Toyota Prius and Camry, drive-by-wire, and our failure to learn from experience

[steven johnson]

This author has come to the conclusion that the software is too complicated to ever be adequately tested considering the number of permutations and combinations of inputs that could be stress the software.

Toyota internal documents reveal that software caused surges and had been implementing software corrections as early as 2005.

Toyota Software Caused Surges, Docs Show

Now that it has been shown that the software can't handle several postential short circuits, the fail safes really seem to lack redundancy that are needed to prevent runaway accelerations.

Expert: Electronic Design Flaw Linked to Runaway Toyotast

I see from the morning news that Toyota's adventure into the world of embedded software is going badly. The company's second attempt to find a quick fix for unintended acceleration in its conventionally-powered vehicles is barely underway, and already evidence is emerging that the underlying problem is likely in the engine controller, not in the pedal mechanical assembly. And now we hear from Japan that the Prius, Toyota's golden child, has a problem with its brake-by-wire control system.

One has to recall Audi, which decades ago accidentally introduced drive-by-wire with its advanced cruise control on the Audi 5000. The cars were allegedly subject to spontaneous acceleration. The company blamed the problem on operator error. At the time, I was told that researchers at another European high-end auto company had uncovered a problem in Audi's engine-control firmware and reproduced the acceleration without requiring a driver to mistake the gas pedal for the brake. But in the ensuing liability litigation, all hope was lost of diagnosing the actual problem and documenting it so that the rest of the real-time software community could avoid it.

The reason all this came to mind this morning was actually not the newspapers, but a panel I attended yesterday at DesignCon. The subject was achieving quality closure. But the issue of software sat like an elephant in the corner of the room, awaiting notice. One of the panelists—I believe it was Design Rivers president Camille Kokozaki—pointed out that perhaps the most serious quality problem in IC designs now is not quality closure on the hardware, but the integrity of the firmware and software that will run on the chip. There simply is no systematic approach to ensuring the quality of an integrated hardware/software system.

So now, after decades invested in metrics-driven verification, formal verification, and methodology management, we find that our chips don't work as expected because the software is still being "verified" by feeding it test cases until the schedule expires. And we find that our cars run into things for the same reason, and the press of course will blame the problem on "electronics."

Toyota Prius and Camry, drive-by-wire, and our failure to learn from experience

[KoKo]

1. And Honda Owners need to be aware! Does their "Drive by Wire" cause some of the same problems...

as Toyota's system? Does the Drive by Wire take over the car's acceleration system, totally?

We were ready to buy a Honda Odyssey...but the "Drive by Wire" on the car (to save fuel by boosting the engine output by the computer deciding how much power is needed to accelerate or decelerate)allows the computer to decide how to do this and our concern was that this might lead to the computer controlling the car and not us.

I've tried to find out if Honda's system allows and "over-ride" of their "Drive by Wire" that allows you to control how your car accelerates and decelerates but have not been successful either by asking the sales person or doing an internet search on "Honda's Drive by Wire System) as to whether proper safe guards are in place.

We have put off our purchase until it all sorts out.

Link to Post in DU "Editorials Forum."

http://www.democraticunderground.com/discuss/duboard.php?az=show_mesg&forum=103&topic_id=519854&mesg_id=519854

[Make7]

2. Car And Driver Magazine: How To Deal With Unintended Acceleration

 

...

For our tests, we rounded up a disparate bunch: a V-6 Camry (a recalled vehicle), an Infiniti G37 convertible, and a hugely powerful 540-hp Roush Stage 3 Mustang.

...




http://www.caranddriver.com/features/09q4/how_to_deal_with_unintended_acceleration-tech_dept

 

[KoKo]

3. BTW...I've read on some Car Sites that some American cars have an "Overide" that

will disengage the "drive by wire" or controls that Toyota and now Honda are using. But, that could just be disinfo from US manufacturers hoping to get the business that is lost by Toyota.

I went over to Chrysler site and tried to see if their "Specs" had anything about their electronic controls but didn't find much except that they have some system that keeps you from going into a skid that is called "Electronic Stability" which the computer takes over if you hit an ice patch or a place in the road and start to skid. The computer overides your controls so that you stay stable. Chrysler didn't talk about "Drive by Wire" or using computers to ramp up engine capacity or throttles. That doesn't mean that they don't use, it though.

