Unintended Acceleration - Find the Cause

sharonkl

Hope this may help some of the intelligent minds here on this blog. Professor Dave Gilbert is a professor Auto Technology Department at University of Southern Illinois. Auto Technolgy Department School ranks #1 in US. 30+ years experience. Background given in testimony how he decided to investigate

Gilbert's Testimony at Hearings
http://energycommerce.house.gov/Press_111/20100223/Gilbert.Testimony.pdf

Gilbert's Actual Investigation Report submitted for record at hearing
http://energycommerce.house.gov/Press_111/20100223/Toyota.Electronic.Throttle.Co- ntrol.Investigation.pdf

noncarpetmntis

OK, the consensus seems to be cruise control.

Meanwhile, Toyota needs a field patch to slow the car down until they diagnose and remedy the root cause(s). Maybe EPROM flash fix for dealers. Maybe flashing an algorithm that first confirms an improbable simultaneous intersect of related values on the bus such as state of pedal sensor (zero), state of MAP (high), brake pedal switch on for minimum time = t, delta rate of road wheel RPM (positive or zero), rate of change engine RPM. This algorithm may not trust certain input signals and so may not even interrogate state of cruise control, or state of TPS at all. Algorithm logic then makes decision: vehicle engine status is inappropriate for observed conditions. Thirdly, algorithm excludes TPM (motor & gear set module at throttle body) but instead directs fuel inj pulse widths to shrink, VVT to limit intake valve opening, derate spark advance all cylinders, or dump engine to "EPA limp-in" mode if limp-in excludes TPM. This is only a temporary patch until all "carpet" and pedal mysteries are solved Few of us at 63 MPH have tried to apply the vacuum assisted power brake on our own vehicle when the booster diaphragm is up at barometric pressure. Naturally, when we are normally decelarating, foot on brake, throttle is closed and engine idle pumping delivers plenty vacuum to the brake booster, the assisted brake pedal feels easy, driver highly confident to stop the car. At 76 MPH and open throttle runaway, what engine vacuum is available without a supplemental 12 Vdc Toyota aftermarket vacuum pump?
Toyota engineering staffs are sharp people. So where were the HIL monte carlos? Where were the FMEAs and all that stuff? Invitations & seminars with aeronautic techs about fly-by-wire design and field traps?

dcxone

Looks like the problem first surfaced on the 2005 model Avalon and no other 05' models. I'd focus on what was different with that model than any of the other 05' Toyota models...would at least narrow it down.
Along with x738127's comment on mechanical vs. electronic control of the throttle. Easiest solution would apply the KISS principle (Keep It Simple Stupid)....for throttle system go back to a mechanical linkage vs. software input design......just think aircraft throttles are now software controlled......same would apply there.....one 0 swapped with a 1 in the code and you're hosed....

jiml8

Well now. That report was certainly interesting.

It doesn't get much more serious than that. Toyota's ECM is shown to not be able to detect some of the most serious possible malfunctions in the throttle position sensor mechanism.

I, for one, had been assuming that Toyota had been doing it right but had overlooked something (which can always happen). This report says, quite definitely, that Toyota is doing it wrong. They've cut corners on the error detection logic, and the Toyota "drive by wire" car CAN operate with undetected malfunctions in critical circuits.

dulongsynth

Yeah, it's the old theft-prevention scheme, except you don't hide a tiny switch under the dash where a thief can't find it. You make it prominent, easily-accessible, and with the accelerometer-triggered light, impossible to miss. Of course, "tuners" and drag-racers may make the switch light up, but they can ignore the signal.

I think this gets computers, hall-effect sensors, and other fly-by-wire technologies out of the picture in an emergency. It's dead-simple, and intuitive for the driver. Unlike Toyota's plan to require pressing the brake and gas at the same time.

blueiedgod

You can blame all this on the demise of the driver and the invertion of the drone.

How many Toyotas are sold with manual transmission with a real clutch these days? Almost none.

Anyone driving stick knows that it takes a millisecond to clutch in, or just snap out of gear into neutral if something is not right.

However, the continual dumming down of driving (no manuals, self parking, radar based cruise....) is taking the driving out of the driver's hands and into the computer hands. If people hate driving so much, why not take mass transit?

Most young people I enounter these days have never, not only driven, seen a car with 3 pedals. There was a case of car thieves a couple of years ago who broke into a manual vehicle and had no clue how to get going with 3 pedals and a shifter without a "D".

