Denial of Motor Vehicle Defect Petition |
|---|
Topics: Toyota
|
Frank S. Borris II
National Highway Traffic Safety Administration
3 March 2016
[Federal Register Volume 81, Number 42 (Thursday, March 3, 2016)]
[Notices]
[Pages 11351-11354]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2016-04605]
-----------------------------------------------------------------------
DEPARTMENT OF TRANSPORTATION
National Highway Traffic Safety Administration
Denial of Motor Vehicle Defect Petition
AGENCY: National Highway Traffic Safety Administration, (NHTSA),
Department of Transportation.
ACTION: Denial of a petition for a defect investigation.
-----------------------------------------------------------------------
SUMMARY: This notice sets forth the reasons for denying a petition
(DP15-007) submitted to NHTSA under 49 U.S.C. 30162 and 49 CFR part
552, requesting that the agency ``have Toyota correct software defects
in their electronic throttle control software'' and then ``issue a
national recall of all effected [sic] vehicles and have Toyota replace
the old faulty code with the new safer code.''
FOR FURTHER INFORMATION CONTACT: Mr. Stephen McHenry, Vehicle Control
Division, Office of Defects Investigation, NHTSA, 1200 New Jersey
Avenue SE., Washington, DC 20590. Telephone 202-366-4883. Email
stephen.mchenry@dot.gov.
SUPPLEMENTARY INFORMATION:
1.0 Introduction
Interested persons may petition NHTSA requesting that the agency
initiate an investigation to determine
[[Page 11352]]
whether a motor vehicle or item of replacement equipment does not
comply with an applicable motor vehicle safety standard or contains a
defect that relates to motor vehicle safety. 49 U.S.C. 30162(a)(2); 49
CFR 552.1. Upon receipt of a properly filed petition, the agency
conducts a technical review of the petition, material submitted with
the petition, and any additional information. 49 U.S.C. 30162(c); 49
CFR 552.6. The technical review may consist solely of a review of
information already in the possession of the agency, or it may include
the collection of information from the motor vehicle manufacturer and/
or other sources. After considering the technical review and taking
into account appropriate factors, which may include, among others,,
agency priorities, the likelihood of uncovering sufficient evidence to
establish the existence of a defect, and the likelihood of success in
any necessary enforcement litigation, the agency will grant or deny the
petition. See 49 U.S.C. 30162(d); 49 CFR 552.8.
2.0 Petition Background Information
In a letter dated September 15, 2015, Dr. James Stobie (the
petitioner) requested that NHTSA ``have Toyota correct software defects
in their electronic throttle control software'' and then ``issue a
national recall of all effected [sic] vehicles and have Toyota replace
the old faulty code with the safer code.'' Dr. Stobie references two
previous defect petitions related to unintended acceleration in Toyota
vehicles that NHTSA recently evaluated and denied. The petitioner
stated that his petition contains new information affecting NHTSA's
conclusions in the previous petition evaluations. This includes: (1)
Information related to a crash that occurred as his wife was attempting
to park their model year 2010 Lexus HS250H; (2) the source of EDR data
in Toyota vehicles; (3) alleged defects in the Toyota Electronic
Throttle Control (ETC) software; and (4) a recall conducted by Honda in
Japan. NHTSA has reviewed the material cited by the petitioner. The
results of this review and our evaluation of the petition are set forth
in the DP15-007 Petition Analysis Report, published in its entirety as
an appendix to this notice.
After a thorough assessment of the material submitted by the
petitioner, the information already in NHTSA's possession, and the
potential risks to safety implicated by the petitioner's allegations,
it is unlikely that an order concerning the notification and remedy of
a safety-related defect would result from any proceeding initiated by
granting Dr. Stobie's petition. After full consideration of the
potential for finding a safety related defect in the vehicle, and in
view of NHTSA's enforcement priorities and its previous investigations
into this issue, the petition is denied.
Appendix--Petition Analysis--DP15-007
1.0 Introduction
On September 23, 2015, the National Highway Traffic Safety
Administration (NHTSA) received a September 15, 2015 letter from Dr.
