134 replies to this topic

[Greg Locock]

Rather than resurrect the 1200 post thread I thought I'd kick off a new one.

 

http://www.eetimes.c...3&page_number=1

 

Loosely describes some rather obscure issues with the ECU programming. Having driven several proto cars where the ECU soft rebooted some loops several times a minute due to stack errors and so on, I can't say I am much convinced by this as an explanation, but it certainly seems to have put the willies up Toyota (ie they are paying out cash rather than refute the claims).

 

 

[desmo]

If the OS is self aware enough to blue screen which is the norm, it is self aware enough to have a fail safe or limp home base state. No?

[Greg Locock]

I'd have thought so. It is a long time since I was involved in engine/trans calibration, but back then if enough things went wrong you got 3rd gear, open torque converter, fixed spark, fixed mixture. An amazingly high proportion of taxis drove around in that configuration. 3rd gear open was not too bad.

[ray b]

I will not buy a car that drives for me

I want total control of throttle position 

or spys on me [crash data logs]

 

I heard they lost a jury trial

but had not heard of other big pay outs

[Zoe]

Is than an Haiku? 

 

Zoe

[Greg Locock]

$1.2 to $1.4 /billion/ in total although that does include a whole bunch of other stuff, fines, and rectification costs. Still, it's big bickies. It's worth reading that EE article, they don't seem impressed by NASA's previous investigation that Toyota relied on.

[Magoo]

Thanks for the article, good read. 

[jpf]

This article has a little more substantive discussion of the findings, although it is written by the consultant who did the software analysis for the plaintiff:

 

http://www.edn.com/d...ts-consequences

 

It gives a little more detail as to how embedded systems with failsafes can still fail to catch bad states, or how they may still act improperly when caught and lead to dangerous signals sent to the vehicle controls.

 

More interestingly, it discusses the failure of Toyota to meet coding standards set forth by the industry consortium MISRA (Motor Industry Software Reliability Association) and their own internal standards -- this is the part that is especially damning, because it describes coding standards that Toyota's own documents show they intended to comply with, but failed badly to do so.  This seems particularly hard for Toyota to explain away in court.

 

So while nothing was identified as the cause of this particular (or other, AFAIK) incident, it shows that there were defects which could potentially cause such incidents, and that there was laxity in the coding standards which will tilt juries in support of negligence claims.

[gruntguru]

Is than an Haiku? 

 

Zoe

[Magoo]

This article has a little more substantive discussion of the findings, although it is written by the consultant who did the software analysis for the plaintiff:

 

http://www.edn.com/d...ts-consequences

 

It gives a little more detail as to how embedded systems with failsafes can still fail to catch bad states, or how they may still act improperly when caught and lead to dangerous signals sent to the vehicle controls.

 

More interestingly, it discusses the failure of Toyota to meet coding standards set forth by the industry consortium MISRA (Motor Industry Software Reliability Association) and their own internal standards -- this is the part that is especially damning, because it describes coding standards that Toyota's own documents show they intended to comply with, but failed badly to do so.  This seems particularly hard for Toyota to explain away in court.

 

So while nothing was identified as the cause of this particular (or other, AFAIK) incident, it shows that there were defects which could potentially cause such incidents, and that there was laxity in the coding standards which will tilt juries in support of negligence claims.

 

 

Fairly damning.

 

A few years ago here when folks were saying unintended acceleration was "impossible," they weren't using their imaginations. If the ECU is empowered to open the throttle, it's possible. 

[desmo]

Did anyone actually say unintended accelerations were "impossible"? Can't recall that.

[gruntguru]

This is the key (scary stuff). I am sure the statement should apply to the entire motor industry - not just Toyota.

 

"NHTSA needs to get Toyota to make its existing cars safe and also needs to step up on software regulation and oversight. For example, FAA and FDA both have guidelines for safety-critical software design (e.g., DO-178) within the systems they oversee. NHTSA has nothing."

[Greg Locock]

There were a lot of scary phrases, even "11,000 global variables" made me shiver. I mostly write matlab where variables are local by default.

 

Funnily enough in the 1210 post thread, the cruise control task came up as having the right sort of charactiersitics to be a smoking gun, I think Magoo suggested it. Task X is cruise control, amongst other functions.

[mariner]

Very interesting, particularly with respect to another prior topic here - driverless cars.

 

If its this hard to provide a fail safe throttle, such a basic function, then how can a driverless car be presumed safe in law?