If people really want to be incontrol of their vehicles, then, maybe, they should start driving!

scout17

This is caused my someone, or some country from a satellite or a mainframe sitting back enjoying people getting hurt ,or trying to take down the big auto makers!

commonsense!

bystrom123

I don't beleive this problem is as hard as everyone thinks. On fly by wire systems their should be fail safe positions. If the correct logic is applied in the circuit and the sensors are wired correctly there should be no issue. Applying the proper logic can be easily acheived, especially giving each sensor a hierachy. There are some old school methods that can be used that are being over looked.

techrep

Please note; no amount of armchair engineering will provide a solution without hands on research and investigation. Should software code/s prove faulty, various vehicles sharing the same code/s should have the same fault. Is this the case? Only research data will provide the answer. It is possible that the fault/s may be found in sensor signals, which relates to data sent to the processor.
To determine a fault, we must first examine, test, and troubleshoot a vehicle model with a known fault. Once fault is identified, remove fault by means of temporary bypass, design change, or component replacement or upgrade, and verify repair via operational testing. Then re-introduce the fault to verify existence. Then repeat fault removal and repair process with regard to the affected components as required. This process will be required for each Toyota vehicle type, model, or VIN series identified as having “Unintended Acceleration”. Recommendation procure affected faulty vehicle for engineering investigation team compiled of test mechanics and engineers such as myself. Provide workshop/facility for vehicle testing and evaluation. Upon removal, testing, and evaluation of each throttle related component, sensors, electrical cabling and connectors, control cables, linkages, servos, which will include electrical system monitoring and voltage testing the team shall then provide detailed engineering investigation report highlighting component conflicts, failures and repair process with supporting test documentation. Team will make recommendation for the most cost effective solution using existing Toyota components, or contract requisitioned parts.

Anthony B. Ellinor
Virginia Beach, VA

dodge440

The problem involves Software AND EMI / RFI interference. Once Toyota's ECU is disrupted by outside RF noise, the ECU computer cannot reset itself to a default state. Additionally, a brake-override feature is just now being implemented by Toyota - a HUGE oversight. It will prove out that the source code needs more work as well as implementing sufficient EMI / RFI filtering / shielding in the I/O connectors / harnesses throughout Toyota's vehicles.

gboyden

Toyota's unexpected acceleration is caused by the computer that controls speed. The device is much too sensitive and may also be affected by exposure to outside electronic radiation. For example, if you jiggle the Cruise Control Lever the vehicle is subject to runaway. Jiggle it again, and the problem disappears. Obviously, the problem lies in the acceleration computer. When this device is too sensitive, it will malfunction by reason of electronic waves emitted by items such as pacemakers, cellphones, garage door openers, pocket radios, etc. To solve this problem, merely replace the acceleration computer with a sensor that is less sensitive to physical manipulation, and is also more resistant to outside electronic interference.

straydog1

Would it be possible that ethanol is separating from the fuel mixture causing a dose of pure ethanol to be introduced into the engine?

kernick

Even if that did occur, and the engine continued to run despite it not being designed for >10% ethanol, how does that cause UA? If you replace an equal amount of gasoline with an equal amount of gasoline going into the engine, you'd actually get LESS energy release.

britdriver

Absolutely Correct In the USA there are no drivers only steerers. car control is non existent. If you drive with one foot and and one hand with your phone in the other hand how can anyone expect any emergency to be addressed. Surely a car would not go into warp speed and disable all other driving controls.

Most drivers do not even know how to downshift an automatic or how to find neutral.You can reduce speed on any car by stamping firmly on the brake pedal with both feet yes you are allowed to use the other foot.
I believe Toyotas have an ABS system so the car should stay in a straight line.

I once had a 1977 Ford Cortina Automatic that suffered from the same complaint. The way to slow it down was to blip the accelerator pedal which cleared the jammed carburator butterfly.
Ok that is irrelevant to electronic systems today or is it.

Far from blaming floor mats and suspect gas pedals my wife had a similar problem on her 2005 Volvo S40 with the individual climate control. Under certain conditions usually when the car was left in the sun for a long time the heater would blast blistering hot air into the car.The only way to turn it off was to turn the heater/AC knob to its maximum and then back to the desired setting.It worked every time.The cause was put down to the stepping motors somehow moving the fan and heater control to the maximum settings. So Perhaps the Computer on the Toyota is over heating and the throttle inlet becomes stuck open.

So back to Toyota. Has anyone who has experienced a runaway condition tried to kick down the accelerator for a millisecond to see if it cleared it?

webfoot73

Invitations & seminars with aeronautic techs about fly-by-wire design and field traps?