James Stobie, Ph.D. (the petitioner), petitioning the agency to
``have Toyota correct software defects in their electronic throttle
control software'' and then ``issue a national recall of all
effected [sic] vehicles and have Toyota replace the old faulty code
with the safer code.'' The petition cites a crash that occurred as
his wife was attempting to park their model year 2010 Lexus HS250H
in an angled parking space facing a brick building and references
two previous Toyota unintended acceleration defect petitions that
NHTSA evaluated and denied. Dr. Stobie's petition also alleges that
new information not considered by the Agency in those prior
petitions should be evaluated by NHTSA. This new information
includes: (1) The facts and circumstances of a crash that occurred
as his wife was attempting to park their model year 2010 Lexus
HS250H; (2) the source of EDR data in Toyota vehicles; (3) alleged
defects in the Toyota Electronic Throttle Control (ETC) software;
and (4) a recall conducted by Honda in Japan.
2.0 Petition Analysis
2.1 Background
2.1.1 EDR Data Limitations
The Toyota EDR collects pre-trigger data (vehicle speed, engine
speed, brake switch status, and accelerator pedal position sensor #1
voltage) from the vehicle's High Speed Controller Area Network (HS-
CAN), which is refreshed either periodically or immediately by the
respective control modules.
Table 1--EDR Pre-Crash Parameters, by Refresh Rate
------------------------------------------------------------------------
Parameter Refresh rate Resolution
------------------------------------------------------------------------
Brake Switch.................... Immediately....... On/Off.
Engine RPM...................... 24 ms............. 400 RPM.\1\
Vehicle Speed................... 500 ms............ 2 km/h.\2\
Accelerator Rate................ 512 ms............ 0.039 volts.
------------------------------------------------------------------------
The EDR continuously performs 1 Hz sampling of HS-CAN pre-
trigger data and stores the data in a temporary buffer. The EDR only
saves this data, along with the trigger data, when it detects a
triggering event such as a crash.\2\ Table 1 shows the refresh rates
and resolutions for the pre-crash data signals. Any analysis of EDR
data for Toyota vehicles should apply these data time tolerances and
resolutions at each of the pre-crash data points.
---------------------------------------------------------------------------
\1\ EDR recorded data are rounded down in the indicated
resolution increments.
\2\ An event is triggered by detection of a deceleration of
approximately 2 g's.
---------------------------------------------------------------------------
In 2010, NHTSA's Vehicle Research and Test Center (VRTC)
conducted testing to validate the EDR pre-crash data used in NHTSA
field investigations.\3\ The testing found that the pre-crash data
recorded by the Toyota EDR were accurate within the known
limitations resulting from the data resolution and sampling rates.
The testing also demonstrated that the EDR does not necessarily
capture all accelerator pedal applications during an event and the
accelerator pedal voltage recorded at each EDR time interval may not
be the actual accelerator pedal voltage at that interval. Subsequent
studies have confirmed the limitations of stored EDR pre-crash data
in capturing the entire crash event due to the data refresh rates,
data resolutions and EDR sampling rates.4 5 6
---------------------------------------------------------------------------
\3\ ``Event Data Recorder--Pre Crash Data Validation of Toyota
Products,'' NHTSA-NVS-20ll-ETC-SR07, February 2011.
\4\ Brown, R., White, S., ``Evaluation of Camry HS-CAN Pre-Crash
Data,'' SAE Technical Paper 2012-01-0996, 2012, doi: 10.4271/2012-
01-0996.
\5\ Brown, R., Lewis, L., Hare, B., Jakstis, M. et al.,
``Confirmation of Toyota EDR Pre-crash Data,'' SAE Technical Paper
2012-01-0998, 2012, doi: 10.4271/2012-01-0998.
\6\ Ruth, R., Bartlett, W., Daily, J., ``Accuracy of Event Data
in the 2010 and 2011 Toyota Camry During Steady State and Braking
Conditions,'' SAE Technical Paper 2012-01-0999, 2012, doi: 10.4271/
2012-01-0999.
---------------------------------------------------------------------------
The EDR download report clearly notes these issues in the first
two items of Data Limitations section on page one of the report:
Due to limitations of the data recorded by the airbag
ECU, such as the resolution, data range, sampling interval, time
period of the recording, and the items recorded, the information
provided by this data may not be sufficient to capture the entire
crash.
Pre-Crash data is recorded in discrete intervals. Due
to different refresh rates within the vehicle's electronics, the
data recorded may not be synchronous to each other.
