Wow. I was just browsing the Prius Owners Manual to get a better understanding of some of the drivers' responsibility for these crashes, and found this in caution box under "When driving the vehicle".



"Hybrid system" is the term Toyota uses in the manual to describe anything to do with either the engine or electric motor, alone or combined.

I call this a 'whoopsie'.

EDIT:
In fact there is no instruction on how to shift to N at all in the manual, while at the same time there are plenty of warnings against shifting to or leaving the car in N, in addition to the ones I quoted above. The FMEA guys were not only asleep at the switch, it's almost like they were trying to get people killed. Unbelievable.

EDIT 2:
There are instructions to shift into N after all.

But he did vote for Obama right?

Gods imagine the faults that would occur in the Prius's of people who voted for bush or palin...I have images of the James Bond ejector seats, and bladed prop thingy's that extended from the cars hubs of cars next to you!

LOL. Congratulations for grasping the improbability of a 100 ohm resistor falling into the APP assembly. However, that was not at all the point of Gilbert's demonstration. He simply demonstrated that a false input from the APP to the ECM may not be recognized by the ECM, while the ECM is not capable of recognizing a false command signal to the throttle stepper, even from the ECM itself.

That was odd, how did Toyota push the argument away from that? Oh well it sucked the idiots in. No apology.

For those with a knowledge or interest in DC electricity, here are two contrasting documents, the Gilbert testimony and the engineering report prepared for Toyota's law firm:

http://energycommerce.house.gov/Press_111/...t.Testimony.pdf

http://energycommerce.house.gov/Press_111/...bruary.2010.pdf

I have had something similar to the Toyota thing happen to my Fiart Grande Punto 1,4 8v. I was going full speed on the autobahn and when lifting the throttle. it stayed on approx. 80% until i touched the brake. Then the engine started to engine brake.

Bjørn

I don't know anything about this person and the incident seems suspicious to me, but once these things go public and attain sufficient critical mass in the zeitgeist, it's bound to happen. Recall the Tylenol and anthrax scares: Some percentage of the population will always want to get in on the act, with their motivations ranging from financial greed to a pathological need for attention. I don't know if this was a staged incident, but there are going to be staged incidents. It's inevitable. All the more reason for Toyota to get its arms around the problem before it ever got to this ridiculous state.

I'm troubled by this aspect of the 'test' conducted by the autoshop teacher:

"Using shorted APP signal circuit fault conditions purposely installed on the test vehicles, and with known resistance values that would not set a DTC, vehicle operational behaviors were also noted."

He picked a valid circuit voltage and wired a patch to duplicate it. That's pretty much how electrical engineering works. V=IR There are physical properties that can be duplicated. It has also been demonstrated that this isn't unique to Toyota's throttle circuits. Did the Ford, BMW, Chevrolet, and Honda that responded to a cloned floored accelerator pedal just as the Toyota did trigger fault codes? That would be worth knowing, but so far I haven't seen it mentioned.

That is not as interesting to me as the fact that the ECM can drive the throttle actuator wide open without recognizing that it is doing so. I have always doubted that the problem lies in the APP, for a number of reasons, so the duplication of an APP failure is not the focus for me. Obviously, an APP failure is not necessary to produce SUA. I don't know this but based on the available info, my best guess is the problem probably resides within the ECM. Gilbert's finding is hardly a smoking gun, but it does demonstrate that the mechanism for the failure is present in the system -- which the company has done its best to deny.

If it is to function as a cruise control then it must be able to do this, otherwise some customers would complain. What's an APP?

Accelerator Pedal Position

Very interesting documents. I will summarise them for those that don't have time to read them.

The Toyota APP sensor contains two sensors - one with an output varying from 1.5 to 5.0 VDC as the accelerator pedal moves from idle to WOT and another that varies from 0.8 to 5.5 VDC. The result is that these two voltages should always be about 1 volt apart. If the difference becomes significantly lower or higher than 1V, the ECU decides the sensor is faulty, logs a code and enters a fail-safe mode. This is a fairly safe system, in that no single fault could induce a SUA.

What Professor Gilbert has done is short the signals together using a resistor (Fault #1). A dead short would reduce the difference to much less than 1V and be detected by the ECU. A high resistance short is not unusual - it could be caused by moisture induced corrosion between terminals in the wiring harness or between tracks on a PCB for example.

