Denial of Motor Vehicle Defect Petition

AGENCY:

National Highway Traffic Safety Administration, (NHTSA), Department of Transportation.

ACTION:

Denial of a petition for a defect investigation.

SUMMARY:

This notice sets forth the reasons for denying a petition (DP15-007) submitted to NHTSA under 49 U.S.C. 30162 and 49 CFR part 552, requesting that the agency “have Toyota correct software defects in their electronic throttle control software” and then “issue a national recall of all effected [sic] vehicles and have Toyota replace the old faulty code with the new safer code.”

FOR FURTHER INFORMATION CONTACT:

Mr. Stephen McHenry, Vehicle Control Division, Office of Defects Investigation, NHTSA, 1200 New Jersey Avenue SE., Washington, DC 20590. Telephone 202-366-4883. Email stephen.mchenry@dot.gov.

SUPPLEMENTARY INFORMATION:

1.0 Introduction

Interested persons may petition NHTSA requesting that the agency initiate an investigation to determine whether a motor vehicle or item of replacement equipment does not comply with an applicable motor vehicle safety standard or contains a defect that relates to motor vehicle safety. 49 U.S.C. 30162(a)(2); 49 CFR 552.1. Upon receipt of a properly filed petition, the agency conducts a technical review of the petition, material submitted with the petition, and any additional information. 49 U.S.C. 30162(c); 49 CFR 552.6. The technical review may consist solely of a review of information already in the possession of the agency, or it may include the collection of information from the motor vehicle manufacturer and/or other sources. After considering the technical review and taking into account appropriate factors, which may include, among others,, agency priorities, the likelihood of uncovering sufficient evidence to establish the existence of a defect, and the likelihood of success in any necessary enforcement litigation, the agency will grant or deny the petition. See 49 U.S.C. 30162(d); 49 CFR 552.8.

2.0 Petition Background Information

In a letter dated September 15, 2015, Dr. James Stobie (the petitioner) requested that NHTSA “have Toyota correct software defects in their electronic throttle control software” and then “issue a national recall of all effected [sic] vehicles and have Toyota replace the old faulty code with the safer code.” Dr. Stobie references two previous defect petitions related to unintended acceleration in Toyota vehicles that NHTSA recently evaluated and denied. The petitioner stated that his petition contains new information affecting NHTSA's conclusions in the previous petition evaluations. This includes: (1) Information related to a crash that occurred as his wife was attempting to park their model year 2010 Lexus HS250H; (2) the source of EDR data in Toyota vehicles; (3) alleged defects in the Toyota Electronic Throttle Control (ETC) software; and (4) a recall conducted by Honda in Japan. NHTSA has reviewed the material cited by the petitioner. The results of this review and our evaluation of the petition are set forth in the DP15-007 Petition Analysis Report, published in its entirety as an appendix to this notice.

After a thorough assessment of the material submitted by the petitioner, the information already in NHTSA's possession, and the potential risks to safety implicated by the petitioner's allegations, it is unlikely that an order concerning the notification and remedy of a safety-related defect would result from any proceeding initiated by granting Dr. Stobie's petition. After full consideration of the potential for finding a safety related defect in the vehicle, and in view of NHTSA's enforcement priorities and its previous investigations into this issue, the petition is denied.

Appendix—Petition Analysis—DP15-007

1.0 Introduction

On September 23, 2015, the National Highway Traffic Safety Administration (NHTSA) received a September 15, 2015 letter from Dr. James Stobie, Ph.D. (the petitioner), petitioning the agency to “have Toyota correct software defects in their electronic throttle control software” and then “issue a national recall of all effected [sic] vehicles and have Toyota replace the old faulty code with the safer code.” The petition cites a crash that occurred as his wife was attempting to park their model year 2010 Lexus HS250H in an angled parking space facing a brick building and references two previous Toyota unintended acceleration defect petitions that NHTSA evaluated and denied. Dr. Stobie's petition also alleges that new information not considered by the Agency in those prior petitions should be evaluated by NHTSA. This new information includes: (1) The facts and circumstances of a crash that occurred as his wife was attempting to park their model year 2010 Lexus HS250H; (2) the source of EDR data in Toyota vehicles; (3) alleged defects in the Toyota Electronic Throttle Control (ETC) software; and (4) a recall conducted by Honda in Japan.

