80 FR 27835 - Denial of Motor Vehicle Defect Petition
DEPARTMENT OF TRANSPORTATION
National Highway Traffic Safety Administration Federal Register Volume 80, Issue 93 (May 14, 2015)
National Highway Traffic Safety Administration
Federal Register Volume 80, Issue 93 (May 14, 2015)
| Page Range | 27835-27844 | |
| FR Document | 2015-11632 |
[Federal Register Volume 80, Number 93 (Thursday, May 14, 2015)] [Notices] [Pages 27835-27844] From the Federal Register Online [www.thefederalregister.org] [FR Doc No: 2015-11632] [[Page 27835]] ----------------------------------------------------------------------- DEPARTMENT OF TRANSPORTATION National Highway Traffic Safety Administration Denial of Motor Vehicle Defect Petition AGENCY: National Highway Traffic Safety Administration, (NHTSA), Department of Transportation. ACTION: Denial of a petition for a defect investigation. ----------------------------------------------------------------------- SUMMARY: This notice sets forth the reasons for denying a petition (DP14-003) submitted to NHTSA 49 U.S.C. 30162, 49 CFR part 552, requesting that the agency open ``an investigation into low-speed surging in the 2006-2010 Toyota Corolla [vehicles] with ETCS-i, in which the brakes fail to stop the vehicle in time to prevent a crash.'' FOR FURTHER INFORMATION CONTACT: Mr. Stephen McHenry, Vehicle Control Division, Office of Defects Investigation, NHTSA, 1200 New Jersey Avenue SE., Washington, DC 20590. Telephone 202-366-4883. Email [email protected]. SUPPLEMENTARY INFORMATION: 1.0 Introduction Interested persons may petition NHTSA requesting that the agency initiate an investigation to determine whether a motor vehicle or item of replacement equipment does not comply with an applicable motor vehicle safety standard or contains a defect that relates to motor vehicle safety. 49 U.S.C. 30162(a)(2); 49 CFR 552.1. Upon receipt of a properly filed petition the agency conducts a technical review of the petition, material submitted with the petition, and any additional information. 49 U.S.C. 30162(c); 49 CFR 552.6. After considering the technical review and taking into account appropriate factors, which may include, among others, allocation of agency resources, agency priorities, and the likelihood of success in litigation that might arise from a determination of a noncompliance or a defect related to motor vehicle safety, the agency will grant or deny the petition. 49 U.S.C. 30162(d); 49 CFR 552.8. 2.0 Petition Background Information In a letter dated September 11, 2014, Mr. Robert Ruginis requested that NHTSA open ``an investigation into low-speed surging in the 2006- 2010 Toyota Corolla [vehicles] with ETCS-i, in which the brakes fail to stop the vehicle in time to prevent a crash.'' Mr. Ruginis based his request upon multiple low-speed ``surge events'' allegedly experienced by his wife in their model year (MY) 2010 Toyota Corolla, the latest of which resulting in a crash into a parked vehicle on June 8, 2014. Mr. Ruginis makes the following claims in support of his petition: (1) The Event Data Recorder (EDR) readout of his wife's crash supports her account of vehicle acceleration after she applied the brake; (2) NHTSA has never investigated surges in low-speed crashes in Toyota vehicles; (3) a software expert has identified vulnerabilities in Toyota's ETCS-i source code; (4) there are other similar incidents of ``surge at low speed or no speed'' in Toyota Corolla vehicles in NHTSA's consumer complaint database; and (5) surges in low-speed parking scenarios are a safety problem. NHTSA has reviewed the material cited by the petitioner. The results of this review and our analysis of the petition's merits are set forth in the DP14-003 Petition Analysis Report, published in its entirety as an appendix to this notice. For the reasons presented in the petition analysis report after a thorough assessment of the potential risks to safety, it is unlikely that an order concerning the notification and remedy of a safety- related defect would be issued as a result of granting Mr. Ruginis's petition. After full consideration of the potential for finding a safety related defect in the vehicle and in view of the need to allocate and prioritize NHTSA's limited resources to best accomplish the agency's mission, the petition is respectfully denied. Appendix--Petition Analysis--DP14-003 1.0 Introduction On September 12, 2014, the National Highway Traffic Safety Administration (NHTSA) received a September 11, 2014, letter from Mr. Robert Ruginis petitioning the agency ``for an investigation into low- speed surging in the 2006-2010 Toyota Corolla [vehicles] with ETCS-i, in which the brakes fail to stop the vehicle in time to prevent a crash.'' The letter provides the following basis for the request: This request is based on first-hand experience in which multiple low-speed surge events that occurred while driving our 2010 Corolla. The latest incident resulted in a crash on June 8, 2014. In addition to the evidence from our crash incident, we are providing evidence that many other Corolla owners are experiencing similarly unsafe scenarios that are leading to crashes. The petition letter provides information regarding the June 8, 2014, crash incident, including the petitioner's interpretation of pre- crash data downloaded from the vehicle Event Data Recorder (EDR) by Toyota field inspectors: The EDR investigation report clearly showed that at the moment the airbag module made the decision whether to deploy (about the time of impact), the voltage to the accelerator pedal was .78 (at idle), the brake was engaged, yet both the speed of the vehicle and engine RPM's had doubled in less than 2 seconds. Mr. Ruginis provided copies of the police report for the accident, the EDR report, and a list of ODI complaints (VOQs) that he considered similar to his wife's experience in the crash and in prior driving experience. He provided the following five reasons supporting an ODI investigation of the alleged defect in the MY 2006 through 2010 Toyota Corolla vehicles: 1. The EDR results suggest that unsafe and unexpected surges can occur even when the driver's action is to apply the brake; 2. NHTSA has never investigated surges in low-speed crashes in Toyotas; 3. The observations of software expert Michael Barr suggest that Toyota's electronic architecture has many vulnerabilities; 4. Unintended surges in low-speed parking scenarios are common; and 5. Surges in low-speed parking scenarios are a safety problem. In evaluating the petitioner's allegations and preparing a response, ODI:Reviewed the petition request and submitted appendices, interviewed the petitioner and his wife--who was the primary driver and who was driving when the crash occurred. Provided the 163 VOQs submitted by the petitioner to Toyota, formally requested Toyota to provide full warranty claim histories for throttle and braking systems on the subject vehicles, as well as copies of all reports made to Toyota by the complainants or by dealership or Toyota technical personnel related to the complaints, field inspection data, and all related EDR download data obtained by Toyota collected from vehicles identified in incidents reported in the subject vehicle VOQs. Requested technical and engineering information from Toyota related to the alleged defect as submitted by the petitioner. Analyzed the information provided by Toyota in response to our specific requests for information. Reviewed previous analysis and investigative work into unintended acceleration done by NHTSA, the National Aeronautics and Space [[Page 27836]] Administration, and the National Academy of Sciences as well as papers from the Society of Automotive Engineers related to EDR download data interpretation and limitations. Interviewed complainants who had submitted the 163 VOQs noted by the petitioner. Gathered, when possible, law enforcement crash reports, insurance reports, repair facility invoices, photographs of crash sites, security camera surveillance video, and any other relevant information related to the reported incidents. Acquired the petitioner's vehicle and transported it to the Vehicle Research Test Center (VRTC) in East Liberty, Ohio, for evaluation. 2.0 Background 2.1 Definitions The term ``unintended acceleration'' (UA) is often used to generally describe any unintended speed increase in a motor vehicle. This is an extremely broad definition that includes some aspects of normal vehicle performance (e.g., idle speed control and transmission control), as well as many forms of abnormal performance of those systems that represent little to no hazards to highway safety (i.e., issues generally described as ``driveability'' issues).\1\ Within the universe of unintended acceleration issues that do involve potentially serious safety hazards, ``sudden acceleration'' (SA) incidents are the most common and are defined as allegations of ``unintended, unexpected, high-power acceleration from a stationary position or a very low initial speed accompanied by an apparent loss of braking effectiveness.'' \2\ This definition was developed in the 1980's, when ODI first began investigating the subject in a large cross-section of passenger car makes and models sold in the U.S., including Audi 5000 sedans. --------------------------------------------------------------------------- \1\ ODI's analysis of warranty data for MY 2002-2010 Toyota Camry vehicles submitted by Toyota as part of RQ10-003, determined that approximately 80 percent of the claims were related to engine or transmission recalibrations to address a number of vehicle driveability concerns (e.g., improving shift feel) as described in a series of technical service bulletins, each related to separate conditions and vehicle subpopulations. Claim rates were negligible (less than 0.03%) in vehicles with no such TSB's (e.g., MY 2002-2006 Camry L4 with 2AZ-FE engines). \2\ The definition has been broadened in recent years to include incidents occurring in certain on-road driving maneuvers that require braking, such as approaching controlled intersections or highway exit ramps, but the majority of incidents continue to be reported in low-speed parking maneuvers. --------------------------------------------------------------------------- The foregoing definition purposefully excludes ``stuck throttle'' type incident symptoms, which involve failure of the throttle to return to idle when the accelerator pedal is released by the driver. Stuck throttle defects generally follow patterns including relatively high initiation speeds, large accelerator pedal applications and other driving conditions specific to each defect condition. For example, floor mat entrapments tend to occur after the driver has intentionally pressed the accelerator pedal to the floor to pass vehicles on the highway, merge with highway traffic or accelerate up hills. Unintended accelerations resulting from pedal entrapment involve maximum engine power and often include degraded brake effectiveness if the driver pumps out the reserve vacuum in the brake booster, resulting in loss of power assist to the brakes. If the driver is unable to bring the vehicle to a complete stop within the first couple of miles, the brakes will continue to lose effectiveness due to brake fade or heat degradation of the friction materials. 2.2 Sudden Acceleration Background ODI's first investigation of sudden acceleration, EA78-110, opened almost 40 years ago, covered approximately 60 million MY 1973 through 1986 General Motors passenger cars. That investigation established that sustained, unintended, ``high-power acceleration'' could only be caused by failure mechanisms that produced large throttle openings. This finding reduced the potential failure modes to defects affecting throttle linkages and cruise control components. Ninety percent of the accident vehicles in EA78-110 were not equipped with cruise control, thus eliminating the only potential electronic mechanism capable of opening the throttle in that investigation.\3\ The investigation was closed in 1986 after eight years of testing and studies, concluding that: --------------------------------------------------------------------------- \3\ Reinhart, W. 1996. Engineering Analysis Closing Report, EA78-110. Washington, DC: NHTSA, (11). Inadvertent and unknowing driver application of the accelerator pedal when the driver intended to apply the brake [``pedal misapplication''] appears to be the cause of many of the reported sudden acceleration related accidents, even though many of the drivers continue to believe that they had been pushing on the brake pedal.\4\ --------------------------------------------------------------------------- \4\ Reinhart, W. 1996. Engineering Analysis Closing Report, EA78-110. Washington, DC: NHTSA, (18). In October 1987, a little over a year after EA78-110 was closed; NHTSA's Administrator ordered an independent review of SA (the ``Study''). While the phenomena affected all automatic transmission- equipped cars sold in the U.S., some had notably higher occurrence rates, raising questions about vehicle design factors that may be contributing to the problem. The Study re-examined potential causes of SA, as well as design factors that may contribute to higher rates of pedal misapplication. The results of the Study were released in March 1989, in a report titled ``An Examination of Sudden Acceleration.'' \5\ With respect to the cause of SA incidents, the Study concluded that, absent evidence of a throttle, cruise control or brake malfunction, ``the inescapable conclusion is that these definitely involve the driver inadvertently pressing the accelerator instead of, or in addition to, the brake pedal.'' --------------------------------------------------------------------------- \5\ Pollard, J., and E.D. Sussman. 1989. An Examination of Sudden Acceleration. Report DOT-HS-807-367. Transportation Systems Center, U.S. Department of Transportation. --------------------------------------------------------------------------- Because the majority of incidents were associated with accelerations that began after the vehicle was started and shifted from Park to Drive or Reverse gear, the most effective countermeasure for pedal error related SA incidents was the incorporation of brake-shift interlocks to prevent shifting from Park when the brake pedal is not depressed. Shift interlocks were voluntarily implemented by most manufacturers in the late-1980's and early-1990's and early studies showed reductions in the number of SA complaints during this time period, with the trend driven by the drop in events occurring immediately after shift from Park.\6\ Brake shift interlocks have no effect on mitigating pedal errors later in the drive cycle (e.g., parking). --------------------------------------------------------------------------- \6\ Reinhart, W. 1994. The Effect of Countermeasures to Reduce the Incidence of Unintended Acceleration Accidents. Paper 94 S5 O 07. Proc., 14th International Technical Conference on Enhanced Safety of Vehicles, Washington, DC, Vol. 1, (821-845). --------------------------------------------------------------------------- 2.3 Toyota Investigations and NHTSA/NASA Study From 2003 through 2009, ODI examined unintended acceleration issues in Toyota vehicles equipped with ETCS-i in 3 defect investigations and 5 defect petition evaluations. These activities prompted 4 safety recalls addressing floor mat entrapment, a ``sticky pedal'' condition, and an accelerator pedal interference condition. Publicity surrounding a fatal crash in August 2009, that was determined to have been caused by floor mat entrapment, the ensuing floor mat recall by Toyota and the ``sticky pedal'' recall led to intense media coverage of Toyota unintended acceleration issues and possible electronic defects. Much of the interest focused on low-speed SA incidents in Toyotas not included in the floor mat recalls or in recalled vehicles that had clearly not [[Page 27837]] experienced either mat entrapment or ``sticking accelerator pedals.'' NHTSA responded by conducting an in-depth examination of Toyota's electronic throttle control systems in partnership with NASA's Engineering and Safety Center. NHTSA and NASA released reports detailing the results of this study in early 2011, concluding that incidents alleging low-speed surges during brake application were most likely related to driver pedal misapplication and were not associated with an electronic or software defect in Toyota's ETCS-i system. 