Having found a range of resistances that could be used to bridge the two circuits without detection by the ECU, He then simultaneously introduced fault #2 - a short between the 5V supply and the shorted APP circuits (probably the higher voltage of the two). This has the effect of signalling 5V on one line and 4 point something on the other ie WOT to the ECU and therefore generates a SUA.

The Exponent report - commissioned by Toyota's attorneys - simulated a wide range of single-fault situations but nothing similar to Professor Gilbert's experiment. All their simulations were detected as faults by the ECU and they were unable to simulate an SUA.

The runaway prius man's story is being, ahem, heavily questioned in the media now. One good piece pointed out that you have to be a contortionist to pull the throttle pedal up in Prius as he claims he tried, yet the guy claimed to be too scared to take his hand off the wheel to change gear. etc

Shades of the great Anthrax scare - a few real occurrences and a lot of media hype=chancers going for publicity

here's one nobody on line believes either http://www.abc.net.au/news/stories/2009/12/16/2773292.htm

Not really -- the ECM always has access to throttle position. However, apparently (or we could hypothesize) the throttle diagnostics are not looking when the cruise is commanding a throttle position, and there lies the rub. But there is no particular reason the ECM can't be looking. I think it should be. Number of ways to do it, you just have to do it.

All along I have been thinking cruise-related. What else has such broad authority over throttle actuation? Several manufacturers have had SUAs with non-ETC systems. To my knowledge they invariably come down to CC. ETC doesn't eliminate the responsible bits and pieces, simply rearranges them.

Exactly, straight linear offset. (Only in the car industry.) The better way is to reverse one side so that one sensor reads 0-5V and the other 5-0V through the pedal sweep. The same for the throttle pots.

I have to confess that every single accident-resulting SUA is to some degree suspicious to me. From my perspective it's hard to believe that drivers could be that helpless. But when you talk to many regular, everyday people about SUA you find they are. They truly don't know what to do. This is not helped by television reporters explaining what to do when clearly, they don't know either. In fact, they are a fairly good indicator of the general state of automotive knowledge among the driving population: Low.

However, when I read that the Prius driver was a former member of a Corvette owner's club, it became very difficult for me to believe that he was also a hapless innocent, unable to remove one hand from the wheel to place his runaway hybrid in neutral. Strains credulity beyond the breaking point.

But that is another problem, and for the moment the problem is that cars should not do that. No defense for it. For example, Ray's sister was quite able to successfully cope with SUA -- but she also. quite rightly, decided that she would just as soon not drive such a car. I suspect that many if not the majority of SUA cases are of similar outcome. So no point in sharp-shooting the victims, let's just fix the problem.

There seem to be four obvious things that could be implemented. I'm not saying I like all of them

1) Simple direct non negotiable way of switching engine off

2) when driver selects neutral, neutral is selected non negotiably (every car I have checked allows this)

3) brake overrides accelerator above a certain speed.

4) if the APP (TPS) system detects a conflict between its sensors it registers a persistent CANBUS fault.


1 and 2 and 4 are pretty painless in my opinion, 3 I can live with but don't necessarily love.

On one of the first pages of this thread I mentioned how the electronic throttle on my concrete mixer truck works as a throttle, a cruise control and as a hand throttle.
It is supposed to only allow the hand throttle to work when the truck is in neutral. (this is for holding the revs at mixing speed for the concrete when it is loading) I can get the throttle to make mistakes.

These trucks also have a dash control to change the idle speed.

What does the Toyota use to set the idle speed? I wonder if there is any chance that the Toyota problem may not be a throttle or cruise control problem but an idle problem? (a very high idle speed!)

1/ Losing either power brakes or steering or both so no.

2/ Best - my Mazda 6 allows it in case you have never checked one. Brakes are not good with no vacuum but still have steering.
I think also simpler to train as everyone understands the basic function of the gearstick where as one would have to think about finding and operating engine kill.

1. Disagree. IMO this should be a last resort that is available to the operator. Undesirable yes, but in the event shifting to "N" or other measures don't work then this would be the last chance. Perhaps design the parking brake to assist in stopping?

2. Concur. Any news about the California cop who died in a Lexus ... supposedly he couldn't shift into Neutral. There's been some discussion about electronic lockouts. On the news the other day was a spot about shifting a Prius into "N," apparently not as simple as popping the lever to the "N" position.

In the case of the CHP officer, it appears that a) the shifter didn't work, or b) he didn't know how to use it. What might appear to select neutral on the shifter -- the standard, intuitive act of nudging the lever forward -- really only performs an upshift in the +/- manual "sport shift" function. There is a photo of the Lexus shifter further up the thread to illustrate this, reposted below. The third and most remote possibility, I think, is that the driver went into a total panic and forgot he could select neutral.