I agree with this. Car “fly by wire” is at about the same point in its history as planes were about 15-20 years ago, and look at all the problems they have had over the years. I program computers and know how easy it is to overlook something, especially when dealing with interrupts and multi-processing. This is especially a problem in big corps and large projects where committees control the process and individual groups do “there own thing”, then they try to put everything together. They may pass unit tests, but the permutations are enormous when put together… but that said, these are not accounting systems where a problem results in the loss of a few bucks. I’m sure Toyota has lots of great people working on the problem, but something has been missed. Given the huge corporate money and reputation involved, I wouldn’t want to be the one to find the problem and associate it with my programming group.

webfoot73

I had a '65 Buick Wildcat that had the problem. Motor mount would break, the engine would shift and the accelerator would go to full. Had to turn off ignition to "bail out". GM's fix was to affix a cable to keep the engine from shifting after the motor mount would break. The engine would settle back into the mount and drive normally for months. I almost got into two wrecks before the recall notice. The first was a 540-degree spin on a wet 4 lane 101 Highway in California. I can really feel for the Toyota drivers that feel like they have a sword hanging over their heads.

lvision

David Gilbert, a Southern Illinois University-Carbondale professor, testified before the committee last week that he was able to create sudden acceleration in a Toyota by manipulating the vehicle's electronics. Knight said Toyota will provide the committee with Exponent test results that will disprove Gilbert's conclusions. Toyota said it was able to do the same with vehicles made by competitors and that Gilbert's tests do not replicate "real world" conditions.

That's $1M from Edmunds, $1 from me.

tucanoe

The problem involves Telephone EMI / RFI interference. Telephones broadcast radio waves and they are picked up by the cars wiring and interpreted by the software. Better RF shielding and RF design on the cars electronics will fix the problem.

kernick

I'm okay with electronics when they're on my PC, my MP3 player, my XBox360, or a bunch of other devices where I'm not driving 60mph. If the electronics break as they surely do - like my Kodak camera which during startup has the lens zoom jam and shutdowns, or the Red Ring of death that my XBox and 22% of all built had, I throw it aside.

In an automobile it's not such a good idea to have 1 ECU system without backups, tied to and communicating with other essential electronic systems. Whether it be software or hardware design-error, or a failure due to the operating environment, it is a poor idea to have designed a system like that that can injure or kill the consumer. I don't care whether it is Toyota, Hyundai, Ford, or Mercedes, they should all be chastised if they do that.

When it comes to the potential for injury and death to the user, the user should not be relying on technology that we all know from our experiences with technology, are not that reliable.

There are 2 things that a vehicle needs to keep running - fuel and spark. I think my grandfather could engineer in 1/2 a sure-fire way to kill an engine. Physically stop either!

sam_g5

Yes, I've encountered that issue also but it is different from this issue.

webfoot73

And air.

There are a lot of programmers out there that don't have the ability or thought processes to program devices or systems that may have life and death implications. I worked for a company that was developing a medical records storage system in the early '90s... I quit after about 3 months because the entire system was suspect and was tired of butting heads. It was designed by a marketing person and a self-taught programmer. (BTW: The system never got off the ground, but it did make it into one hospital for a trial.)

intermittent1

Welcome to the digital age! The answer can be difficult to find. First the best and brightest engineers will need to get a true understanding of electrical intermittents. Once they do this and then the automakers except there is a real problem as Toyota has. They will have to test, test, test. When they get to the Fuel Control, Accelerator Linear Variable Differential Transformer (LVDT), Computer and the electrical functional paths between them they will be in the right place. As moisture and later corrosion that develops from the moisture penetration takes place it can cause a resistive short circuit within any part of this control and can cause such faults as unintended acceleration among others. Unfortunately the vehicles computer is not programed nor designed to detect these faults. If the Computer would perform a Built in Test (BIT) on these circuits it could then detect and display the potential fault by illuminating an instrument cluster warning light. This as well as possible corrective actions can be explained in greater detail if requested. To keep the story short, basically the BIT would have to be programmed smart enough to warn the driver of the potential fault and stop it from the unintended action.

intermittent1

Excellent response until, "Upon removal, testing, and evaluation of each throttle related component, sensors, electrical cabling and connectors, control cables, linkages, servos, which will include electrical system monitoring and voltage testing the team shall then provide detailed engineering investigation report highlighting component conflicts, failures and repair process with supporting test documentation." Upon removal you disturbed the malfunction and have an extremely high probability for the follow on testing to yield, NO FAULT FOUND!!! Test the vehicle as is first and then move cautiously towards individual component removal for test, one at a time.

phdhyperd

I have the fix,and Toyota does not wish to communicate with me.
The challenger from Edmunds desires an improper protocol to prove the diagnosis,assuming its a jinx from some kind of "Beam Machine" or something,which it is not.
Toyota has angered someone,and they are getting even.
Guys like me who have a Phd. In HD physics always know whats up.
Edmunds man ,send transport for me,no air allowed,pay me my million and I will teach you something you have applied for,now have the guts to follow through.
Oh,and expenses are on you also,but Im a cheap date,I assure you.