I hope this whole thing with Toyota will lead to better disclosure about how much our cars are controlled by computers these days. We consumers should have more info to make better choices instead of being forcefed these things without our knowing thy are their and how much our cars are controlled y these new innovations.

[Mopar151]

5. I've used a device like that in my race cars for over 20 years

No computer at all, or the little one in the spark box.

All I use is an adjustable switch, actuated by brake line pressure. when pedal/line pressure goes above a normal hard stop, the ignition is cut off. Simple, pretty effective. These switches are currently available from Mico, who also manufacture brake locking devices for trucks.
The Roush Interrupter, used in NASCAR, works in a similar manner, also sensing throttle position by manifold vacumm.
Part of the reason we use these can be seen in the graph above - The powerful Roush Mustang is pushing it's locked front wheels, because the rear brakes alone are not powerful enough to stop the engine (Brakes have to be biased toward the front wheels to prevent premature locking of the rears).

And as I've said in other posts this morning - other automakers have used D-B-W for most of a decade, without this level of failure. Which tells me that Toyota has poor system design, known sensor issues (the gas pedal, and some buggy code, without enough cross-checking.

[530jonathan]

6. drive by wire

you would be surprised by how completely modern cars are controlled by some sort of computer. I am an auto technician and most cars since the early 2000s have been drive by wire.. this just means that there is no mechanical connection, or throttle cable, between your right foot and the throttle body. by hitting the gas, you are simply telling the computer that you want to accelerate. most systems are redundant by having twin sensors in both the accelerator pedal and the throttle body. even your lights on most cars are computer controlled. when you hit your light switch, you are not completing the circuit, you are simply telling a computer to trigger the lights. the reason for the drive by wire has to do with the epa, and the ever lowering emissions standards with newer cars. not to mention that the tighter these regulations get, the more expensive to repair all cars will get. im all for cleaner air, but everything has its price. in a very short time, look for cars that do EVERYTHING by wire, including taking over ALL control of the vehicle when it senses in impending accident!!!

[northernlights]

9. I saw an ad last night for a benz that does that

"including taking over ALL control of the vehicle when it senses in impending accident!!!"

Too scary for me. Can you still get standard transmission? If you shifted into neutral, would that work?

If not, I'm going back to horse and buggy. Yes, horses do run away with you. Max speed, ~30mph for a short distance.

[530jonathan]

11. i hear ya

it is scary... i havent even got into what mercedes engineers were planning a few years back.. their safety engineers have been having wet dreams for years about such a system.. lets imagine for a minute that you are driving down some back road and round a corner, and bambi is standing in your lane. the car would then brake, steer, and accelerate around bambi, and then when the car determines that it is safe, it then hands you back control. for this to work, 3 basic things have to change.

1: no mechanical connection between the accelerator pedal and the engine..... done, been that way for years

2: no mechanical connection between the brake pedal and the master cylinder or brakes....... done, a few cars have experimented with this technology, mercedes being one of them. cars have been able to apply the brakes without driver input for some time.

3: no mechanical connection between the steering wheel and the rack and pinion. not done yet, however engineers are working on this. some cars have even made the switch to electronic power steering as opposed to hydraulically boosted steering. the computers can actually provide their own input to the steering, such as compensating for a crosswind.

ive been working in the field for over 15 years now, and these things scare the hell outta me! what happens when the really big fuse blows? can i still steer my car? luckily, manufacturers build quite a bit of redundancy into these systems, but we all know, even from toyotas current crisis, that cars are not designed perfectly.... just imagine if microsoft designs some of these systems!!!!

[BeFree]

4. Software problems?

We use software to count votes. I'm sure there's no problems.

[Dr.Phool]

7. Did Microsoft design it?

[AzNick]

8. How come Volvo never has that issue?

Volvo has been drive-by-wire for ages, never an issue.

So, what gives?

