Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.
5 Review of National Highway Traffic Safety Administration Initiatives on Unintended Acceleration The statement of task for this study requests âan independent review of past and ongoing industry and NHTSA [National Highway Traffic Safety Administration] analyses to identify possible causes of unintended accel- eration.â As noted in Chapter 1, NHTSAâs Office of Defects Investigation (ODI) has investigated driver complaints of unintended acceleration for more than 40 years, and these complaints have encompassed a wide range of reported vehicle behaviors. Some complaints have involved moving vehicles that do not slow down as expected when pressure on the accelerator pedal is released. Others have involved vehicles that speed up abruptly with high engine power from a stopped position or while moving slowly. At other times the complainants describe fluctuations in engine idling, hesitation, shuddering during gear change, fluctuation of cruise control speeds around their set values, or delayed deceleration when brakes are applied on an uneven road surface. Degraded or failed braking is often asserted along with the unintended acceleration. Some complainants report having brought the vehicle to a dealer or other repair facility after the episode only to learn that no vehicle-related causes could be found or to receive an unsatisfactory explanation of possible causes.1 The committee is not charged with determining which of these vehicle behaviors constitute unintended acceleration or with examining alterna- tive theories of the causes of such behaviors. The charge is to review the 1 The committee read the narratives of hundreds of complaints submitted to NHTSA and downloaded from the agencyâs website to make these characterizations. 133
134 || The Safety Promise and Challenge of Automotive Electronics investigations conducted and supported by ODI on the basis of its defini- tion of unintended acceleration and its purposes in conducting the inves- tigations. ODI informed the committee that it investigates consumer complaints to determine whether the conditions and behaviors reported result from a vehicle-related deficiency that presents a public safety risk.2 The agencyâs investigations inform decisions about whether specific fol- low-up steps are warranted, such as influencing or ordering a manufac- turer safety recall, amending a Federal Motor Vehicle Safety Standard (FMVSS), or sponsoring research to identify vehicle- and human-related factors that may be causing or contributing to an evident safety defi- ciency. The emphasis of this chapter is on reviewing ODI investigations of unintended acceleration with regard to their use in informing such agency decisions. As a consequence, the chapter does not assess ODIâs investigations with regard to reasons unconnected to agency decision makingâfor example, whether the investigations are suited to explor- ing all conceivable means by which electronics systems could fail and lead to unsafe vehicle conditions or behaviors. The committee under- stands that ODIâs investigations are intended to identify defects that present a demonstrable safety hazard.3 For years, ODIâs Defects Assessment Division has sorted the com- plaints it receives on unintended acceleration according to certain signa- ture characteristics that it associates with driver pedal misapplication. By doing so, ODI believes that it can make more effective use of its investi- gative resources and better identify complaints involving unintended acceleration in which pedal misapplication was not the likely cause. The criteria that ODI uses for this sorting are derived from the report An Examination of Sudden Acceleration (Pollard and Sussman 1989), which was produced by the U.S. Department of Transportationâs (DOTâs) Trans- portation Systems Center (TSC). The committee was asked to review 2 Title 49, United States Code, Chapter 301, Subchapter 1, Section 30101. To demonstrate the existence of a safety defect, NHTSA needs to show that a defect exists and that it is safety-related. Accordingly, the agency must prove both that substantial numbers of failures attributable to the defect have occurred or are likely to occur and that the failures pose an unreasonable risk to safety. 3 One could argue that NHTSA should examine electronics systems to assess any vulnerabilities that could plausibly lead to unsafe behaviors in the field and then perhaps look for evidence of such behav- iors in the fleet. However, NHTSA does not view âprove outâ as part of its mission, and therefore ODIâs investigations are not designed for this purpose. As noted in Chapter 1, NHTSA describes the purpose of its initiatives on unintended acceleration as âintended to provide NHTSA with the information it needed to determine what additional steps may be necessary to identify the causes of unintended acceleration in Toyota vehicles and determine whether a previously unknown electronic defect may be present in those vehicles and warrant a defect investigationâ (NHTSA 2011, 12).
Review of NHTSA Initiatives on Unintended Acceleration || 135 and comment on the continued relevance of the criteria derived from that report, which is often referred to as the Silver Book. More recently, questions have arisen about whether vulnerabilities in electronic throttle control systems (ETCs) have caused or contributed to an increase in consumer complaints alleging unintended acceleration, particularly by drivers of Toyota vehicles, which experienced a notable increase in these complaints in recent years. In February 2011, NHTSA released its most comprehensive report on unintended acceleration since sponsoring the Silver Book more than 20 years ago. The report, Tech- nical Assessment of Toyota Electronic Throttle Control Systems (NHTSA 2011), recounts ODIâs investigations of unintended acceleration complaints involving Toyota vehicles over the past decade, analyzes the entire con- sumer complaint database for all reported incidents involving forms of unintended acceleration, reports on agency analyses of warranty data and crash investigations, and draws conclusions from a NHTSA-commissioned study (NASA 2011) by the National Aeronautics and Space Adminis- tration (NASA) of potential design and implementation vulnerabilities in the Toyota ETC. NASAâs study results are not detailed in this chapter (since the study is available on the Internet),4 but ODIâs conclusions about the candidate causes of unintended acceleration as informed by the NASA results are examined. Finally, ODIâs investigative actions and processes are not considered with regard to matters such as their documentability or compliance with administrative and statutory requirements.5 The committee was not constituted to perform such auditlike functions. The U.S. DOT Office of Inspector General (OIG) did undertake such an audit (OIG 2011) and has made several recommendations to NHTSA for improving related aspects of its defect surveillance and investigation programs. The emphasis of the chapter is on describing how ODI has monitored for and investigated the potential causes of unintended acceleration. The purpose is to obtain insight into where changes in NHTSAâs regula- tory, research, and defect investigation approaches may be needed, given that other electronics systems could be suspected in reports of vehicle control problems and other unintended behaviors in the same manner as Toyotaâs ETC. 4 http://www.nhtsa.gov/UA. 5 For example, the committee did not review the grounds for NHTSA assessing a civil penalty against Toyota for recall timeliness.
136 || The Safety Promise and Challenge of Automotive Electronics Past NHtsa INItIatIves oN UNINteNded acceleratIoN As indicated in Chapter 1, two major investigations of unintended acceleration were commissioned by NHTSA during the 1980s. The first (Walter et al. 1988) was undertaken in response to incidents involving the Audi 5000. The second, which led to the Silver Book (Pollard and Sussman 1989), involved more vehicle makes and models and focused on incidents involving vehicles that had been stopped or moving slowly before accelerating suddenly. Audi 5000 Investigation During the mid-1980s, ODI received a large number of consumer com- plaints by owners of the Audi 5000 reporting episodes of unintended acceleration. In analyzing complaints for all vehicle makes and models spanning Model Years 1978 to 1986, ODI calculated an exceptionally high rate of complaints against the Audi 5000: an estimated 556 per 100,000 vehicles produced compared with a fleetwide average of 28 per 100,000.6 The complaint rate remained high even after the vehicle had been the subject of earlier recalls intended to fix the perceived problem. In 1982, for example, Volkswagen (the Audi importer) had issued a recall to modify the shape of the accelerator pedal to prevent interfer- ence by the floor mat. In 1983, the company issued a recall to attach a plate to the brake pedal to elevate it relative to the accelerator pedal. Even before commencing its Audi investigation, ODI had conducted dozens of investigations of complaints alleging unintended acceleration involving scores of vehicle makes and models. Some of the complaints involved prolonged, high-speed events, and others involved abrupt, short- lived acceleration often ending with a crash. The investigations prompted a number of recalls to repair various problems, including pedal entrap- ment, throttle icing, broken or ill-fitting parts in the throttle assembly, and bound accelerator cables that had caused the throttle to remain open even when the driverâs foot was removed from the accelerator pedal. In all of these cases, physical evidence could be identified to determine the source of the problem, but in a large majority of other cases no vehicle-related 6 The Audi complaint rates were calculated by NHTSA in October 1988. As noted in Chapter 1, media attention contributed to the rate of complaint reporting by Audi drivers. For example, a November 1986 broadcast of the CBS show 60 Minutes portrayed the Audi as âout of controlâ (the title of the broadcast).
