suggest a lot of DSP algorithms involved in calculating the angle and deceleration to determine if and what airbags should deploy. I'm not sure how the little processor could do that all.

Check the block diagram, whilst the main MCU has SPI bus to the firing banks, the failsafe only has a "single" line, i think that the failsafe just fires everything(i mean, it's failsafe after all, what's safer than "in case of failure, deploy all", you can't go wrong with that) and since it doesn't needs to calculate direction, it only has a threshold that might be higher than the main DSP(so that it doesn't overrides it on any impact with it's "fire all" signal) or maybe the banks inhibit the failsafe line if they receive valid firing "data" signals.
At least that's what i can think of the top of my head...
wait.. i figured out one that would work more easily: if the banks receive the failsafe fire signal and have no valid "data/SPI" fire signal then after a timeout they fire(assuming main MCU failure), that way you satisfy all conditions!

Well maybe not.  A coworker's wife's Honda suddenly fired all the airbags while she was driving down the road. She almost got in a wreck trying to control the car without seeing anything.

Honda wouldn't fix it because the car was out of warranty and she had to use her insurance to cover the repair.

Might be covered under a recent recall.
http://www.carcomplaints.com/news/2013/honda-recalls-honda-odyssey-acura-mdx-air-bags.shtml

[MFX]

Funnily enough this teardown came right at the time when I was researching airbag systems for ideas for a pyrotechnic firing system I'm in the (long) process of designing. One particular patent I came across was US6597181  http://www.google.com/patents/US6597181 Basically the squib is between a high side and low side FET you insert a current limited (not enough to fire the squib) voltage that is around half the voltage of the firing voltage at the mid point of the FET's. If either of the FET's is faulty (short) then the test voltage will get pulled high or low depending on which FET is faulty, if that test passes then you can turn on each FET in turn to test their operation and also measure squib resistance. For my initial tests I'm using "Smart FETs" again designed specifically for the automotive industry, they are particularly resistant to blowing due to short circuits without affecting their ability to provide peak inrush currents. I'm using ITS428L2 for the high side and BTS3160D for the low side (mainly because I could easily get them from RS).

Martin.

[brainwash]

I thought the firing mosfets were shot after deployment, did not know of the special ones.
Nevertheless, even if possible, it might seem like a bad idea to reuse controllers. The plus side might be that the unit was already tested and found working

I had a friend who did all these kinds of resets: airbag and light controllers, ECUs, car stereos. While the airbag stuff has only a safety side to it (if YOU reuse it) lying on the mileage, reusing a stolen stereo or selling a shot controller as new is completely wrong. I never knew what he did with the dirty money, he already had a good job anyway.

Most of the grey-area automotive 'resets' are operations performed on EEPROMS. However, I suspect some units also need parts (fuse) replacement.

[MFX]

Sorry didn't make the MOSFET bit clear, although the ones I'm using are designed for automotive use they are more intended for controlling lights hence they have short circuit protection but also open circuit detection built in so they can signal a blown filament. Airbag MOSFETS seem to often be integrated into the main control processor. I'd be surprised if the MOSFET did blow on deployment as that would indicate it's operating right on the edge/beyond it's safe working area which would be a bad thing for reliable operation, how can you guarantee that the MOSFET has done it's job before it blows? I regularly fire squibs around 1 ohm 24Volts from fairly small MOSFETS (RFD14N05L is a common one I use) and they are fine. Occasionally a squib will blow but then go short which can blow an unprotected MOSFET but there are ways to protect against that, either use a MOSFET with built in protection or fit an external protection circuit. One of the simplest protection methods I've seen in a 24V firing system was two car headlamp bulbs in series, cold they provide a very low resistance so don't limit the current to the squib that much  but in the event of a short they quickly heat up, resistance increases and protects the FET. Downside is their fragility.

[Mister_Elektro]

Wow, it's very interesting to whats inside one of those things. I'm in the fire department so i the those things sometimes "in action".

[castironman]

Well, in the UK now it is an MOT (roadworthiness) failure to have a lit airbag fault light. I'd imagine that maybe the lesser microcontroller is perhaps only for fault detection? The documentation I could find seems to suggest a lot of DSP algorithms involved in calculating the angle and deceleration to determine if and what airbags should deploy. I'm not sure how the little processor could do that all.

Check the block diagram, whilst the main MCU has SPI bus to the firing banks, the failsafe only has a "single" line, i think that the failsafe just fires everything(i mean, it's failsafe after all, what's safer than "in case of failure, deploy all", you can't go wrong with that) and since it doesn't needs to calculate direction, it only has a threshold that might be higher than the main DSP(so that it doesn't overrides it on any impact with it's "fire all" signal) or maybe the banks inhibit the failsafe line if they receive valid firing "data" signals.
At least that's what i can think of the top of my head...
wait.. i figured out one that would work more easily: if the banks receive the failsafe fire signal and have no valid "data/SPI" fire signal then after a timeout they fire(assuming main MCU failure), that way you satisfy all conditions!