2.4 National Research Council Special Report 308 In 2012, the National Academy of Sciences released a report that included a review of NHTSA's defects investigations of low-speed surging in Toyota vehicles and the results of the joint study with NASA. The report, titled ``The Safety Promise and Challenge of Automotive Electronics, Insights from Unintended Acceleration,'' concluded that NHTSA's decision to close its investigations of Toyota's ETC were justified based on the initial investigations, complaint analyses, field investigations using EDR data and NASA's examination of the Toyota ETC. With regard to allegations of low-speed surging with ineffective brakes, the report stated: Reports of braking ineffectiveness in controlling a vehicle experiencing the onset of unintended acceleration from a stopped position or when moving slowly require an explanation for the ineffectiveness, such as physical evidence of damage to the brake system. Under these circumstances, investigating for phenomena other than pedal misapplication absent an explanation for the ineffectiveness of the brakes, which are independent of the throttle control system and are designed to dominate engine torque, is not likely to be useful.\7\ --------------------------------------------------------------------------- \7\ NRC. 2011. TRB Special Report 308: The Safety Challenge and Promise of Automotive Electronics: Insights from Unintended Acceleration. Washington, DC: National Academies Press, (164). --------------------------------------------------------------------------- 3.0 Petition Analysis [GRAPHIC] [TIFF OMITTED] TN14MY15.008 3.1 Petitioner's Vehicle 3.1.1 Petitioner's Accident The petition was prompted by a collision with a parked vehicle during an attempted curbside parking maneuver in a residential neighborhood on June 8, 2014. In the police report, the driver states that she stopped at an intersection with the intention of turning right and parking along the curb behind a parked vehicle. Figure 1. Pre-Crash Data for Petitioner's Accident (Image From Bosch CDR Report) During a subsequent vehicle inspection on June 24, 2014, Toyota downloaded data from the vehicle EDR (Figure 1). 3.1.2 EDR Data Analysis Although the EDR data shown in Figure 1 appears to show that engine speed doubled on or about the same time that the brake switch shows brake pedal application, examination of this data as well as the ways in which the EDR collects, transmits and records it, does not support the petitioner's conclusion that the vehicle accelerated when the brake was applied. Interpretation of EDR pre-crash data should be done within the context of the incident reconstruction, including a detailed statement from the driver, and must take into account the limitations of the system as documented on the Bosch Crash Data Retrieval (CDR) report. The limitations include the resolution of each data element, the asynchronous refresh rates of the data elements, and the rate at which the EDR samples and records the data. Toyota provided the following EDR design information for the 2010 Corolla in response to a formal request by ODI: The Vehicle Speed is based on the front wheel speed sensors and recorded in 2 kph increments and nominally updated every 500 ms. The Brake Switch, based on the stop lamp switch status, is either ON or OFF, and is updated instantly. The service brake pedal must be depressed minimally for the stop lamp to activate. The accelerator pedal position is recorded in 0.039 volt increments, and the value is nominally updated every 524 ms. This measurement is taken directly at the operator's accelerator pedal. The Engine RPM is measured in 400 RPM increments and is nominally updated every 524 ms.\8\ --------------------------------------------------------------------------- \8\ As indicated in the Bosch CDR report, the Vehicle Speed and Engine RPM values are both rounded down in the given increments. ODI interviewed the driver to obtain her description of the incident. She indicated that her normal braking style when parking is to apply light, gradual pressure to the brake pedal, rather than a sudden, hard stop. She indicated that as she applied the brakes during the incident, the car responded by accelerating. She stated that it did not slow down, and it continued to increase in speed until it hit the back of the parked vehicle. The petitioner provided a similar description in a call to Toyota's customer relations department three days after the incident, alleging simultaneous failures of both the engine/accelerator and brakes that resulted in full throttle acceleration into a parked vehicle. The EDR data for the petitioner's incident shows no recorded service brake application until the airbag module trigger point (t = 0s).\9\ This indicates that the brake switch was ON immediately after impact, but does not indicate the degree or duration of brake application. The fact that the EDR showed a nominal 3.8 mph increase in vehicle speed in the last 1.8 seconds of recording, and subsequent vehicle testing found the brakes to be fully functional, indicates that no meaningful braking occurred prior to impact. Based on the vehicle speeds recorded just prior to impact (t = -0.8 s), the Corolla was less than a car length from the parked vehicle and traveling 7 to 9 feet per second with no indication of service brake application. Based on the vehicle [[Page 27838]] speed and the driver's stated braking habits, initiation of braking would be expected when the vehicle is about a full car length or more from the intended stopping point. Based upon all of these factors, ODI does not believe that the brake switch data recorded by the EDR is consistent with the petitioner's statement that the vehicle accelerated with the brake applied and vehicle testing demonstrated that acceleration would not occur if the brake pedal had been applied with any meaningful force. --------------------------------------------------------------------------- \9\ Airbag deployment software is triggered within 1ms of the airbag module sensing a longitudinal deceleration of about 2 g's (``algorithm enable''). The time interval between impact and airbag algorithm enable is very short, with the precise time depending upon specific crash dynamics. --------------------------------------------------------------------------- In addition, although the EDR does not show any increase in accelerator pedal voltage in the final 2.8 seconds prior to impact, this does not mean that the accelerator pedal was not depressed during that time period. According to Toyota, ``The increase in the vehicle speed and engine speed prior to impact is consistent with an accelerator pedal being depressed between the recorded data points but not recorded by the EDR.'' VRTC testing confirmed that a short and rapid application of the accelerator could: (1) Fail to be recorded by the EDR based on the asynchronous update rates of the CAN bus signals and the relatively slow sampling rate used by the EDR; and (2) produce the engine and vehicle speed changes recorded by the EDR at t = 0.0 s. 3.1.3 VRTC Vehicle Evaluation/Testing Following detailed instructions provided by the petitioner regarding the conditions of the surging during the parking maneuvers, VRTC performed over 2,000 miles of test driving while evaluating the petitioner's accident and the vehicle itself. The testing did not produce any unusual performance of the throttle or transmission systems. In addition, testing of the incident vehicle brake system found that it functioned normally and could hold the vehicle stationary with the engine at 2,000 RPM with less than 15 lb of pedal pressure applied to the brakes. The brakes could also hold the vehicle stationary at full throttle with less than 20 lb of force applied to the brake pedal. Testing also showed the vehicle's brakes could bring it to a full stop in less than three feet at the speeds provided in the petitioner's account of the crash. The petitioner also alleged that uncommanded, short-duration throttle surges occurred in the Corolla during certain decelerations from highway speed. VRTC also conducted testing to try to reproduce this phenomenon but did not observe any unusual performance or symptoms associated with harsh downshifting or changes in torque converter clutch status. Drivers that use light braking during coasting decelerations are likely to be more sensitive to certain transmission shift transients that are triggered by brake application (e.g., torque converter un-lock), that may not be noticed by drivers who use more brake pedal force. However, such transients have very brief durations, involve minor changes in vehicle deceleration and are normal operating characteristics of automatic transmission vehicles that do not represent an unreasonable risk to motor vehicle safety. Furthermore, ODI does not consider the coast down condition reported by the petitioner to be related to the surging alleged in the accident, which did not involve transmission shifting. 3.2 NHTSA Investigations of Low-Speed Surges The petitioner claims that NHTSA has never investigated low-speed surges in Toyota vehicles. This is incorrect. NHTSA has investigated complaints alleging low-speed surges in Toyota vehicles equipped with ETCS-i for over 10 years, starting with a defect petition (DP03-003) in 2003. Altogether, ODI completed 5 defect petition evaluations and 1 investigation (PE04-021) related to allegations of low-speed surging in Toyota vehicles equipped with ETCS-i prior to the joint study of the issue initiated by NHTSA and NASA in 2010.\10\ --------------------------------------------------------------------------- \10\ DP03-003, DP04-003, PE04-021, DP05-002, DP06-003 and DP08- 001 all included examination of alleged vehicle accelerations from low-speeds. --------------------------------------------------------------------------- Low-speed surges were the primary focus of the study by NHTSA and NASA in 2010. As clearly stated in the Executive Summary of NHTSA's February 2011 report from this study: Both [NHTSA and NASA] also noted that the vast majority of complaints involved incidents that originated when the vehicle was stationary or at very low speeds and contained allegations of very wide throttle openings, often with allegations that brakes were not effective. NHTSA's analysis indicated that these types of complaints generally do not appear to involve vehicle-based causes and that, where the complaint included allegations that the brakes were not effective or that the incident began with a brake application, the most likely cause of the acceleration was actually pedal misapplication (i.e., the driver's unintended application of the accelerator rather than, or in addition to, the brake.) The results of NHTSA's field inspections of vehicles involved in alleged UA incidents during 2010 supported this analysis. Those vehicle inspections, which included objective evidence from event data recorders, indicated that drivers were applying the accelerator and not applying the brake (or not applying it until the last second or so).'' \11\ --------------------------------------------------------------------------- \11\ NHTSA. 2011. Technical Assessment of Toyota Electronic Throttle Control (ETC) Systems. (viii). http://www.nhtsa.gov/PR/DOT-16-11. A review of the NHTSA and NASA reports from the Toyota ETCS-i study show that the petitioner's incident and the other similar incidents presented by the petitioner fall within the scope of the prior work, which concluded that allegations of sudden acceleration from a stop or low-speed with ineffective brakes are most likely caused by pedal error by the driver and not indicative of a vehicle-based defect (unless potential faults are identified in pedal design or in shift-interlock safeguards--for incidents occurring after a shift from Park). 3.3 Software Theories The petition states that ``the observations of software expert Michael Barr suggest that Toyota's electronic architecture has many vulnerabilities'' and concludes that these observations suggest that ``floor mats and sticky accelerator pedals are not the only causes of unintended low-speed surges in Toyota vehicles.'' Before responding to the petitioner's statement regarding recent software theories, ODI first notes that floor mats and sticky pedals have never been considered likely ``causes of unintended low-speed surges in Toyota vehicles.'' Incidents of pedal entrapment by improper or out-of-position floor mats are a severe form of a stuck throttle condition, as they occur after the pedal has intentionally been fully depressed to wide-open throttle (WOT) by the driver, generally during attempted passing maneuvers, accelerations on highway entrance ramps to merge with highway traffic or attempts to maintain speed or accelerate up hills. When the driver releases pressure from the accelerator, the pedal remains stuck at WOT resulting in an incident of high-speed unintended acceleration. The ``sticky pedal'' condition was associated with excessive friction in the accelerator pedal assembly which could develop after the vehicle had been parked overnight in certain environmental conditions (e.g., high relative humidity and cool ambient temperature). A pedal with excessive friction may be slow to return to idle when released by the driver and, in some cases, may stick after being held at a constant position for an extended period of time. This would typically occur during steady-state highway driving (i.e., pedal held at constant position for some period of time) [[Page 27839]] following a morning cold-start and the pedal could ordinarily be returned to idle simply by tapping the accelerator pedal to free the sticking condition. Although ODI is not aware of any crashes or injuries resulting from sticking pedals, the condition has been mistaken for evidence of electronic UA in at least one instance.\12\ --------------------------------------------------------------------------- \12\ Testing conducted by Toyota and observed by NHTSA engineers reproduced the sticking pedal condition in the pedal assembly removed from a MY 2007 Toyota Avalon involved in an incident in January 2010 that was reported by some as evidence of electronic UA (VOQ 10300210). --------------------------------------------------------------------------- With regard to Mr. Barr, ODI is aware that he and other consultants have raised certain software design and electrical architecture issues in the course of civil litigation regarding Toyota ETCS-i vehicles. The petition does not cite, and ODI is unaware of, any instance where Barr or any other consultant postulating that the ETCS-i software is defective has reproduced unintended acceleration in a Toyota ETCS-i vehicle under real-world driving conditions. The petitioner submitted a presentation prepared by Barr regarding his analysis of the software in a 2005 Toyota Camry and cites several opinions contained in that document, but does not identify any specific condition or theory that could result in SA in the subject vehicles.