phdhyperd

Its not software,its not moonbeams,its not stray emf or fairly bright people would have it solved long ago,so why even go there? It take a guy with high experience in hyperdimensional physics to fix the problem. Ha,Ha,Ha.
How much is it going to cost before someone pays us to stop the terrorism,and even the FAA's recent glitches are from the same causation,Ha,Ha,Ha again.

kwoodall

All cell phones transmit at different frequency. They correspond with what triggered the computer to be disrupted. This is a vital piece of information that has be overlooked. Their is correlation between these incidents & the cell phone frequencys At which is attracted to the computer. Their needs to be an RF choke placed onto the computers wiring. About 10 yrs ago I had an experience with a 91 Lumina, while running a Ham Radio . When the mic was keyed the gas pedal would accelerate to full speed., and go to the floor. As if I had the cruise on and was hitting the accel button. When the mic was unkeyed the car went back to normal acceleration & speed.

ilumina3

It is most likely in the programming in association with the cruise controls. Majority of all electronic functions require input/output transmissions. Something is triggering / activating the cruise controls to accelerate unwanted outside of driver inputs or lack there of. This is were I believe the focus should center around. This programming most likely was intentional by someone who wants to ruin Toyota, they need to look into who they may have pissed off. To eliminate fear from driving their reputation to its death quickly.

kernick

it's a little difficult sorting thru these posts. But what I can comment on, being an engineer is - we have made the systems of a vehicle TOO COMPLEX.

What an average intelligence person could look at 40 years ago on a vehicle, and make sense out of how the engine ran, and the brakes and the transmission worked is now a complex mystery.

Listen in this forum and the Toyota-specific forums to how many different possibilities there can be - from hardware, firmware, sensors, relays, electrical and radio frequency interference ...

The MORE complex something is and the more parts it has, the MORE likely it is to not work when the individually designed parts are put together. The MORE parts the more likely you will have an individual part that is manufactured incorrectly or just plain fails, as every machine fails. Whatever happened to KISS design? Maybe the Chinese would have a great marketing advantage if they can sell their basic cars here.

Right now I'm glad at least that my high-tech '07 car is a manual so I don't have to worry that some rush-design, built at a low-price electronic system is going to decide to take my car up to 150 mph.

skidster

The solution to unintended acceleration is very simple. I know what the problem is and how to fix it. It's not just a Toyota problem. In Albuquerque NM this past January, an Octupus car wash worker was killed by a Jeep Cherokee from unexpected acceleration. I own a 2005 R3500 Dodge diesel that had acceleration problems that I have repaired and it's never done it since. So basically it's not one brand of vehicles, it can happen to all of them.

artsports

Presumption of unintended acceleration can be found from many different world even cars without cruise control.

I had TramAm back in 1983 and it accelerate to full throttle and gas pedal never return, so I hit brake as hard as I can and no response. Had to turn off ignition and makes all power steering and power brake none operational. Complaint to dealer and you can never find the cause, after its done. After I sold my car, 2 years later heard report about cruise control gets lock with full throttle. This may be a mechanical failure or TPS, no one will know until having unit to constant monitor ecu to find triggered timing at which specific value causing it.

Back to subject, it important to monitor ecu output signal. This is only way to find the cause.

grudd

The fastest way to get at the root of the problem with Toyota's "drive-by-wire" throttle system is to open it to public scrutiny. Releasing the details of the hardware and software design will allow hundreds of thousands of engineers and programmers to look for the problem. Whether problems are found or not, the issue will be resolved once and for all.

This strategy is used by the "open software" industry and has shown that exposing software to widespread inspection by thousands of programmers has greatly increased the software's reliability. Furthermore, I don't think "testing" will prove anything. There are nearly unlimited combinations of possible circumstances, plus the problem may be statistical, rather than deterministic.

killer007

Hi, there
I also found the cause and the solution.

stever

What an average intelligence person could look at 40 years ago on a vehicle, and make sense out of how the engine ran, and the brakes and the transmission worked is now a complex mystery.

You needed those smarts 40 years ago when cars broke down all the time and needed valve adjustments every 3,000 miles. You really don't see all that many cars sitting on the shoulder with the hood up these days. Even if the transmission dies, it'll get you to the dealer in limp mode.

larryscott

There is only one system on all vehicles produced that can cause the vehicles to accelerate by themselves. It is the cruise control system, which is linked to the ECU and all sensors and/or switches or relays.
Possible cruise control light or LED could be out of not functioning.

The two most likely causes if it is not the ECU

Cause:
Two simple electronic problems happening simultaneously
Acceleration button, switch or relay sticking or malfunctioning. Along with a failure or defective brake switch, relay and or component.
Or, a wire chaffing issue in a wiring harness or loom causing a false or a non-signal being sent to the ECU.
*signal meaning voltage

drtomjones

Just using a regular accelerator linkage with the drive-by-wire system? This way there is a check for the DBW. I believe that Toyota found the problem to be with the manufacturer of the AAP/accelerator pedal. Adding a small weight to the pedal balanced out the sensor and gave the ECU the proper signal during power on.

plekto

Presumption of unintended acceleration can be found from many different world even cars without cruise control.