Review of NHTSA Initiatives on Unintended Acceleration || 137 deficiency was found. The latter cases tended to involve vehicles that were accelerating abruptly from a stopped or parked position or from a low travel speed, often accompanied by a reported loss of braking. It was also common for the driver to claim that the acceleration started at the same time as brake application. Unable to find physical evidence of brake failure or the kinds of mechanical problems listed above, ODI usually attributed these incidents to drivers pressing the accelerator pedal instead of, or in addition to, the brake pedal. The large number of reports of unintended acceleration involving the Audi 5000 caused ODI to enlist TSC to conduct a more thorough investigation of why the phenomenon was being reported much more frequently among owners of this vehicle (Walter et al. 1988). The TSC investigators analyzed the vehicleâs major mechanical, electronics, and electromechanical systems to determine the conditions under which they could create high engine power; measured the dimensions and examined the design of the Audi driver compartment to determine whether the fea- tures of the compartment and driving controls might increase the proba- bility of pedal misapplication; and studied the age and other characteristics of Audi drivers to determine whether they were more likely than the drivers of other vehicles to be exposed to situations in which unintended acceleration could occur. In examining the Audi complaints, the TSC investigators found that a large proportion of the incidents involved reports of unintended accelera- tion and brake failure occurring at the same moment. The investigators were unable to identify any combination of failures that could create simultaneous failures of these two systems without leaving any physical evidence and concluded that pedal misapplication had to be the cause. The investigators therefore sought to explain why the accelerator pedal was being misapplied more often by drivers of the Audi than by drivers of other vehicles. They observed that the pedal and seating arrangements of the Audi differed from those of peer domestic vehicles, and they noted that many of the drivers reporting unintended acceleration had owned the vehicle for a short period of time. The investigators surmised that the higher incidence of pedal misapplication may have resulted from driversâ unfamiliarity with the vehicleâs seating and pedal layout. Another feature of the Audi 5000 that TSC investigators suspected may have contributed to pedal misapplication was the vehicleâs idle sta- bilizer. After Model Year 1983, Audi incorporated an electronically con- trolled idle stabilizer to regulate engine speed according to the demands
138 || The Safety Promise and Challenge of Automotive Electronics of engine load. The system, composed of an electronic control unit and an electromechanical air valve, was prone to defects that caused a high idle speed and periodic engine surging.7 The TSC team noted that because of their intermittent nature, these behaviors may not have been detected during premarket testing of the Audi or in postcrash investigations by ODI and others. Volkswagen had recalled the idle stabilizer valve because of the surging problem. While the surges were not accompanied by a large throttle opening and were not found to be consistent with con- sumer complaints of high-power acceleration, the TSC team speculated that the vehicle behavior could have startled some drivers and led some to press the accelerator pedal when they intended to apply the brake. Silver Book After the Audi 5000 investigation, TSC was enlisted again by ODI to conduct a more broadly based review of unintended acceleration com- plaints. The focus of this follow-up study was on incidents in which the acceleration began while the vehicle was stopped or moving slowly. ODI recognized the occurrence of other types of unintended acceleration incidents such as those starting from higher speeds but wanted to obtain a better understanding of this more common class of incidents. These sudden acceleration incidents were also troubling because they tended to be accompanied by reports of complete brake loss. The product of this second TSC investigation, An Examination of Sudden Acceleration, has come to be known as the Silver Book (Pollard and Sussman 1989). In carrying out its investigation, the TSC team reviewed hundreds of complaints submitted by drivers alleging unintended acceleration during the previous decade. The investigators also reviewed relevant literature and case documentation; interviewed drivers who had filed complaints; and studied the fuel systems, brakes, cruise control systems, power trains, and pedal and gearshift lever layouts of 10 vehicle makes, some of which were selected because of their above-average complaint rates. The teamâs methods and results were subjected to peer review by a group of experts in various safety and engineering disciplines. In a manner similar to the Audi 5000 investigation, the TSC investiga- tors examined possible mechanical causes. They focused on the potential 7 The idle speed control systems of the time would more appropriately be called idle stabilization sys- tems, since they only provided a âtrimming functionâ around the normal operating point to help achieve smoother idle quality.
Review of NHTSA Initiatives on Unintended Acceleration || 139 for a sticking throttle caused by problems such as frayed or kinked cables, broken springs, and stuck pedals. They concluded that such mechanical faults were not likely to be causes of unexplained cases of unintended acceleration since their origins would be evident during postevent inspec- tion of the vehicle. Transmission and idle speed stabilizer systems were also examined for conditions that might lead to unintended acceleration. Because it had no influence on throttle actuation, the transmission was dismissed as a possible cause. The TSC team concluded that the idle speed stabilizer was incapable of causing the simultaneous high levels of fuel and air flow needed to produce the reported high-power acceleration. Cruise control modules had often been suspected as a source of unin- tended acceleration, and they were tested to assess whether they could create and sustain a large throttle opening.8 Modules were thus placed in an environmental chamber and subjected to variations in power supply, temperature, and electromagnetic interference over a period of months.9 The TSC team did not find any significant or sustained malfunctions of the modules as a result of any of the environmental conditions tested. Whereas the electromagnetic interference tests caused system malfunc- tions, they were found to be momentary. In examining the possible tran- sient conditions that might cause intermittent problems, the TSC team concluded that the low probability of simultaneous failures of more than one component, coupled with the many redundant mechanical and electrical fail-safe mechanisms for disabling the servo (including light tapping of the brake), ruled out the cruise control as a plausible cause of wide-open throttle. Once again, the TSC investigators found that complete loss of brak- ing was common among driver complaints of unintended acceleration occurring in a stopped or slow-moving vehicle. The team could not iden- tify any credible mechanisms by which brakes could fail fully but then recover normal function with no signs of physical damage. In addition, the team pointed to tests indicating that brake application, even if it is 8 Cruise control systems of the time consisted of control switches, an electronic control module (typi- cally using a microprocessor or custom integrated circuit), a speed sensor typically mounted in the transmission or in the speedometer cable, a servo that mechanically pulled on the throttle lever, and electric or vacuum dump valves that would release the vacuum in the actuator when the brake pedal was depressed. 9 The electromagnetic interference test simulated a transient of an air conditioning clutch engaging and disengaging (which produces a large electrical transient on the power line), and the radio frequency interference units were subjected to a signal from a high-power citizens band antenna located close to the module and a simulated electrostatic discharge.
140 || The Safety Promise and Challenge of Automotive Electronics assumed to be delayed somewhat to simulate a driverâs emergency response to the onset of acceleration, will quickly stop a vehicle acceler- ating from a stationary position or low travel speed.10 Unintended acceleration accompanied by unexplained brake loss had long been associated with pedal misapplication.11,12 The TSC inves- tigators knew this and questioned whether certain vehicle-related fac- tors could be responsible for drivers applying the wrong pedal after being startled by a vehicle-related condition or behavior. They surmised that phenomena such as engine surging, high idling, or even unex- pected noises could induce this effect, especially among drivers unfa- miliar with the vehicle, its operating characteristics, and its control layout. Noting that many incidents had involved motorists operating new vehicles, the team surmised that such patterns could be indicative of the driver lacking familiarity with the gearshift lever and pedals. The Silver Book therefore recommended that NHTSA undertake more research to determine whether such vehicle-related factors may have contributed to pedal misapplication, including research to examine the effect of pedal layouts and configurations. NHTSA subsequently spon- sored research by the Texas Transportation Institute (Brackett et al. 1989) to advise on pedal designs and layouts that might be less suscep- tible to misapplication. In the decade following the release of the Silver Book (and before the introduction of ETCs), NHTSA continued to receive complaints involving unintended acceleration across vehicle makes and models. ODIâs investi- gations of these complaints led to many of the same conclusions reached in the Silver Book: most incidents were caused by drivers mistakenly pressing the accelerator pedal, while the remainder resulted from mechan- 10 The Silver Bookâs Appendix E refers to brake force and performance tests conducted at NHTSAâs test center by R. G. Mortimer, L. Segal, and R. W. Murphy: âBrake Force Requirements: DriverâVehicle Braking Performance as a Function of Brake System Design Variables.â 11 The TSC investigators were not the first to associate pedal misapplication with unintended accelera- tion. ODI had concluded that pedal misapplication was the cause of many episodes of unintended acceleration during the previous 20 years of case investigations. Pedal misapplication had also received attention in the human factors literature (Schmidt 1989; Rogers and Wierwille 1988; Vernoy and Tomerlin 1989). 12 Pedal misapplication is also now known to be a source of unintended acceleration by operators of commercial vehicles. In a study of unintended acceleration involving school buses and other heavy vehicles, the National Transportation Safety Board (NTSB) reported that the drivers in these occur- rences all reported a loss of braking, but the investigators did not find physical evidence of brake damage. NTSB concluded that the brakes did not fail; instead, the drivers had applied the accelerator pedal when they had intended to apply the brake (NTSB 2009).