\13\ The Barr presentation summarizes his review of Toyota's ETCS-i source code and a case review of a defect theory he developed as part of a lawsuit relating to a fatal accident in a 2005 Toyota Camry with a 4-cylinder engine. Barr's defect theory involved the suspension of a specific operating system task that performs multiple throttle control and failsafe functions in the Toyota ETCS-i source code (Task X death). Task X death would result in the throttle remaining stuck at the last computed throttle command, but would be terminated by any transition in brake switch status.\14\ --------------------------------------------------------------------------- \13\ For example, the petitioner cited Barr's opinions that ``Toyota's ETCS source code is of unreasonable quality'' and ``Toyota's source code is defective and contains bugs, including bugs that can cause unintended acceleration.'' \14\ Any transition in brake switch status would result in a discrepancy between brake status recognized by the Main CPU, which would be frozen by the task death, and the Sub-CPU which would continue to receive actual brake status voltage from the stop lamp switch (``brake echo check''). This would trigger failsafe operation with throttle opening limited to less than 10 degrees and set a fault code. --------------------------------------------------------------------------- We note that the Corolla vehicles that are the subject of this petition are equipped with engine control modules (ECM's) supplied by Delphi, while Barr's task death theory applies to Toyota Camry vehicles equipped with Denso modules. The Delphi modules contain different source code with different task and stack monitoring functionality than the Denso modules and, hence, do not contain substantially similar software. It is therefore reasonable to conclude that the theories and mechanisms advanced by Mr. Barr in regard to the software employed in the Denso throttle controls are inapplicable to the petitioner's vehicle. Nonetheless, since the low-speed surge incidents that are the subject of the petition are similar to the SA crash incidents reported in other Toyota vehicles, regardless of throttle control technology or ECM supplier, ODI offers the following assessment of the Barr task death theory submitted by the petitioner: No specific defect identified--Barr identifies a number of issues with Toyota's ETCS-i software and electrical architecture, including several potential failure mechanisms that he speculates could result in task death.\15\ However, as stated in his ``Case Specific Opinions'' slide [54], he ``cannot identify with 100% certainty the specific software defects'' responsible for the UA incident. ODI sees no factual basis for assigning any level of probability to his theories. --------------------------------------------------------------------------- \15\ For example, Barr speculated that memory corruptions resulting from stack overflow or unidentified software bugs could result in task death and other negative effects. --------------------------------------------------------------------------- Not reproduced--Barr does not identify any specific software states or vehicle operating conditions necessary for any of the failure mechanisms to occur and has not reproduced a task death or any other software failure resulting in SA in real world driving conditions.\16\ --------------------------------------------------------------------------- \16\ Barr's only testing of Task X death involved a fault injection method, performed with Toyota's assistance, to artificially induce task deaths to study system and failsafe performance. There is no evidence of any scenario in which the ``brake echo check'' failed to cut power to the throttle after brake switch transition during this testing. --------------------------------------------------------------------------- Untestable--Rather than identifying the specific conditions necessary for theoretical software failures to occur, Barr and other proponents of the theory have suggested that such failures cannot be reproduced because ``the test space is effectively infinite'' resulting in ``too many possible tests.'' \17\ This precludes any scientific evaluation of the validity of such theories.\18\ --------------------------------------------------------------------------- \17\ In ODI's investigations of defects involving embedded control system faults, either VRTC, the manufacturer, or the supplier have been able to: (1) Identify the specific operating conditions necessary to produce the fault through field data analysis, system review and testing; and (2) reproduce the conditions to duplicate the faults in vehicle testing. \18\ Theories of electromagnetic interference (EMI) effects on ETC or cruise control systems as causes of SA incidents have included similar claims regarding testability. No EMI theories have ever been duplicated in a vehicle and no specific source or path for the interference has been identified. --------------------------------------------------------------------------- Fault injection did not produce SA--When Task X deaths were reproduced by fault injection, they did not result in sudden increases in throttle opening or any loss of brake effectiveness. Incidents that begin when the brake is not applied result in loss of power to the throttle when the brake is applied and incidents that begin with the brake already applied would, necessarily, involve low severity because the engine would be frozen at idle.\19\ Table 1 describes throttle and brake responses for each of the initial condition pedal state scenarios associated with Task X death. The risk of uncontrolled acceleration, crash or injury would be low and complaints associated with such incidents would be more likely to cite loss of power or stalling than uncontrolled engine power. --------------------------------------------------------------------------- \19\ With regard to the potential for more severe failure modes associated with Task X death, Barr further speculates that one memory corruption event ``can cause task death and open [the] throttle'' and that the brake echo check may not always cut power to the throttle. He states that ``memory corruptions are like ricocheting bullets'' that may result in more severe effects. However, these theories have never been demonstrated in any testing nor were they observed during fault injection tests conducted to observe system performance with artificially induced task death. Table 1--Task X Death Scenarios ------------------------------------------------------------------------ Initial conditions Throttle and brake symptoms ------------------------------------------------------------------------ Foot on the accelerator pedal.......... Throttle stuck at last computed throttle command. Brake application cuts power to the throttle. Foot on the brake pedal................ Throttle is initially stuck at idle. Normal braking (brake release cuts power to the throttle). Foot on neither pedal.................. Throttle is initially stuck at idle. [[Page 27840]] Brake application cuts power to the throttle. ------------------------------------------------------------------------ No evidence in field data--The fault injection testing did not reproduce an SA, but it did demonstrate that failures related to Task X death would result in a very specific set of symptoms that can be used to identify potentially relevant incidents in field data, such as: (1) Allegations of unresponsive accelerator pedals that do not increase or decrease engine power when the driver presses or releases the pedal; (2) allegations of vehicles suddenly losing power when the brake is applied; and (3) fault codes associated with ``brake echo check'' failsafe operation. ODI's analyses of complaints and warranty data have not revealed any sign of these symptoms in any Toyota ETCS-i vehicles. Not consistent with reported SA--Incidents of sudden acceleration also involve very specific symptom patterns, including: (1) Primarily occurring in low-speed driving maneuvers in parking lots and driveways, as well as other driving maneuvers associated with required brake application (see Table 3); (2) reports of sudden increases in engine power allegedly initiated by application of the brake; and (3) the allegations of brake ineffectiveness in the same complaints. None of the software task death theories postulated by Barr fit or otherwise explain these patterns. The same patterns and vehicle dynamics are evident in the large volume of crashes in which pedal misapplication has been identified as the undisputed cause (see section 3.5, Low-speed surge hazards). ODI has observed these patterns in SA complaints in investigations and research covering nearly 40 years and involving vehicles with all forms of throttle control, both mechanical and electronic. Brake effectiveness--None of the electronic theories reviewed by ODI explain how pressing on the ``brake'' would result in a sudden increase in engine power as alleged in SA complaints, nor do they explain why the brakes would suddenly lose effectiveness at the same time as the engine power surge.\20\ --------------------------------------------------------------------------- \20\ Pressing the brake pedal with a nominal force of 40 lbs or less would produce sufficient braking torque to overcome full/ maximum drivetrain torque in all vehicles that have been evaluated by ODI to date. --------------------------------------------------------------------------- Different software--As noted above, the Corolla vehicles at issue in this petition are equipped with ECM's supplied by Delphi, while Barr's task death theory applies to certain Toyota Camry vehicles equipped with Denso modules. The Delphi modules contain different system monitoring functionality than the Denso modules and, hence, do not contain substantially similar software. Pedal error not excluded--As Barr indicated in a slide titled ``Other Similar Incident Criteria [55],'' evidence contradicting correct use of pedals is one factor that would exclude his theories from consideration. As outlined in Section 3.4 of this report, Other Similar Incidents, the available EDR data for the subject vehicles does provide evidence contradicting the correct use of pedals. 3.4 Other Similar Incidents The petitioner states: ``I reviewed the complaints made to NHTSA by owners of 2006-2010 Toyota Corollas [and] found 163 reports in which the driver experienced a surge at low speed or no speed; 99 drivers mentioned that the brakes were already depressed when the surge occurred or the surge occurred when the brakes were depressed; 83 incidents resulted in crashes.'' ODI provided copies of the 163 VOQs noted by the petitioner to Toyota and requested complaint, warranty, inspection and EDR information about each vehicle (``subject vehicles''). Using information supplied by Toyota, the VOQ text, and any supporting or additional information (e.g., law enforcement crash reports, repair orders from dealers or independent repair facilities, photographs, interviews with complainants and/or complainants' families,\21\ witness statements, letters to elected representatives, letters to NHTSA, etc.) ODI analyzed the petitioner's incident and the 163 VOQs reporting similar incidents as alleged by the petitioner. Six of the VOQs are duplicate submissions, resulting in a total of 158 unique vehicles. ODI's analysis of these complaints is summarized in Table 2, which groups the complaints in three major categories.\22\ The categories are based on ODI's analysis of all available information and not solely on the initial VOQ complaint text. --------------------------------------------------------------------------- \21\ Three complainants were now deceased and in some cases the complainant was not the driver at the time of the incident. \22\ An itemization of VOQ number by Category is provided in the closing resume for this investigation, which can be obtained at www.safercar.gov. Table 2--ODI Analysis of Petitioner Selected VOQ's ---------------------------------------------------------------------------------------------------------------- Supported by Category Description of category Number of VOQs Number of EDR pre-crash crashes data ---------------------------------------------------------------------------------------------------------------- A.................................. There is an alleged 105 93 17 increase in engine power in which the brakes are allegedly unable to control: Incidents are caused by pedal misapplication or by a late braking effort of the driver. B.................................. Dual pedal application: The 28 2 0 driver inadvertently applied both the brake and the accelerator simultaneously during the event. C.................................. Incidents that do not fit 25 10 0 the alleged defect of ``engine surge in which the brakes fail to stop the vehicle in time to prevent a crash.''. ---------------------------------------------------------------------------------------------------------------- Category A: Category A complaints are those alleging simultaneous failures of the vehicle's braking ability and a sudden increase in engine power that the driver did not request by pressing on the accelerator pedal, with no evidence [[Page 27841]] of brake system malfunction observed in post-incident inspections/ testing. These complaints fit the definition of ``sudden acceleration'' incident allegations as described in the background section of this report and fall within the scope of the petitioner's allegations. As discussed in previously in this report, these incidents fit the profile of pedal misapplications. Again quoting from the from the 2012 TRB report reviewing ODI's processes for investigating unintended acceleration: ``investigating for phenomena other than pedal misapplication absent an explanation for the ineffectiveness of the brakes, which are independent of the throttle control system and are designed to dominate engine torque, is not likely to be useful. [164]'' As further confirmation of this assessment, some of the VOQs submitted by the petitioner had pre-crash EDR data available that show brake status, accelerator pedal voltage, engine speed and vehicle speed in the 5 seconds prior to the time of the collision trigger (if it was on a model year 2009 or later Corolla). This information, together with other relevant facts (e.g., law enforcement reports, accident reconstruction, witness interviews), can be compared to the driver's statement regarding the use of foot controls and their alleged effectiveness prior to the collision. Table 3--Summary of Incidents with Pre-Crash EDR Data ---------------------------------------------------------------------------------------------------------------- ODI brake category A-- Case No. VOQ No. Incident T-5 speed misapply B-- Summary of driver date (mph) late apply C-- allegation no apply ---------------------------------------------------------------------------------------------------------------- 1........................... 10534094 Sep-11...... 45 B Driving at night in rain, released accelerator, departed road, crashed into tree. 2........................... 10334936 May-10...... 31 A Approaching stop sign, applied brake, accelerated into fence. 3........................... 10363685 Oct-10...... 31 C Approaching stop sign, applied brake, accelerated into utility pole. 4........................... 