 

I'm not discusing if is it safe but what happens if it is suspected of having a fault?

 

I don't know the case or the relative qualifications of the Toyota engineers and the plantiff's experts but curently the State of California is defining rules i.e laws for driverless cars.

 

Will those laws specify the softwares' detail fail safe standards for every control sub system?

 

Even if they do wil it be impossible for an expert witness to prove, to a civil court standard ( which is NOT beyond reasonable doubt) that the rules required by the law are infallible?

 

If the combination of law, rules and execution are found faulty who gets to pay out the $1.5m per case?

 

Maybe  its a bit like a plane crash lawsuit ( not an FAA/CAA investigation) - the pilot /airline or maker can be sued but not the FAA?

 

 

 

 

[pugfan]

This is the key (scary stuff). I am sure the statement should apply to the entire motor industry - not just Toyota.

 

"NHTSA needs to get Toyota to make its existing cars safe and also needs to step up on software regulation and oversight. For example, FAA and FDA both have guidelines for safety-critical software design (e.g., DO-178) within the systems they oversee. NHTSA has nothing."

 

Exactly, don't blame software, how many thousands of people are this second totally reliant on fly by wire software for their lives?

[pugfan]

There were a lot of scary phrases, even "11,000 global variables" made me shiver. I mostly write matlab where variables are local by default.

 

Funnily enough in the 1210 post thread, the cruise control task came up as having the right sort of charactiersitics to be a smoking gun, I think Magoo suggested it. Task X is cruise control, amongst other functions.

 

11,000 global variables? That sort of thing screams poor software architecture.

[Magoo]

Did anyone actually say unintended accelerations were "impossible"? Can't recall that.

 

I think that was a common retort but I could be wrong, often am. Here is the previous discussion. 

 

 

 

http://forums.autosp...-aways-not-f-1/

[Lee Nicolle]

I'd have thought so. It is a long time since I was involved in engine/trans calibration, but back then if enough things went wrong you got 3rd gear, open torque converter, fixed spark, fixed mixture. An amazingly high proportion of taxis drove around in that configuration. 3rd gear open was not too bad.

Been there done that. And the 'experts', both Ford and Auto Elecs cannot find anything wrong.
It can be but far from exclusively a bad earth wire from the battery to the body.

As for Toymota maybe they should go back to basics and use throttle cables and proper ignition switches. And while they are at it fix the creeping cruise controls too.
Though many other manufacturers have the same problem.

[Magoo]

 

 

Funnily enough in the 1210 post thread, the cruise control task came up as having the right sort of charactiersitics to be a smoking gun, I think Magoo suggested it. Task X is cruise control, amongst other functions.

 

Skepticism is a genuine skill. 

[BRG]

I wonder why there are no Toyota run-aways in the UK?  Must be our climate.

[Scotracer]

I wonder why there are no Toyota run-aways in the UK?  Must be our climate.

 

Could be different calibration. 

[MatsNorway]

Whe had one in Norway too. Experts from Germany found no errors and the drivers claims was put in doubt as he claimed 176km`t as he stopped it by going into the autorail, it had only minor scratches.

http://www.dagbladet...afikk/10869939/

[rory57]

Every bike I have ridden has had a kill switch, which disconnected power to the ignition circuit. A proper disconnect of the DC too, not a signal to inhibit ignition electronics or to the engine controller.

 

Similarly, when I worked on computer controlled production equipment with moving / rotating parts, the requirement was always for a physical break in the power supply to the system, using these    and specially rated relays designed so that the contacts could not stick.

The product liability insurers were absolutely adamant that STOP had to mean NO POWER to the system.

Should I ever buy myself that Lexus SC430 I fancy, I will be fitting just such a switch.

[Magoo]

Every bike I have ridden has had a kill switch, which disconnected power to the ignition circuit. A proper disconnect of the DC too, not a signal to inhibit ignition electronics or to the engine controller.

 

Similarly, when I worked on computer controlled production equipment with moving / rotating parts, the requirement was always for a physical break in the power supply to the system, using these    and specially rated relays designed so that the contacts could not stick.

The product liability insurers were absolutely adamant that STOP had to mean NO POWER to the system.

Should I ever buy myself that Lexus SC430 I fancy, I will be fitting just such a switch.

 

 

At the very least we could couple the throttle control to the brake pedal, FFS. (Though some people object to this feature as it interferes with their hooning, evidently.) 