2.1.2 National Research Council Report
In 2012, the National Research Council released a report that
included a review of NHTSA's processes for investigating allegations
of sudden unintended acceleration in Toyota and other vehicles.\7\
As noted in the agency's denial of DP14-003, the report concluded
that NHTSA's decision to close its investigations of Toyota's ETC
were justified based on the initial investigations, complaint
analyses, field investigations using EDR data and NASA's examination
of the Toyota ETC. With regard to allegations of low-speed surging
with ineffective brakes, the report stated:
---------------------------------------------------------------------------
\7\ NRC. 2011. TRB Special Report 308: The Safety Challenge and
Promise of Automotive Electronics: Insights from Unintended
Acceleration. Washington, DC: National Academies Press, (164).
Reports of braking ineffectiveness in controlling a vehicle
experiencing the onset of unintended acceleration from a stopped
position or when moving slowly requires an explanation for the
ineffectiveness, such as
[[Page 11353]]
physical evidence of damage to the brake system. Under these
circumstances, investigating for phenomena other than pedal
misapplication absent an explanation for the ineffectiveness of the
brakes, which are independent of the throttle control system and are
---------------------------------------------------------------------------
designed to dominate engine torque, is not likely to be useful.
2.2 Crash Incident
The crash identified by the petitioner involved a sudden
acceleration incident experienced by his wife as she attempted to
park the family's 2010 Lexus HS250H on June 20, 2015, while on the
grounds of the United States Naval Academy.
2.2.1 Driver's Statement
Mrs. Stobie described the sudden unintended acceleration
incident in several complaints submitted to ODI from June 21, 2015
to August 17, 2015 (VOQ's 10726415, 10726781, and 10749195). She
provided the following statement in the most recent complaint (VOQ
10749195):
My accident was caused by unintended acceleration. As I was
slowly turning right into a parking place, the car suddenly
accelerated and crashed into a brick building. The force of the
crash caused the air bags to deploy. There was so much damage to the
car that it was a total loss. After the crash I obtained the event
data recorder (EDR) reading from a contractor hired by Toyota. It
showed that for the last 5 seconds before the crash, I was applying
very light pressure to the gas pedal up until the last .8 seconds.
For the last .8 second the EDR shows that my foot was on the brake
and the throttle was at nearly maximum value. During the last .8
seconds the car went from 5 mph to 9.9 mph and the engine rpm went
from 1200 to 2800. I did not apply pressure to the gas pedal at this
time. I was applying pressure to the brake pedal . . .
2.2.2 Event Data Recorder Data
The petitioner provided a copy of the EDR download data (Table
2).
Table 2--Pre-Crash Data for VOQ 10749195
--------------------------------------------------------------------------------------------------------------------------------------------------------
Time (sec) -4.8 -3.8 -2.8 -1.8 -0.8 0 (TRG)
--------------------------------------------------------------------------------------------------------------------------------------------------------
Vehicle Speed (MPH [km/h])...... 2.5 [4]........... 1.2 [2]........... 2.5 [4]........... 3.7 [6]........... 5 [8]............. 9.9 [16].
Brake Switch.................... OFF............... OFF............... OFF............... OFF............... OFF............... ON.
Accelerator Rate (V [% full 0.78 [0].......... 0.98 [8].......... 1.45 [27]......... 1.41 [26]......... 1.33 [22]......... 3.32 [106].
apply]).
Engine RPM (RPM)................ 800............... 800............... 800............... 1,200............. 1,200............. 2,800.
--------------------------------------------------------------------------------------------------------------------------------------------------------
The EDR data shows that at the most recent EDR sample prior to
impact (t = -0.8 s), the vehicle is nominally within 10 ft. of the
building, travelling approximately 7 ft./s, the accelerator is at
approximately 22 percent of full apply and the brake is not applied.
The recorded data at the airbag trigger point (t = 0 s), shows that
the accelerator pedal was fully applied \8\ at sometime within 0.512
seconds prior to the trigger point (see Section 2.1.1 EDR Data
Limitations for the source and refresh rate of Accelerator Rate) and
the brake switch is ``On.''
---------------------------------------------------------------------------
\8\ According to Toyota, an Accelerator Rate of 3.188 volts
corresponds with a 100% accelerator pedal application resulting in
wide-open throttle. Any further application of the pedal may produce
higher voltage, but will not result in any additional throttle
opening.