But as I pointed out, if they changed the sensor back to a potentiometer based design, HOW it would fail and the warning signs would be different. Nobody would be getting killed. Because the software to interpret the throttle position would be literally idiot proof to program as well as implement a fail-safe for.

The real issue is that when the throttle is based upon a sensor that is telling you some value that it thinks is valid that the computer then is interpreting. This is different than a constant resistance or voltage based upon real physical inputs.(an optical sensor that went bad would also give potentially random or bad data)

ie - with a potentiometer(or a similar device) the fail-safe would merely have to monitor to see if the resistance was infinite and/or if the thing had shorted out.

NOTE:
An easy way to fix this is to make 95% throttle the max you can actually press. Any time it ever registers 100% from any part of the system the computer knows it's broken and kicks into emergency mode(or turns off) I don't think anyone would ever notice that the difference in the pedal or power, even.(when I press hard, 80% is as good as 100% - it's already so limited by smog equipment that it can't actually force more air into the engine past 80% anyways)

But it would add another layer of protection in case the thing failed in some spectacular way.

oldcolonel

I would recommend a simple module modification between the servo and the fuel system. My previous suggestion attacked the problem by employing feedback to prevent a run away servo loop.
This suggestion recommends adding a module which accomplishes the following: take the value of servo output (now the denominator) and divide the output into the number one (the numerator). Increasing value data is used to decrease the input to the fuel control. This data decrease should be the input value to the fuel control. The input from either the accelerator or the cruise control, which may at some time experience or produce a random signal increase, Instead of the rapid increase shocking the fuel to an uncontrolled state, it will work the opposite because as t he denominator value rapidly increases, the control output value by this operation increase, divided into the value one, yields an ever decreasing value and the run away ceases and drops to zero.
I would recommend that the program, once seeing this affect, would limit only the accelerating pedal operaton to max of 25 mph to give operator opportunity to drive to safety - or drive for for emergency repair.

vagrawal

There could be several possibilities for such a cause. Some of them are listed below.
1. sensor malfunction including hardware latch up under cerain condition
2. controller instabilty
3. ECU memory latch up for a typical memory pattern
4. Power Driver latch up under certain condition
5. Estimator ( if used for sensor filtering) instabilty for certain input conditionws and sequences
6. software bugs, data overlapping etc.
7. inadequte sampling ( could be part of 2)
8. inadequate processor timing
9. latency in the system
10. many other possibilities specific to hardware and software.

If complete deatils ( hardware and software) are available more accurate prediction can be made.
I can take up such a challenge if details are available.
Vinod

kajuan

If you check in the wiring for the cruise control then you will find that there are defects in the harness thats causing the pedal to stick.

tobysan

With the exception of the older Beetle, I dont recall any broken cables and only a couple of broken return springs. However my memory is not what it used to be or never was according to my wife. Gm recalling electronic racks just makes me wonder why we have to abandon mechanical connections on these critical components. Thanks for reply. ( Further rantings of old gray haired mechanic)

tobysan

THANK YOU!

jaxbax

ESP or Rollover protection is the only system in the car aside from cruise control that actually causes acceleration. I know of a couple who were in their car when this malfunctioned and they crashed into a median on a highway. The system locks the brake on one side and accelerates on the other to prevent a rollover. So acceleration by this system is seen as normal and may pas unnoticed. The car in question was a Mercedes and they informed the people that had this problem ( a light would go on) to call Mercedes and they came and picked up the car on their own. They were told not to drive the car because.....acceleration could engage at any time. Remember ESP is scheduled to be mandatory in 2012 could this forced integration be an issue?

rue_dupin

I have written a longish essay on why Toyotas accelerate; here is my conclusion:

I would argue that one likely culprit is the electronic cruise control system, which could be reset and activated by an external wireless electronic source and rev the cars up to high speed. It would also somehow have to override the braking pedal’s electronic cancellation of the cruise control. Notice here that Toyota’s installation of a braking system which overrides acceleration suggests we are at least on the right track. Some irregular and dynamic interaction between the anti-lock braking system, the cruise control, and the electronic accelerator ought to stand out in a line up of suspects.

In their panic, have drivers tried to shut off or cancel their cruise control manually? Does the cruise control indicator even light up? Could electronic interference reset the control to the speed of its previous use? After accelerating, does the car’s speed ever level off at what might be a preset rate?