The current Prius being shift-by-wire, the lever must be held to the left for some period of time -- a few seconds -- before neutral is activated. Unsatisfactory IMO. The Prius also features the hold-down-for-three-seconds engine stop switch, which is also unsatisfactory IMO. Honestly, I do not understand the appeal in this feature. I propose that an engine stop switch should stop the engine when you push it -- as with any sensibly-designed machinery. Imagine a motorcycle or stamping press where the kill switch must be held down for three seconds.

Sounds like maybe you saw the same NBC/CNBC/MSNBC segment I did. If so, did you also find the presenter to be somewhat lacking in competence on his subject?


Lexus shifter

Indeed, and thus my curiousity as to if an interlock is a design feature (or not).



Absolutely.



Not sure but possible. The one thta I watched was on in the morning and the guy didn't seem too sharp ... ... but I have to admit that all of my attention was not focused on the presentation.

All sensible solutions. You have touched on something important in point 4: the whole point of ETC is to allow throttle position to diverge from pedal input. So it's not a matter of simple conflicts in position values between pedal and throttle -- the diagnostics must be considerably more complicated in order to identify a failure.

So I would add one more, applying to all manufacturers. The control and diagnostic regimes for ETC systems must be made more robust. For example, the ECM must always know where the throttle assembly is commanded and its actual position, in every case and in every operating condition without exception, with meta-authority over all other functions. When it doesn't know exactly where the throttle is commanded, or why, the engine is returned to idle and the red MIL is illuminated. If the automakers find this potential solution too expensive or burdensome, they can put a cable on the thing. Cables work fine.

It's entirely possible. My reaction is it's less likely than other scenarios, but really I don't know that. Whatever the problem, it lies in a hole, a window of opportunity if you will, in the ECM's design/programming -- a suite of conditions where the ECM does not have the ability to monitor and diagnose itself. So it could be literally anywhere.

When you think about the company's defense, that this failure is impossible without triggering a failure code and failsafe mode, it defies logic. That could be possible -- if the hardware and software designers operate at a degree of infallibility superior to the Pope. And as the Pope himself will tell you, he's not really infallible; that's just the company position. It's kind of amazing to me that people embrace the automaker's position as though it were a matter of scientific fact.

Your truck sounds like an interesting machine and as you know, we all like machines. Please, tell us more.

This would be a revelation if the lever rested in the 'S' slot during normal operation. I've driven a number of cars with that type of shift patern, and the only way to get into the manumatic mode is to slide the lever to the left out of drive. If you are in drive, sliding the lever forward puts you in neutral. If you are in 'S' mode, then the car only upshifts automatically at redline - nobody is going to remain in 'S' mode by accident for long.

If the CHP officer used the "manumatic mode" to rapidly accelerate and merge with traffic then once merged, (at 65 mph or so), one more "nudge" would put the car in high gear.
The car continues to accelerate, on it's own.
At 100 mph any further nudge does nothing, because he's already in high.
A pull back on the lever does nothing either, because the ECM won't allow the downshift, and cause the engine to over-rev.

so yes, it "would be a revelation if the lever rested in the 'S' slot"

If he didn't know what he was doing, why on earth would he manumatic his upshifts to merge on the freeway? He'd only be in 2nd gear if he were to floor an RX350 to 65 mph. The governed top speed would be reached in 4th gear with 2 more still to come. Also, this was a Lexus loaner. Chances are that his normal car is also a Lexus. Why wouldn't he know how the gearshift works? Manumatic isn't useful for merging. It is a gimmick with marginal returns on winding roads or when towing a trailer up or down a grade. I think McGuire honestly didn't know what he was looking at in the photo of the Lexus shifter. I don't think anyone uses manumatic shifters on the freeway.

And I think you have a tendency to personalize arguments. Now pay attention and try to keep up. I am only seeking a plausible explanation as to how the driver, a trained CHP officer, could fail to put the transmission in neutral when he had considerable time and distance to do so. One possibility: in the midst of the SUA, he didn't realize he had the shifter in the far selector gate, or couldn't get to neutral from there -- possibly after downshifting in an attempt to check his speed. Beyond that, it pretty much comes down to two remaining possibilities:

1. In a total state of panic, he simply forgot he could place the transmission in neutral.

2. The shifter was inoperative.

sorry if this is a repost, but this guy makes it look simple enough... (foul language alert)

http://www.youtube.com/watch?v=lZ4PtafRB9c

Then describe for us what he did.