10523677 May-13...... 20 A Approaching intersection, applied brake, accelerated into tree. 5........................... 10352668 Mar-09...... 11 A Entering parking space, applied brake, accelerated into parked vehicle. 6........................... 10479582 Oct-12...... 10 A Entering parking space, applied brake, accelerated into building. 7........................... 10369494 Nov-10...... 8 A/B Entering parking space, applied brake, accelerated into concrete post. 8........................... 10344874 Jul-10...... 6 A Entering driveway, applied brake, accelerated into iron fence. 9........................... 10363886 Sep-10...... 6 A/B Entering parking space, applied brake, accelerated into building. 10.......................... 10520195 Jun-13...... 6 A/B Entering parking space, applied brake, accelerated over two curbs. 11.......................... 10551478 Oct-13...... 5 A Entering parking space, applied brake, accelerated into dumpster. 12.......................... 10597296 May-14...... 4 A Entering parking space, applied brake, accelerated into parked vehicle. 13 *........................ 10637908 Jun-14...... 4 A/B Entering parking space, applied brake, accelerated into parked vehicle. 14.......................... 10507434 Apr-13...... 2 A Entering parking space, applied brake, accelerated into building. 15.......................... 10552563 Oct-13...... 1 A Entering parking space, applied brake, accelerated into parked vehicle. 16.......................... 10578871 Apr-14...... 1 A Backing from parking space, lightly pressed accelerator, accelerated into vehicle. 17.......................... 10447756 Jan-12...... 0 A Exiting parking space, applied brake, accelerated into brick wall. ---------------------------------------------------------------------------------------------------------------- * petition incident. Table 4--Summary of Brake and Accelerator Pedal Use in Incidents With Pre-Crash EDR Data.23 -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- T-5 Brake switch status by EDR time interval Accelerator pedal apply status by EDR time interval Case No. speed --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- (mph) -5 -4 -3 -2 -1 0 -5 -4 -3 -2 -1 0 -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- 2.............................. 31 Off............... Off............... Off............... Off............... Off.............. Off.............. High............. High............. High............. High............. High............. High 6.............................. 10 Off............... Off............... Off............... Off............... Off.............. Off.............. Low.............. High............. High............. High............. High............. High 4.............................. 20 Off............... Off............... Off............... Off............... Off.............. Off.............. Low.............. Off.............. Low.............. High............. High............. High 16............................. 1 Off............... Off............... Off............... Off............... Off.............. Off.............. Low.............. Low.............. Low.............. Med.............. High............. High 14............................. 2 Off............... Off............... Off............... Off............... Off.............. Off.............. Low.............. Low.............. Low.............. Low.............. High............. High 8.............................. 6 Off............... Off............... Off............... Off............... Off.............. Off.............. Off.............. Off.............. Off.............. Off.............. High............. High 12............................. 4 Off............... Off............... Off............... Off............... Off.............. Off.............. Low.............. Low.............. Low.............. Low.............. High............. Off 15............................. 1 Off............... Off............... Off............... Off............... Off.............. Off.............. Off.............. Off.............. Low.............. Low.............. Low.............. High 10............................. 6 Off............... Off............... Off............... Off............... Off.............. On............... Low.............. Low.............. Off.............. Low.............. High............. Off 11............................. 5 Off............... Off............... Off............... Off............... Off.............. Off.............. Off.............. Off.............. Off.............. Off.............. Off.............. High 5.............................. 11 Off............... Off............... Off............... Off............... Off.............. Off.............. Med.............. Med.............. Med.............. Med.............. Med.............. Med 17............................. 0 Off............... Off............... Off............... Off............... Off.............. Off.............. Low.............. Low.............. Low.............. Low.............. Low.............. Med 7.............................. 8 Off............... Off............... Off............... Off............... Off.............. On............... Low.............. Low.............. Low.............. Low.............. Med.............. Off 1.............................. 45 Off............... Off............... Off............... Off............... On............... On............... Low.............. Low.............. Low.............. Low.............. Off.............. Off 9.............................. 6 Off............... Off............... Off............... Off............... Off.............. On............... Off.............. Off.............. Off.............. Off.............. Low.............. Off 13 *........................... 4 Off............... Off............... Off............... Off............... Off.............. On............... Off.............. Off.............. Low.............. Off.............. Off.............. Off [[Page 27842]] 3.............................. 31 Off............... Off............... Off............... Off............... Off.............. Off.............. Off.............. Off.............. Off.............. Off.............. Off.............. Off -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- * petition incident. Summaries of the 17 crash incidents in which pre-crash EDR was available are provided in Tables 3 and 4. Table 3 provides a summary of the speeds the vehicles were traveling approximately 5 seconds prior to the collision events, ODI's assessment of the causes, and the incident driver's allegation of the sequence of events leading to the collision. Thirteen (13) of the incidents involved vehicles travelling at low- speeds in parking lot maneuvers, including 11 that occurred while parking the vehicle. Fifteen (15) of the incidents alleged that the acceleration began after the brake was applied.\24\ These data are consistent with EDR data collected during the prior Toyota study in 2010, which included 39 incidents assessed as pedal misapplications due to no brake application or late braking, including 29 that initiated in parking lots or at low speeds. --------------------------------------------------------------------------- \23\ EDR reports with accelerator pedal data shown as voltage readings from 0.78 to 3.70V were converted as follows: Off = 0.78V; Low = 0.79 to 1.75V; Medium = 1.76 to 2.72V; and High = 2.73V and above. \24\ See supplemental report in the public file for this investigation (www.safercar.gov) for a discussion of some of the EDR downloads and associated VOQs, Supplemental Report, DP14-003, EDR Examples. --------------------------------------------------------------------------- ODI's assessments were based on the EDR download data and all available supporting information, as to the cause of the unintended acceleration event, i.e., a pedal misapplication, a braking that occurred too late to in the event to effectively stop the vehicle in time (driver error), a combination of both, and in one case no application of accelerator or brake. Table 4 provides the EDR download information for brake and accelerator pedal information for the individual incidents. Twelve incidents showed no evidence of braking during the crash event, 4 do not show braking until the airbag trigger point, t = 0, and the final incident involved late transition from accelerator to brake for a vehicle travelling over 40 mph (Case #1). These incidents are a representative sampling of the incidents alleging low-speed surging with ineffective brakes and demonstrate that driver statements regarding pedal use in such incidents are not reliable. It should be emphasized that in order for these 105 VOQs to be included in this category there must have been an alleged concurrent failure or weakness of the throttle and braking systems. No mechanism has been identified that could cause a sudden failure of both systems. No evidence of throttle or brake system faults were found in post- incident inspections of these vehicles and there is no indication of faults in those systems in the available service histories before and after the events. Based on this analysis, ODI does not believe there is evidence of a vehicle based defect in this category of complaints. Category B: Category B complaints are incidents involving allegations of engine racing or surging during brake application. These incidents do not allege brake ineffectiveness and are therefore not within the scope of the petitioner's alleged defect. The common explanation for complaints alleging engine racing or surging during brake application is that the driver is inadvertently applying both the brake and accelerator pedals when intending to only apply the brake. This is particularly evident in complaints that indicate that engine races faster when the brake is pressed harder.\25\ --------------------------------------------------------------------------- \25\ These complaints further demonstrate the effectiveness of the brakes in overcoming engine power. --------------------------------------------------------------------------- Several drivers recognized that inadvertently stepping on both pedals was the cause of the engine surging they reported, either in the initial complaint or in subsequent interviews with ODI. For example, in a follow-up interview one owner (VOQ 10363529) noted that after a few incidents, ``I realized in that case that my foot was on both the brake and the accelerator. This may have been carelessness on my part. However, it being a compact car, the brake is very close to the accelerator. Perhaps closer that the other cars that I drive or have driven. No one else in our family has reported unintended acceleration with this car.'' A variation of dual application that increases the potential severity of such incidents involves unsecured floor mats that slide forward into a position where they can impede brake application. ODI identified two crashes involving drivers who had floor mats that had moved forward over the accelerator pedal and under the brake pedal such that when the brake pedal was applied the force was transferred through the floor mat to the accelerator pedal (in one case it was an aftermarket floor mat plus a bathroom rug). Category C: Category C complaints are incidents that do not fit the alleged defect of ``engine surge in which the brakes fail to stop the vehicle in time to prevent a crash.'' Examples are instances of high idle at initial startup, transmission shift flares or delays in coast down idle. Two of the crashes in this category were due to vehicles being struck by following traffic which then propelled the vehicles forward uncontrollably. Four of the crashes were due to a lack of brake effectiveness, such as a soft brake pedal, without any corresponding engine surge, three of the crashes were due to the driver applying the accelerator pedal too aggressively without any brake application, and one crash was due to a medical condition experienced by the driver. 3.5 Low-Speed Surge Hazards ODI agrees that uncontrolled vehicle accelerations in parking lot environments represent a clear safety hazard to surrounding traffic, pedestrians and even building occupants, as vehicles often accelerate inside of businesses with facing parking spaces where they have caused serious and sometimes fatal injuries. However, investigations have shown that these incidents are not isolated to any particular makes or models of vehicles and rarely have any vehicle based defects been identified in the throttle or brake systems in post-incident inspections. As background, to put ODI complaints of low-speed surging during brake application in context, separate research conducted for NHTSA by the Highway Safety Research Center to examine the prevalence of crashes caused by pedal application errors found that they occur more frequently than is generally known and exhibit many of the same characteristics as the SA complaints received by ODI, although in much greater numbers. The study included a review of North Carolina state crash database records, which identified 2,411 [[Page 27843]] self-reported pedal misapplication crashes between 2004 and 2008, an average of approximately 480 per year.\26\ --------------------------------------------------------------------------- \26\ Lococo, K., Staplin, L., Martell, C., and Sifrit, K. 2012. Pedal Application Errors. Report DOT-HS-811-597. TransAnalytics, LLC and Highway Safety Research Center, U.S. Department of Transportation. www.nhtsa.gov/staticfiles/nti/pdf/811597.pdf. --------------------------------------------------------------------------- Projected nationally, the North Carolina data predict over 16,000 pedal error crashes per year, or about 44 incidents per day. These pedal error crash counts are likely conservative, since they are limited to self-reported incidents that were documented in law enforcement accident reports. The total number of pedal error incidents, including those in which the driver is not aware of the error (such as the petitioner's incident) are unknown and the there is no systematic process or database in the United States for tracking such events. An April 2012 summary of the study notes that 57 percent of pedal error crashes identified in the study occurred in parking lots or driveways, which projects to over 9,000 incidents per year in those driving environments nationwide.\27\ --------------------------------------------------------------------------- \27\ NHTSA. 2012. Pedal Error Crashes. Report DOT-HS-811-605. Traffic Tech. U.S. Department of Transportation. (1). www.nhtsa.gov/staticfiles/traffic_tech/811605.pdf. --------------------------------------------------------------------------- In addition, the Storefront Safety Council, an independent private organization focused on safety hazards associated with vehicle into building crashes, estimates that over 20,000 such crashes occur annually in the U.S. (60 per day), resulting in over 4,000 injuries and as many as 500 deaths.