Review of NHTSA Initiatives on Unintended Acceleration || 141 ical problems (e.g., stuck pedals and accelerator cables) and pedal obstructions (such as floor mat entrapment). During this period, pedal misapplication was found to be more common among vehicles with automatic transmissions that lacked brake transmission shift interlocks. Although these devices were not required at the time by federal regula- tion, many manufacturers began installing them during the 1980s and 1990s. The interlock requires the driver to press the brake pedal to shift out of park and is designed to keep the driver from shifting into drive or reverse while the accelerator pedal is mistakenly depressed. The increased use of the interlock during the 1990s substantially lowered the number of reports of unintended acceleration involving vehicles maneuvering in parking lots and driveways (Reinhart 1994).13 Much of the history of ODIâs investigations of unintended accelera- tion during the 1990s can be found in an April 2000 notice issued by NHTSA in the Federal Register.14 During that period, ODI often referred to the Silver Bookâs findings as grounds for determining when a reported incident had the hallmarks of pedal misapplication and when it did not. As the design of power trains and cruise controls changed during the 1990s, the test results reported in the Silver Book lost their relevance and were no longer cited by ODI when it investigated unintended accel- eration incidents involving later model vehicles. Nevertheless, ODI inves- tigators continued to refer to the Silver Bookâs characterization of pedal misapplication incidents as a way to sort complaints of unintended accel- eration. The advent of ETCs did not change the relationship between the brakes and the throttle control systems, which continue to remain inde- pendent of one another. INvestIgatIoNs of toyota comPlaINts According to a recent report by the U.S. DOT OIG, ODI conducted 24 investigations of unintended acceleration involving numerous vehi- cle makes and models from 2002 through 2010. The investigations led to 13 The brake shift interlock is not always fail-safe. In a notable case from 1998, ODI investigated a case of unintended acceleration by a police officer in Minneapolis, Minnesota. ODI concluded that the cause was pedal misapplication but found that the functioning of the brake transmission shift inter- lock had been compromised by an aftermarket device causing the cruiserâs brake lights to flash when the dome light was energized (NHTSA File Number MF99-002, March 18, 1999). 14 April 28, 2000 (Vol. 65, No. 83, pp. 25026â25037).
142 || The Safety Promise and Challenge of Automotive Electronics 15 recalls affecting 13 manufacturers (OIG 2011, 5).15 Eight of the inves- tigations involved Toyota vehicles and led to two manufacturer recalls. ODI made several other preinvestigation inquiries of unintended accel- eration in Toyota vehicles; two of them resulted in Toyota issuing recalls before ODI had opened a formal investigation. During the same period, ODI investigated Ford four times, General Motors three times, and Chrysler twice for reports of unintended acceleration (OIG 2011, 11). Nine other automotive manufacturers were the subject of investigations and inquiries.16 ODI concluded that in all of these cases pedal misapplica- tion or mechanical factors such as floor mats impeding the pedal, throt- tle valve sticking, and bound cables were the sources of the behavior. OIGâs audit assessed the effectiveness of ODIâs processes for identify- ing and addressing safety defects and compared the processes with those followed by automotive safety authorities in other countries. OIG con- cluded that ODI had followed established procedures in conducting its investigations of unintended acceleration complaints and in monitoring resulting safety recalls. Although it did not question ODIâs conclusions about the causes of the investigated cases of unintended acceleration, OIG recommended that ODI improve its documentation of preinvestiga- tion activities and communications with manufacturers, establish a sys- tematic process for seeking third-party assistance with investigations, and set and adhere to timelines for completing investigations.17 Early Toyota Investigations A summary of the Toyota investigations and inquiries is provided in Table 5-1. It indicates how the consumer complaint data were used both by ODI and by consumers to identify, analyze, and investigate occurrences of unintended acceleration. The four earliest investigations, occurring from 2003 to 2006, were initiated in response to petitions by consumers 15 The OIG report also contains tabulations of unintended acceleration complaints across the industry by manufacturer. These complaints were identified through broad searches of the Vehicle Ownerâs Questionnaire database using the component code âvehicle speed control.â The OIG report notes that using this component code to sort complaints will exclude some complaints that may have involved unintended acceleration if the complaint was filed by using a different component code such as âser- vice brakes.â In addition, some complaints coded for âvehicle speed controlâ may involve issues unre- lated to acceleration, such as transmission behaviors. The committeeâs own sampling of the Vehicle Ownerâs Questionnaire data found numerous instances of both shortcomings. 16 Honda, Audi, Daimler, Buell, MacNeill Auto Products, Electronic Mobility, Jonway, CTS, and Kia were each investigated once. 17 The OIG report is available at http://www.oig.dot.gov/sites/dot/files/ODI%20Final%20Report%20 10-06-11.pdf.
TABLE 5-1 Summary of ODI Investigations and Inquiries on Unintended Acceleration Involving Toyota Vehicles, 2003â2010 Vehicles Involved (Toyota and Lexus Makes) ODI Investigation or Inquiry Findings and Conclusions Action Lexus GS and Response to a consumer petition: A petitioner to ODI After normalization to account for Assessment closed LS (Model Years reported experiencing multiple events of unintended vehicle production data, ODI did not 1997â2000) acceleration, one that led to a rear-end collision. In find the Lexus complaint rate to be Petition assess- each case, no vehicle-related cause was identified by higher than that of peer vehicles. In ment opened the dealer. After reviewing other VOQs, the petitioner the interview, the petitioner reported 2003 cited a high percentage of complaints in which the applying the brake before the crash. component code âvehicle speed controlâ had been ODI cited findings from earlier work (the marked in the complaints filed for this vehicle model. 1989 Silver Book) indicating that the ODI interviewed the petitioner, inspected a Model Year driver probably applied the accelerator 1999 Lexus LS 400, examined past complaints involving pedal when the intent was to apply the reports of unintended acceleration involving the same brake pedal. vehicle model, and compared complaint rates of peer vehicles made by other manufacturers. Camry and Lexus Response to a consumer petition: A petitioner reported After conducting an analysis of past Investigation ES 300 (Model that her Lexus accelerated unintentionally, causing complaints, conducting driver interviews, closed, no recall Years 2002â2003) a low-speed crash in a parking lot. The petitioner and performing vehicle inspections, ODI Investigation reported that she applied the brakes but that they concluded that the reported incidents opened 2004 were ineffective. In scanning complaints, ODI found involved acceleration coincidental with 20 reports alleging unintended acceleration involving brake application during low-speed these vehicle makes and model years. maneuvering with no evidence of failed components. The agency cited earlier investigations involving similar circumstances (low initiation speeds and acceleration and reported brake failure occurring coincidentally), suggesting that the likely cause was pedal misapplication. (continued on next page)
TABLE 5-1 (continued) Summary of ODI Investigations and Inquiries on Unintended Acceleration Involving Toyota Vehicles, 2003â2010 Vehicles Involved (Toyota and Lexus Makes) ODI Investigation or Inquiry Findings and Conclusions Action Camry and Lexus Response to consumer petition: ODI received a petition The prevalence of low initiation speed Assessment closed ES 300 (Model citing complaint data alleging unintended acceleration incidents and reported brake failure Years 2002â2005) involving these vehicles. The petitioner suspected that caused ODI to conclude that pedal mis- Petition assess- the ETC could be the source of the problem. ODI visited application was the likely cause rather ment opened the petitioner and inspected the vehicle, reviewed the than an electronics-related problem. 2005 complaints, interviewed drivers, inspected other vehicles, and sent an information letter request to Toyota. Camry and Response to consumer petition: ODI received a petition The lack of significant warranty claims Assessment closed Solara (Model from a driver reporting unintended acceleration, many and prevalence of low initiation speed Years 2002â2006) citing other complaints found in the VOQ database to incidents and reported brake failure Petition assess- support the petition, and questioned whether a malfunc- caused ODI to conclude that pedal mis- ment opened tioning ETC was the cause. ODI reviewed the VOQs, application was the likely cause rather 2006 visited the petitioners, obtained parts, interviewed than an electronics problem. drivers, inspected vehicles, and sent an information letter request to Toyota seeking warranty claim data. Camry and Lexus ODI review of consumer complaints: In monitoring com- The interviewed drivers reported that Toyota issued a ES 350 (Model plaint reports, ODI found five reports by drivers alleging the accelerator pedal would not return recall of the acces- Years 2007â2008) unintended acceleration involving these vehicles. Ana- to its rest position after it was released. sory rubber floor Investigation lysts noticed that the complaints involved unintended ODI inspectors observed the prevalence mat, prompting opened 2007 acceleration occurring at high initiation speeds, in con- of unsecured all-weather floor mats in ODI to close its trast to earlier complaints. ODI interviewed the drivers vehicles and suspected that the cause investigation. and inspected vehicles. Through the Vehicle Research was pedal entrapment. The rubber and Test Center, ODI surveyed vehicle owners. Six hun- floor mats were found to be unsecured dred owners responded, and 35 reported problems with because they were placed over the floor mat interference with the accelerator pedal. secured carpet floor mat.
