One may rightfully wonder about why the existence of this TSB is not evidence of Toyota knowing about possible software problems in its electronics.   I wonder more about how such a TSB is not publicly available.  Interestingly, NHTSA had seen the TSB and has a short report on it.

Given that the TSB was not public, it would seem that only those 2002 Camrys, which were taken to a Toyota dealer, could have been patched.    Others could still be using the mis-calibrated tables in the firmware on the engine control module.

That’s a distinction without a difference!   Any logger on the vehicle that stores events from the automobile is an event data recorder (recall that many planes have two black boxes).   It would appear without additional information that they had read the non-volatile memory on the Engine Control Module or other ECU (Electronic Control Unit).    Is it possible to read such data from other Toyota vehicles as well?  Any afflicted parties and NHTSA ought to get a complete listing of what data get stored by each Toyota vehicle.  NHTSA should also be given the means to read that data.

As I have argued in a different posting, Toyota should release what information is stored in each vehicle before future incidents are analyzed.

[...] Driving one of the suspect Toyotas raises your chances of dying in a car crash over the next two years from .01907 percent (that’s 19 one-thousandths of 1 percent, when rounded off) to .01935 percent (also 19 one-thousandths of one percent)….  It’s not worth losing sleep over.

Intriguing analysis.   Some items to note that may alter the above math significantly:

1. Why compute the probability over the next two years as opposed to 10 or even 20 years?  (According to Toyota, about 80% of their vehicles that are 10-20 years old are still on the road).
2. Why compute only the probability of dying?  What about the probability of being injured which is about 10-20 times higher?  Do we want our cars to be unsafe and to add to the uncertainties of the world we live in?
3. An unsafe vehicle does not just pose a danger to the occupants of the vehicle.  It could pose greater dangers to pedestrians and passengers in other vehicles.
4. The NHTSA database only contains reports that were filed by pro-active complainants.  Many incidents may not have been reported; one estimate is that only 20% of incidents get reported – people may just sell a car with problems and move on.   It is also at least conceivable that there have been accidents, injuries and deaths that have been wrongly attributed to driver error when in fact the vehicle is to be blamed.

I also interpret this report as confirmation that NHTSA does have a black-box reader from Toyota.   That’s good news for all.

Most people have a strong opinion now on whether Mr. Sikes staged a hoax of a runaway Prius in Southern California last week.   Amidst the flare-up came another seemingly minor twist on the black-box front that Toyota doesn’t seem to want anybody else to understand.     For a long time, Toyota has maintained that their black-boxes (event data recorders) could store only 2-5 seconds of vehicle data for (experimental) use by them but not by others.    Furthermore, only they could read the data, and a consumer can get the data only through a court order.   And Toyota has said that they had exactly one laptop in the US that could access said data.    Recently, there was a report that NHTSA was given 3 such devices but that report has not been confirmed as far as I know.   (Data from cars made by the Detroit Three can be read directly by consumers today).

Then, the Southern California event with a Prius (supposedly) runs away, afflicted with a claim of sudden unintended acceleration.    Toyota is now confidently reporting that their analysis of the vehicle data showed that the brake and accelerator pedals were being alternatively pressed *250* times, i.e. over a duration of several minutes.  ( The implication is that Mr. Sikes was just faking the situation.   He may have well been, but it could not have been because the situation could not be repeated – SUA incidents have not been repeatable posing a major challenge for those trying to find the problem source).  So, when the data are in Toyota’s favor, they are able to read several minutes’ worth of data about the status of braking and accelerating.    Now, please watch this video clip on CNN.   No braking and acceleration data available even for a few seconds!     Toyota would very likely say “The features and recording time depend upon model year and other ‘variables’”.

Here is what Toyota should do: Release to the public a table that shows for various model years (and VIN ranges if applicable), which data and how much data are recorded.  So, the next time a SUA event happens, everybody knows beforehand what can be expected.  That sounds fair.  Right?