These speculative questions are just that without further information. We need those "Black Boxes" Toyota refuses to release. But let’s go a bit further on our own and ask what other external devices could be triggering the electric accelerator into overdrive directly or indirectly through the cruise control.

Red light cameras, surveillance cameras, police radar, cell phones, GPS systems, internet connections and all kinds of electronic remotes, including those from other cars, are a few of the wireless external devices beamed at and from within vehicles on the road today. Add to these, all kinds of spurious radiation from innumerable electronic and radio sources in our contemporary electronic environment. Are these gremlins to blame? (More ominously, would it be revealed if some were?) Can anyone simulate in a lab their effects in order to test whether they interfere with a Toyota’s electronic devices, such as the computer or cruise control?

We will not get much closer to solving the acceleration riddle until these questions are asked and satisfactorily answered.

Rue Dupin

plekto

There is a difference, though, between cruise control based acceleration(IIRC it's never more than half throttle) verus full throttle (something shorted out or broke). Unfortunately, you'd have to figure out a way to rig the car to do both and run a comparison. It's pretty obvious, though, that the cruise control likely isn't the issue since several of the reports also claim that the engine was still at full throttle when it came to a stop.

Now, that's not to say that the cruise system getting confused doesn't happen on most modern cars from time to time. And it is disconcerting if it happens. But it's entirely different than a bad ETC system.

deselius

An additional factor of Toyota acceleration problem that needs consideration is the semiconductor’s lattice structure of chip substrate susceptibility to alpha radiation.

Radiation originates from the sun or may even emit from the lead used in chip manufacturing. Identifying an alpha radiation bit-flip is a very technical process. Each semiconductor design/fabricator use their own process and procedures to construct semiconductors. Finding a chipmaker who may flip-bits will require some research. Briefly, back in the 1980s, Intel noted a one-bit random change within memory circuits on their chips, the semiconductor problem lingers.

Technically, the following, or some variation of ambient neutron flux problem, appears to be an ongoing semiconductor industry’s problem.

“With the ambient neutron flux rising well past previous maximum counts over the last 45 years, and with the unavoidable exposure to alpha particles from within semiconductor packaging itself, it is critical for engineers to have an understanding of the real-world effects that these particles have on common FPGA device types. This article examines these effects for SRAM FPGAs, explores the difference between soft and firm errors, looks at FPGA firm-error immunity, and details third-party alpha and neutron testing results for a wide range of FPGA architectures.”

“As reliability requirements for ground-based systems increase, and as the terrestrial operating environment becomes more challenging, these effects are much more relevant to system designers. By carefully choosing FPGA devices, designers can ensure they deliver highly reliable systems that can operate even in the most challenging extended availability ground-based applications.”

"FPGA Reliability And The Sunspot Cycle"
September 16th, 2009

bnet

I owned a 2000 Lexus LS400 that had 6 sudden unintended acceleration (SUA) events between 2004 and 2006. Reporting to NHSTA and Toyota was a fruitless exercise. The acceleration occurred from a stopped condition where in taking my foot off the brake, but before touching the accelerator, it surged to what felt like full throttle. It then took 3 surges, with both feet on the brake ,before I was able to get into neutral. I was lucky in all 6 incidents to stop just short of hitting the car in front of me. There is absolutely no doubt in my mind that Toyota has a electronic throttle failure problem. Note that this was an intermittent failure in that the car worked normally again right after the incident. This was also true for a lucky few that had an incident during normal driving but recovered before a fatal crash.

I also happen to be an electrical engineer (circuit designer) that has worked in the disk drive industry as a read write channel designer ('60's) where the goal was to deliver data that satisfied a bit error rate (BER) of about 1 error in 10^9 bits passed. Starting from those early days it was evident that the main challenge was providing the needed system signal-noise-rato (SNR) to satisfy the spec'd BER. There were many hard lessons learned in circuit designing for good SNR. The fact that the Toyota problem shows up as an intermittent non repeatable error where the occurrence rate may be less than 1% makes it a difficult problem but similar to the disk drive environment since you have to consider both an SNR problem. In both cases the key question is how does one design a system that guarantees that a low probability of failure (SUA's for autos) or a low data failure rate for disk drives. From a disk drive standpoint one must communicate from a recording head transducer through an amplifier to a data recovery system. Similarly for an automobile the throttle system must work from the position sensors through the ECM to the throttle. Both have to deliver high reliability with low probability of failure.

In the disk drive design environment it was mandatory that one understood the faliure modes, and SNR trade offs of the key components, head, disk, electronics etc. I think it is no different with the electronic throttle. In order to determine whether that goal can be reached one has to figure out how to test to insure that the low probability of failure is met. Early disk drives were stressed with injected noise, varying voltages and other stressors. Solving some intermittents that occurred once in a 3 week period showed that the ambient noise was too close to the switching threshold of a particular circuit causing lower SNR. I believe that stress testing of the electronic throttle system has to be defined to determine whether the particular failure can be invoked (similar to Prof Gilberts work) along with determining SNR sensitivities that may come from unsound grounding practices etc.

