Wednesday, December 31, 2014

OUT-OF-CONTROL SUV Crashes into building


A subsequent article below identified the vehicle as a Chevrolet Tahoe with no disclosure of 'MEDICAL CONDITION.'


Police identify driver who crashed through Austintown store

AUSTINTOWN, Ohio (WKBN) – The woman who drove her SUV through the front of a clothing store at the Austintown Plaza has been identified.

According to a police report, Heather Scott, 39, of Canfield was behind the wheel Tuesday night when she lost control of the Chevrolet Tahoe she was driving and crashed through the front of Dots clothing store on Mahoning Avenue.

Both Scott and her son, who was a passenger in the vehicle, were taken to the hospital and released a short time later.

Police believe Scott may have suffered a medical condition prior to the accident.

No charges have been filed. The investigation is ongoing.


http://wkbn.com/2014/12/31/police-identify-driver-who-crashed-through-austintown-store/?utm_source=dlvr.it&utm_medium=twitter




Notice that the police speculate that it was a MEDICAL CONDITION of a 39-year-old driver with no evidence and fail to provide the MAKE and MODEL of the vehicle.  

Gotta be DRIVER ERROR! Couldn't be a DEFECTIVE VEHICLE! Nawww....






Vonny~ (@MsMischiefmaker)
Accident Investigators' Daily is out! paper.li/MsMischiefmake… Stories via @charleneblake @Drug_Attorney @AccidentalShot



SUV crashes through Austintown store

Tuesday, December 30, 2014

Anyone one with a brain, sitting in front of a computer....













can access the truly PISSED OFF TOYOTA OWNERS who have experienced TOYOTA OIL SLUDGE.





Obvious oil sludge issue, claim denied


a TOYOTA CORPORATE SHILL [if it act likes a TOYOTA SHILL and sound like a TOYOTA SHILL, must be a TOYOTA SHILL! ] appears to comment on the article below:




swiftman2000


it is normal for any vehicle to use up to a quart every 1,000 to 1,300 miles. Every motor in every vehicle is different. My 2007 rav4 motor isn't the same as your 2007 rav4 motor. Just because yours uses oil and mine doesn't does not mean there is a huge problem with toyota. Take responsibility for your vehicles. Toyota is not going to rebuild your engine if its with in those specs or you are out of your power train warranty. Toyota is a good company and they back there vehicles there customers. I didn't hear people complain when Toyota was buying old Tacomas back from people for 1.5 times the value of the truck because those owners didn't ever clean the salt off of the frame and now they're rusty. Toyota spent millions of dollars buying trucks back and replacing frames for people that don't even take care of there vehicle at a Toyota dealer. My favorite are you people that bought your vehicle second hand for a private owner or a none toyota dealer and are complaining about it. Or you service your vehicle at jiffy lube and expect toyota to pay for your repairs when you're out of warranty when there is a problem. YOU own your car not toyota...

Toyota - Rav 4 Oil Consumption needs to be a recall item





IF ANY VEHICLE CONSUMES THAT AMOUNT OF OIL, YA GOTTA PROBLEM!


TOYOTA: Come on! Can't ya do better with your TOYOTA SHILLS  ? How 'bout fixin' your TOYOTA PROBLEMS?



Duh?



JUST MY OPINION...AT THE MOMENT....

Thursday, December 25, 2014

Media Spin! Bob Scrum SPILLED THE BEANS! The Nation of MINDLESS SHEEP!



Mr. Schrum announced to the world that THEY know which vehicles are prone to

SUDDEN UNINTENDED ACCELERATION



The Corporate Media SPINS the issue by attacking a Car Wash Employee with a LABEL.

NOTICE? 

Why would you call someone 'DOPEY' ? Is that simply to stop you from THINKING?




Bob Schrum, the owner of Flagstop Car Wash, said his employees are provided a list of cars, trucks and SUVs that have been proven prone to unintentional acceleration. In fact, he said the instances have been well documented by the National Car Wash Association.
FROM:

Car Washes KNOW, but Consumers Don't?


Have consumers become such midless sheep that the Corporate Media Pre-Digested Pap makes sense?














Jeep vehicles are WELL-KNOWN in terms of sudden unintended acceleration. Ask ANY car wash business. As a matter of fact, the Car Wash Association has a formal LIST of most likely vehicles to do this. Jeeps often TAKE OFF while inside these car washes. Carol lives on a lake and the humid conditions may well be connected.

There's a BIG hidden secret in the auto industry...it's called ELECTRONIC sudden unintended acceleration! I know...you thought that was just about FLOOR MATS and sticky pedals, or "driver error," right? That's certainly what TOYOTA would like you to continue to believe, BUT DON'T!