2.0 Petition Analysis

2.1 Background

2.1.1 EDR Data Limitations

The Toyota EDR collects pre-trigger data (vehicle speed, engine speed, brake switch status, and accelerator pedal position sensor #1 voltage) from the vehicle's High Speed Controller Area Network (HS-CAN), which is refreshed either periodically or immediately by the respective control modules.

The EDR continuously performs 1 Hz sampling of HS-CAN pre-trigger data and stores the data in a temporary buffer. The EDR only saves this data, along with the trigger data, when it detects a triggering event such as a crash. Table 1 shows the refresh rates and resolutions for the pre-crash data signals. Any analysis of EDR data for Toyota vehicles should apply these data time tolerances and resolutions at each of the pre-crash data points.

In 2010, NHTSA's Vehicle Research and Test Center (VRTC) conducted testing to validate the EDR pre-crash data used in NHTSA field investigations. The testing found that the pre-crash data recorded by the Toyota EDR were accurate within the known limitations resulting from the data resolution and sampling rates. The testing also demonstrated that the EDR does not necessarily capture all accelerator pedal applications during an event and the accelerator pedal voltage recorded at each EDR time interval may not be the actual accelerator pedal voltage at that interval. Subsequent studies have confirmed the limitations of stored EDR pre-crash data in capturing the entire crash event due to the data refresh rates, data resolutions and EDR sampling rates.

The EDR download report clearly notes these issues in the first two items of Data Limitations section on page one of the report:

• Due to limitations of the data recorded by the airbag ECU, such as the resolution, data range, sampling interval, time period of the recording, and the items recorded, the information provided by this data may not be sufficient to capture the entire crash.
• Pre-Crash data is recorded in discrete intervals. Due to different refresh rates within the vehicle's electronics, the data recorded may not be synchronous to each other.

2.1.2 National Research Council Report

In 2012, the National Research Council released a report that included a review of NHTSA's processes for investigating allegations of sudden unintended acceleration in Toyota and other vehicles. As noted in the agency's denial of DP14-003, the report concluded that NHTSA's decision to close its investigations of Toyota's ETC were justified based on the initial investigations, complaint analyses, field investigations using EDR data and NASA's examination of the Toyota ETC. With regard to allegations of low-speed surging with ineffective brakes, the report stated:

Reports of braking ineffectiveness in controlling a vehicle experiencing the onset of unintended acceleration from a stopped position or when moving slowly requires an explanation for the ineffectiveness, such as physical evidence of damage to the brake system. Under these circumstances, investigating for phenomena other than pedal misapplication absent an explanation for the ineffectiveness of the brakes, which are independent of the throttle control system and are designed to dominate engine torque, is not likely to be useful.

2.2 Crash Incident

The crash identified by the petitioner involved a sudden acceleration incident experienced by his wife as she attempted to park the family's 2010 Lexus HS250H on June 20, 2015, while on the grounds of the United States Naval Academy.

2.2.1 Driver's Statement

Mrs. Stobie described the sudden unintended acceleration incident in several complaints submitted to ODI from June 21, 2015 to August 17, 2015 (VOQ's 10726415, 10726781, and 10749195). She provided the following statement in the most recent complaint (VOQ 10749195):

My accident was caused by unintended acceleration. As I was slowly turning right into a parking place, the car suddenly accelerated and crashed into a brick building. The force of the crash caused the air bags to deploy. There was so much damage to the car that it was a total loss. After the crash I obtained the event data recorder (EDR) reading from a contractor hired by Toyota. It showed that for the last 5 seconds before the crash, I was applying very light pressure to the gas pedal up until the last .8 seconds. For the last .8 second the EDR shows that my foot was on the brake and the throttle was at nearly maximum value. During the last .8 seconds the car went from 5 mph to 9.9 mph and the engine rpm went from 1200 to 2800. I did not apply pressure to the gas pedal at this time. I was applying pressure to the brake pedal . . .

