Disabling direct hazards in a vehicle crash – going beyond the high-volt systems

Safety is a number one priority for emergency responders. Therefore, they always try to remove or reduce potential dangers present. 

Modern vehicles contain several systems that may pose a risk for people involved.  When it comes to people trapped into a machine, one golden rule is to disable the machine and to make sure, that it will not start again. This is also true for every road vehicle, although the level of experience is much higher on this type of machine. Therefore, one general rule of emergency responders is to reduce the risk by disabling the different systems present in the vehicle if this can be done in an acceptable time frame.

In a proposal by CTIFs commission for extrication and new technology emergency responders ask for an “Easy and fast disabling method”. The method should not only disable the propulsion system, but also systems, that may affect the rescue operations, such as HV system, restraint system, 48 V electrical system. Systems such as the 12 Volt electrical system, should stay active to be able to open doors, move seats, open windows etc. An indicator should be available to show that disabling has been successful. “

Speaking about direct hazards in a vehicle several vehicle systems can be mentioned:

• Turning parts

Running combustion engines, electric motors or other moving parts in a vehicle, can be very dangerous during an emergency response. This includes the danger of unintentionally restarting the propulsion system of the vehicle and the danger that the vehicles rolls or drives away.

• Fuel system (containing flammable liquid or gas)

The fuel system is the system that feeds the flammable fuel to a combustion engine or fuel cell. If this system is active after a collision, the risk of a fire is increased, as fuel may escape through broken fuel lines and ignite. 

• 12 Volt electrical system

The 12 Volt electrical systems power a lot of the vehicle features. Cables damaged during the crash or during extrication can lead to arcing and sparking which may ignite flammable liquids present. 

• Supplemental Restraint System (SRS-System)

The supplemental restraint system includes SRS sensors, an SRS control unit and different restrain systems, such as airbags and seatbelt pretensioners. It is possible to accidentally deploy restraint systems during extrication operations, when manipulating around active sensors or an active control unit. Being hit by a deploying airbag may be very dangerous. 

• 48 V electrical system

48 Volt electrical systems have similar potential dangers as 12 Volt electrical systems. However, they have a higher arcing and sparking potential than 12 Volt electrical systems. 

• High voltage (HV) system

High voltage systems operate with voltages above 60 V DC. Therefore, working on an active and possibly damaged HV system, may pose an electrical shock danger to emergency responders. 

• Loss of hazard detection systems (e.g. Battery Management System)

The Battery Management System (BMS) is a system, that monitors the state of the HV battery and its modules and cells. The BMS may be able to detect serious faults inside the battery pack long before signs would be visible outside (such as smoke, odor etc.). In contrast to all the systems mentioned above, shutting off the BMS will lead to a loss of these features.

For car manufacturers, reducing hazards in the post-crash vehicle has also been in focus for many years. 

A lot of vehicles automatically disable direct hazards, such as the fuel system, by switching of the fuel pump or shutting off gas valves on accident detection (airbag deployment). In addition, the HV system on electric or hybrid vehicles will normally also be disabled automatically when a crash is detected. 

When it comes to the supplemental restraint system, most vehicle manufacturers do not automatically disable SRS sensors and control units after the collision. Instead, most of them advise emergency responders to switch of the ignition and/or disconnect the 12 Volt electrical system. While there may be arguments to keep the SRS system operational after a primary collision for some time, to deploy additional airbags in a secondary crash, it may be helpful for emergency responders when SRS sensors and the control unit will be disabled before arrival on the crash scene (e.g. 2 minutes after the collision). 

For the 12 Volt electrical system, disabling is more complicated as it (if it has not been damaged during the collision) also powers a lot of important vehicle functions for access (opening doors and tailgate), extrication (moving seats or opening windows) and safety (eCall, disabling indicator, battery management system). An active 12 Volt system always has a certain risk of arcing and sparking, that may ignite flammable fuels or deploy restraint systems. 

Therefore, the question, if some systems should stay operational, is a risk vs. benefit analysis. Emergency responders are willing to take certain risks in lifesaving situations when this can save valuable time. This is why it would be best to automatically shut-off some of the 12 Volt systems (for instance with a safety battery terminal, circuit breaker or safe power net), while maintaining the important vehicle functions for access, extrication and safety. 

 The 48 Volt electrical system should be handled in a similar manner, if important features are powered by the 48 Volt system at all. If this is not the case, the 48 V system should be automatically disabled without the need to manually disconnect 48 V batteries.