[530jonathan]

10. volvo

actually thats not the case... volvo has LOTS of issues with their throttle bodies. all of their drive by wire throttles have firmware embedded in them!?! if the battery is disconnected for a long time, the throttle and the engine computer will forget eachother and usually the car will only idle, no matter what is done with the throttle. luckily for volvo, their cars dont do the oppisite and accelerate!!

[AzNick]

14. So... It does NOT have THIS issue :)

As you said, they can stall but I don't know anyone who had this issue.

The Volvo forums report different little pesky issues, like the acceleration delays and the hit on the turbo model.

Some buy a chip programmer and get a totally different car out of it, with smoother transitions and also more power, meaning more in the red.

The chips are programmed to response to EPA regulations. I also suspect the manufacturers to mellow down the car to keep it running smoothly longer.

Volvos are usually owned by midlifers and older, except for older models, as used old Volvos, especially wagons, make great cars for students and people starting in life.

When Volvo released the S60R they saw a totally different crowd walk around their lots and they probably got scared. So now that model is gone.

This explains why they program their chips to make them quite a bit more mellow than they could be.

[530jonathan]

16. true

they dont have the same problem as toyota, but their throttle body and dbw setup are far from perfect..

[Mopar151]

12. As our new friend posted above (Jonathan 630)

Welcome, guy!:pals: Volvo, BMW, et al use redundant sensors, and, in general, a more robust system design. Their ABS is much 'Smarter" than a lot of domestics, as well, so that it does'nt screw up as much in unusal situations.
It would not surprise me, either, if the European FBW cars have bigger and more powerful brakes relative to engine size/power than the Toyotas, or that they use an ABS sensor, like wheel speed or abs actuation, as an interlocking control with the throttle/engine control logic.

[AzNick]

13. Note that I had a Toyota Echo and then switched to an S60

The Echo got rear ended and the other party's insurance paid full Blue Book on the Echo, and with this amount I managed to buy an S60 with only $2000 extra although the tired were bald, so that's another $800 (I went with Michelins all weather, still newish 35,000 miles later when Goodyears would be bald).

I upgraded because I bought the Echo when I was 31 (new) and the S60 when I was 39. So, yes, I got a bit older, got paid more, was tired of a car that was quite economical (up to 40 MPG and I was not driving economically, I am a left lane driver and I know how and when to step on it) and never got any issue except for a blown A/C from driving in the Phoenix weather with A/C on ALL THE TIME.

The Echo has a cable operated throttle and I did have to lube it a couple times, as well as retighten it myself. I did have the issue with the OEM carpet folding under the pedal, which caused acceleration issues. A replacement with non-OEM carpets from eBay fixed it.

The S60 is a totally different car. Not as economical, but weighs about twice. You can tell this thing is built for safety. It does have some power but the computer controlled acceleration is a bit frustrating. If I need the power to pass someone, I have to carefully temporize it and step on it a little before I need it. But at times the power is right there... and this thing having a turbo (it's the 2.4T), it goes from "granpa" to "sport" all of a sudden in a very rude but somewhat enjoyable manner.

I eventually took a hit with the S60, identical to the one that killed my Echo. The collision shop had to cut off the duron steel subframe and that cost the insurance a bundle. I know it's probably showing on Carfax now, which makes me wish the car had been totaled, so I can buy the same, but newer :)

So, yes, I like cars that are well built and well engineered, and may consider a Toyota in the future, especially since Volvo is now Chinese-owned.

I also made a point to own a domestic vehicle as well and we own an Avalanche. That, my friend, is a piece of turd. Huge, proud, big block engine with tons of power, but this truck has been falling apart and it's only got 80,000 miles on it.

I with our domestic manufacturers could take this opportunity to improve on their products before demand comes back.

[530jonathan]

15. absolutely,

i have worked on mainly audis and vws since 1999, and we have insane communication between modules. we have had a can-bus since 1999, the first ones were a little slow, but the newer ones exchange information at phenomenal rates!! we also have had the brake switch failsafe on all of our dbw cars since they went electronic.. your correct on the brakes as well, as one year model will have 2 or 3 different brake setups based on which engine is installed. sometimes its to the point of overkill, but everything serves its purpose.. I love the new generation of abs as well, which allows some wheelspin, and doesnt cause the throttle to instantly drop out like the earlier ones did... thanks for the welcome!!