These ultra-complex new engines are completely computer driven. Software is needed to control the throttle system. You THINK you are giving gas when you press the accelerator, but you are only SUGGESTING this to the computer. In electronic SUA cases, the throttle software may be glitch-prone and NOT do as you wish.

What happens then? Well, the glitch may (and has for countless SUA victims) result in an OPEN THROTTLE situation. The brakes become INEFFECTIVE in these situations and crashes into storefronts, buildings, and homes have resulted.

What does the automaker say? They hook the vehicles up to the computer and declare NOTHING WRONG! They cite the EDR which has erroneous data and say YOU were NOT braking. They point the finger at you based on AGE, GENDER, MEDICAL history, prescription meds, etc. YOU name it, they've TRIED it!

Get the picture? And you THOUGHT the GM issue was big? Think again! This cover-up of ELECTRONIC SUA is scandalous and very well-orchestrated.

Why even a WHISTLEBLOWER has been legally harassed by Toyota as it does NOT want her Toyota internal docs posted online anymore. The automaker wants to intimidate and SILENCE her. It doesn't want the PUBLIC involved, for goodness sake!









SEE IT: Queens car wash worker plows Lexus into traffic

Dashcam footage shows the 2009 Lexus IS250 first being slowly driven through the cleaning machines in Long Island City, reports Jalopnik.com, but then suddenly lurch forward. The driver is heard swearing in Spanish as the car narrowly avoids hitting another customer and speeds across the road. It sideswipes one vehicle before finally coming to a stop on the opposite sidewalk.

NEW YORK DAILY NEWS
Wednesday, December 24, 2014
  
A dopey Queens car wash employee mistakenly slammed his foot onto a car's gas pedal instead of the brake — and ended up plowing into four lanes of traffic.

Dramatic dashboard camera footage shows the 2009 Lexus IS250 first being slowly driven through the cleaning machines in Long Island City, reports Jalopnik.com.

As the vehicle emerges from the garage, however, it suddenly lurches forward.


The driver is heard swearing in Spanish as the car narrowly avoids hitting another customer and speeds across the road.

It sideswipes one vehicle before finally coming to a stop on the opposite sidewalk.







He uploaded the footage of the Nov. 7 crash to YouTube on Sunday and it's since been viewed more than 60,000 times. Mike also posted other videos of the damage online.







Charlene Blake
Jeep vehicles are WELL-KNOWN in terms of sudden unintended acceleration. Ask ANY car wash business. As a matter of fact, the Car Wash Association has a formal LIST of most likely vehicles to do this. Jeeps often TAKE OFF while inside these car washes. Carol lives on a lake and the humid conditions may well be connected.

There's a BIG hidden secret in the auto industry...it's called ELECTRONIC sudden unintended acceleration! I know...you thought that was just about FLOOR MATS and sticky pedals, or "driver error," right? That's certainly what TOYOTA would like you to continue to believe, BUT DON'T!

These ultra-complex new engines are completely computer driven. Software is needed to control the throttle system. You THINK you are giving gas when you press the accelerator, but you are only SUGGESTING this to the computer. In electronic SUA cases, the throttle software may be glitch-prone and NOT do as you wish.

What happens then? Well, the glitch may (and has for countless SUA victims) result in an OPEN THROTTLE situation. The brakes become INEFFECTIVE in these situations and crashes into storefronts, buildings, and homes have resulted.

What does the automaker say? They hook the vehicles up to the computer and declare NOTHING WRONG! They cite the EDR which has erroneous data and say YOU were NOT braking. They point the finger at you based on AGE, GENDER, MEDICAL history, prescription meds, etc. YOU name it, they've TRIED it!

Get the picture? And you THOUGHT the GM issue was big? Think again! This cover-up of ELECTRONIC SUA is scandalous and very well-orchestrated.

Why even a WHISTLEBLOWER has been legally harassed by Toyota as it does NOT want her Toyota internal docs posted online anymore. The automaker wants to intimidate and SILENCE her. It doesn't want the PUBLIC involved, for goodness sake!
Charlene Blake
Jeep vehicles are WELL-KNOWN in terms of sudden unintended acceleration. Ask ANY car wash business. As a matter of fact, the Car Wash Association has a formal LIST of most likely vehicles to do this. Jeeps often TAKE OFF while inside these car washes. Carol lives on a lake and the humid conditions may well be connected.

There's a BIG hidden secret in the auto industry...it's called ELECTRONIC sudden unintended acceleration! I know...you thought that was just about FLOOR MATS and sticky pedals, or "driver error," right? That's certainly what TOYOTA would like you to continue to believe, BUT DON'T!