---------------------------------------------------------------------------
In support of his allegation that data provided to the EDR was
corrupted by an undefined software error, the petitioner notes that
the EDR erroneously states that the brake pedal and accelerator were
both being pressed at the same time. Other vehicle data shows that
they were not: This information does not validate the conclusion
adopted in the petition. Separate data downloaded from the Hybrid
Control Unit (HCU) for the petitioner's vehicle indicates that the
brake pedal and the accelerator pedal were not applied
simultaneously at any time during the key cycle in which the
petitioner's accident occurred.\9\ As noted above, the EDR reads the
position of the brake light switch instantaneously while there can
be a time lag as long as 0.512 seconds in writing accelerator
position to the EDR. Since the brake light switch was in the ON
state at the air bag trigger point, this indicates that the brake
was not applied until after the accelerator pedal was released,
which must have occurred in the final half second of travel.
---------------------------------------------------------------------------
\9\ The HCU receives data directly from the Accelerator Pedal
Position Sensor and Brake Stop Lamp Switch and records any instance
in which the pedals are applied at the same time in a particular
drive cycle. Hybrid motor protection logic will override accelerator
pedal signals that occur when the brake is applied.
---------------------------------------------------------------------------
In addition, as noted by the petitioner, brake testing conducted
by Toyota field inspectors after the incident found that the system
performed normally and was capable of stopping a vehicle at full
throttle:
During the test drive they floored the accelerator and then
quickly slammed on the brakes. The car behaved as expected. Nowhere
did they find a safety defect.
Based on the recorded vehicle speeds, the vehicle was inside the
parking space when the most significant acceleration occurred. At
this time and distance from impact, a driver would normally be
applying the brake or coasting and not applying the accelerator to
full throttle. Although the driver alleged that the brakes were not
effective during the incident, the brakes had no prior history of
malfunction and the post-incident inspection did not identify any
issues with the brake system. Review of the EDR and HCU data
indicate very late activation of the Brake Stop Lamp Switch after
full application of the accelerator pedal. These data do not support
the driver's statement that the brake was applied when the
acceleration occurred. Based on the foregoing information, this
incident appears to be a case of pedal misapplication.
2.3 Source of EDR Data
The petitioner correctly notes that the EDR receives the
Accelerator Rate voltage from the engine computer and not directly
from the pedal and asserts that this is ``new critical information
about EDR data.'' In the petitioner's view, the analog to digital
conversion of the accelerator pedal signal and subsequent processing
by the engine computer creates a potential pathway for an unknown
software error to create erroneous accelerator position data.
However, this is not ``new'' information about the source of the
accelerator pedal position data sampled and recorded by the EDR. All
prior work by the agency related to Toyota EDR data dating back to
the joint NHTSA/NASA study, including the two previous petitions and
other studies referenced in that work, recognized and reported that
the EDR samples Accelerator Rate voltage data from the HS-CAN bus.
Further, as discussed below, the engine computer software has been
exhaustively examined, including analysis in the NHTSA/NASA study,
and no one, even consultants who have offered testimony asserting
the software is defective, has identified a specific and
reproducible mechanism or set of conditions that produces unintended
acceleration or the ``false'' data phenomenon put forward in the
petition. As noted in the prior work and in Section 2.1.1 of this
report, the HS-CAN bus receives the Accelerator Rate data from the
engine control module, which refreshes the data every 512 ms (see
Table 1).
The EDR continuously samples the HS-CAN data once per second and
stores the data in a temporary buffer. The EDR only saves this data,
along with the trigger data, when it detects a triggering event such
as a crash. Because of the manner in which the ECM updates/refreshes
the data to the HS-CAN, the ``recorded'' Accelerator Rate data saved
by the EDR is not necessarily the ``actual'' data at the precise
time intervals captured by the EDR. For example, the Accelerator
Rate recorded by the EDR for the petitioner's crash at the trigger
point (t = 0 s) is not necessarily the actual data at the trigger
point, but the most recent value refreshed to the HS-CAN over the
prior 512 ms. This explains why it is possible for the EDR data to
show that the accelerator appeared to be applied fully at the same
time the brake switch was in the ON position when the HCU data shows
that the brake and the accelerator were not applied simultaneously.
2.4 Alleged Software Defects
The petitioner states that software defect theories posited by
plaintiff experts in
[[Page 11354]]
unintended acceleration litigation against Toyota is new evidence
since the joint NHTSA/NASA study. However, ODI has previously
reviewed this information during its evaluation of DP14-003. The
petitioner does not provide any new information about the theories
or his allegations of defects in the Toyota ETC software. As noted
in ODI's denial report for DP14-003, the software defect theories
failed to identify a precise cause for sudden acceleration, the
software experts did not reproduce the alleged software defects in
testing, and the theorized conditions did not result in sudden
acceleration when artificially simulated. We find no basis for
concluding that the software defect theories constitute
scientifically valid evidence or could explain the incident alleged
by the petitioner.