 

 

I believe I noted this earlier, but: a stuck throttle is one thing when you have net 90 hp at the drive wheels all in, and it's another thing altogether with 200+ hp. A Toyota Camry V6 now has 263 hp, I see, and does 0-60 mph in 5.8 seconds. That's quicker than a 1965 Pontiac GTO 389 4-speed, etc. 

[Lee Nicolle]

I will say this again. The cars concerned had the moronic pushbutton start,, which you have to hold down for a number of seconds to turn the engine off. Not a good situation for a panic stop. You can drive through a LOT of scenery waiting 3-5 sec.

Obviously putting the car in neutral would be smarter though many cars are decidedly difficult to do that in too. You do have to look.

 

What is the attraction to these stupid switches? They make no sense to me. Nor does carrying a key in your pocket when you are driving.

Plain commonsense and practicality is totally denied. And turning the key off is a damn site easier in a panic ,,, providing you don't turn to far. Though most modern cars are fairly good in that respect these days.

A friend who drives an upmarket Euro [brand withheld as he is arguing with the dealer] had the wonderful feeling recently as he walked through a car park another car similar [but not the same model] opened up as he walked near it. And that make could be counted in the dozens in Adelaide, not the thousands as the popular makes are.

 

I have said this before too. Standardisation of controls is important. Ignition key in the same location, turn signals and wipers too. And standardising heat and ventilation would be great too. But instead everyone has to reinvent the wheel and put controls all over the shop. On many occasions I have had to stop to work them out driving a different car. And stopping in fog to try and work out the demister is hardly a great idea.  Even the damned radios are near impossible at times.

[Terry Walker]

I was out on a job the other day and watched as someone tried to back a brand new car out of a driveway--not their own car, just borrowed the keys for the task--and couldn't work out how to start it. The owner explained, the car was started--and then the driver couldn't work out how to find reverse.

 

Hadn't done their full conversion training course on a simulator I guess. Used to a real car with actual key and actual gear lever.

 

Lee is right about dumb switches... I have several electronic gadgets (eg printer, kindle) which require a looooong push of the switch to turn off, Serious butt pain. The technology is cheap, it exists already, why not use it in a car?  Lots of reasons.

 

And I agree--if you are in a car which will not let you switch it off nor let you get out of gear, you are in a death trap which should not be type approved for licencing anywhere in the world.

[gruntguru]

All very true. The parallel to aviation and Terry's reference to "type approval" is interesting. The auto industry and its regulators are obsessed with crash testing but a small amount of regulation around standardisation of controls would do much to reduce the road toll (worldwide about 1.25 million per annum these days plus how many serious injuries and permanent disbility?)

 

The aviation industry had a total of about 500 fatalities in 2012. Mostly due to the high degree of regulation and standardisation, meticulous failure analysis and rigorous testing and justification before any innovation is allowed into widespread use.

[saudoso]

I had a push button start rental one time for a week. Twice left the car stranded at a garage entrance with the keys going away on my pocket and the operator had to run after me to get it. Couldn't understand the point either.

[BRG]

All very true. The parallel to aviation and Terry's reference to "type approval" is interesting. The auto industry and its regulators are obsessed with crash testing but a small amount of regulation around standardisation of controls would do much to reduce the road toll (worldwide about 1.25 million per annum these days plus how many serious injuries and permanent disbility?)

 

The aviation industry had a total of about 500 fatalities in 2012. Mostly due to the high degree of regulation and standardisation, meticulous failure analysis and rigorous testing and justification before any innovation is allowed into widespread use.

There is no real standardisation of controls in aviation.  That's why you need to have a specific type qualification before you are allowed to fly a different aircraft.  There have been accidents due to pilots not being fully familiar with an aircraft.  

[Lee Nicolle]

I was out on a job the other day and watched as someone tried to back a brand new car out of a driveway--not their own car, just borrowed the keys for the task--and couldn't work out how to start it. The owner explained, the car was started--and then the driver couldn't work out how to find reverse.
 
Hadn't done their full conversion training course on a simulator I guess. Used to a real car with actual key and actual gear lever.
 
Lee is right about dumb switches... I have several electronic gadgets (eg printer, kindle) which require a looooong push of the switch to turn off, Serious butt pain. The technology is cheap, it exists already, why not use it in a car?  Lots of reasons.
 
And I agree--if you are in a car which will not let you switch it off nor let you get out of gear, you are in a death trap which should not be type approved for licencing anywhere in the world.