2.2.2 Event Data Recorder Data

The petitioner provided a copy of the EDR download data (Table 2).

The EDR data shows that at the most recent EDR sample prior to impact (t = −0.8 s), the vehicle is nominally within 10 ft. of the building, travelling approximately 7 ft./s, the accelerator is at approximately 22 percent of full apply and the brake is not applied. The recorded data at the airbag trigger point (t = 0 s), shows that the accelerator pedal was fully applied at sometime within 0.512 seconds prior to the trigger point (see Section 2.1.1 EDR Data Limitations for the source and refresh rate of Accelerator Rate) and the brake switch is “On.”

In support of his allegation that data provided to the EDR was corrupted by an undefined software error, the petitioner notes that the EDR erroneously states that the brake pedal and accelerator were both being pressed at the same time. Other vehicle data shows that they were not: This information does not validate the conclusion adopted in the petition. Separate data downloaded from the Hybrid Control Unit (HCU) for the petitioner's vehicle indicates that the brake pedal and the accelerator pedal were not applied simultaneously at any time during the key cycle in which the petitioner's accident occurred. As noted above, the EDR reads the position of the brake light switch instantaneously while there can be a time lag as long as 0.512 seconds in writing accelerator position to the EDR. Since the brake light switch was in the ON state at the air bag trigger point, this indicates that the brake was not applied until after the accelerator pedal was released, which must have occurred in the final half second of travel.

In addition, as noted by the petitioner, brake testing conducted by Toyota field inspectors after the incident found that the system performed normally and was capable of stopping a vehicle at full throttle:

During the test drive they floored the accelerator and then quickly slammed on the brakes. The car behaved as expected. Nowhere did they find a safety defect.

Based on the recorded vehicle speeds, the vehicle was inside the parking space when the most significant acceleration occurred. At this time and distance from impact, a driver would normally be applying the brake or coasting and not applying the accelerator to full throttle. Although the driver alleged that the brakes were not effective during the incident, the brakes had no prior history of malfunction and the post-incident inspection did not identify any issues with the brake system. Review of the EDR and HCU data indicate very late activation of the Brake Stop Lamp Switch after full application of the accelerator pedal. These data do not support the driver's statement that the brake was applied when the acceleration occurred. Based on the foregoing information, this incident appears to be a case of pedal misapplication.

2.3 Source of EDR Data

The petitioner correctly notes that the EDR receives the Accelerator Rate voltage from the engine computer and not directly from the pedal and asserts that this is “new critical information about EDR data.” In the petitioner's view, the analog to digital conversion of the accelerator pedal signal and subsequent processing by the engine computer creates a potential pathway for an unknown software error to create erroneous accelerator position data. However, this is not “new” information about the source of the accelerator pedal position data sampled and recorded by the EDR. All prior work by the agency related to Toyota EDR data dating back to the joint NHTSA/NASA study, including the two previous petitions and other studies referenced in that work, recognized and reported that the EDR samples Accelerator Rate voltage data from the HS-CAN bus. Further, as discussed below, the engine computer software has been exhaustively examined, including analysis in the NHTSA/NASA study, and no one, even consultants who have offered testimony asserting the software is defective, has identified a specific and reproducible mechanism or set of conditions that produces unintended acceleration or the “false” data phenomenon put forward in the petition. As noted in the prior work and in Section 2.1.1 of this report, the HS-CAN bus receives the Accelerator Rate data from the engine control module, which refreshes the data every 512 ms (see Table 1).

The EDR continuously samples the HS-CAN data once per second and stores the data in a temporary buffer. The EDR only saves this data, along with the trigger data, when it detects a triggering event such as a crash. Because of the manner in which the ECM updates/refreshes the data to the HS-CAN, the “recorded” Accelerator Rate data saved by the EDR is not necessarily the “actual” data at the precise time intervals captured by the EDR. For example, the Accelerator Rate recorded by the EDR for the petitioner's crash at the trigger point (t = 0 s) is not necessarily the actual data at the trigger point, but the most recent value refreshed to the HS-CAN over the prior 512 ms. This explains why it is possible for the EDR data to show that the accelerator appeared to be applied fully at the same time the brake switch was in the ON position when the HCU data shows that the brake and the accelerator were not applied simultaneously.