Sienna (Model ODI review of complaint data: ODIâs Early Warning Vehicle inspections by ODI and Toyota Toyota issued a Year 2004) Division recommended a review of the Model Year found that the trim panel on the center recall to fix the Investigation 2004 Sienna because the Early Warning Reporting data console could obstruct the accelerator panel compo- opened 2008 showed an unexplained trend of pedal interference in pedal. nent, prompting owner complaints made to Toyota. On further review ODI to close its of the VOQ complaint data, ODI found an additional investigation. complaint and Toyota field report involving this vehicle suggestive of pedal interference. Tacoma (Model Response to consumer petition: A petitioner reported ODI reported finding no evidence sup- Assessment closed Years 2006â2007) experiencing two unintended acceleration events at porting a vehicle defect but could not Petition assess- low speed in a 2-hour period. The petitioner cited other identify a likely cause for the reports of ment opened complaints of unintended acceleration involving the unintended acceleration. 2008 same vehicle. ODI examined the complaint database for similar reports and interviewed the petitioner and more than 60 other drivers reporting similar incidents. ODI also tested consumer vehicles and queried Toyota for more information. Lexus ES 300 Response to consumer petition: The petitioner ODI interviewed the driver and exam- Assessment closed (Model Years reported experiencing prolonged unintended accel- ined complaints for the vehicle make 2002â2003) and eration while driving at highway speeds. The brakes and model. ODI obtained a Lexus ES ES 350 (Model were reported to have slowed the vehicle but became 350 for examination at the agencyâs test- Year 2007) increasingly ineffective after prolonged use. The driver ing center. ODI reported that the tests Petition assess- reported that he stopped the vehicle by shifting to did not reveal a potential electronics- ment opened neutral and shutting off the engine. The dealer did not related source of unintended accelera- 2009 find a vehicle defect but noted that the driver-side floor tion. ODI noted that the vehicle involved mat was out of position. was already covered by the earlier recall for pedal entrapment by floor mats. (continued on next page)
TABLE 5-1 (continued) Summary of ODI Investigations and Inquiries on Unintended Acceleration Involving Toyota Vehicles, 2003â2010 Vehicles Involved (Toyota and Lexus Makes) ODI Investigation or Inquiry Findings and Conclusions Action Multiple Toyota ODI response to a crash investigation: The fatal crash Toyota issued a second recall of the Toyota issued a models and years of a Lexus ES 350 in San Diego, California, which vehicles more prone to floor mat recall to reshape Inquiry made in was found by the local police to be caused by a floor entrapment to reshape their pedals. For pedals on all 2009â2010 (man- mat (designed for another vehicle model) entrapping vehicles with keyless ignition systems, vehicles and to ufacturer issued a the accelerator pedal, prompted ODI to reassess the ODI advised Toyota to install systems install brake over- recall before the adequacy of the earlier floor mat recall. The driver was in which application of the brake would ride software on investigation was unsuccessful in efforts to shut off the engine by using override accelerator control. vehicles equipped opened) the onâoff button for the keyless ignition system. with keyless ignition systems. Multiple Toyota ODI complaint analysis: ODI examined a complaint in Toyota contacted ODI and identified Toyota issued a models and years which the driver reported that the released accelerator the specific pedal component defect recall to replace Inquiry made in pedal returned slowly to its rest position as opposed that could cause excess friction in some the affected pedal 2009 (manufac- to remaining stuck in the depressed position, which is pedal assemblies. component. turer issued a characteristic of floor mat entrapment. ODI also found recall before the evidence of similar pedal malfunctions in subsequent investigation was screening of warranty repair data submitted by Toyota. opened) Source: Derived from NHTSA 2011 and original ODI investigation reports.
Review of NHTSA Initiatives on Unintended Acceleration || 147 who had experienced unintended acceleration and subsequently reviewed the consumer complaint data [Vehicle Ownerâs Questionnaire (VOQ)] to identify reports from drivers who experienced similar episodes. In response to the petitions, ODI also consulted the VOQ data to look for similar reports involving the same vehicle makes and models, to identify drivers to inter- view and complainant vehicles to inspect, and to compare complaint rates among peer vehicles. Some of the consumers who filed the petitions spec- ulated on the possibility of malfunctioning ETCs as the cause. However, the prevalence of low initiation speeds and reports by drivers of applying the brakes to no effect coincidental with the occurrence of the unintended acceleration led ODI to conclude that pedal misapplication was the likely cause in all four investigations. Pedal Entrapment Investigations and Recalls In 2007, ODI analysts observed that a number of consumer complaints with regard to Toyota vehicles involved unintended acceleration occurring at high travel speeds and for prolonged periods, in contrast to more com- mon complaints in which the acceleration occurred at low initiation speeds and was short-lived. In these later cases, drivers often reported conditions suggesting that the throttle had remained stuck in an open position rather than going quickly from idle to wide open, as typically occurs in cases where the driver presses firmly on the accelerator pedal believing it is the brake. The drivers also reported having trouble slowing the vehicle in response to the unintended acceleration, since prolonged or repeated brake application became increasingly ineffective. After interviewing drivers and inspecting vehicles associated with these complaints, ODI inves- tigators noted the common use of an unsecured rubber floor mat placed on top of the carpeted mat. The investigators concluded that the rubber mat, which was designed with a raised lip on the front edge, was susceptible to slipping under the accelerator pedal, potentially preventing the pedal from returning to its rest position when the driver released it. ODI notified Toyota of the identified problems. In response, the manu- facturer issued recalls to install redesigned floor mats and alert dealers and vehicle owners to the risk of unsecured floor mats as well as evasive actions that should be taken in the event of pedal entrapment. In subse- quent reviews of the VOQ data, ODI investigators identified another pos- sible means by which the trim panel in the center console of a particular Toyota model (2004 Sienna) could cause pedal entrapment. Toyota was notified and issued a fix for the console.
148 || The Safety Promise and Challenge of Automotive Electronics During the floor mat investigations, ODI mailed a survey to more than 1,800 owners of the 2007 Lexus ES 350 requesting information on occur- rences of unintended acceleration. Of the approximately 600 owners who responded, 10 percent stated that they had experienced unintended accel- eration, and 6 percent complained of occasional pedal interference from floor mats. The survey also indicated that many owners were unfamiliar with how to press the startâstop button to turn off the engine in an emer- gency while the vehicle is in motion. ODI also obtained a Lexus ES 350 from a complainant to perform an engineering analysis of possible vehicle-related causes of the unintended acceleration and difficulties associated with regaining control of the vehicle.18 These tests, conducted at the Vehicle Research and Test Cen- ter (VRTC),19 indicated that the accelerator pedal was capable of being entrapped by the lip of the unsecured rubber floor mat. The tests also indicated that when the vehicleâs throttle is kept open by an entrapped pedal or other means, the vacuum power assist in the braking system will become depleted if the driver repeatedly presses the brakes to slow the vehicle. The loss of vacuum power assist caused braking to be much less effective and to demand significantly more pedal force. ODI was called to investigate a highly publicized crash involving a Lexus ES 350 on a highway in the city of Santee in San Diego County, California, during August 2009. This crash, involving four deaths, brought renewed public and media attention to the occurrence of unintended acceleration in Toyota vehicles. Both ODI and San Diego County sheriffâs investigators20 determined that the cause of the crash was entrapment of the accelerator pedal caused by a floor mat that had been designed for another vehicle. The floor mat was found in the vehicle under the accel- erator pedal. It was evident that the driver had tried to slow and regain control of the vehicle by repeatedly applying the brakes, which led to the brakes losing vacuum and overheating. There was also evidence that the driver, who was operating a dealer-loaned vehicle, was unable or unpre- pared to respond by moving the gearshift lever out of drive or by turning the engine off by holding down the ignition startâstop button. 18 VRTC Memorandum Report EA07-010-VRTC-DCD7113, 2007 Lexus ES 350 Unintended Acceleration. http://www-odi.nhtsa.dot.gov/acms/docservlet/Artemis/Public/Pursuits/2007/EA/INFR-EA07010- 28888.pdf. 19 VRTC, in East Liberty, Ohio, is a federal facility that conducts research in support of NHTSA. It sup- ports ODIâs testing needs. 20 San Diego County Sheriffâs Department Incident Report concerning August 2009 crash in Santee, California (Case No. 09056454).
Review of NHTSA Initiatives on Unintended Acceleration || 149 The involvement of the Lexus ES 350, which had been among the Toyota models subject to the earlier floor mat recall, in the Santee crash prompted ODI to question whether Toyotaâs recall plan was adequate and whether other precautions were needed to prevent a recurrence of such outcomes.21 Toyota responded by issuing a second recall to reshape the accelerator pedal to reduce the potential for floor mat entrapment. For recalled vehicles equipped with the startâstop button, Toyota also installed software that would cause application of the brake to override the throttle in the event of entrapment.22 Pedal Sticking Recall In late 2009, after the issuance of Toyotaâs second recall associated with floor mats, ODI observed that some owners of Toyota vehicles were complaining about the need to press harder than normal on the accel- erator pedal to increase vehicle speed, and some were also finding that the pedal was slow to return to a rest position after it was released. ODI subsequently received several field reports from Toyota indicating simi- lar circumstances, although none of the cases appeared to have pro- duced wide-open throttle. ODI met with Toyota in January 2010 to review the source of the problem, which Toyota concluded had been caused by excessive friction in a defective pedal component. That month Toyota issued a recall of the component and devised an interim remedy that involved altering the pedal component while a supplier manufac- tured a replacement part for the affected vehicles. Concerns About the Role of the ETC As noted, during the course of many of these earlier Toyota inquiries and investigations, ODI was asked by petitioners to investigate the possibility of the ETC being the source of the unintended acceleration. These elec- tronics systems had been introduced in some Toyota vehicles during the late 1990s and in the Camry and Lexus ES in Model Year 2002. In its aforementioned VRTC testing of the Lexus ES 350, ODI had performed some limited electronics-related tests, including the introduction of mul- tiple electrical signals into the vehicleâs electrical system to assess suscepti- bility to electrical interference. In addition, testers placed a strong magnet near the throttle body and the accelerator pedal sensors. The tests caused 21 The recall plan included notification of dealers and consumers with regard to the potential dangers of using floor mats not designed for the vehicle. 22 The brake override software only works if the driver is applying the brake and thus would have no effect on cases involving misapplication of the accelerator pedal.