In my 6 incidents my circuit designer instincts would make me suspect a blocked oscillation maybe triggered by current noise in a ground loop where the sensitive position sensing shares a ground with other high current applications that could input a noise pulse to the sensitive position control. It appears that the ECM is triggered into a momentary latched condition where it commands full throttle. Margin testing the ECM voltages and doing injected noise tests would seem appropriate. However, finding an auto that has experienced an SUA event is mandatory because even then it would take innovative stress testing to try and emulate the SUA event. Comparing stress testing results between a car known to have the problem and the rest of the population might show meaninful differences.

There is one thing about noise trouble shooting: no cases are the same and satisfying low probability failure rates is extremely difficult. It is statistical problem where one has to accelerate the failures by stress testing so cause and effect improvements can be made.

phdhyperd

When the FAA's computers malfunction and it shuts down the southwest quadrant,they have the same denial of service problem tht Toyota and others have as random events.
It is mostly the same very certain problem that creates a "Terrorism Event"
It is directed,it is not mechanical or software.
Lots and lots of computer equipment is replaced every year due to this terrorism event.
These events are just little/or big,Jinxes.
It takes knowledge of the methodology to fix the bugs ,as knowledge is the key.
Maybe Toyota will pay the right persons their protection fee,and they will resume doing business ,just a bit bruised,and maybe they wont and they will slowly fade down.
The knowledge some of us posess can offer fixes to most of the problems plagueing electronics that are tested and tested and burned in hour after for some equipment only to fail at very certain times.
Jump up and down Toyota,pay me my fee and I will lead you down the road to prevention.

noncarpetmntis

Vinod - Do you agree with Forum message # 260 (from bnet) that says "................. make me suspect a blocked oscillation maybe triggered by current noise in a ground loop where the sensitive position sensing shares a ground with other high current applications that could input a noise pulse to the sensitive position control. It appears that the ECM is triggered into a momentary latched condition where it commands full throttle. Margin testing the ECM voltages and doing injected noise tests would seem appropriate. However, finding an auto that has experienced an SUA event is mandatory because even then it would take innovative stress testing to try and emulate the SUA event. Comparing stress testing results between a car known to have the problem and the rest of the population might show meaningful differences." ?

Do you and bnet rank RFI/EMI lower than other more probable causes?

Even if a handful of exemplar cars are located for buy-back to examine and experiment upon, it sounds as if the SUA behavior will be very difficult to replicate. Bnet suggests stressing those returned vehicles to cause SUA or its analog in the ECM. If SUA is instigated not by a single trigger but requires a convergence of two or three simultaneous triggers, how is stress testing organized or designed to not take 50 or 100 long weeks?

Bnet claims to have had 6 personal incidents, each a classic SUA.

Eventually, can the throttle position motor or linear displacement device that moves the throttle plate via the ECM driver logic have 10Hz double-checks built-in? Regardless of road speed, upon receiving any and all commands to open throttle, an interrogation loop would be forced to check the states of several associated parameters and compare that result with a reference GO - NO GO pattern coded in the ECM. Corruption would be suspected if the GO-NO GO returned a pedal sensor at zero (value 0), brake pedal high (value 1). For that case, the "open throttle" command is classed as illogical and is prohibited. This would represent a safety or mini-self diagnostic each time the throttle receives command to open.

kernick

an interrogation loop would be forced to check the states of several associated parameters and compare that result with a reference GO - NO GO pattern coded in the ECM.

What if the ECM is the source of the problem? such that it is not processing new information, instead being locked on an "accelerate signal" from the pedal or cruise. I've had PC's and other electronics that acted "confused". :confuse:

Gentlemen - for many years people had a rubber accelerator pedal attached to a steel-rod that adjusted the fuel-flow. That system worked pretty reliably.

I'm an engineer and I know it's tough for engineers and software people to step back and question why wouldn't we want to make this a fully integrated computer-controlled system. Step back and take a look at how potentially complicated this whole issue is!

Giving Toyota or whatever company has other similar problems advice - "You may never find the source or all the sources of the problem. You may induce new problems the next time updates are made to the software or hardware. Your products can kill and injure your customers. Give your customers a foolproof way of shutting these vehicles off, such that they do not rely on the potentially defective electrical components or software. Give the customer a) a shutoff valve for the fuel, or b) something that cuts the battery-wires to the engine. This would be no different than the concept you have breakers and a main breaker in your house, or the valve you have to shutoff the water to your house, or the ability to yank the cord out-of-the-wall on any appliance in my house.