\28\ The Storefront Safety Council identifies pedal error as the number one cause of these crashes at 35 percent (other causes include other types of operator error, such as confusing Drive and Reverse, impaired driving, medical conditions and deliberate building intrusions). --------------------------------------------------------------------------- \28\ Storefront Safety Council--working to end vehicle into building crashes. http://www.storefrontsafety.org/. --------------------------------------------------------------------------- These data indicate that pedal error crashes are much more common than previously known, even well after the implementation of brake shift interlocks. The patterns associated with these incidents are similar to complaints to ODI and manufacturers alleging SA incidents when analyzed by: (1) Location; (2) vehicle dynamics; (3) driver demographics; and (4) vehicle design. Both occur predominantly in parking lots and driveways; both involve sudden increases in engine power, unchecked by braking, and coinciding with intended application of the brake; both disproportionately involve younger and older drivers; and both have occurred in vehicles with all forms of throttle and cruise control systems. As previously noted, the incidents were initially observed by ODI in vehicles with purely mechanical throttle control and no cruise control in the earliest years of NHTSA's safety defect enforcement program (EA78-010). [GRAPHIC] [TIFF OMITTED] TN14MY15.009 Complaints to ODI alleging SA related crashes are far less common. In the same period from 2004 through 2008 that the pedal error study identified over 2,400 pedal error related crashes in North Carolina police reports, ODI received less than 40 complaints alleging SA crashes in North Carolina in all light vehicles--or less than 2 percent of the number of crash incidents identified in the pedal error study. However, publicity can significantly increase ODI complaint volumes, as is evident for Toyota Corolla vehicles equipped with ETCS-i, which saw a 7,900% increase in speed control complaints alleging crashes and a 12,800% increase in total speed control complaints from the first quarter of 2009 to the first quarter of 2010, after news media coverage of Toyota's pedal entrapment and sticky pedal recalls (Figure 2). Each of these factors, as well as the incident characteristics used for identifying complaints likely to be related to a common cause (see Section 2.1, Definitions), must be considered before conducting any analysis of, or drawing any conclusions regarding, SA rates or trends based strictly upon ODI complaint data. These data support the petitioner's claim that uncontrolled vehicle accelerations in parking environments are a public safety issue but are not evidence of a motor vehicle defect and, therefore, do not support the opening of a defect investigation. 4.0 Conclusion In our view, a defects investigation is unlikely to result in a finding that a defect related to motor vehicle safety [[Page 27844]] exists or a NHTSA order for the notification and remedy of a safety- related defect as alleged by the petitioner at the conclusion of the requested investigation. Therefore, given a thorough analysis of the potential for finding a safety related defect in the vehicle and in view of the need to allocate and prioritize NHTSA's limited resources to best accomplish the agency's safety mission and mitigate risk, the petition is respectfully denied. This action does not constitute a finding by NHTSA that a safety-related defect does not exist. The agency will take further action if warranted by future circumstances. Authority: 49 U.S.C. 30162(d); delegations of authority at 49 CFR 1.50 and 501.8. Frank S. Borris, II, Acting Associate Administrator for Enforcement. [FR Doc. 2015-11632 Filed 5-13-15; 8:45 am] BILLING CODE 4910-59-P
![Federal Register / Vol. 80, No. 93 / Thursday, May 14, 2015 / Notices 27835
DEPARTMENT OF TRANSPORTATION experienced by his wife in their model petitioner’s interpretation of pre-crash
year (MY) 2010 Toyota Corolla, the data downloaded from the vehicle Event
National Highway Traffic Safety latest of which resulting in a crash into Data Recorder (EDR) by Toyota field
Administration a parked vehicle on June 8, 2014. Mr. inspectors:
Ruginis makes the following claims in The EDR investigation report clearly
Denial of Motor Vehicle Defect Petition support of his petition: (1) The Event showed that at the moment the airbag
AGENCY: National Highway Traffic Data Recorder (EDR) readout of his module made the decision whether to deploy
Safety Administration, (NHTSA), wife’s crash supports her account of (about the time of impact), the voltage to the
Department of Transportation. vehicle acceleration after she applied accelerator pedal was .78 (at idle), the brake
the brake; (2) NHTSA has never was engaged, yet both the speed of the
ACTION: Denial of a petition for a defect vehicle and engine RPM’s had doubled in
investigation. investigated surges in low-speed crashes
in Toyota vehicles; (3) a software expert less than 2 seconds.
SUMMARY: This notice sets forth the has identified vulnerabilities in Toyota’s Mr. Ruginis provided copies of the
reasons for denying a petition (DP14– ETCS-i source code; (4) there are other police report for the accident, the EDR
003) submitted to NHTSA 49 U.S.C. similar incidents of ‘‘surge at low speed report, and a list of ODI complaints
30162, 49 CFR part 552, requesting that or no speed’’ in Toyota Corolla vehicles (VOQs) that he considered similar to his
the agency open ‘‘an investigation into in NHTSA’s consumer complaint wife’s experience in the crash and in
low-speed surging in the 2006–2010 database; and (5) surges in low-speed prior driving experience. He provided
Toyota Corolla [vehicles] with ETCS-i, parking scenarios are a safety problem. the following five reasons supporting an
in which the brakes fail to stop the NHTSA has reviewed the material ODI investigation of the alleged defect
vehicle in time to prevent a crash.’’ cited by the petitioner. The results of in the MY 2006 through 2010 Toyota
FOR FURTHER INFORMATION CONTACT: Mr. this review and our analysis of the Corolla vehicles:
Stephen McHenry, Vehicle Control petition’s merits are set forth in the 1. The EDR results suggest that unsafe
Division, Office of Defects Investigation, DP14–003 Petition Analysis Report, and unexpected surges can occur even
NHTSA, 1200 New Jersey Avenue SE., published in its entirety as an appendix when the driver’s action is to apply the
Washington, DC 20590. Telephone 202– to this notice. brake;
366–4883. Email stephen.mchenry@ For the reasons presented in the 2. NHTSA has never investigated
dot.gov. petition analysis report after a thorough surges in low-speed crashes in Toyotas;
assessment of the potential risks to 3. The observations of software expert
SUPPLEMENTARY INFORMATION: Michael Barr suggest that Toyota’s
safety, it is unlikely that an order
1.0 Introduction concerning the notification and remedy electronic architecture has many
of a safety-related defect would be vulnerabilities;
Interested persons may petition 4. Unintended surges in low-speed
NHTSA requesting that the agency issued as a result of granting Mr.
Ruginis’s petition. After full parking scenarios are common; and
initiate an investigation to determine 5. Surges in low-speed parking
whether a motor vehicle or item of consideration of the potential for
finding a safety related defect in the scenarios are a safety problem.
replacement equipment does not In evaluating the petitioner’s
comply with an applicable motor vehicle and in view of the need to
allegations and preparing a response,
vehicle safety standard or contains a allocate and prioritize NHTSA’s limited
ODI:
defect that relates to motor vehicle resources to best accomplish the • Reviewed the petition request and
safety. 49 U.S.C. 30162(a)(2); 49 CFR agency’s mission, the petition is submitted appendices, interviewed the
552.1. Upon receipt of a properly filed respectfully denied. petitioner and his wife—who was the
petition the agency conducts a technical Appendix—Petition Analysis—DP14– primary driver and who was driving
review of the petition, material 003 when the crash occurred.
submitted with the petition, and any • Provided the 163 VOQs submitted
1.0 Introduction
additional information. 49 U.S.C. by the petitioner to Toyota, formally
30162(c); 49 CFR 552.6. After On September 12, 2014, the National requested Toyota to provide full
considering the technical review and Highway Traffic Safety Administration warranty claim histories for throttle and
taking into account appropriate factors, (NHTSA) received a September 11, braking systems on the subject vehicles,
which may include, among others, 2014, letter from Mr. Robert Ruginis as well as copies of all reports made to
allocation of agency resources, agency petitioning the agency ‘‘for an Toyota by the complainants or by
priorities, and the likelihood of success investigation into low-speed surging in dealership or Toyota technical
in litigation that might arise from a the 2006–2010 Toyota Corolla [vehicles] personnel related to the complaints,
determination of a noncompliance or a with ETCS-i, in which the brakes fail to field inspection data, and all related
defect related to motor vehicle safety, stop the vehicle in time to prevent a EDR download data obtained by Toyota
the agency will grant or deny the crash.’’ The letter provides the following collected from vehicles identified in
petition. 49 U.S.C. 30162(d); 49 CFR basis for the request: incidents reported in the subject vehicle
552.8. This request is based on first-hand VOQs.
experience in which multiple low-speed • Requested technical and
2.0 Petition Background Information
surge events that occurred while driving our engineering information from Toyota
In a letter dated September 11, 2014, 2010 Corolla. The latest incident resulted in related to the alleged defect as
Mr. Robert Ruginis requested that a crash on June 8, 2014. In addition to the submitted by the petitioner.
• Analyzed the information provided
tkelley on DSK3SPTVN1PROD with NOTICES
NHTSA open ‘‘an investigation into evidence from our crash incident, we are
low-speed surging in the 2006–2010 providing evidence that many other Corolla by Toyota in response to our specific
Toyota Corolla [vehicles] with ETCS-i, owners are experiencing similarly unsafe requests for information.
in which the brakes fail to stop the scenarios that are leading to crashes. • Reviewed previous analysis and
vehicle in time to prevent a crash.’’ Mr. The petition letter provides investigative work into unintended
Ruginis based his request upon multiple information regarding the June 8, 2014, acceleration done by NHTSA, the
low-speed ‘‘surge events’’ allegedly crash incident, including the National Aeronautics and Space
VerDate Sep<11>2014 17:59 May 13, 2015 Jkt 235001 PO 00000 Frm 00208 Fmt 4703 Sfmt 4703 E:\FR\FM\14MYN1.SGM 14MYN1](https://thefederalregister.org/doc/80_FR_27928/page/1.svg)
![27836 Federal Register / Vol. 80, No. 93 / Thursday, May 14, 2015 / Notices
Administration, and the National accelerator pedal is released by the contributing to the problem. The Study
Academy of Sciences as well as papers driver. Stuck throttle defects generally re-examined potential causes of SA, as
from the Society of Automotive follow patterns including relatively high well as design factors that may
Engineers related to EDR download data initiation speeds, large accelerator pedal contribute to higher rates of pedal
interpretation and limitations. applications and other driving misapplication. The results of the Study
• Interviewed complainants who had conditions specific to each defect were released in March 1989, in a report
submitted the 163 VOQs noted by the condition. For example, floor mat titled ‘‘An Examination of Sudden
petitioner. Gathered, when possible, law entrapments tend to occur after the Acceleration.’’ 5 With respect to the
enforcement crash reports, insurance driver has intentionally pressed the cause of SA incidents, the Study
reports, repair facility invoices, accelerator pedal to the floor to pass concluded that, absent evidence of a
photographs of crash sites, security vehicles on the highway, merge with throttle, cruise control or brake
camera surveillance video, and any highway traffic or accelerate up hills. malfunction, ‘‘the inescapable
other relevant information related to the Unintended accelerations resulting from conclusion is that these definitely
reported incidents. pedal entrapment involve maximum involve the driver inadvertently
• Acquired the petitioner’s vehicle engine power and often include pressing the accelerator instead of, or in
and transported it to the Vehicle degraded brake effectiveness if the addition to, the brake pedal.’’
Research Test Center (VRTC) in East driver pumps out the reserve vacuum in Because the majority of incidents
Liberty, Ohio, for evaluation. the brake booster, resulting in loss of were associated with accelerations that
2.0 Background power assist to the brakes. If the driver began after the vehicle was started and
is unable to bring the vehicle to a shifted from Park to Drive or Reverse
2.1 Definitions complete stop within the first couple of gear, the most effective countermeasure
The term ‘‘unintended acceleration’’ miles, the brakes will continue to lose for pedal error related SA incidents was
(UA) is often used to generally describe effectiveness due to brake fade or heat the incorporation of brake-shift
any unintended speed increase in a degradation of the friction materials. interlocks to prevent shifting from Park
motor vehicle. This is an extremely when the brake pedal is not depressed.
broad definition that includes some 2.2 Sudden Acceleration Background Shift interlocks were voluntarily
aspects of normal vehicle performance ODI’s first investigation of sudden implemented by most manufacturers in
(e.g., idle speed control and acceleration, EA78–110, opened almost the late-1980’s and early-1990’s and
transmission control), as well as many 40 years ago, covered approximately 60 early studies showed reductions in the
forms of abnormal performance of those million MY 1973 through 1986 General number of SA complaints during this
systems that represent little to no Motors passenger cars. That time period, with the trend driven by
hazards to highway safety (i.e., issues investigation established that sustained, the drop in events occurring
generally described as ‘‘driveability’’ unintended, ‘‘high-power acceleration’’ immediately after shift from Park.6
issues).1 Within the universe of could only be caused by failure Brake shift interlocks have no effect on
unintended acceleration issues that do mechanisms that produced large throttle mitigating pedal errors later in the drive
involve potentially serious safety openings. This finding reduced the cycle (e.g., parking).
hazards, ‘‘sudden acceleration’’ (SA) potential failure modes to defects 2.3 Toyota Investigations and NHTSA/
incidents are the most common and are affecting throttle linkages and cruise NASA Study
defined as allegations of ‘‘unintended, control components. Ninety percent of
unexpected, high-power acceleration the accident vehicles in EA78–110 were From 2003 through 2009, ODI
from a stationary position or a very low examined unintended acceleration
not equipped with cruise control, thus
initial speed accompanied by an issues in Toyota vehicles equipped with
eliminating the only potential electronic
apparent loss of braking effectiveness.’’ 2 ETCS-i in 3 defect investigations and 5
mechanism capable of opening the
This definition was developed in the defect petition evaluations. These
throttle in that investigation.3 The
1980’s, when ODI first began activities prompted 4 safety recalls
investigation was closed in 1986 after
investigating the subject in a large cross- addressing floor mat entrapment, a
eight years of testing and studies,
section of passenger car makes and ‘‘sticky pedal’’ condition, and an
concluding that:
models sold in the U.S., including Audi accelerator pedal interference condition.