In recent times I have had the misfortune to work on some truly awful vehicles. A Renault van that has a lever out of the floor, no markings or gates. A Citroen with weird controls. A hassle to get them on the hoist and off again just to fit tyres and brake pads.
As a long time car dealer I have almost had accidents test driving different cars. And I ever only bought mainstream stuff. And would be worse now. I dabble in a few select groups these days.
The 4 cars I drive most personally are 4 entirely different cars just to work the gear lever,, all autos.And mainstream brands.

Edited by Lee Nicolle, 06 November 2013 - 21:51.

[chipmcdonald]

Could be different calibration. 

 

I wonder why there are no Toyota run-aways in the UK?  Must be our climate.

 

... Could be your lawyers?

 

Could somebody explain the nature of what form the control signal is as it leave the ECU to the servo/throttle motor? 

 

Does the throttle body mechanism have it's own logic, could something as primitive as a short/bad ground/water make it decide it's getting a 0, or a full-scale signal?  Seems like everyone points to the ECU as the culprit in this case but there isn't an actual smoking gun?

[Greg Locock]

as described in the enormous thread, typically the throttle pedal sender is 3 pots, 2 going up and one going down in resistance as the throttle pedal moves. So if the pedal shorts and reads zero then the EEC knows something is wrong.

 

rory - you might be amused by slide 7 in this story http://news.drive.co...1022-2vyd7.html although probably not as amused as I was by some of the comments.

[Lee Nicolle]

as described in the enormous thread, typically the throttle pedal sender is 3 pots, 2 going up and one going down in resistance as the throttle pedal moves. So if the pedal shorts and reads zero then the EEC knows something is wrong.
 
rory - you might be amused by slide 7 in this story http://news.drive.co...1022-2vyd7.html although probably not as amused as I was by some of the comments.

What the ! It is the back of a Territory taped onto a Ranger Ute. Such flowing lines and panel fit!!

[GreenMachine]

Yes, I had to smile at some of the comments in the accompanying story.

 

I note they have fitted a BRB to kill the engine in case of runaway throttle events ... maybe someone there is reading these threads??

[Greg Locock]

Only if they have a time machine. SOP for at least 10 years.

[Amaroo Park]

I wonder why this isnt an issue here in Australia

[Catalina Park]

I wonder why this isnt an issue here in Australia

 

Because we have good quality technicians working on our Toyotas?

[Amaroo Park]

"You might very well think that; I couldn't possibly comment"

[Catalina Park]

They call 'em technicians 'cause they ain't mechanics.

[Lee Nicolle]

I wonder why this isnt an issue here in Australia

It has been a problem. Hushed up but a genuine problem.
As many will attest.
Talk to Ray Bell!

[Amaroo Park]

Ok News to me, so what are they doing about it out here?

[BRG]

I wonder why this isnt an issue here in Australia

Probably the same reason why it hasn't been a problem in the UK.  Our lawyers just ain't vicious enough.

[Amaroo Park]

I have been chasing this up but can't find any info on it over here

[gruntguru]

Ray

must be

on holidays.

[Catalina Park]

I bet the dealers know all about it and the Service managers are hushing it up while the techs are performing voodoo rituals on the ECU.

[Lee Nicolle]

I bet the dealers know all about it and the Service managers are hushing it up while the techs are performing voodoo rituals on the ECU.

Hardly a secret. Dealers however are the mugs in the middle!

[indigoid]

The go pedal used to occasionally wedge underneath the OEM floor mat in my 2001 (AE112) Corolla. Instead of lawyers-at-ten-paces I decided that I'd probably kicked it forward a bit. I recall the floor had a metal locating hook sticking up out of it that poked through a corresponding hole in the mat, presumably to stop the mat sliding forward, but this wasn't enough, and it still moved around just enough to be troublesome. Eventually just got rid of the mat and didn't look back.

 

It shouldn't have happened at all, though, and in my case it was fortunate that my car had that pesky third pedal (and that I knew what it was for!). I never drove a two-pedal version of that car, so NFI if they had the same issues. I expect they did.

 

No more floor mats. IMHO cars should have some kind of barrier underneath the driver seat, too, to stop things sliding forward from the rear seat floor.