150 || The Safety Promise and Challenge of Automotive Electronics FIGURE 5-1 Consumer complaints of unintended acceleration (UA) in relation to publicized events, as reported by NHTSA. Total VOQ traffic versus those matching UA keyword search, October 2008 through December 2010. Keyword search is overinclusive and complaints are unconfirmed (Accel = accelerator). (Source: NHTSA 2011, Figure 2, page 18.) an increase in engine idle speed (up to approximately 1,000 revolutions per minute), but ODI investigators could find no evidence of susceptibility to creation of a large throttle opening. ODI believed that it had already determined the pedal-related causes of unintended acceleration by Toyota vehicles, and it had not found any evi- dence of relevant problems with the ETC in its VRTC testing or through its reviews of warranty repair data submitted by Toyota. However, public con- cerns about the possible role of this electronics system persisted. In con- gressional hearings during early 2010, NHTSA was also questioned about its technical capacity to investigate and test for electronics problems.23 NHTSAâs initiatives in response to these concerns are discussed below. The publicity from the Toyota recalls, the fatal Santee crash, and the ensuing congressional hearings prompted more drivers, particularly own- ers of Toyota vehicles subject to the recalls for pedal entrapment and sticking, to lodge complaints of unintended acceleration with NHTSA. Figure 5-1 shows the fluctuations in complaints in proximity to these 23 Hearings before the Oversight and Government Reform Committee, U.S. House of Representatives, February 24, 2010.
Review of NHTSA Initiatives on Unintended Acceleration || 151 publicized events as well as NHTSAâs announcement of its intention to commission studies by NASA and the National Research Council [referred to as the National Academy of Sciences (NAS) in the figure]. receNt NHtsa INItIatIves oN UNINteNded acceleratIoN Reexamination of All Consumer Complaints of Unintended Acceleration In early 2010, ODI embarked on a review of its entire VOQ database for the period January 1, 2000, to March 5, 2010, to identify and character- ize reported incidents involving Model Year 1998 to 2010 vehicles that could be viewed as having involved unintended acceleration. In so doing, ODI noted that the VOQ form does not contain any condition-related code that consumers can use consistently to report the occurrence of unintended acceleration.24 Accordingly, ODI analysts had to undertake a keyword text search25 of the narratives of the more than 400,000 com- plaints lodged during the 10-year period to identify complaints alleging the broadest possible range of conditions that could be construed as involving unintended acceleration. Results of the VOQ analysis, shown in Table 5-2, were released in the agencyâs comprehensive report (NHTSA 2011). ODI found roughly 19,000 complaints containing key words that could be associated with forms of unintended acceleration. A manual reading of the narratives of these 19,000 complaints revealed 9,701 in which some form of unintended acceleration was reported, representing about 2 percent of total complaints filed during the period.26 24 Consumers are asked in the questionnaire to identify the vehicle component (or components) that they believe is associated with the problem being reported. One component option is âvehicle speed control.â Sorting on this component is sometimes done to identify complaints in the VOQ data that involve unintended acceleration, but such component characterizations are made inconsistently by consumers. Thus, relying on âvehicle speed controlâ as a sorting mechanism may help in identifying some reports of unintended acceleration, but it will lead to other relevant reports being missed (i.e., those categorized under a different vehicle component such as electrical, engine, power train, and service brakes) and other reports that do not involve unintended acceleration being included. 25 Keyword search overview and terms are available in Report No. NHTSA-NVS-2011-ETC-SR01. 26 The USDOT OIG (2011, 6) performed a text search on all complaints submitted to NHTSA between 2002 and 2009 and estimated that about 4 percent per year, or 13,778, involve allegations of some degree of unintended acceleration. The OIG did not manually review the identified complaints, as ODI did in arriving at the 2 percent figure.
152 || The Safety Promise and Challenge of Automotive Electronics TABLE 5-2 Unintended Acceleration Consumer Complaints Received by NHTSA, 2000â2010 Item Number Total consumer complaints (January 1, 2000, to March 5, 2010) 426,911 Complaints identified by key words associated with unintended acceleration 19,269 Complaints after manual review of narratives (Model Year 1998â2010 9,701 vehicles only) Complaints deemed to have sufficient information to infer incident 5,512 circumstances, conditions, and driver actions Source: NHTSA 2011, Table 2. The 9,701 complaints were further examined for certain objective information about incident circumstances and conditions, such as whether a crash occurred, the speed at which the incident began, and the actions of the driver. The complaints were examined for other infor- mation helpful for inferring these details, such as whether the incident occurred in a parking lot or driveway. A total of 5,512 complaints of the 9,701 were deemed to contain sufficient information to identify or infer incident circumstances. On the basis of this information, the ODI analysts were able to group the complaints into initiation speed rangesâthat is, the speed at which the onset of unintended acceleration occurred. The results of these grouping are shown in Table 5-3. More than two-thirds of the complaints (and more than 80 percent of the complaints involving crashes) involved unintended acceleration that started from a stationary position or low speed (less than 15 mph). ODI reported that many of these incidents (40 percent of complaints and 64 percent of complaints involving crashes) took place while the vehicle was in a parking lot and where the driver reported immediate ineffective braking. TABLE 5-3 Share of All Consumer Complaints of Unintended Acceleration by Initiation Speed (All Manufacturers) Percentage of Total Percentage of Complaints Initiation Speed Complaints (N = 5,512) Involving Crashes (N = 2,039) Stationary 36 33 Low speed (<15 mph) 33 51 Medium speed (15 â 45 mph) 12 9 High speed (>45 mph) 19 7 Source: NHTSA 2011, Table 3.
Review of NHTSA Initiatives on Unintended Acceleration || 153 ODI concluded that the low initiation speed incidents are highly sug- gestive of pedal misapplication for the reasons explained in the earlier discussion of the Silver Book. ODI further concluded that many of the incidents involving vehicles in which the onset of acceleration occurred at medium and higher speeds (31 percent of complaints) also were likely the result of pedal misapplication. This was particularly the case if the driver reported experiencing the acceleration at the same moment as reported application of the brakeâfor example, when the driver was try- ing to brake while approaching an intersection, an exit ramp, or stopped traffic. However, ODI also concluded that some of the higher-speed inci- dents were caused by pedal entrapment, including the incidents already identified as having involved entrapped floor mats. ODIâs complaint analysis focused further on the ETC-equipped Toyota Camrys from Model Years 2002 to 2006. This analysis also indicated that the large majority (74 percent) of complaints involved high-power accel- eration beginning when the vehicle was standing or moving slowly, as shown in Table 5-4. In a large percentage of these complaints, the driver TABLE 5-4 Share of Toyota Camry Consumer Complaints of Unintended Acceleration by Initiation Speed and Driver Actions Complaints (%) Model Year Model Year Model Year 1998â2001 2002â2006 2007â2010 Initiation Without ETC with ETC with ETC Speed Scenario (N = 110) (N = 544) (N = 304) Low speed Apply brake pedal 48 69 25 (<15 mph) Apply accelerator pedal 12 4 4 Release accelerator pedal 5 Idle or normal operations 3 1 3 Roadway Apply brake pedal 7 6 7 speed Apply accelerator pedal 0.3 (â¥15 mph) Release accelerator pedal 12 3 23 Cruise control 1 5 Drivability problem 1 7 23a Other or unknown 1 1 Unknown speed Unknown intent 12 10 10 Note: Columns may not add to 100 percent because of rounding. a The higher number of complaints involving drivability concerns was a result of a transmission-related defect. Source: NHTSA 2011, Table 6.
154 || The Safety Promise and Challenge of Automotive Electronics claimed to have applied the brakes. The analysis also indicated a number of cases in which the acceleration began at highway speeds; they occurred among the Model Year 2007 to 2010 vehicles that had been subject to the floor mat recalls. In addition, the analysis uncovered a number of com- plaints reporting vehicle hesitation and lurching, mostly among the Model Year 2007 to 2010 vehicles. ODI concluded that the latter incidents did not involve high-power acceleration and were attributable to transmission problems, consistent with Toyota technical service bulletins. Crash Investigations Using Toyota Camry Event Data Recorder Data During 2010, NHTSA conducted field investigations of 58 crashes involv- ing Toyota Camrys equipped with ETCs and documented the results (NHTSA 2011). Unintended acceleration had been reported or suspected in all 58 crashes.27 Twenty years earlier, investigators only had vehicle inspections and documentation, physical evidence at the crash scene, and testimony from vehicle occupants and witnesses to rely on. In contrast, the ODI investigators in 2010 could obtain additional objective evidence from the event data recorders (EDRs) in the crash vehicles. Indeed, the 58 crashes were selected because of the expected availability of EDR data. EDR data were not available in five of the 58 crashes; the devices did not record data because of low crash forces. In one other case, the EDR data were not used because the recorded values were clearly erroneous. ODI removed these six crashes from the study. Of the remaining 52, ODI concluded that 12 involved circumstances that were not characteristic of unintended acceleration. Those 12 crashed vehicles had been driven off the road or struck objects with no EDR evidence of either acceleration or braking, suggesting factors such as driver inattention or falling asleep at the wheel. Of the remaining 40 crashes, the investigators confirmed with physical evidence that one involved pedal entrapment by a floor mat. Among the remaining 39, investigators concluded that the most likely cause of all the crashes was pedal misapplication. The EDR data proved especially helpful in reaching this conclusion. In 29 of the 39 crashes, the EDR showed no brake pedal application at all, since the brake light switch had never tran- sitioned from âoffâ to âon.â EDR readings from an additional six cases 27 The 58 cases were identified by ODI by reviewing consumer complaints, police records, Toyota records, insurance company records, and media reports.