Inadvertent and unknowing driver Publicity surrounding a fatal crash in
5000 sedans. application of the accelerator pedal when the
The foregoing definition purposefully August 2009, that was determined to
driver intended to apply the brake [‘‘pedal have been caused by floor mat
excludes ‘‘stuck throttle’’ type incident misapplication’’] appears to be the cause of
symptoms, which involve failure of the entrapment, the ensuing floor mat recall
many of the reported sudden acceleration
throttle to return to idle when the related accidents, even though many of the by Toyota and the ‘‘sticky pedal’’ recall
drivers continue to believe that they had been led to intense media coverage of Toyota
1 ODI’s analysis of warranty data for MY 2002– pushing on the brake pedal.4 unintended acceleration issues and
2010 Toyota Camry vehicles submitted by Toyota possible electronic defects.
as part of RQ10–003, determined that
In October 1987, a little over a year Much of the interest focused on low-
approximately 80 percent of the claims were related after EA78–110 was closed; NHTSA’s speed SA incidents in Toyotas not
to engine or transmission recalibrations to address Administrator ordered an independent included in the floor mat recalls or in
a number of vehicle driveability concerns (e.g., review of SA (the ‘‘Study’’). While the
improving shift feel) as described in a series of recalled vehicles that had clearly not
technical service bulletins, each related to separate phenomena affected all automatic
conditions and vehicle subpopulations. Claim rates transmission-equipped cars sold in the 5 Pollard, J., and E.D. Sussman. 1989. An
were negligible (less than 0.03%) in vehicles with U.S., some had notably higher Examination of Sudden Acceleration. Report DOT–
tkelley on DSK3SPTVN1PROD with NOTICES
no such TSB’s (e.g., MY 2002–2006 Camry L4 with occurrence rates, raising questions about HS–807–367. Transportation Systems Center, U.S.
2AZ–FE engines). Department of Transportation.
2 The definition has been broadened in recent
vehicle design factors that may be 6 Reinhart, W. 1994. The Effect of
years to include incidents occurring in certain on- Countermeasures to Reduce the Incidence of
3 Reinhart, W. 1996. Engineering Analysis Closing
road driving maneuvers that require braking, such Unintended Acceleration Accidents. Paper 94 S5 O
as approaching controlled intersections or highway Report, EA78–110. Washington, DC: NHTSA, (11). 07. Proc., 14th International Technical Conference
exit ramps, but the majority of incidents continue 4 Reinhart, W. 1996. Engineering Analysis Closing on Enhanced Safety of Vehicles, Washington, DC,
to be reported in low-speed parking maneuvers. Report, EA78–110. Washington, DC: NHTSA, (18). Vol. 1, (821–845).
VerDate Sep<11>2014 17:59 May 13, 2015 Jkt 235001 PO 00000 Frm 00209 Fmt 4703 Sfmt 4703 E:\FR\FM\14MYN1.SGM 14MYN1](https://thefederalregister.org/doc/80_FR_27928/page/2.svg)
![27838 Federal Register / Vol. 80, No. 93 / Thursday, May 14, 2015 / Notices
speed and the driver’s stated braking that use light braking during coasting not applying it until the last second or
habits, initiation of braking would be decelerations are likely to be more so).’’ 11
expected when the vehicle is about a sensitive to certain transmission shift A review of the NHTSA and NASA
full car length or more from the transients that are triggered by brake reports from the Toyota ETCS-i study
intended stopping point. Based upon all application (e.g., torque converter un- show that the petitioner’s incident and
of these factors, ODI does not believe lock), that may not be noticed by drivers the other similar incidents presented by
that the brake switch data recorded by who use more brake pedal force. the petitioner fall within the scope of
the EDR is consistent with the However, such transients have very the prior work, which concluded that
petitioner’s statement that the vehicle brief durations, involve minor changes allegations of sudden acceleration from
accelerated with the brake applied and in vehicle deceleration and are normal a stop or low-speed with ineffective
vehicle testing demonstrated that operating characteristics of automatic brakes are most likely caused by pedal
acceleration would not occur if the transmission vehicles that do not error by the driver and not indicative of
brake pedal had been applied with any represent an unreasonable risk to motor a vehicle-based defect (unless potential
meaningful force. vehicle safety. Furthermore, ODI does faults are identified in pedal design or
In addition, although the EDR does not consider the coast down condition in shift-interlock safeguards—for
not show any increase in accelerator reported by the petitioner to be related incidents occurring after a shift from
pedal voltage in the final 2.8 seconds to the surging alleged in the accident, Park).
prior to impact, this does not mean that which did not involve transmission
the accelerator pedal was not depressed 3.3 Software Theories
shifting.
during that time period. According to The petition states that ‘‘the
Toyota, ‘‘The increase in the vehicle 3.2 NHTSA Investigations of Low- observations of software expert Michael
speed and engine speed prior to impact Speed Surges Barr suggest that Toyota’s electronic
is consistent with an accelerator pedal architecture has many vulnerabilities’’
The petitioner claims that NHTSA has
being depressed between the recorded and concludes that these observations
never investigated low-speed surges in
data points but not recorded by the suggest that ‘‘floor mats and sticky
Toyota vehicles. This is incorrect.
EDR.’’ VRTC testing confirmed that a accelerator pedals are not the only
NHTSA has investigated complaints
short and rapid application of the causes of unintended low-speed surges
alleging low-speed surges in Toyota
accelerator could: (1) Fail to be recorded in Toyota vehicles.’’
vehicles equipped with ETCS-i for over
by the EDR based on the asynchronous Before responding to the petitioner’s
update rates of the CAN bus signals and 10 years, starting with a defect petition
statement regarding recent software
the relatively slow sampling rate used (DP03–003) in 2003. Altogether, ODI
theories, ODI first notes that floor mats
by the EDR; and (2) produce the engine completed 5 defect petition evaluations
and sticky pedals have never been
and vehicle speed changes recorded by and 1 investigation (PE04–021) related
considered likely ‘‘causes of unintended
the EDR at t = 0.0 s. to allegations of low-speed surging in
low-speed surges in Toyota vehicles.’’
Toyota vehicles equipped with ETCS-i
3.1.3 VRTC Vehicle Evaluation/ Incidents of pedal entrapment by
prior to the joint study of the issue
Testing improper or out-of-position floor mats
initiated by NHTSA and NASA in
are a severe form of a stuck throttle
Following detailed instructions 2010.10
condition, as they occur after the pedal
provided by the petitioner regarding the Low-speed surges were the primary has intentionally been fully depressed
conditions of the surging during the focus of the study by NHTSA and NASA to wide-open throttle (WOT) by the
parking maneuvers, VRTC performed in 2010. As clearly stated in the driver, generally during attempted
over 2,000 miles of test driving while Executive Summary of NHTSA’s passing maneuvers, accelerations on
evaluating the petitioner’s accident and February 2011 report from this study: highway entrance ramps to merge with
the vehicle itself. The testing did not highway traffic or attempts to maintain
Both [NHTSA and NASA] also noted that
produce any unusual performance of the the vast majority of complaints involved speed or accelerate up hills. When the
throttle or transmission systems. In incidents that originated when the vehicle driver releases pressure from the
addition, testing of the incident vehicle was stationary or at very low speeds and accelerator, the pedal remains stuck at
brake system found that it functioned contained allegations of very wide throttle WOT resulting in an incident of high-
normally and could hold the vehicle openings, often with allegations that brakes
speed unintended acceleration.
stationary with the engine at 2,000 RPM were not effective. NHTSA’s analysis
The ‘‘sticky pedal’’ condition was
with less than 15 lb of pedal pressure indicated that these types of complaints
generally do not appear to involve vehicle- associated with excessive friction in the
applied to the brakes. The brakes could accelerator pedal assembly which could
also hold the vehicle stationary at full based causes and that, where the complaint
included allegations that the brakes were not develop after the vehicle had been
throttle with less than 20 lb of force effective or that the incident began with a parked overnight in certain
applied to the brake pedal. Testing also brake application, the most likely cause of environmental conditions (e.g., high
showed the vehicle’s brakes could bring the acceleration was actually pedal relative humidity and cool ambient
it to a full stop in less than three feet misapplication (i.e., the driver’s unintended temperature). A pedal with excessive
at the speeds provided in the application of the accelerator rather than, or friction may be slow to return to idle
petitioner’s account of the crash. in addition to, the brake.)
when released by the driver and, in
The petitioner also alleged that The results of NHTSA’s field inspections of
vehicles involved in alleged UA incidents some cases, may stick after being held
uncommanded, short-duration throttle at a constant position for an extended
surges occurred in the Corolla during during 2010 supported this analysis. Those
vehicle inspections, which included objective period of time. This would typically
tkelley on DSK3SPTVN1PROD with NOTICES
certain decelerations from highway occur during steady-state highway
evidence from event data recorders,
speed. VRTC also conducted testing to indicated that drivers were applying the driving (i.e., pedal held at constant
try to reproduce this phenomenon but accelerator and not applying the brake (or position for some period of time)
did not observe any unusual
performance or symptoms associated 10 DP03–003, DP04–003, PE04–021, DP05–002, 11 NHTSA. 2011. Technical Assessment of Toyota
with harsh downshifting or changes in DP06–003 and DP08–001 all included examination Electronic Throttle Control (ETC) Systems. (viii).
torque converter clutch status. Drivers of alleged vehicle accelerations from low-speeds. http://www.nhtsa.gov/PR/DOT-16-11.