In addition, it would be good, if the vehicle cannot be restarted accidentally. There are known cases, where combustion engines restarted while relocating the vehicle for extrication purposes. 

One potential danger with electric and hybrid vehicles is a malfunction of battery cells, which may go into thermal runaway. If the battery is not obviously reacting, it is difficult for emergency responders to predict, if a collision has been serious enough to damage battery cells to an extend that thermal runway is likely to happen. This is why it could be a good idea to maintain the function of the BMS system post-crash and include means to display critical information from the BMS to vehicle occupants or emergency responders. Disconnecting the vehicles 12 Volt system (as shown in many rescue sheets today) will also shut-off the BMS.

In summary, car manufacturers already disable some “direct hazard systems” in collisions detected by the restraint system. A number of improvements to the automatic disabling process would lead to an even safer environment for occupants and responders. A summary of a “perfect” automatic disabling process (from an emergency response perspective) is shown below: 

1. Initiate crash mode:

   1. Signal to stop engine or motor
   2. No restart possible
   3. Switch on hazard warning light 
   4. Engage electric parking break

    

2. Shut off fuel system (fuel pump, gas valves)
3. Shut off HV system (HV contactors on HV battery or fuel cell)
4. Shut off 48 Volt electrical system
5. Shut off unnecessary parts of the 12 V electrical system, keep critical functions operational (e.g. electric locks, seat adjustment, steering column adjustment, electric side and roof windows, exterior and interior lightning including hazard warning lights, battery management system)
6. Check status of HV disabling and show disabling indicator in instrument cluster
7. Initiate additional crash functions
   1. eCall
   2. HV battery observation by BMS, show critical information in the instrument cluster (detection of thermal runaway)
   3. Inform vehicle owner

8. Shut of SRS sensors and SRS control unit (possible with time delay)

    

Automatic disabling of all “direct hazard systems” is the preferred solution from the emergency responder’s perspective, nevertheless it is worthless, if it is unclear if disabling has been initiated and the systems are really disabled. 

Therefore, an indicator is necessary together with the information which of the “direct hazard systems” have been included in the automatic disabling process. This information can easily be given in the rescue sheet.

Many vehicle manufacturers state, that the airbag is “the indicator” for a successful disabling of some of the “direct hazard systems”. However, a deployed airbag only shows that crash sensing has worked out and airbags could be deployed. It is no proof that (in case of an electric or hybrid vehicle) the HV contactors are really opened. 

Honestly, the vehicle should be smart enough to really measure the voltage of the HV system after the collision to see, if it has significantly dropped and then display a real indicator (e.g. on the center console), saying which systems have been proofed to be disabled. Furthermore, automatic disabling may also work in crashes not severe enough to deploy airbags or not prone to deploy an airbag. This may be the case in rollover accidents in vehicles not equipped with a rollover-sensors or in rear-end collisions, where normally only seatbelt pretensioners are triggered. Collisions with pedestrians, who may become trapped under a vehicle are another example to be mentioned. In these cases, responders would need to manually disable the vehicle, as the airbag is missing as the indicator, although automatic disabling may already be complete. 

It Is correct, that such an indicator may not be functional after very severe and destructive collisions, but it will be operational in a very high percentage of accidents. Sometimes, emergency responders need to take a risk, they are used to the fact, that there are never 100%.

No! At least, not yet! Unfortunately, not all emergency response scenarios are covered by the automatic detection mechanisms of a modern road vehicle today:

• If a vehicle catches on fire (either during driving or while being parked) there is no automatic sequence to disable the direct hazards. If the driver leaves the vehicle immediately, all systems may still be operational. Vehicles are not equipped with a dedicated sensing system for fires.

• If a leak occurs in the CNG or H2-System of the car, the vehicle will most likely not detect this automatically. Most vehicles are not equipped with gas detection sensors at all.

• If a vehicle is involved in a collision while being parked at a charging station, the charging operation will likely not be stopped immediately in most vehicles, as the sensing system for collisions is switched off, when the vehicle is charging.

Other scenarios (rollover collisions, rear end-collisions with no airbag deployment or collisions with pedestrians) have been mentioned before. In addition, not all vehicles are at all equipped with crash detection equipment (e.g. heavy trucks or city buses), so when will they be disabled automatically?

From an emergency response perspective, it would be the best if future vehicles would be able to detect all kinds of incidents and initiate automatic disabling. This seems to be relatively easy for rollover or rear-end crash detection, as the technology is available on the market and only needs to be coupled with the indicator, to show that disabling has been successful. 