These ultra-complex new engines are completely computer driven. Software is needed to control the throttle system. You THINK you are giving gas when you press the accelerator, but you are only SUGGESTING this to the computer. In electronic SUA cases, the throttle software may be glitch-prone and NOT do as you wish.

What happens then? Well, the glitch may (and has for countless SUA victims) result in an OPEN THROTTLE situation. The brakes become INEFFECTIVE in these situations and crashes into storefronts, buildings, and homes have resulted.

What does the automaker say? They hook the vehicles up to the computer and declare NOTHING WRONG! They cite the EDR which has erroneous data and say YOU were NOT braking. They point the finger at you based on AGE, GENDER, MEDICAL history, prescription meds, etc. YOU name it, they've TRIED it!

Get the picture? And you THOUGHT the GM issue was big? Think again! This cover-up of ELECTRONIC SUA is scandalous and very well-orchestrated.

Why even a WHISTLEBLOWER has been legally harassed by Toyota as it does NOT want her Toyota internal docs posted online anymore. The automaker wants to intimidate and SILENCE her. It doesn't want the PUBLIC involved, for goodness sa

Azar Hadi

Wow, Lexus took off by itself, This is nothing new, Toyota and Lexus are known to take off on their own with no input from the driver. It actually happened to me in 2005, while sitting at the red light my 2004 ES 330 Lexus took off on its own. I am very lucky that I did not kill anyone because I probably would have been sitting in prison today, but the Lexus managed crushing my legs and totaling two cars and injured another person. Even though Toyota/Lexus have paid over $5 billion in lawsuits, repairs, fine and penalties, but these out of control cars with electronic software defects have not been fixed yet. What is it going to take for Toyota to stop the lies and cover up, injuring and murdering people all over the world.

Parris Boyd


By all means let's pander to the murderous interests of the auto industry by not mentioning the issue of electronically-induced unintended acceleration or the fact that the national carwash association has been keeping records of vehicles prone to suddenly speed out of control. And make DOUBLE sure not to reveal what the carwash employee said happened. Maybe Toyota is trying to take the lead away from Jeep when it comes to notoriety for these kinds of events at carwashes. I've been blogging about the issue - search "Beware of Toyota. Their next victim may be YOU..."




Charlene Blake

BTW, why is it that police always say the drivers "hit the gas pedal instead of the brakes?" It also to sounds like a directive from a superior! The phrase is repeated over and over to the point of being statistically impossible! Are we, the public, being asked to accept this statistical impossibility? Are police "encouraged" to find fault in the driver? After all, sooooo many of these crashes are reduced to "pedal confusion" or "mistaking the gass pedal for the brake" even when the drivers themselves indicate this is NOT the case! Wow! Smacks of a cover-up of auto industry-wide proportion with Toyota and Lexus leading the way, IMO! I'm far from alone in that sentiment!


The SPIN:

Car Wash Employee Forgets What Pedals Do What, Totals Lexus





Toyota China: Responds, Doesn't Explain Out-Of-Control Toyota




Toyota China officially responds to case of Zelas speeding out of control

By Carmen Lee From Gasgoo.com

Gasgoo.com (Shanghai December 6) - Late last month, there was an incident where a Toyota Zelas coupe sped out of control on a highway in Zhejiang. The brakes on the Zelas did not function properly, causing it to speed at around 125 km/h. It took nearly an hour for the police to help the out of control vehicle come to a stop. Relatives of the driver said that he had to pull the handbrake until the vehicle was able to come to a stop.

According to a Beijing News report appearing today, Toyota China has officially responded to the incident, which made headlines across the country. In their statement, four of the vehicle's independently controlled systems must all malfunction simultaneously for such an incident to occur.

A Toyota representative explained the situation more clearly: "[Our] technology department's evaluations show that the vehicle's cruise control system, drivetrain system, engine system and transmission systems must simultaneously malfunction for such a problem to occur." In the incident, the Zelas (pictured) was reportedly unable to brake, its cruise control and engine could not be shut off and its transmission was stuck in neutral. The representative added that without direct access to the vehicle, it was impossible for Toyota to make any further judgment on the issue.

The statement also emphasized the seriousness with which Toyota China, Guangqi Toyota and their dealerships were handling the issue. They have already contacted the driver of the vehicle in question as well as involved traffic departments to better understand the cause of the problem.