Review of NHTSA Initiatives on Unintended Acceleration || 155 showed that the brake had been applied late in the crash, indicated by the brake light switch transitioning to âonâ either 1 second before or at the time of the crash. The significantly delayed brake pedal application (sug- gesting a late driver correction after application of the wrong pedal) was considered insufficient to have any meaningful effect on slowing the vehi- cle before the crash. The EDR also recorded the accelerator pedal position, which was used by ODI investigators to better account for the location of the driversâ feet. In 35 of the 39 incidents, the pedal position data indicated either sustained or increasing pressure on the accelerator pedal. Other EDR and investigation data indicated that in 28 of the 39 cases the driver began to experience acceleration when the vehicle was travel- ing at speeds of 15 mph or less. All but one of the 28 crashes took place in a confined space, mostly residential driveways and commercial parking lots. The nine cases in which acceleration began when the vehicle was moving at faster speeds (>15 mph) consisted of traffic circumstances in which the driver would likely have been trying to apply the brake to slow the vehicle (for example, in approaching a stoplight). In addition, the investigators found that 24 of the 39 crashes involved drivers aged 65 or older. The finding of a high proportion of older drivers was consistent with ODIâs earlier observation from investigations of unintended accel- eration that older drivers are overinvolved in these cases. According to ODIâs summary assessment, the 58 crash investigations did not reveal any new candidate causes, such as failure of the ETC, for unintended acceleration. Examinations and Measurements of Toyota Camrys In its report (NHTSA 2011), ODI explained how it had obtained 20 drivable Model Year 2001 to 2009 Toyota Camrys to permit more extensive exami- nation and measurement of vehicle braking and ergonomic characteristics. Eleven of the 20 vehicles, including two Model Year 2001 vehicles that were not equipped with ETCs, had not been involved in reported unin- tended acceleration events. The other nine consisted of âcomplaintâ vehi- cles that had been involved in alleged unintended acceleration events. In selecting the nine complaint vehicles, any vehicles that had been involved in confirmed cases of entrapped or sticking pedals were excluded. Examination of Braking Characteristics In testing the Camry vehicles, ODI measured the effect of open-throttle acceleration on the performance of brake systems. Each vehicle underwent
156 || The Safety Promise and Challenge of Automotive Electronics acceleration and brake performance testing to quantify braking effective- ness with and without power assistance. Tests included baseline accelera- tion and then a series of acceleration tests while applying pressure to the brake pedal by using the forces required for testing to comply with NHTSAâs brake performance regulation (FMVSS 135). Additional brake tests were conducted by using similar forces to measure the stopping distances of each vehicle. Braking tests were conducted with no accelera- tion, full acceleration with vacuum assist, and full acceleration without vacuum assist. ODI concluded that the subject braking systems were more than ade- quate to halt acceleration initiated at low speed, including instances involving wide-open throttle. Even without vacuum assist, the brakes demonstrated the ability to overcome the engine torque, although the brake pedal force necessary to do so increased substantially. The tests indicated that a large throttle opening maintained for a longer period, as occurred in some pedal entrapment cases, could prompt drivers to pump the brakes repeatedly to cause loss of vacuum assist and overheating of the brakes from prolonged application. ODI stated that these findings are consistent with its earlier conclu- sion that reports of total and immediate brake failure coincidental with the onset of acceleration, as alleged in many low initiation speed inci- dents, are implausible and indicative of pedal misapplication. The find- ings of brake fade and vacuum depletion provided further evidence of why brakes sometimes became difficult to use and eventually ineffective during pedal entrapment cases occurring at highway speeds and when the driver applied the brakes repeatedly. Gearshift Lever Ease of Use An assessment of whether the gearshift lever could be used to disengage the engine quickly and simply in the event of unintended acceleration was made. The Camry shift pattern and required movements to achieve drive, neutral, reverse, and park were examined, along with any extra effort that might be required to move the lever, such as pressing a button on the shifter. The tests did not reveal any ease-of-use issues for the stan- dard shifter used in the Camry when compared with measurements taken from other vehicles. In all cases, shifting to park or reverse caused the transmission to go to neutral.28 28 The testers did find, however, that a serpentine design on the âautostickâ shifter of the highest-trim models could increase the chances of a driver not being able to shift quickly out of drive when under duress.
Review of NHTSA Initiatives on Unintended Acceleration || 157 Pedal Layout and Driver Interface The orientation, location, and operation of the accelerator and brake pedals in the Camrys were tested and measured. NHTSA reported that these measurements did not provide any basis for concluding that pedal misapplication was more likely in the Camry than in other vehicles (NHTSA 2011, 54). However, the testers observed that the accelerator pedal used for the ETC-equipped vehicles presented a âfeelâ different from that of the pedal in Camrys not having ETCs. Compared with the Model Year 2001 vehicles (which have cables linking the pedal to the throttle), depressing the pedal in the ETC-equipped Camrys caused the engine to produce power at a different rate and with a different level of operator effort. The testers also noted that the accelerator pedal force- versus-displacement effort in the 2002 ETC-equipped Camry was some- what similar to the vehicleâs brake pedal force-versus-displacement effort. The testers speculated that this pedal similarity could make it more difficult for a driver to discern the difference between the two ped- als by their feel (NHTSA 2011, 53). NASA Investigation of the Toyota ETC In early 2010, NHTSA commissioned NASAâs Engineering and Safety Center (NESC) to investigate whether vulnerabilities exist in the Camry ETC and whether any of them could be a plausible source of reported occurrences of unintended acceleration. By enlisting NASA, NHTSA was able to draw on specialized testing capabilities and engineering disci- plines, including expertise in software analysis, electronics engineering, systems safety, and electromagnetic compatibility. NASAâs report was released in February 2011. NASA Study Approach and Key Results NASAâs investigation was multiphased. After identifying the critical func- tions of the ETC, the NESC team examined how the electronics system is designed and implemented to guard against failures and to respond safely when failures occur. The team then looked for vulnerabilities in these designs and their implementation. After it identified potential vulnerabili- ties, the team looked for evidence from the fleet of any of them having caused unintended acceleration characteristic of a large throttle opening. Vulnerabilities were sought by identifying circumstances in which a failure could occur and go undetected so as to bypass system fail-safe responses. To assess whether an identified vulnerability had led to failures
158 || The Safety Promise and Challenge of Automotive Electronics causing unintended acceleration in the fleet, the NESC team reviewed consumer complaints for hallmarks of the failures and tested vehicles and components previously used by drivers alleging unintended acceleration. On the basis of its vulnerability analysis, the NESC team identified the following two scenarios that it described as having at least a theoretical potential to produce unintended acceleration characteristic of a large throttle opening: (a) a systematic failure of software in the ETCâs central processing unit that goes undetected by the supervisory processor and (b) two faults in the pedal position sensing system that mimic a valid accelerator command. The two scenarios are shown in Table 5-5, which is an abbreviated version of the failure mode and effects analysis (FMEA) performed by the NESC team during its vulnerability analysis. To test the plausibility of the first scenario, NESC investigators used multiple tools to analyze software logic paths and to examine the pro- gramming code for paths that might lead to unintended acceleration. These extensive testing and analytic efforts did not uncover any evi- dence of problems, but the team pointed out that no practical amount of testing and analysis can guarantee that software is free of faults. The NESC software analysts reported that certain characteristics of the sub- ject software (from a 2005 Camry) hindered the testing. For example, they found that the code structure relied on the use of a single large memory space shared among all tasks with unrestricted access (in con- trast to designs where each task is given private memory inaccessible to other tasks). This lack of modularity reportedly precluded automated analysis and required more time-consuming manual inspection by ana- lysts (NASA 2011, Appendix A, Section A.8.2). Thus, the NESC teamâs technical description of its analysis suggested a concern that the software was not structured to facilitate assessments of dependability to a high degree of confidence. To examine the second scenario, the team tested numerous potential software and hardware failure modes by using bench-top simulators and by testing vehicles involved in reported cases of unintended acceleration. The vehicles were inspected for signs of electrical faults. They were also subjected to electromagnetic interference by using radiated and con- ducted levels in excess of those required for type certification by the European Union.29 The electromagnetic interference tests did not produce 29 As explained in Chapter 3, the European Union requires automobile manufacturers to subject their vehicles and systems to electromagnetic compatibility testing, whereas the United States does not.