Well maybe not.  A coworker's wife's Honda suddenly fired all the airbags while she was driving down the road. She almost got in a wreck trying to control the car without seeing anything.

Honda wouldn't fix it because the car was out of warranty and she had to use her insurance to cover the repair.

I always wondered about this system, a little worried when I work around it. I wonder if the system was not triggered before she started to drive and then all parameters just perfected lined up... My truck had a front impact that took the whole front and the air bags did not deployed. Maybe a Dodge thing.

[orion242]

Misc
IANAL but I haven't heard of any case where the data stored in the EEPROM was being used to monitor someone or make a spectacular legal case.

A quick google turned up a few cases where they did retrieve it.

http://bangordailynews.com/2013/08/21/news/midcoast/police-pull-information-from-cars-computer-in-fatal-port-clyde-crash/
http://www.trivalleycentral.com/casa_grande_dispatch/area_news/archer-trial-begins-on-tuesday/article_ea68209a-7a10-11e3-9926-001a4bcf887a.html
http://www.postbulletin.com/news/local/divers-find-rd-body-in-the-mississippi-after-weekend-crash/article_f8ae21b0-c311-5d2c-8428-519b6e6dde5e.html


Companies specializing in the retrieval of this data.  Must be a market for it....

http://www.meaforensic.com/technical/event-data-recorders/
http://www.crashforensics.com/automobiledatarecorders.cfm

I read somewhere that a local cop shop was talking about review this data on every crash as part of a normal investigation.  I can't seem to find this now.

How about turning them into a revenue generator?

http://articles.latimes.com/2013/oct/26/nation/la-na-roads-black-boxes-20131027

[fkoran]

Anyone notice this unpopulated QFP footprint with the vias and fiducial? Guessing that's some sort of test pattern for optical inspection?

[mikerj]

I find it more interesting that for motorcycles the stuff is less regulated and generally less safe and reliable, with the exception of [big] BMW motorcycles which share a lot of technology with their car counterparts from 5-10 years before.

The only safety systems on a modern bike are ABS and sometimes traction control (inc. anti-wheelie).  What makes you believe these systems are less safe and reliable than those deployed in a car?

[brainwash]

I said in general, not just for those two systems. I'm sure ABS and TCS work just fine, even though on cars I've had varying experience with different manufacturers.
While there are probably some models out there that have at least one of these suggestions, these things are missing: active handlebar dampening, airbags (at least for precious areas), high-side prevention, fatigue detection, night vision, active cruise control with imminent impact warning.
I'm sure if the manufacturers were required to put those in, through regulation, they would find a way to do it cost-effectively. Except night vision (yet), that's a bit of a stretch.

[mikerj]

I said in general, not just for those two systems. I'm sure ABS and TCS work just fine, even though on cars I've had varying experience with different manufacturers.
While there are probably some models out there that have at least one of these suggestions, these things are missing: active handlebar dampening, airbags (at least for precious areas), high-side prevention, fatigue detection, night vision, active cruise control with imminent impact warning.
I'm sure if the manufacturers were required to put those in, through regulation, they would find a way to do it cost-effectively. Except night vision (yet), that's a bit of a stretch.

By "less safe and reliable" you actually mean "not available".  Quite a big difference.

FWIW traction control should prevent high-sides in the majority of cases but I suspect it would be almost impossible to achieve complete immunity from them.

Airbags are now available built into motorcycle clothing which is the only valid place for them to exist.

Active handlebar dampening is a slightly bizarre suggestion IMO, why not strive to make engines well balanced instead?

The rest of the stuff sound like you basically want a two wheeled car. IMO one of joys of motorcycling is to get away from this complexity.

[brainwash]

My post should read: the motorcycles are less safe and reliable because of missing systems. I NEVER said that safety systems that are already implemented are less safe than their automobile counterpart, but you still insist on reading it like that.

Active handlebar dampening - if you've never had the handlebars slam against the tank in a turn you wouldn't understand this. Yes, I know that motorcycles are inherently self-stabilizing and doing nothing is better, but we are talking about safety and prevention.
Airbags - ok, cannot argue with that
TCS - a friend of mine managed to do a low-speed high-side last year with a new bike (VFR1200). I don't know the exact details and his proficiency, though he has a few years and around 100k miles under the belt. Not drawing any conclusions, just stating a fact.

Cars vs. motorcycles argument: ok, I agree, but they share the same street. Track racing is something else. I never even had a bike with ABS, not complaining about that and not really missing it. But why not try to prevent accidents if the technology is already there in the mass-market?

So, again, my post should read: motorcycle technology is behind automotive by at least 5-10 years, with regard to both safety and reliability. Technically, it's possible, just not being done (voluntarily or enforced).

Same thing for emissions and economy, but I don't want to be perceived as 'that guy'; personally I think small vehicles are negligible w.r.t. emissions. I just find it strange that a bike with 600cc and <300kg eats as much fuel at 120km/h as one 2000kg car with 2500cc, same production year.