Toyota began selling the Zelas, which is known overseas as the Scion tC, in China in 2010 as an import model. The Zelas, which is priced between 255,000 yuan and 280,000 yuan ($40,627-
$44,611), is sold by Guangqi Toyota in the country. Being a pure coupe, sales of the Zelas in China have been relatively small.


http://autonews.gasgoo.com/china-news/toyota-china-officially-responds-to-case-of-zelas-121207.shtml



Friday, December 19, 2014

Think About It: Melting Dashboards



TOYOTA CUSTOMERS complain about a problem.

TOYOTA ignores them!

TOYOTA OWNERS file complaints with NHTSA.

NHTSA fails to ACT!




Life is SIMPLE! TOYOTA is unresponsive to defects in their vehicles!

TOYOTA can't blame this one on DRIVER ERROR, FLOOR MATS or OWNER NEGLECT.



FROM:
Beware of Toyota. Their next victim may be YOU...

is the following:

Crooked Toyota yields to public exposure on melting dashboards


Coverup King and admitted-crook Toyota has now agreed to do what the corporate slob should have done in the first place, without any stonewalling blabber about the dashboard warranties running out. YES. Toyota will now recall millions of vehicles to correct the problem, and reimburse customers who paid to have dashboards replaced.



Charlene M. Blake (@charleneblake)
Congratulations, @JennStrathman, for your recent success in exposing #meltingdashboards of #Toyota & #Lexus owners! uc2.blogspot.com/2014/12/crooke…

Download the official Twitter app here


Charlene McCarthy Blake
 
 
[VIDEO ON LINK]

Toyota parts shortage delays melting dashboard repairs until May 2015; refunds start immediately

Toyota is first manufacturer to extend warranty

 
 
WEST PALM BEACH - New details emerging today in the repair and refund program Toyota and Lexus are offering drivers with melting dashboards.

The manufacturer is extending its warranty on 4.5 million cars allowing free repairs if your dashboard is melting. It's what's Consumer Watchdog Jenn Strathman has been pushing for since she first uncovered the sticky, shiny problem eight months ago.

“Florida is the sunshine state,” said Toyota driver Mike Rios.

Leading the country in sunshine, but also sticky shiny dashboards.

“It’s a safety hazard,” Rios said. Six accidents were reported to the National Highway Traffic Safety Administration, including four in Toyota / Lexus vehicles.

“It's dangerous and this is going to make a big difference for all of us,” explained Rios.

Toyota is the first manufacturer to admit there is a problem, offering free repairs on certain model year Toyota and Lexus vehicles. Click here for a list of cars included in the repair .

“I was ecstatic,” explained Rios.

“When it's been in the sun for awhile it's real nasty. You feel like you are touching this sticky sponge,” explained Lexus driver Joyce Rutherford. The foam is showing on Rutherford’s dash and door panels.

“They are going to replace the dash and the door panels and rear as well on both sides. It's quite extensive what they are going to do,” explained Rutherford.

Letters are being sent to Lexus and Toyota drivers, but don’t expect repairs to start until May 2015.
“I wish the parts shortage did not exist,” explained Earl Stewart.

Stewart of Earl Stewart Toyota replaced 100 dashboards in just the last few months.

“It's a disgrace these dashes were installed in the first place,” explained Stewart. Now that millions qualify for a free repair, Toyota is using the remaining inventory for cars in accidents.

“If the dashes were not in stock and they were in transit Toyota cancelled those orders and we had to tell the customers we can’t replace their dash until May 2015,” explained Stewart.

Leaving drivers like Rios waiting a little longer for this long awaited repair.

“I believe you did a wonderful job. It was excellent. It’s the best Christmas gift everyone can have this time of year,” explained Rios.

An early holiday present, but one you’ll have to wait 5 months to unwrap.

If you paid out of pocket for one of these new dashboards, refunds will start immediately. The letter that will be mailed will have all the details for the refund process.


http://www.wptv.com/money/consumer/toyota-parts-shortage-delays-melting-dashboard-repairs-until-may-2015-refunds-start-immediately

 

Toyota Recalls





close RECALL Subject : Seat Heater Electrical Wiring

Sunday, December 14, 2014

...."brake override" stops runaway cars....




Video: Consumer Reports demonstrates how "brake override" stops runaway cars

Consumer Reports News: March 23, 2010 08:36 PM







As this new video demonstrates, smart throttle, or brake override, technology can be an effective tool to mitigate the risks associated with unintended acceleration. We have advocated for the adoption of smart throttle or similar technology to ensure drivers can halt their vehicles in a reasonable distance, even if the throttle is wide open. (Read: "Consumers Union calls for changes to strengthen U.S. car-safety net.") 

Our ongoing tests with our recently updatedToyota Camry and European models so-equipped from the factory continue to show the benefits of brake override systems, without interfering with normal driving needs or even grin-inducing sporty driving. (Read: " Track test: How does brake-override affect enthusiast driving?") 