VerDate Sep<11>2014 17:59 May 13, 2015 Jkt 235001 PO 00000 Frm 00211 Fmt 4703 Sfmt 4703 E:\FR\FM\14MYN1.SGM 14MYN1](https://thefederalregister.org/doc/80_FR_27928/page/4.svg)
![Federal Register / Vol. 80, No. 93 / Thursday, May 14, 2015 / Notices 27839
following a morning cold-start and the stuck at the last computed throttle • Not reproduced—Barr does not
pedal could ordinarily be returned to command, but would be terminated by identify any specific software states or
idle simply by tapping the accelerator any transition in brake switch status.14 vehicle operating conditions necessary
pedal to free the sticking condition. We note that the Corolla vehicles that for any of the failure mechanisms to
Although ODI is not aware of any are the subject of this petition are occur and has not reproduced a task
crashes or injuries resulting from equipped with engine control modules death or any other software failure
sticking pedals, the condition has been (ECM’s) supplied by Delphi, while resulting in SA in real world driving
mistaken for evidence of electronic UA Barr’s task death theory applies to conditions.16
in at least one instance.12 Toyota Camry vehicles equipped with
With regard to Mr. Barr, ODI is aware Denso modules. The Delphi modules • Untestable—Rather than identifying
that he and other consultants have contain different source code with the specific conditions necessary for
raised certain software design and different task and stack monitoring theoretical software failures to occur,
electrical architecture issues in the functionality than the Denso modules Barr and other proponents of the theory
course of civil litigation regarding and, hence, do not contain substantially have suggested that such failures cannot
Toyota ETCS-i vehicles. The petition similar software. It is therefore be reproduced because ‘‘the test space is
does not cite, and ODI is unaware of, reasonable to conclude that the theories effectively infinite’’ resulting in ‘‘too
any instance where Barr or any other and mechanisms advanced by Mr. Barr many possible tests.’’ 17 This precludes
consultant postulating that the ETCS-i in regard to the software employed in any scientific evaluation of the validity
software is defective has reproduced the Denso throttle controls are of such theories.18
unintended acceleration in a Toyota inapplicable to the petitioner’s vehicle. • Fault injection did not produce
ETCS-i vehicle under real-world driving Nonetheless, since the low-speed SA—When Task X deaths were
conditions. surge incidents that are the subject of reproduced by fault injection, they did
The petitioner submitted a the petition are similar to the SA crash not result in sudden increases in throttle
presentation prepared by Barr regarding incidents reported in other Toyota opening or any loss of brake
his analysis of the software in a 2005 vehicles, regardless of throttle control
effectiveness. Incidents that begin when
Toyota Camry and cites several opinions technology or ECM supplier, ODI offers
the brake is not applied result in loss of
contained in that document, but does the following assessment of the Barr
not identify any specific condition or task death theory submitted by the power to the throttle when the brake is
theory that could result in SA in the petitioner: applied and incidents that begin with
subject vehicles.13 The Barr • No specific defect identified—Barr the brake already applied would,
presentation summarizes his review of identifies a number of issues with necessarily, involve low severity
Toyota’s ETCS-i source code and a case Toyota’s ETCS-i software and electrical because the engine would be frozen at
review of a defect theory he developed architecture, including several potential idle.19 Table 1 describes throttle and
as part of a lawsuit relating to a fatal failure mechanisms that he speculates brake responses for each of the initial
accident in a 2005 Toyota Camry with could result in task death.15 However, as condition pedal state scenarios
a 4-cylinder engine. Barr’s defect theory stated in his ‘‘Case Specific Opinions’’ associated with Task X death. The risk
involved the suspension of a specific slide [54], he ‘‘cannot identify with of uncontrolled acceleration, crash or
operating system task that performs 100% certainty the specific software injury would be low and complaints
multiple throttle control and failsafe defects’’ responsible for the UA associated with such incidents would be
functions in the Toyota ETCS-i source incident. ODI sees no factual basis for more likely to cite loss of power or
code (Task X death). Task X death assigning any level of probability to his stalling than uncontrolled engine
would result in the throttle remaining theories. power.
TABLE 1—TASK X DEATH SCENARIOS
Initial conditions Throttle and brake symptoms
Foot on the accelerator pedal .................................................................. • Throttle stuck at last computed throttle command.
• Brake application cuts power to the throttle.
Foot on the brake pedal ........................................................................... • Throttle is initially stuck at idle.
• Normal braking (brake release cuts power to the throttle).
Foot on neither pedal ............................................................................... • Throttle is initially stuck at idle.
12 Testing conducted by Toyota and observed by 15 For example, Barr speculated that memory 18 Theories of electromagnetic interference (EMI)
NHTSA engineers reproduced the sticking pedal corruptions resulting from stack overflow or effects on ETC or cruise control systems as causes
condition in the pedal assembly removed from a unidentified software bugs could result in task of SA incidents have included similar claims
MY 2007 Toyota Avalon involved in an incident in death and other negative effects. regarding testability. No EMI theories have ever
January 2010 that was reported by some as evidence 16 Barr’s only testing of Task X death involved a been duplicated in a vehicle and no specific source
of electronic UA (VOQ 10300210).
13 For example, the petitioner cited Barr’s fault injection method, performed with Toyota’s or path for the interference has been identified.
opinions that ‘‘Toyota’s ETCS source code is of assistance, to artificially induce task deaths to study 19 With regard to the potential for more severe
unreasonable quality’’ and ‘‘Toyota’s source code is system and failsafe performance. There is no failure modes associated with Task X death, Barr
defective and contains bugs, including bugs that evidence of any scenario in which the ‘‘brake echo further speculates that one memory corruption
can cause unintended acceleration.’’ check’’ failed to cut power to the throttle after brake event ‘‘can cause task death and open [the] throttle’’
tkelley on DSK3SPTVN1PROD with NOTICES
14 Any transition in brake switch status would
switch transition during this testing. and that the brake echo check may not always cut
result in a discrepancy between brake status 17 In ODI’s investigations of defects involving power to the throttle. He states that ‘‘memory
recognized by the Main CPU, which would be corruptions are like ricocheting bullets’’ that may
embedded control system faults, either VRTC, the
frozen by the task death, and the Sub-CPU which
manufacturer, or the supplier have been able to: (1) result in more severe effects. However, these
would continue to receive actual brake status
voltage from the stop lamp switch (‘‘brake echo Identify the specific operating conditions necessary theories have never been demonstrated in any
check’’). This would trigger failsafe operation with to produce the fault through field data analysis, testing nor were they observed during fault
throttle opening limited to less than 10 degrees and system review and testing; and (2) reproduce the injection tests conducted to observe system
set a fault code. conditions to duplicate the faults in vehicle testing. performance with artificially induced task death.
VerDate Sep<11>2014 17:59 May 13, 2015 Jkt 235001 PO 00000 Frm 00212 Fmt 4703 Sfmt 4703 E:\FR\FM\14MYN1.SGM 14MYN1](https://thefederalregister.org/doc/80_FR_27928/page/5.svg)
![27840 Federal Register / Vol. 80, No. 93 / Thursday, May 14, 2015 / Notices
TABLE 1—TASK X DEATH SCENARIOS—Continued
Initial conditions Throttle and brake symptoms
• Brake application cuts power to the throttle.
• No evidence in field data—The ODI has observed these patterns in SA 3.4 Other Similar Incidents
fault injection testing did not reproduce complaints in investigations and The petitioner states: ‘‘I reviewed the
an SA, but it did demonstrate that research covering nearly 40 years and complaints made to NHTSA by owners
failures related to Task X death would involving vehicles with all forms of of 2006–2010 Toyota Corollas [and]
result in a very specific set of symptoms throttle control, both mechanical and found 163 reports in which the driver
that can be used to identify potentially electronic. experienced a surge at low speed or no
relevant incidents in field data, such as:
• Brake effectiveness—None of the speed; 99 drivers mentioned that the
(1) Allegations of unresponsive brakes were already depressed when the
electronic theories reviewed by ODI
accelerator pedals that do not increase surge occurred or the surge occurred
explain how pressing on the ‘‘brake’’
or decrease engine power when the when the brakes were depressed; 83
driver presses or releases the pedal; (2) would result in a sudden increase in
engine power as alleged in SA incidents resulted in crashes.’’ ODI
allegations of vehicles suddenly losing provided copies of the 163 VOQs noted
power when the brake is applied; and complaints, nor do they explain why the
brakes would suddenly lose by the petitioner to Toyota and
(3) fault codes associated with ‘‘brake requested complaint, warranty,
echo check’’ failsafe operation. ODI’s effectiveness at the same time as the
engine power surge.20 inspection and EDR information about
analyses of complaints and warranty each vehicle (‘‘subject vehicles’’).
data have not revealed any sign of these • Different software—As noted above, Using information supplied by
symptoms in any Toyota ETCS-i the Corolla vehicles at issue in this Toyota, the VOQ text, and any
vehicles. petition are equipped with ECM’s supporting or additional information
• Not consistent with reported SA— supplied by Delphi, while Barr’s task (e.g., law enforcement crash reports,
Incidents of sudden acceleration also death theory applies to certain Toyota repair orders from dealers or
involve very specific symptom patterns, Camry vehicles equipped with Denso independent repair facilities,
including: (1) Primarily occurring in modules. The Delphi modules contain photographs, interviews with
low-speed driving maneuvers in parking different system monitoring complainants and/or complainants’
lots and driveways, as well as other functionality than the Denso modules families,21 witness statements, letters to
driving maneuvers associated with and, hence, do not contain substantially elected representatives, letters to
required brake application (see Table 3); similar software. NHTSA, etc.) ODI analyzed the
(2) reports of sudden increases in engine petitioner’s incident and the 163 VOQs
• Pedal error not excluded—As Barr
power allegedly initiated by application reporting similar incidents as alleged by
indicated in a slide titled ‘‘Other Similar
of the brake; and (3) the allegations of the petitioner. Six of the VOQs are
brake ineffectiveness in the same Incident Criteria [55],’’ evidence duplicate submissions, resulting in a
complaints. None of the software task contradicting correct use of pedals is total of 158 unique vehicles. ODI’s
death theories postulated by Barr fit or one factor that would exclude his analysis of these complaints is
otherwise explain these patterns. The theories from consideration. As outlined summarized in Table 2, which groups
same patterns and vehicle dynamics are in Section 3.4 of this report, Other the complaints in three major
evident in the large volume of crashes Similar Incidents, the available EDR categories.22 The categories are based on
in which pedal misapplication has been data for the subject vehicles does ODI’s analysis of all available
identified as the undisputed cause (see provide evidence contradicting the information and not solely on the initial
section 3.5, Low-speed surge hazards). correct use of pedals. VOQ complaint text.
TABLE 2—ODI ANALYSIS OF PETITIONER SELECTED VOQ’S
Supported by
Number of Number of
Category Description of category EDR pre-crash
VOQs crashes data
A ................ There is an alleged increase in engine power in which the brakes are alleg- 105 93 17
edly unable to control: Incidents are caused by pedal misapplication or by a
late braking effort of the driver.
B ................ Dual pedal application: The driver inadvertently applied both the brake and the 28 2 0
accelerator simultaneously during the event.
C ................ Incidents that do not fit the alleged defect of ‘‘engine surge in which the 25 10 0
brakes fail to stop the vehicle in time to prevent a crash.’’.
tkelley on DSK3SPTVN1PROD with NOTICES
Category A: Category A complaints of the vehicle’s braking ability and a the driver did not request by pressing on
are those alleging simultaneous failures sudden increase in engine power that the accelerator pedal, with no evidence
20 Pressing the brake pedal with a nominal force 21 Three complainants were now deceased and in 22 An itemization of VOQ number by Category is
of 40 lbs or less would produce sufficient braking some cases the complainant was not the driver at provided in the closing resume for this
torque to overcome full/maximum drivetrain torque the time of the incident. investigation, which can be obtained at
in all vehicles that have been evaluated by ODI to www.safercar.gov.
date.
VerDate Sep<11>2014 17:59 May 13, 2015 Jkt 235001 PO 00000 Frm 00213 Fmt 4703 Sfmt 4703 E:\FR\FM\14MYN1.SGM 14MYN1](https://thefederalregister.org/doc/80_FR_27928/page/6.svg)
![Federal Register / Vol. 80, No. 93 / Thursday, May 14, 2015 / Notices 27841
of brake system malfunction observed in unintended acceleration: ‘‘investigating brake status, accelerator pedal voltage,
post-incident inspections/testing. These for phenomena other than pedal engine speed and vehicle speed in the
complaints fit the definition of ‘‘sudden misapplication absent an explanation 5 seconds prior to the time of the
acceleration’’ incident allegations as for the ineffectiveness of the brakes, collision trigger (if it was on a model
described in the background section of which are independent of the throttle year 2009 or later Corolla). This
this report and fall within the scope of control system and are designed to information, together with other
the petitioner’s allegations. As dominate engine torque, is not likely to relevant facts (e.g., law enforcement
discussed in previously in this report, be useful. [164]’’ reports, accident reconstruction, witness
these incidents fit the profile of pedal As further confirmation of this interviews), can be compared to the
misapplications. Again quoting from the assessment, some of the VOQs driver’s statement regarding the use of
from the 2012 TRB report reviewing submitted by the petitioner had pre- foot controls and their alleged
ODI’s processes for investigating crash EDR data available that show effectiveness prior to the collision.
TABLE 3—SUMMARY OF INCIDENTS WITH PRE-CRASH EDR DATA
ODI brake
category
Incident T¥5 speed
Case No. VOQ No. A—misapply Summary of driver allegation
date (mph) B—late apply
C—no apply
1 ...................... 10534094 Sep-11 ... 45 B Driving at night in rain, released accelerator, departed road,
crashed into tree.
2 ...................... 10334936 May-10 ... 31 A Approaching stop sign, applied brake, accelerated into fence.
3 ...................... 10363685 Oct-10 .... 31 C Approaching stop sign, applied brake, accelerated into utility
pole.