I find it easy to believe that you don't know when you're being ironic.

Todd, here's a link to a page with a picture of your "hypothetical" 2010 RX350's shifter... (scroll down)

http://www.auto123.com/en/lexus/rx/2010/re...mp;artid=111587

If I was unfamiliar with the loaner car, it would be easy to find myself 'caught' in that 'gate' at the bottom left.

And where is the easy 'OFF' switch located?

No matter how much panic he was feeling, I'm sure he still would have tried to pull the accelerator pedal back with his foot... it's a natural and instinctive reaction when a car's throttle sticks...

If he did this and there really was a mat there, then he would have freed the pedal. Case closed. Toymotor lied.

Cables can bind and stick. I've had it happen. I wonder if cable throttles are statistically actually less failure prone than TBW in real world use and if so should old non-TBW cars with cable throttles be pulled off the road for being too dangerous?

Thats the same shifter that whatever new Lexus he had in for service would have had, explaining why he had a Lexus dealer loaner. This article, which has a photo of the car, says that he was driving a 2009 Lexus ES350, which is a fancy Camry.

http://www.nbcsandiego.com/news/local-beat...--58333232.html

The 2009 ES350 probably has a horizontal shifter gate.

I assume you meant to say were mechanical throttle linkages more failure prone then they should be pulled off the road. I suppose you could do this in totalitarian countries. Back in the day, I did suffer any number of stuck throttles due to amatuer aftermarket carburetor installations, fatigued and failed return springs, binding of old linkages, etc... The real reason for TBW though is out of control emissions regulation. That's why a computer controls your actual throttle opening. It is all about lift throttle emissions spikes and such. I don't know why nobody has the balls to mention this when TBW is being villified on the evening news.

Perhaps a slightly modified Start/Stop button?
At the moment you have to hold the Start button for three seconds (unless the car is moving, etc) for it to stop. Keep that, but make it so a good hard push will stop the engine immediately.
Kind of like some of the Citroen horns, where they have a two-stage button. The first one is an attention-getter, the second is a loud warning.

Yes, a lot of OEM's do that. Occurred to me though, that a single fault (short the two outputs) could register a 50% throttle condition that looks legit to the ECU, and thus trigger an SUA. (Of course there are ways around that but is it done?). Certainly the level of rejection in the Toyota system doesn't fill me with confidence.

I was told the GM equivalent uses two positive going and one negative going sensor. I still puzzle over the logic of including two sensors and then IGNORING any mismatch from them. Why bother with two?

I assume you are referring to the Toyota case. Toyota doesn't ignore mismatches, however there is of course a threshold, and between the upper and lower thresholds there is a range of "error" signal values which are ignored. The Exponent report gives details of voltage mismatch levels required to log a code. Professor Gilbert's demonstration exploits this range of "false pass".

Mainly because it's not true, I suppose. Of all the reasons to employ ETC, emissions compliance is not at/near the top of the list.

The other logical obstacle to blaming emissions regs for Toyota's SUA/ETC problems: Other manufacturers have had no discernible problems with their ETC systems while meeting the very same regulations.

For Toyota at least and as I noted earlier (hadn't we already covered this?) the company's incidence rate for SUA complaints shot straight up when it switched from manual throttle to ETC systems.

I don't see this as a manual vs. ETC issue but as reliable/safe vs. unreliable/unsafe. Obviously, ETC requires a higher level of expertise than cable, so really it's a competency issue. There's the 800 lb gorilla in the room whose gaze we are attempting to avert. When a mechanical throttle fails, a couple of trade-school mechanics can probably sort it out. With ETC, it's quite possible that an entire cubicle farm of software engineers will have trouble identifying the exact failure mechanism.

Most cars these days can store some data in the airbag controller. Data is stored and overwritten until the airbags are deployed.

The intention of this data is to help car manufacturers construct safer cars, it's not intended to help convict people. That part is especially important since the systems accuracy haven't been scientifically proven. It's also important because of privacy issues. Most people doesn't want to have their car spying at them. So, several car manufacturers have set a policy to don't give out this information, even to law enforcement. The information is there to help the car manufacturers improve their cars, nothing else.



The owner of the car.



Unless someone installs a 200 ohm resistor between the right wires in the car, what Gilbers demonstrated isn't going to happen.