Three things to note:

1. Readers of this blog know that we have always acknowledged that pedal misapplication certainly does happen but it does not address all SUA incidents.  Life is not simply binary: either all electronic problems or all operator error.    There is no law against there being some of each.   One of the articles highlights the fact that senior citizens are involved in more than 55% of SUA-related deaths/incidents.   Am I the only one to note that this still leaves at least 45% of incidents that cannot be just waved away by using the older age of the driver as the explanation?   A psychologist is quoted that, unlikely as it may seem, all SUA problems can really be attributed to drivers – he cites the Audi incidents from the 80s as his base.   Hello!  Does his PC or laptop work perfectly today?  It perhaps did in the 80s – simply because he had none.    Electronics is complex – just because you do not understand how it works does not mean that it is bug-free or cannot go wrong.   The blame is being pinned on the hapless driver when these writers do not want to take the time to understand what can indeed go wrong.   The drivers are sadly victimized twice: once by the vehicle, and then by these allegations.  Even NASA, whose spacecraft are operated by astronauts who have trained for their entire careers, places non-zero failure rates on their electronics when they have an obscene amount of redundancy and use the best technology/people available.   Comparably, automotive electronics only has an “affordable” level of redundancy.
2. SUA incidents spiked in the 90s when electronic cruise control was introduced.  They spiked again when electronic throttle control was introduced in the early ’00s.   Did people suddenly become less smart when electronics got introduced?   Would/did they even know that there was electronics involved?
3. If drivers were to be blamed, the SUA rate will be, statistically speaking, roughly uniform across all years, makes and models.  Toyota cars, after ETCS-I introduction, had more than 45% of the share of SUA incidents while having 20% of the market share.   That’s statistically significant – meaning, it is very likely that “pedal mis-application” fails to explain the discrepancy.

The rationale is that if the engine is shut off and then restarted, the problem seems to go away (but may reappear later).  Diagnosing the situation is significantly easier when data are collected while in that abnormal state.  Again, the key is to get these data while the engine is still in the SUA state (albeit in neutral gear).

Alternatively, if you want to run some tests on your car after it has experienced SUA, please consider lending us your Toyota for a couple of weeks.    We are currently testing a Lexus IS250 in this mode.   Many Toyota vehicles do not encounter SUA, but some do.   Tests are expected to be much more likely to find a problem source by looking at the latter category of vehicles.

Please be safe under all cases.   If you know of somebody encountering SUA issues, please let them know of this as well.

Conflicts of Interest All-Around?

Three professors working in the context of automobiles come to mind.  I, as at least some of you know from my home-page, have a working relationship with GM.  Prof. Gerdes of Stanford University, who spoke at the Toyota conference rebutting Dr. Gilbert’s experiments, runs a lab that is partly funded by Toyota.  Dr. Gilbert of SIU himself works with SRS, which represents plaintiffs, a fact that was emphasized during a segment of the congressional hearing last month.      While I can certainly understand it if you are skeptical, I would add that most academics and researchers including the ones mentioned above are interested in problem-solving, creating solutions that help people, and make the world a better/safer place to live in.   Like everybody else, we will have our biases and what one might be considered constructive by one could be construed as negative by another.    If we did not believe in technology and its promise, we would be doing something else.   The grilling of Dr. Gilbert at the congressional hearing was by a House member whose district includes a Toyota plant.  So, it is in his self-interest to defend Toyota.

Meanwhile, Toyota itself has a vested interest in not identify/revealing any defects thanks to the fear of liabilities that open up.  They clearly have a large number of lawyers on their payroll defending their cases and delaying them as the situation warrants in their judgment.  They clearly have a core business need to protect their reputation, business image, sales and market share.   De-emphasizing negatives is part of a marketeer’s job and an imperative of a business executive.  Finally, automotive suppliers may not have deep pockets and try to push liability back to the automakers (witness the tussle between CTS and Toyota last month).

Independent Entities?

The best entities one can think of in this category would perhaps be consumer organizations like Consumer Reports and government agencies like NHTSA.   Consumer Reports does not accept advertisements and have been able to maintain independence.  But, despite their popular recommendations in the automotive sector, they have to go far beyond this sector to be able to sustain themselves.  Also, they serve the consumer perspective (“we used it, found this aspect to be good, think that other aspect is bad; we do surveys and give you a nice, credible compilation and recommendation”) but do not go into the nitty-gritty that is needed for looking at electronics in depth.    NHTSA has about 600 employees and  a budget of about $600M.  They collect and investigate complaints through their Office of Defects Investigation.   But as an arm of the government, they can be pulled in different directions and also seem to be reactive to complaints.   Many have argued that NHTSA really needs to bring in electronics experts as automobiles have moved from the mechanical area to electro-mechanical and now are increasingly electronics-driven.

Time to become Luddites?