4 ...................... 10523677 May-13 ... 20 A Approaching intersection, applied brake, accelerated into tree.
5 ...................... 10352668 Mar-09 ... 11 A Entering parking space, applied brake, accelerated into parked
vehicle.
6 ...................... 10479582 Oct-12 .... 10 A Entering parking space, applied brake, accelerated into build-
ing.
7 ...................... 10369494 Nov-10 ... 8 A/B Entering parking space, applied brake, accelerated into con-
crete post.
8 ...................... 10344874 Jul-10 ..... 6 A Entering driveway, applied brake, accelerated into iron fence.
9 ...................... 10363886 Sep-10 ... 6 A/B Entering parking space, applied brake, accelerated into build-
ing.
10 .................... 10520195 Jun-13 .... 6 A/B Entering parking space, applied brake, accelerated over two
curbs.
11 .................... 10551478 Oct-13 .... 5 A Entering parking space, applied brake, accelerated into dump-
ster.
12 .................... 10597296 May-14 ... 4 A Entering parking space, applied brake, accelerated into parked
vehicle.
13 * .................. 10637908 Jun-14 .... 4 A/B Entering parking space, applied brake, accelerated into parked
vehicle.
14 .................... 10507434 Apr-13 .... 2 A Entering parking space, applied brake, accelerated into build-
ing.
15 .................... 10552563 Oct-13 .... 1 A Entering parking space, applied brake, accelerated into parked
vehicle.
16 .................... 10578871 Apr-14 .... 1 A Backing from parking space, lightly pressed accelerator, accel-
erated into vehicle.
17 .................... 10447756 Jan-12 .... 0 A Exiting parking space, applied brake, accelerated into brick
wall.
* petition incident.
TABLE 4—SUMMARY OF BRAKE AND ACCELERATOR PEDAL USE IN INCIDENTS WITH PRE-CRASH EDR DATA.23
T¥5 Brake switch status by EDR time interval Accelerator pedal apply status by EDR time interval
Case No. speed
(mph) ¥5 ¥4 ¥3 ¥2 ¥1 0 ¥5 ¥4 ¥3 ¥2 ¥1 0
2 .................. 31 Off ......... Off ......... Off ......... Off ......... Off ......... Off ......... High ...... High ...... High ...... High ...... High ...... High
6 .................. 10 Off ......... Off ......... Off ......... Off ......... Off ......... Off ......... Low ....... High ...... High ...... High ...... High ...... High
4 .................. 20 Off ......... Off ......... Off ......... Off ......... Off ......... Off ......... Low ....... Off ......... Low ....... High ...... High ...... High
16 ................ 1 Off ......... Off ......... Off ......... Off ......... Off ......... Off ......... Low ....... Low ....... Low ....... Med ....... High ...... High
14 ................ 2 Off ......... Off ......... Off ......... Off ......... Off ......... Off ......... Low ....... Low ....... Low ....... Low ....... High ...... High
8 .................. 6 Off ......... Off ......... Off ......... Off ......... Off ......... Off ......... Off ......... Off ......... Off ......... Off ......... High ...... High
12 ................ 4 Off ......... Off ......... Off ......... Off ......... Off ......... Off ......... Low ....... Low ....... Low ....... Low ....... High ...... Off
15 ................ 1 Off ......... Off ......... Off ......... Off ......... Off ......... Off ......... Off ......... Off ......... Low ....... Low ....... Low ....... High
tkelley on DSK3SPTVN1PROD with NOTICES
10 ................ 6 Off ......... Off ......... Off ......... Off ......... Off ......... On ......... Low ....... Low ....... Off ......... Low ....... High ...... Off
11 ................ 5 Off ......... Off ......... Off ......... Off ......... Off ......... Off ......... Off ......... Off ......... Off ......... Off ......... Off ......... High
5 .................. 11 Off ......... Off ......... Off ......... Off ......... Off ......... Off ......... Med ....... Med ....... Med ....... Med ....... Med ....... Med
17 ................ 0 Off ......... Off ......... Off ......... Off ......... Off ......... Off ......... Low ....... Low ....... Low ....... Low ....... Low ....... Med
7 .................. 8 Off ......... Off ......... Off ......... Off ......... Off ......... On ......... Low ....... Low ....... Low ....... Low ....... Med ....... Off
1 .................. 45 Off ......... Off ......... Off ......... Off ......... On ......... On ......... Low ....... Low ....... Low ....... Low ....... Off ......... Off
9 .................. 6 Off ......... Off ......... Off ......... Off ......... Off ......... On ......... Off ......... Off ......... Off ......... Off ......... Low ....... Off
13 * .............. 4 Off ......... Off ......... Off ......... Off ......... Off ......... On ......... Off ......... Off ......... Low ....... Off ......... Off ......... Off
VerDate Sep<11>2014 19:07 May 13, 2015 Jkt 235001 PO 00000 Frm 00214 Fmt 4703 Sfmt 4703 E:\FR\FM\14MYN1.SGM 14MYN1](https://thefederalregister.org/doc/80_FR_27928/page/7.svg)
![27844 Federal Register / Vol. 80, No. 93 / Thursday, May 14, 2015 / Notices
exists or a NHTSA order for the • Mail: Docket Operations, U.S. including former title if a change is
notification and remedy of a safety- Department of Transportation, West being made; (2) OMB control number;
related defect as alleged by the Building, Ground Floor, Room W12– (3) summary of the information
petitioner at the conclusion of the 140, Routing Symbol M–30, 1200 New collection activity; (4) description of
requested investigation. Therefore, Jersey Avenue SE., Washington, DC affected public; (5) estimate of total
given a thorough analysis of the 20590. annual reporting and recordkeeping
potential for finding a safety related • Hand Delivery: To Docket burden; and (6) frequency of collection.
defect in the vehicle and in view of the Operations, Room W12–140 on the PHMSA will request a three-year term of
need to allocate and prioritize NHTSA’s ground floor of the West Building, 1200 approval for the information collection
limited resources to best accomplish the New Jersey Avenue SE., Washington, activity and, when approved by OMB,
agency’s safety mission and mitigate DC 20590, between 9 a.m. and 5 p.m., publish a notice of the approval in the
risk, the petition is respectfully denied. Monday through Friday, except Federal Federal Register.
This action does not constitute a finding holidays. PHMSA requests comments on the
by NHTSA that a safety-related defect Instructions: All submissions must following information collection:
does not exist. The agency will take include the agency name and docket Title: Flammable Hazardous Materials
further action if warranted by future number for this notice. Internet users by Rail Transportation.
circumstances. may access comments received by DOT OMB Control Number: 2137–0628.
Authority: 49 U.S.C. 30162(d); delegations at: http://www.regulations.gov. Please Summary: This information collection
of authority at 49 CFR 1.50 and 501.8. note that comments received will be pertains to requirements for the creation
posted without change to: http:// of a sampling and testing program for
Frank S. Borris, II, www.regulations.gov including any mined gas or liquid and rail routing for
Acting Associate Administrator for personal information provided. High Hazard Flammable Trains
Enforcement. Privacy Act: In accordance with 5 (HHFTs),a routing requirements for rail
[FR Doc. 2015–11632 Filed 5–13–15; 8:45 am] U.S.C. 553(c), DOT solicits comments operators, and the reporting of incidents
BILLING CODE 4910–59–P from the public. DOT posts these that may occur from HFFTs.
comments, without edit, including any In the final rule entitled ‘‘Enhanced
personal information the commenter Tank Car Standards and Operational
DEPARTMENT OF TRANSPORTATION provides, to www.regulations.gov, as Controls for High-Hazard Flammable
described in the system of records Trains’’ PHMSA and FRA adopted a
Pipeline and Hazardous Materials notice (DOT/ALL–14 FDMS), which can risk-based timeline for the retrofit of
Safety Administration be reviewed at www.dot.gov/privacy. existing tank cars to meet an enhanced
Requests for a copy of an information CPC–1232 standard when used as part
[Docket No. PHMSA–2012–0082 (Notice No. collection should be directed to Steven of an HHFT. The retrofit timeline
15–13)] Andrews or T. Glenn Foster, Standards focuses on two risk factors, the packing
Hazardous Materials: Information and Rulemaking Division (PHH–12), group and differing types of DOT–111
Collection Activities Pipeline and Hazardous Materials Safety and CPC–1232 tank cars. The timeline
Administration, 1200 New Jersey provides an accelerated risk reduction
AGENCY: Pipeline and Hazardous Avenue SE., East Building, 2nd Floor, that more appropriately addresses the
Materials Safety Administration Washington, DC 20590–0001, overall risk. The timeline is provided in
(PHMSA), Department of Transportation Telephone (202) 366–8553. the §§ 173.241, 173.242, and 173.243
(DOT). FOR FURTHER INFORMATION CONTACT: tables of the final rulemaking (80 FR
ACTION: Notice and request for Steven Andrews or T. Glenn Foster, 26643) and includes a January 1, 2017
comments. Standards and Rulemaking Division deadline for of non-jacketed DOT–111
(PHH–12), Pipeline and Hazardous tank cars in PG I service in an HHFT.
SUMMARY: In accordance with the Materials Safety Administration, 1200 Not adhering to the January 1, 2017
Paperwork Reduction Act of 1995, New Jersey Avenue SE., East Building, deadline would trigger a reporting
PHMSA invites comments on its 2nd Floor, Washington, DC 20590–0001, requirement.
intention to revise an information Telephone (202) 366–8553. This reporting requirement would
collection under Office of Management SUPPLEMENTARY INFORMATION: Section require owners of non-jacketed DOT–
and Budget (OMB) Control Number 1320.8(d), Title 5, Code of Federal 111 tank cars in Packing Group I service
2137–0628, ‘‘Flammable Hazardous Regulations requires PHMSA to provide in an HHFT to report to DOT the
Materials by Rail Transportation’’. This interested members of the public and following information regarding the
reporting requirement would require affected agencies an opportunity to retrofitting progress:
tank car owners to report their progress comment on information collection and • The total number of tank cars
in the retrofitting of tank cars to the recordkeeping requests. This notice retrofitted to meet the DOT–117R
Department of Transportation (DOT). identifies an information collection specification;
DATES: Interested persons are invited to request that PHMSA will be submitting • The total number of tank cars built
submit comments on or before July 13, to OMB for revision. This information or retrofitted to meet the DOT–117P
2015. collection request is contained in 49 specification;
ADDRESSES: You may submit comments CFR part 174 of the Hazardous Materials • The total number of DOT–111 tank
identified by the docket number Regulations (HMR; 49 CFR parts 171– cars (including those built to CPC–1232
industry standard) that have not been
tkelley on DSK3SPTVN1PROD with NOTICES
(PHMSA–2012–0082) by any of the 180). PHMSA has revised the burden
following methods: estimate, where appropriate, to reflect modified;
• Federal eRulemaking Portal: Go to current reporting levels or adjustments
a An HHFT means a single train transporting 20
http://www.regulations.gov. Follow the based on changes described in this
or more loaded tank cars of a Class 3 flammable
online instructions for submitting notice. The following information is liquid in a continuous block or a single train
comments. provided for the information collection: carrying 35 or more loaded tank cars of a Class 3
• Fax: 1–202–493–2251. (1) Title of the information collection, flammable liquid throughout the train consist.
VerDate Sep<11>2014 17:59 May 13, 2015 Jkt 235001 PO 00000 Frm 00217 Fmt 4703 Sfmt 4703 E:\FR\FM\14MYN1.SGM 14MYN1](https://thefederalregister.org/doc/80_FR_27928/page/10.svg)
Document Created: 2015-12-15 15:33:04
Document Modified: 2015-12-15 15:33:04
| Category | Regulatory Information | |
| Collection | Federal Register | |
| sudoc Class | AE 2.7: GS 4.107: AE 2.106: | |
| Publisher | Office of the Federal Register, National Archives and Records Administration | |
| Section | Notices | |
| Action | Denial of a petition for a defect investigation. | |
| Contact | Mr. Stephen McHenry, Vehicle Control Division, Office of Defects Investigation, NHTSA, 1200 New Jersey Avenue SE., Washington, DC 20590. Telephone 202-366-4883. Email [email protected] | |
| FR Citation | 80 FR 27835 |
2024 Federal Register | Disclaimer | Privacy Policy
USC | CFR | eCFR