TABLE 5-5 Abbreviated FMEA of Toyota ETC by NASA Conditions Failure Condition Physical or Necessary for and Symptoms Electronic Range of Failure System Failure Electronics Failure to Occur, Found in Real Evidence, Failure Throttle Effect Response: Fail-Safe System-Level Component Failure Mode World Detection Opening Braking? Modes Applied Prevention Functional Area: Pedal Command Pedal Position sensor Pedal sensor DTC for high, low, Throttle does Limp-home modeâ Idle mode fuel sensors fail high, low, failures in war- outside operational not open with throttle limited to <15Â°. cut. Fuel cut intermediate ranty data. NESC lane. None if pedal single failure. If neither sensor is oper- limits <2,500 values engineered test sensor fails within able then idle mode. revolutions per lane and a DTC Under certain conditions minute when is set involving potentiometer accelerator sensors, limp-home pedal released. mode is not limited and may jump depending on the rate at which the pedal is applied. Incorrect learned No evidence in Engineered fault in Small open- None. Dual failures look value. Dual warranty data. lane. Valid pedal ing, <10Â° like valid pedal signal failure to specific NESC engi- signal escapes max between cannot be detected, voltages that neered test detection, no normal sensor but 10Â° opening max. result in voltages DTC set. Electrical values and within opera- failures should leave DTC limit tional range trace. Dual failures No signs of dual Engineered fault in Wide-open >35Â° open- None. Dual failures that None possible that result in resistive failures. lane. Valid pedal throttle is ing could emulate or look like a for multiple voltages within NESC engi- signal escapes conceptually deplete vac- valid pedal signal can- failures that operational neered test detection, no DTC possible, but uum assist not be detected. look valid range set. Electrical failures no real-world if brakes are should leave trace. evidence. pumped. (continued on next page)
TABLE 5-5 (continued) Abbreviated FMEA of Toyota ETC by NASA Conditions Failure Condition Physical or Necessary for and Symptoms Electronic Range of Failure System Failure Electronics Failure to Occur, Found in Real Evidence, Failure Throttle Effect Response: Fail-Safe System-Level Component Failure Mode World Detection Opening Braking? Modes Applied Prevention Functional Area: Throttle Control Computer Main CPU Faulty power, ECM failures in DTC set for bad None Engine turned off Engine turned memory failure warranty data. power, memory off NESC engi- fault, consistent neered test data Sub-CPU Faulty power, ECM failures in DTC set for bad None Engine turned off Engine turned memory failure warranty data. power, memory off NESC engi- fault, consistent neered test data Main CPU Software uni- Cannot engineer Theoretical fault Wide-open >35Â° open- Engineered fault None possible, software laterally opens a test. No escapes detection. throttle is ing could escapes detection. malfunction- throttle with place found in conceptually deplete vac- ing computer pedal released, software where a possible, but uum assist opens throttle idle fuel cut not single memory/ no real-world if brakes are and appears active, watch- variable cor- evidence. pumped. normal without dog serviced, no ruption results DTC, watchdog EDAC error, sub- in unintended timeout, limp- CPU does not acceleration. home mode, or detect failure. other errors. Note: CPU = central processing unit; ECM = error-correcting memory; EDAC = error detection and correction. Shaded cells indicate scenarios that can theoretically lead to an uncommanded large throttle opening. Source: NASA 2011, Table 22.214.171.124-1, page 77.
Review of NHTSA Initiatives on Unintended Acceleration || 161 acceleration indicative of a large throttle opening, but some produced engine slowing and stalling. After contacting a consumer who had complained about unusual accel- erator pedal responses, ODI recovered the vehicleâs accelerator pedal assembly, which it turned over to the NESC team for analysis. The faulty assembly was found to contain a low-resistance path, which was deter- mined to have been caused by an electrically conductive tin whisker (a crystalline, hairlike structure of tin that can form on a tin-finished surface) that had formed between signal outputs from the potentiometer pedal position sensors.30 Consideration was given to whether low-resistance paths in the pedal position sensing systemâwhether created by tin whiskers or other means31âcould have produced unintended acceleration indicative of a large throttle opening. The NESC team concluded that if a single low- resistance path were to exist between the pedal sensor outputs, the system could be vulnerable to unintended acceleration if accompanied by a sec- ond specific fault condition. However, for a vulnerability to be created, the two fault conditions would need to escape detection by meeting restrictive criteria consisting of a specific resistance range as needed to create the exact circuit configuration in a correct time phase. If the two faults did not meet these criteria, they would be detected and trigger a diagnostic trouble code (DTC) and a system fail-safe response such as reduced engine power. To gain a better understanding of the probability of the two fault con- ditions occurring in the field, the NESC team examined Camry warranty repair data and consumer complaints of high-power unintended accel- eration. The team posited that for every instance in which two unde- tected faults had led to an episode of unintended acceleration, numerous pedal repairs associated with single detected faults would be expected, since they would be much more likely than two faults having highly restrictive resistance ranges, circuit configurations, and timing phases. In May 2010, ODI had requested warranty claim data from Toyota on all vehicles equipped with ETCs sold in the United States. In particular, ODI asked for details on any warranty claim involving an ETC hardware 30 As discussed in Chapter 3, these sensors provide a voltage output to the engine control module that is proportional to the pedalâs displacement when it is pressed by the driver. The engine control module uses the pedal position sensing information, along with information provided by other sensors, to adjust the throttle plate. 31 Although the NESC team found evidence of tin whiskers, low-resistance paths can also be produced by the presence of moisture, salt spray, and other contaminants.
162 || The Safety Promise and Challenge of Automotive Electronics component, the engine control module, the throttle actuator, the accel- erator pedal, any related wiring or harness connectors, and any DTCs that could be associated with a failure of the ETC. In reviewing the war- ranty data generally, ODI had determined that claim rates for the Camry components (per vehicle sold) were much lower than the claim rates typically found for defective components in other vehicle systems that had been the subject of safety recalls and were thus not suggestive of a defect trend in the Camry ETC. The NESC team also reviewed the Camry warranty repair data for DTCs and repair items indicative of problems in the relevant accelerator pedal sensors and circuitry (NASA 2011, 37â41). The team found fewer warranty repair items than driver reports of high-power unintended acceleration and concluded that the warranty repair data âdoes not sup- port an observable failure signature of pedal-induced DTCsâ (NASA 2011, 16). In short, the warranty data indicated that the postulated dual- fault scenario involving the Camry pedal sensor system was an implau- sible source of the high-power unintended acceleration reported in consumer complaints. Finally, the NESC team reported that its testing revealed ways in which a single-failure mode could cause relatively small throttle open- ings leading to controllable engine behaviors such as high idle speed, hesitation, and âjumpiness.â The team noted that while some of these conditions did not trigger a DTC during testing, they were eliminated by releasing the accelerator pedal or could be overridden by applying the brakes. These controllable behaviors were inconsistent with reports of high-power unintended acceleration. The NASA investigators thus con- cluded that its testing and analysis âdid not find that [the Toyota ETC] electronics are a likely cause of throttle openings as described in the VOQsâ (NASA 2011, 17). NHTSAâs Response to NASA Results On the basis of the NESC teamâs study, NHTSA has concluded âthat the Toyota ETC system does not have design or implementation flaws that could reasonably be expected to cause UA [unintended acceleration] events involving large throttle openings as described in consumer com- plaints to NHTSAâ (NHTSA 2011, 62). Specifically with respect to the postulated dual-fault scenario in the ETCâs pedal position sensing system, NHTSA concurred that the absence of significant numbers of warranty repairs for more likely single faults is indicative of a hypothetical scenario