Give the customer a full-proof way to kill the power/energy. Get away from all the electronics and software in our vehicles.

huanito

To whom it may concern,

I have recently studied the unintended acceleration issue on Toyota vehicles and have developed a theory as to what is behind this problem. I purchased a brand new 2004 Toyota Tacoma some years back. I had driven different used and new vehicles from various manufacturers previous to this, but had never driven a Toyota vehicle, used or new. One thing that I immediately became aware of on this Toyota vehicle, as opposed to vehicles from other manufacturers that I had driven, was the extremely sensitive acceleration response when the gas pedal was even minimally depressed. And, even after the pressure on the gas pedal was released, no matter how minimal the pressure initially applied, the forward motion if in drive, or, the engine revolutions if in neutral or park, continued for a short period afterward. This sensitive acceleration response was easily dealt with by brake pedal depression.

I don't believe this aspect of Toyota vehicles to be a defect at all. As a matter of fact, in terms of crash avoidance, or busy freeway merging, it can be a distinct positive while operating a motor vehicle. In terms of unintended acceleration, if the stats on any manufacturers vehicles were reviewed, it would most likely be found that minute percentages of any vehicle make and model suffer from unintended acceleration issues. These issues are many times due in part, not to manufacturer defect, but to either design problems, foreign object obstruction, operator error, or simply unknown factors.

I myself drive a Ford Taurus now, and have now, for completely unknown reasons, experienced 2 times, the power driver seat activating by itself. Both times, I have been driving down the road, and the seat began to push me forward towards the steering wheel. If I was prone to panic, or would have been unaware as to what was causing the problem, this could have caused a severe accident. However, when I felt the seat begin to move, I simply reached down and manipulated the power seat control, and the forward motion of the seat stopped. Does this mean that all Ford Tauruses are subject to this problem? It could simply be 1 out of a vast percentage of vehicles produced that is experiencing this issue.

If I am not mistaken, until this unintended acceleration issue presented itself, Toyota had never issued a mass recall of this magnitude and nature. And, had built a reputation for extremely high quality vehicles, with customer loyalty and confidence amongst the highest in the automobile industry. As I previously mentioned, Toyota engineers have exhaustively investigated this acceleration issue and have themselves come to the conclusion that there is no defect. Although, I understand that if a defect did exist, since it is the company's own product, Toyota itself might not be the most trusted source to rely on for investigation results. But, since Toyota is under such intense scrutiny, I don't believe Toyota would be foolhardy enough to hide or cover up a defect that they were aware of, and responsible for. I believe the issue of unintended acceleration that a small number of Toyota owners have experienced, as opposed to the vast number of owners who have not experienced this problem, is simply those few incidents that happen with any make and model of vehicle produced in the numbers that Toyota has manufactured it's vehicles. I don't believe it to be a manufacturer defect issue, but believe it to be an issue with foreign object obstruction (such as a poorly designed or placed floormat), owners inexperienced and unfamiliar with extremely responsive and reactive acceleration control endemic to Toyotas, or simply operator error.

But, now we come to the reason I believe there has been such a hysteria about the alleged Toyota unintended acceleration issue. Despite there being no actual verifiable comprehensive problem with acceleration in Toyotas, the story has simply magnified, multiplied, and reached frenzied proportions as any story presented in the media has the possibility of doing, whether true or not. With the condition of the economy as it is now, US automakers have either filed for bankruptcy, or the US taxpayer has simply "bailed" them out. US automobile manufacturers are keenly aware that this is the last "bailout" that they will receive, so if they don't make it now, there will be no more chances. Automobile manufacturers such as Toyota, with it's extreme customer loyalty and confidence, are one of the main factors that drove US automobile manufacturers to the brink of extinction in the first place. In the first decades long battle between US automakers and Japanese automakers like Toyota, US automakers were soundly defeated. Now, they have been thrown into the ring once again with the same foes that delivered the near knockout blows in the first battle, and simply put, they are now in a position of "do or die" so they must win at all costs. I believe that some rival automobile manufacturer, most likely US, but possibly of other origin, in order to eliminate competition, and vanquish the main rival in the automobile market, possibly "planted" a news story with the media concerning the unintended acceleration issue with Toyota vehicles. There is even the possibility that a small percentage of Toyota owners who have experienced this issue have been manipulated by some outside source to some degree. And, the resulting hysteria itself created an issue that literally did not exist, at least in the sense that it has been presented in the media. Destroying Toyotas reputation would be the simplest and the easiest way for a rival manufacturer to strike a crippling or death blow to Toyota, without having to accomplish that by the quality of, and demand for, it's own product. Thereby ensuring it's own survival. That is my theory concerning the Toyota unintended acceleration issue.

John Alvarez