Systems to detect collisions, while the vehicle is stationary and charging are also available in some vehicles already and even gas sensors to detect leaks have been seen in some models, for instance, fuel cell electric vehicles. This shows that the technology is there, but it needs to be implemented.

As it may take some years until this point can be reached and emergency responders know very well that technical systems can fail, an easy and fast disabling method is therefore necessary in every vehicle in addition to automatic disabling of direct hazards.

As mentioned above, disabling procedures for “direct hazards” and the interpretation of a direct hazard vary from manufacturer to manufacturer. Procedures that contain deactivation of all relevant vehicle systems often consist of the following steps in different order:

1. Switching off the ignition of the vehicle by turning the ignition key to the off position or by pushing the start/stop button

While switching off the ignition on a car with an ignition key is easy, it is not that simple on a car with a start/stop-button. One reason being is that pushing the button may unintentionally switch the ignition on again if it has been switched off (for instance by the driver). In addition, some modern cars do neither have a real key nor a start/stop button.

1. Removing a smart key from the vehicle (if present)

Many rescue sheets advise emergency responders to remove the smart key of the vehicle at least a few meters out of the interior. However, it remains unclear, why vehicle manufacturers advise emergency responders to remove the key from the vehicle if the 12 Volt electrical system will be disabled in the next step. This will switch off any system searching for this smart key. It may be very difficult and time consuming to locate a smart key within the crashed vehicle. 

1. Disconnecting the vehicles 12 Volt system

Disconnecting the 12 Volt electrical system by cutting or removing the battery terminals from the battery poles has been a standard measure on severely damaged cars for decades. However, locating the battery or batteries and establishing access to the battery cables is often quite difficult due to the location in the vehicle and the necessity to remove several covers (even with support of a rescue sheet). Disconnecting the main battery will likely shut-off all vehicle features, including the important vehicle functions for access, extrication and safety.

1. Disconnecting the vehicles 48 Volt system (if present)

While some manufacturers do not advise responders to disconnect the 48 Volt battery, other rescue sheets include disconnecting the 48 Volt battery of the vehicle by removing cable connections or disconnecting battery terminals from the battery poles. With regards to access to the 48 Volt battery, the same problems exist as with the 12 Volt battery.

1. Disabling the vehicles HV system (if present)

While some HV system can obviously be disabled by switching off the ignition and disconnecting the 12 Volt electrical system, some manufactures advise responders to take additional measures to disable the HV system. These measures may include cutting a cable loop, operating a service-disconnect switch (12 Volt), pulling a 12 Volt fuse from a fusebox or pulling an HV service disconnect (which may include donning additional protective equipment). Getting access to the disabling device may produce additional workload.

Looking at a rescue sheet, it remains partially unclear, which procedure will have influence on which system. This is why it is not clear which status the disabling of the systems will have if one or more steps of the shown procedures cannot be carried out, due to accessibility issues (vehicle on the roof, component in the front compartment) or crash damage. In some cases, the car manufacturers also state, that at least the HV system will be disabled, as soon as an airbag has been deployed. 

The above list shows, that current procedures to disable direct hazards are also not easy to carry out and may also be extremely time consuming. It would be quite easy to compare the effort necessary on different cars by taking the time to full completion of the disabling procedure on an undamaged car with full access to all sides off the vehicle (which will most likely not be the same on a crash scene and therefore will be the best-case scenario).

The best disabling procedure for emergency responders is the one that disables all relevant systems, while keeping the important vehicle functions for access, extrication and safety operational. 

It should be possible to carry out this procedure in a short timeframe and in different accident scenarios. The best method will disable most direct hazard systems with only a few simple steps and without the need of additional protective equipment or special tools.

This easy and fast disabling method will be shown on the rescue sheets, markings in the vehicle as proposed by EuroNCAP’s rescue, extrication and safety protocol will also support finding the disabling device locations. 

Examples:

1. The vehicle has automatic disabling on accident recognition and will show a disabling indicator in the center console. Cut loops or service-disconnect switches (12 V) are located in the front and rear compartment of the vehicle and are easy to access without tools and special personal protective equipment. Cutting one of the loops or activating one of the service-disconnect switches will initiate the automatic disabling process and activate the disabling indicator. Today, dedicated devices such as cut loops and service-disconnect switches only disable the HV system, however it would be good to consider using these dedicated devices also for other systems at the same time.

   2. The vehicle has automatic disabling on accident recognition and will show a disabling indicator in the center console. Pushing the eCall button of the vehicle for more than 15 seconds will also initiate the automatic crash disabling process.