Review of NHTSA Initiatives on Unintended Acceleration || 163 and not one âoccurring in the real worldâ (NHTSA 2011, 63). NHTSA likewise concurred that the other forms of unintended acceleration cre- ated by single faults do not create large throttle openings and are likely to be rare and controllable; in NHTSAâs view, they do not present a safety hazard. NHTSA acknowledged that Toyotaâs fail-safe strategy for the ETC studied can be characterized as imperfect because it does not respond to all theoretical failure pathways but concluded that âthere is cur- rently no evidence of a real-world safety risk produced by this phenom- enonâ (NHTSA 2011, 63). NHTSA also noted that the NESC teamâs study did not reveal any ETC failure mode that could affect the vehicleâs braking system (NHTSA 2011, 64), and hence any lack of braking effectiveness reported by a driver experiencing unintended acceleration could not be attributed to a shortcoming in the ETC. On the basis of NASAâs study and its own series of analyses and inves- tigations, NHTSA outlined several steps that it planned to take in response to the findings, some of which were discussed in Chapter 4. It indicated that it will consider initiating new rulemakings to require (a) installation of systems that cause the brake to override the throttle, to prevent or mitigate unintended acceleration incidents (e.g., in the case of pedal entrapment); (b) measures to ensure that keyless ignition systems can be turned off by drivers during an on-road emergency; and (c) installation of EDRs on all new vehicles. NHTSA also indicated that it would consider research on the layout and spacing of accelerator and brake pedals, the utility of DTCs in conveying safety-critical information to drivers, and robust software development processes and fail-safe strategies to protect against multifault scenarios. The committee comments on some of these proposed initiatives in the next chapter. cHaPter fINdINgs Finding 5.1: NHTSA has investigated driver complaints of vehicles exhibiting various forms of unintended acceleration for decades, the most serious involving high engine power indicative of a large throttle opening. The two main types of unintended acceleration incidents involving a large throttle opening are those in which rapid acceleration occurs suddenly when the vehicle is in a stopped position, moving slowly, or in the process of slowing down and those in which a moving vehicle maintains or increases its speed after
164 || The Safety Promise and Challenge of Automotive Electronics the driver releases the accelerator pedal. Degraded or failed braking is often asserted along with both of these forms of unintended acceleration. A range of other vehicle behaviors, from high engine idling to surging and transmission hesitations, are sometimes characterized as unintended acceleration. They are controllable and do not present the same safety hazard as acceleration involving a large throttle opening unless the vehi- cle behavior prompts an unsafe response by the driver, such as acciden- tally applying the accelerator pedal instead of the brake. Finding 5.2: NHTSA has most often attributed the occurrence of unintended acceleration indicative of a large throttle opening to pedal-related issues, including the driver accidentally pressing the accelerator pedal instead of the brake pedal, floor mats and other obstructions that entrap the accelerator pedal in a depressed position, and sticking accelerator pedals. Other commonly identified prob- lems include malfunctioning mechanical components in the throttle control system, such as frozen and broken throttle plates, and frayed and trapped connector cables. NHTSA attributes forms of unintended accel- eration involving a large throttle opening occurring in stopped and slow-moving vehicles to pedal misapplication, unless there is a credible explanation of why the vehicleâs brakes were not applied or why they failed to stop and control the engine torque if they were applied. Braking action may not control unintended acceleration occurring in vehicles traveling at faster speeds under limited circumstances. Such incidents are investigated for other potential causes, including pedal entrapment and sticking and malfunctioning throttle control systems, and for evi- dence of brake damage caused by prolonged brake application. Finding 5.3: NHTSAâs rationale for attributing certain unintended acceleration events to pedal misapplication is valid, but such determinations should not preclude further consideration of possible vehicle-related factors contributing to the pedal mis- application. Reports of braking ineffectiveness in controlling a vehicle expe- riencing the onset of unintended acceleration from a stopped position or when moving slowly require an explanation for the ineffectiveness, such as physical evidence of damage to the brake system. Under these circum- stances, investigating for phenomena other than pedal misapplication absent an explanation for the ineffectiveness of brakes, which are inde- pendent of the throttle control system and are designed to dominate engine torque, is not likely to be useful. Full consideration of the causes of pedal misapplication requires that vehicle design and operational conditions that can affect a driverâs actions to control the vehicle be taken into account.
Review of NHTSA Initiatives on Unintended Acceleration || 165 Finding 5.4: Not all complaints of unintended acceleration have the signature characteristics of pedal misapplication; in particular, when severe brake damage is confirmed or the loss of braking effectiveness occurs more gradually after a pro- longed effort by the driver to control the vehicleâs speed, pedal misapplication is improbable, and NHTSA reported that it treats these cases differently. In its investigations of such cases, NHTSA has usually concluded that the acceleration was caused by faulty mechanical components or the accel- erator pedal becoming stuck or entrapped, often by a floor mat. NHTSA did not have a prior technical basis for suspecting the ETC as an alterna- tive cause of such unintended acceleration events reported by owners of Toyota vehicles. Nevertheless, NHTSA commissioned a team of engi- neering specialists from NASA to investigate the potential for Toyotaâs ETC to produce unintended acceleration. Finding 5.5: NHTSAâs decision to close its investigation of Toyotaâs ETC as a possible cause of high-power unintended acceleration is justified on the basis of the agencyâs initial defect investigations, which were confirmed by its follow-up analyses of thousands of consumer complaints, in-depth examinations of EDRs in vehicles suspected to have crashed as a result of unintended acceleration, and the examination of the Toyota ETC by NASA. In its initial investigations of complaints and examinations of warranty repair data, NHTSA did not find evidence implicating the ETC as a cause of unintended accelera- tion reported by drivers of Toyota vehicles. It confirmed the occurrence of pedal entrapment and sticking in some reported cases and the signa- ture characteristics of pedal misapplication in others. The subsequent NASA investigation did not yield evidence contradicting these conclu- sions. NASA identified means by which vulnerabilities in the ETC could produce unintended acceleration but could not find evidence that these means offered a plausible explanation for any occurrences of high-power unintended acceleration observed in the fleet. Finding 5.6: The VOQ consumer complaint data appear to have been sufficient for ODI analysts and investigators to detect an increase in high-power unintended acceleration behaviors in Toyota vehicles, to distinguish these behaviors from those commonly attributed to pedal misapplication, and to aid investigators in identi- fying pedal entrapment by floor mats as the likely cause. Other data available to ODI for monitoring the fleet for defects, including warranty repair information submitted quarterly by Toyota as part of the Early Warning Reporting system, were consulted in response to the suspicious VOQ patterns. These data did not provide indications of malfunctioning ETCs
166 || The Safety Promise and Challenge of Automotive Electronics or any other vehicle defects as possible causes. Unintended acceleration resulting from pedal entrapment or pedal misapplication would not be expected to be revealed by warranty repair data; thus, in this sense the absence of suspect patterns in the warranty data corroborated ODIâs con- clusions that floor mat entrapment was the cause of the increase in the Toyota complaints uncharacteristic of pedal misapplication. Finding 5.7: ODIâs investigation of unintended acceleration in Toyota vehicles indicated how data saved in EDRs can be retrieved from vehicles involved in crashes to supplement and assess other information, including circumstantial evi- dence, in determining causal and contributing factors. In this instance, the EDR data corroborated investigator findings of unintended acceleration occurring through pedal misapplication. refereNces Abbreviations NASA National Aeronautics and Space Administration NHTSA National Highway Traffic Safety Administration NTSB National Transportation Safety Board OIG Office of Inspector General, U.S. Department of Transportation Brackett, R. Q., V. J. Pezoldt, M. G. Sherrod, and L. Roush. 1989. Human Factors Analysis of Automotive Foot Pedals. DOT-HS-807-512. National Highway Traffic Safety Administration, Washington, D.C. NASA. 2011. National Highway Traffic Safety Administration Toyota Unintended Acceleration Investigation: Technical Support to the National Highway Traffic Safety Administration (NHTSA) on the Reported Toyota Motor Corporation (TMC) Unintended Acceleration (UA) Investigation. Jan. 18. http://www.nhtsa.gov/ staticfiles/nvs/pdf/NASA-UA_report.pdf. NHTSA. 2011. Technical Assessment of Toyota Electronic Throttle Control (ETC) Systems. Feb. http://www.nhtsa.gov/staticfiles/nvs/pdf/NHTSA-UA_report.pdf. NTSB. 2009. Highway Special Investigation Report: Pedal Misapplication in Heavy Vehicles. http://www.ntsb.gov/doclib/safetystudies/SIR0902.pdf. OIG. 2011. Process Improvements Are Needed for Identifying and Addressing Vehicle Safety Defects. Report MH-2012-001. Oct. 6. Pollard, J., and E. D. Sussman. 1989. An Examination of Sudden Acceleration. Report DOT-HS-807-367. Transportation Systems Center, U.S. Department of Transportation.
Review of NHTSA Initiatives on Unintended Acceleration || 167 Reinhart, W. 1994. The Effect of Countermeasures to Reduce the Incidence of Unintended Acceleration Accidents. Paper 94 S5 O 07. Proc., 14th International Technical Conference on Enhanced Safety of Vehicles, Washington, D.C., Vol. 1, pp. 821â845. Rogers, S. B., and W. W. Wierwille. 1988. The Occurrence of Accelerator and Brake Pedal Actuation Errors During Simulated Driving. Human Factors, Vol. 31, No. 1, pp. 71â81. Schmidt, R. A. 1989. Unintended Acceleration: A Review of Human Factors Contributions. Human Factors, Vol. 31, No. 3, pp. 345â364. Vernoy, M. W., and J. Tomerlin. 1989. Pedal Error and Misperceived Centerline in Eight Different Automobiles. Human Factors, Vol. 31, No. 4, pp. 369â375. Walter, R., G. Carr, H. Weinstock, E. D. Sussman, and J. Pollard. 1988. Study of Mechanical and Driver-Related Systems of the Audi 5000 Capable of Producing Uncontrolled Sudden Acceleration Incidents. Report DOT-TSC-NHTSA-88-4. Transportation Systems Center, U.S. Department of Transportation.