2.4 Alleged Software Defects

The petitioner states that software defect theories posited by plaintiff experts in unintended acceleration litigation against Toyota is new evidence since the joint NHTSA/NASA study. However, ODI has previously reviewed this information during its evaluation of DP14-003. The petitioner does not provide any new information about the theories or his allegations of defects in the Toyota ETC software. As noted in ODI's denial report for DP14-003, the software defect theories failed to identify a precise cause for sudden acceleration, the software experts did not reproduce the alleged software defects in testing, and the theorized conditions did not result in sudden acceleration when artificially simulated. We find no basis for concluding that the software defect theories constitute scientifically valid evidence or could explain the incident alleged by the petitioner.

ODI's assessment of the software defect theories is not substantially different from that of one of the plaintiff attorneys who hired the software experts. These plaintiff attorneys provided the following characterization of the software experts' work and findings in a document related to the Toyota SUA property loss settlement in 2013:

While Plaintiffs' software experts raised certain software design and architecture issues, they have not been able to identify a defect that is responsible for the vast array of SUAs reported to Toyota and NHTSA by vehicle owners. More specifically, Plaintiffs have been unable to reproduce a UA in a Subject vehicle under driving conditions.

In addition, an October 2013 order from the presiding judge in the Toyota ETC multi-district litigation provided the following characterization of the software defect theories cited by the petitioner when issuing a ruling in a sudden acceleration case:

Toyota's Motion for Summary Judgment is premised on the uncontroverted fact that Plaintiff has been unable to identify a precise software design or manufacturing defect and point to physical or otherwise traceable evidence that the defect actually caused the Camry throttle to open from an idle position to a much wider angle without analog input from the driver via the accelerator pedal. To a lesser extent, it is also premised upon the fact that Plaintiff cannot prove the actual failure of Toyota's fail-safe mechanisms in the Camry on the day of the collision.

2.5 The Honda Example

The petitioner references a 2014 recall of 175,000 Honda Fit vehicles in Japan as an example of a software defect causing unintended acceleration accidents (Honda Foreign Campaign Number 14F-057). The Honda recall addressed programming flaws that may result in unintended acceleration during specific operating conditions. Honda's Foreign Recall Report to NHTSA described the programming flaws and operating conditions:

The vehicle may lurch forward due to excessive driving force generated by the motor if the accelerator pedal is pressed strongly when the vehicle is in Engine mode and shifted into Drive or Reverse, or the vehicle is in EV mode and being operated on a slope. The vehicle may also lurch forward momentarily due to excessive driving force generated by the motor when switching from EV mode to Engine mode after being in stop and go traffic.

Honda was able to reproduce the conditions described in the recall and develop a software update to address the “lurching” concerns. The conditions addressed by the Honda recall are associated with brief surges that occur when the accelerator pedal is being applied under specific operating conditions and, thus, are not related to the petitioner's incident or allegations (which claim sustained acceleration during brake application), nor have they been observed in the general population of Toyota ETC vehicles. Finally, ODI is not aware of any vehicle defect theories, from the software experts cited by the petitioner or anyone else, that have similarly documented and reproduced a sudden unintended acceleration condition in the Toyota vehicles that would be attributable to the electronic throttle control software in those vehicles.

3.0 Conclusion

The petitioner does not provide any new evidence in support of his petition. In our view, a defects investigation is unlikely to result in a finding that a defect related to motor vehicle safety exists, or a NHTSA order for the notification and remedy of a safety related defect as alleged by the petitioner, at the conclusion of the requested investigation. Therefore, given a thorough analysis of the potential for finding a safety related defect in the vehicle, and in view of NHTSA's enforcement priorities and its previous investigations into this issue, the petition is denied. This action does not constitute a finding by NHTSA that a safety related defect does not exist. The agency will take further action if warranted by future circumstances.

Authority: 49 U.S.C. 30162(d); delegations of authority at 49 CFR 1.50 and 501.8.