 

Some of the more modern Corollas that I've rented from time to time have had an inexplicable large gap in the dash/forward console bit between the front seats, ahead of the transmission lever, and down quite low. It concerned me that anyone truly taking advantage of their rental car  might be at risk of things flying from the passenger footwell over into the driver footwell. It never happened to me, but it seemed distinctly possible. And $deity forbid that anyone actually store stuff there...

[Lee Nicolle]

The go pedal used to occasionally wedge underneath the OEM floor mat in my 2001 (AE112) Corolla. Instead of lawyers-at-ten-paces I decided that I'd probably kicked it forward a bit. I recall the floor had a metal locating hook sticking up out of it that poked through a corresponding hole in the mat, presumably to stop the mat sliding forward, but this wasn't enough, and it still moved around just enough to be troublesome. Eventually just got rid of the mat and didn't look back.
 
It shouldn't have happened at all, though, and in my case it was fortunate that my car had that pesky third pedal (and that I knew what it was for!). I never drove a two-pedal version of that car, so NFI if they had the same issues. I expect they did.
 
No more floor mats. IMHO cars should have some kind of barrier underneath the driver seat, too, to stop things sliding forward from the rear seat floor.
 
Some of the more modern Corollas that I've rented from time to time have had an inexplicable large gap in the dash/forward console bit between the front seats, ahead of the transmission lever, and down quite low. It concerned me that anyone truly taking advantage of their rental car  might be at risk of things flying from the passenger footwell over into the driver footwell. It never happened to me, but it seemed distinctly possible. And $deity forbid that anyone actually store stuff there...

While I have frequently had mats get 'under my feet' in cars and on occasion even jam the go slightly, it is not full throttle jam as reported. Most cars do not have go pedals hinged from the floor these days. So how the mats jam them I do not know. My Landcruiser and Camry both have top hinged pedals.95 and 2004 models. The Landcruiser factory mats never cause any trouble. Surprisingly I have never had a Camry with them. [New car dealers push the accessories big time at point of sale as sometimes they make more money on them than on the car!]
The clutch pedal however solves all of the problems,,, if you do not panic as many seem too.
But it seems what is causing most accidents is the STUPID push button start. And 3-5 sec STOP delay. For mine EVERY vehicle fitted with this garbage [of all makes] should be recalled and fit an ignition key and lock. And the government regulators world wide who allowed this garbage should be made to count paperclips for the rest of their lifes.
Though the dozens of in traffic fender benders probably caused by this is still a HUGE concern. Late Toyotas are far less popular as used cars because of this. Though I suspect other makes too may have these problems besides the named ones. Too much electronics in an environment very alien to electronics. Dirt, heat, viabration.
That caused problems on a late Hilux belonging to an aquaintance, occasionally when he drove on a rough dirt road it would stop. Then normally start again though sometimes ran strangely. Since this bloke is a farmer it was a major concern. In the end after about 6 visits to the dealer [who did try] they eventually found a crook ECU. Replaced it and so far ok. It may have been the viabration or just the dust in the car. Whatever it should not happen but it is an alien environment for electronics.
Most repairers will tell similar problems, and unless they happen in your care near impossible to find. And worse the so called 'experts' often have no more idea than the average repairer. This is large auto elec shops and genuine dealers. The number of dodgy fixes for some of these dramas is putting a resistor in the loom. Putting the ECU in the fridge overnight! They do work but who knows how long. The above is for a continually rich mixture on a popular make. Something that is rife on many makes and models. That and dodgey transmission changes. Is it the ECU, is it a dirty connection, is it a crook sensor or sender? Or in one case the harness had a crook wire. This after we cleaned the engine it would not start again. They replaced the harness,, a week after and the car ran better than it had before.
Even a dodgey alternator, or battery can cause grief. this a battery that starts the car, or an alternator that still charges.
Cleaning engines can be a drama. Water gets where is should not and causes all sorts of grief. One particular make amazes me they ever run in the rain! As they are a real drama when you clean the engine.Though I have had them running really poorly on a wet day. As a used car dealer I have had to refuse to fix it. It is a manufacturing fault.

[Amaroo Park]

What is the START button doing to cause the accidents?

[JAW]

Having to drive Toymota hacks for work purposes, I reckon they are merely appliances, & fairly unpleasant as driving machines..

That fly-by-wire throttle disconnect is un-nerving, & the plough understeer/poor driver visibility is shocking.

 

I seriously doubt that claim of a sub-6 second 0-60mph V6 Camry time too, (& I've tried)..

 

But they are 'female-friendly' apparently, & many Toymota drivers don't know any better I guess..