Given that complex systems can fail occasionally, does it mean that we should go back to “simpler” mechanical systems in automobiles?  Electronics are here to stay in automobiles, trains, airplanes, helicopters, ships, elevators, HVAC (heating, ventilation, air conditioning) systems, electric utilities, nuclear power plants, health care,robots, and manufacturing, just to name a few.  In the transportation sector, electronics is what leads to significantly better mileage, bigger horsepower, lower emissions, higher efficiency and stronger safety (in terms of airbags, traction control, slid control, anti-lock brakes, pre-tensioning when accidents become imminent and lane departure warnings).   Even sophisticated cruise control (like adaptive cruise control), which leads to less fatigue, and anti-theft mechanisms are enabled by electronics.   All these *reduce* accidents or their intensity even as features proliferate while keeping costs relatively low. Future features will monitor when drivers become drowsy, when there are vehicles in your blind spot(s), warn you of dangers/traffic jams ahead, tell you when the traffic light ahead is about to turn red, and alert you that you are driving too fast for the current conditions.  These benefits are the direct result of sophisticated electronics.

If the failure rate is non-zero, stupid, why use technology?

Good question.   The answer is simply “The benefits outweigh the risks”.   Think vaccines.   There are always some people who die or have severe allergic reactions to vaccines.   Should we therefore all stop taking vaccines or stop working on new vaccines?  Most would say, no.   Do the positive impact of vaccines outweigh the negative consequences of vaccines?  Of course.   As long as we keep the risks small enough and the benefits clear, vaccines will be around for a long time.  The same applies to electronics in safety-critical systems.   Occasionally, things will go wrong and as long as that failure ratio is small (say compared to somebody getting hit by lightning), we will live with the complexities and uncertainties of life.

What should we do to ensure technology in life-critical systems is safe?

Thought you would never ask    Building new technologies with new capabilities take time and money.   Consider space exploration (NASA), new defense technologies (DARPA), energy technologies (ARPA-E), homeland security technologies (HS-ARPA) and basic science/engineering (NSF).   Substantial investments in the agencies listed within parentheses help move technology progress along these frontiers.   The private sector (the research labs of Microsoft, IBM, HP, Intel, United Technologies, Honeywell, all automakers, GE, Siemens, NEC, Fujitsu, Mitsubishi, Sony, Samsung, etc.)  also funds its own research but often, by necessity, focusing on their individual market sectors.    They also have to change to reflect market realities – for example, the golden years of Bell Labs seem to be well-behind it.   In many cases, companies and non-profit organizations have also received and continue to receive significant funding from government agencies (like DARPA, DoT and ARPA-E).     University research is mostly funded by government agencies as well.

To make a long story short, I do not argue that a new agency must be created for the automotive sector.   DoT and NHTSA already exist – the government should initiate some substantial research programs on the safety of electronics-based systems.  Fund universities, non-profit organizations and company consortia (and combinations of these in teams).  These programs can study how safer designs can be built for transportation systems, while not losing sight of affordability and maintenance.    The basic technologies that will be created will be useful in all safety-critical systems (like in the sectors mentioned above) – these are called “cyber-physical” systems, where cyber components of computing interact with physical elements in the real world.   Seems self-serving?  Perhaps, but researchers and scientists do have a useful role to play in society.  Without them, technology does not progress.   In this context, they can help pave the path for the best industry practices of the future.   Lead, and not just react.

Next, let’s go back to the vaccine analogy.  There exists an insurance fund that compensates victims who react negatively to vaccines.   The automotive industry could look into a similar arrangement.   The merits of doing this completely in the private sector or run completely by a government agency can be vigorously debated.   (Think insurance fees paid by the banks to the FDIC, for example).    Insurance rates can go up if the vehicles from a carmaker have more accidents, and vice-versa.   People may eventually seek vehicles from carmakers who are members of such a consortium, just like you want to put your money in an FDIC-insured institution.   (The fund cannot be liable for accidents due to human error – but event data recorders aka ‘black boxes’ which will be in all new models around 2012 can be used to separate the human component from system flaws).

Thirdly, try to define a specialized version of crowd-sourcing. In the current Toyota situation, it is very difficult for an external entity to find any flaws in Toyota electronics without having access to their large number of internal documents, test results, design/test engineers, system design details and software code.     Put a strict non-disclosure agreement in place, and form “Red Teams” of external experts to pore into the depths of the system.   More often that not, they will find something that could be going wrong.    You are not discrediting your engineers; sometimes, when you have your nose too close to the grindstone, the bigger picture loses its clarity.   External experts bring a fresh view and can ask out-of-the-box, even “stupid”, questions that will end up pointing to the path towards an answer.   Many large projects use this approach after the projects run into trouble.   Immense returns can be obtained from a well-selected/well-paid team.   Shuffle teams over the years to reduce staleness and stagnation.

If even some of these suggestions are adopted,  electronics, as they become an integral part of the fabric of society, will grow into our formidable ally.  Most importantly, electronics will be perceived as being on their side by the public.