Exponent also tested this trick in cars from other manufacturers, and it worked on all tested cars, although the exact resistance required differed. But in any case, this is not going to happen in reality. While a short can happen, you would need two shorts where one of the short gives a resistance of 200 ohm. Shorts don't give this sort of resistance, they either give a very low resistance, close to 0 ohm, or a very high resistance, over 1000 ohm.

The reason it doesn't trigger a fault code is because the trick results in the same voltage as would be the case if the two separate position sensors where operating correctly with a fully depressed pedal. This trick can however be beaten by system which ignore gas pedal position when the brakes are used.



I believe NHTSA stated something like that, with one exception, all the investigated crashes could be explained by either the floor mats or the throttle pedals.



With a stamping press pressing the kill switch by accident can't have any negative consequences, aside from the cost of having the machine standing still. If you shut off your car by accident at speed, which means you will lose power, servo steering and the brake booster, that can have negative consequences for safety.



Emissions are one of the reasons to employ ETC. These days you have trouble even measuring the emissions at steady state, it's emissions after cold start and during transients that are the problem. Here ETC can help you with both. Sure, there are probably other ways to make this work anyway, but ETC is the simple method.

Of course, there are many other reasons to use ETC too. Without a way for the electronics to control the output from the engine, traction control, electronic stability programme, and cruise control would be impossible to achieve.

I've turned an engine off in a car with power steering... I didn't crash, even though I was totally unused to power steering at the time (back in the seventies) and it surprised me...

I've frequently switched off and used the brakes before hitting them again to pull the car up to a stop.

These things won't kill you if you know you're going to have to put more muscle into them. But an engine screaming away putting full power through the drive train can do a lot of damage.

This seems to be what the average driver doesn't realise...

While i know that it is fairly lame. But nuetral is not where nuetral has been on cars for 40 years and having to hold a button for 3 seconds to turn the engine off is still not the same and is disconcerting.

This response is symptomatic of the "everything can be dangerous" approach to design that we live with today. It's the reason Toyota put a 3 second delay on the kill switch and ironically it's reason people died. It's a whole "you're not smart enough to operate this device, let us do it for you" mentality that concludes with the operator's sometimes tragic response of "WTF is this damned thng doing no AAAAHHHHHHHHH....."

Instead of button A (or switch, lever, knob, pedal..) performing function A, it suggests function A to the Big Brain who decides according to criteria outside the operator's knowledge whether or not to perform function A. This is what resulted with the throttle opening increasing for a few seconds at the same time as I commanded it to decrease on the Mazda 3 I test drove years ago. Now that I think about it, that is a textbook instance of Unintended Acceleration, though no floor mat or driver error was involved.

I firmly believe that a properly designed human interface will give the vehicle operator physical feedback to signal to him when it is overriding his command. No buzzers or lights or soothing calm voices, just raw physical feedback. In the case of my Mazda 3 incident the pedal should not have been allowed to move further than the throttle butterfly was being commanded. In the case of the Toyota Start/Stop button, it should either work instantly, or depress gradually over 3 seconds as the timer counts down, or be replaced with a more suitable input device altogether.

If highly trained pilots are crashing because of confusion with their FBW planes, what chance is there for everyday drivers on the roads if the same thinking is applied?

It was never a problem until a few automakers adopted the asinine practice of placing a giant boy-racer start button in the center of the dash. If the ignition switch is placed where it belongs, within easy reach of the driver and no one else, there is little to no danger of the ignition being switched off accidentally. You may recall that cars were built this way for many decades and the incidence rate of safety problems with this layout was essentially nil -- even with a locking steering column.

We don't need a big start button in the center of the dash. It's stupid and juvenile and serves no useful purpose. If having one means the engine stop function must also be compromised, that is even more stupid and juvenile. Someone, anyone: Tell me how that makes the least bit of sense whatsoever.

I agree 100%. It is now trendy[and stupid] to have the pushbutton ignition. Boy racer stuff on a trendy 'green' Prius.
As I have bleated before standardised controls should be on all cars. Ign switch , light switch, wiper switch and gear change controls should be standardised so they are all in the same general location so when a driver gets in they can use the car without hunting for basic controls.

I disagree, despite pointing out the motorcycle bit early. It imposes an arbitrary design constraint and places more of the responsibility for safe operation on the cube farm nerds instead of the end user. Drivers need to be more responsible, not any less than they are. Controls should function as expected (IE - as if it were mechanical) but their location and whether they're a button, a lever or a knob shouldn't be mandated by some international conglomeration of safety Nazis.