ODI's assessment of the software defect theories is not
substantially different from that of one of the plaintiff attorneys
who hired the software experts. These plaintiff attorneys provided
the following characterization of the software experts' work and
findings in a document related to the Toyota SUA property loss
settlement in 2013:
While Plaintiffs' software experts raised certain software
design and architecture issues, they have not been able to identify
a defect that is responsible for the vast array of SUAs reported to
Toyota and NHTSA by vehicle owners. More specifically, Plaintiffs
have been unable to reproduce a UA in a Subject vehicle under
driving conditions.\10\
---------------------------------------------------------------------------
\10\ Berman, S., Seltzer, M., and Pitre,. F. (2013, April 23).
Plaintiff's Memorandum in Support of Plaintiffs' Motion for an Award
of Attorneys' Fees, Reimbursement of Expenses, and Compensation to
Named Plaintiffs, page 12. In Re: Toyota Motor Corp. Unintended
Acceleration Marketing, Sales Practices, and Products Liability
Litigation. United States District Court, Central District of
California. Case No. 8:10ML2151. Retrieved from https://www.toyotaelsettlement.com/Home/CaseDocs.
In addition, an October 2013 order from the presiding judge in
the Toyota ETC multi-district litigation provided the following
characterization of the software defect theories cited by the
---------------------------------------------------------------------------
petitioner when issuing a ruling in a sudden acceleration case:
Toyota's Motion for Summary Judgment is premised on the
uncontroverted fact that Plaintiff has been unable to identify a
precise software design or manufacturing defect and point to
physical or otherwise traceable evidence that the defect actually
caused the Camry throttle to open from an idle position to a much
wider angle without analog input from the driver via the accelerator
pedal. To a lesser extent, it is also premised upon the fact that
Plaintiff cannot prove the actual failure of Toyota's fail-safe
mechanisms in the Camry on the day of the collision.
2.5 The Honda Example
The petitioner references a 2014 recall of 175,000 Honda Fit
vehicles in Japan as an example of a software defect causing
unintended acceleration accidents (Honda Foreign Campaign Number
14F-057). The Honda recall addressed programming flaws that may
result in unintended acceleration during specific operating
conditions. Honda's Foreign Recall Report to NHTSA described the
programming flaws and operating conditions:
The vehicle may lurch forward due to excessive driving force
generated by the motor if the accelerator pedal is pressed strongly
when the vehicle is in Engine mode and shifted into Drive or
Reverse, or the vehicle is in EV mode and being operated on a slope.
The vehicle may also lurch forward momentarily due to excessive
driving force generated by the motor when switching from EV mode to
Engine mode after being in stop and go traffic.
Honda was able to reproduce the conditions described in the
recall and develop a software update to address the ``lurching''
concerns. The conditions addressed by the Honda recall are
associated with brief surges that occur when the accelerator pedal
is being applied under specific operating conditions and, thus, are
not related to the petitioner's incident or allegations (which claim
sustained acceleration during brake application), nor have they been
observed in the general population of Toyota ETC vehicles. Finally,
ODI is not aware of any vehicle defect theories, from the software
experts cited by the petitioner or anyone else, that have similarly
documented and reproduced a sudden unintended acceleration condition
in the Toyota vehicles that would be attributable to the electronic
throttle control software in those vehicles.
3.0 Conclusion
The petitioner does not provide any new evidence in support of
his petition. In our view, a defects investigation is unlikely to
result in a finding that a defect related to motor vehicle safety
exists, or a NHTSA order for the notification and remedy of a safety
related defect as alleged by the petitioner, at the conclusion of
the requested investigation. Therefore, given a thorough analysis of
the potential for finding a safety related defect in the vehicle,
and in view of NHTSA's enforcement priorities and its previous
investigations into this issue, the petition is denied. This action
does not constitute a finding by NHTSA that a safety related defect
does not exist. The agency will take further action if warranted by
future circumstances.
Authority: 49 U.S.C. 30162(d); delegations of authority at 49
CFR 1.50 and 501.8.
Frank S. Borris II,
Acting Associate Administrator for Enforcement.
[FR Doc. 2016-04605 Filed 3-2-16; 8:45 am]
BILLING CODE 4910-59-P