Brake override is a piece of engine management software that simply lets the brakes take precedence over the throttle or accelerator if both brakes and throttle are activated at once. It's already standard on many cars, including most German imports. 

Some people assume that you can always stop a car that's speeding out of control just by hitting the brakes hard, but as you can see in the video that's not always true. And most drivers don't realize that hitting the brakes repeatedly is about the worst thing you can do during a unintended acceleration event because the power brakes in most cars are assisted by a "brake booster" that's charged by a vacuum circuit coming off the engine. An engine that's accelerating isn't producing any vacuum, and repeatedly hitting the brakes will quickly drain away the vacuum reserve, taking the power assist along with it. (Read: " How to stop a runaway car: Five steps that can save your life" and download a pdf of our advice.) 

Override's double action: Less going and more stopping 
The advantage of brake override is two-fold. By cutting power to the engine, the system slows the car, and simultaneously it lets the vacuum system recharge the power booster. Even if a driver takes several stabs on the brake, the car will progressively slow to a stop. 

Maintaining power boost through multiple brake applications is very important. We think that many drivers, faced with a growing emergency, are likely to try the brake pedal more than once before committing to a panic stop. That would be especially true on an open highway where instinct tells you to look for a place to pull over. Without brake override, that decision could be catastrophic.  

What we did 
We ran tests at our track to demonstrate what works and what doesn't if you ever need to stop a car with a stuck gas pedal. Note that despite the media attention it's gotten lately, unintended accerlation is a very rare occurrence in real life. 

For our tests and video demonstration, we used two Toyota sedans in our test fleet, the Avalon and Camry. (Learn about how we test cars.) The Avalon is scheduled for recall work that will retrofit it with brake-override technology, and the Camry has already had that work done. So these tests show how well Toyota's brake-override system works. 

Barely effective: One hard push 
Driving the Avalon down our track with the accelerator floored, our driver reached 60 mph and then pushed the brake pedal to the floor and kept it there with all the force he could muster. The Avalon finally ground to a halt, after over 500 feet. A normal stop from 60 mph would take about 140 feet. 

What not to do: Repeated braking 
Again driving the Avalon with the accelerator floored, our driver found that applying the brakes more than once essentially eliminated the power assist. Using all his weight on the brake pedal was insufficient to stop the vehicle. The best our driver could do was to keep the Avalon from accelerating faster than it was already going.

What you should do: Shift to Neutral 
If you're ever in a car that accelerates out of control, shift the gear selector to Neutral. Then brake to a stop. Even if the engine is racing there should be enough reserve vacuum power to stop the car easily. If you've depleted the vacuum you can still stop, so long as you're in Neutral and the engine isn't pulling against the brakes. 

Brake override: Less thought, better choice 
Driving our Camry with its newly retrofitted brake-override system, our driver reached 60 mph and applied the brakes while keeping the accelerator floored. The brakes immediately cut engine power, letting the car stop almost as easily as if the engine had been idling. Our driver also tried pumping the brakes a few times while slowing down, and that worked too. Each press on the brake pedal would slow the engine, which then allowed engine vacuum to recharge the brake booster. 

Brake override: a treatment, not a cure 
Brake override technology is so compelling that we think it should be standard in all cars. In our recent call forchanges to strengthen U.S. car-safety net, we recommended that the National Highway Traffic Safety Administration (NHTSA) require cars to be able to stop within a reasonable distance, even with the throttle fully open. While Toyota has pledged to make it standard on all future production starting with 2011 models, we wonder why they haven't done so earlier. 

This brake technology should reduce to near zero the problems caused by stuck or entrapped gas pedals. But it's still conceivable that some electronic glitch could override the override. And no obvious fix will help people who think they are braking when they are actually on the accelerator.    
Be sure to follow Consumer Reports Cars blog (RSS) and Twitter (@CRcars) to keep up with the latest information and advice, also see our unintended acceleration guide.
 
 
 
 

Class Action Lawsuit: Nissan Armada Titan, Infiniti QX56 Brake Failures


No NHTSA Recall?

Saturday, December 13, 2014

TOYOTA RECALLS




Please click on the following NHTSA Campaign ID links to view the recall information.
NHTSA Campaign ID Number : 14V715
Manufacturer : Toyota Motor Engineering & Manufacturing
Make / Model Years : TOYOTA / 2014
Subject : Ball Joint may Detach from Left Lower Arm

Thank you,

Recalls Subscription Team
Office of Defects Investigation (ODI)
National Highway Traffic Safety Administration (NHTSA)
U.S. Department of Transportation (DOT)

To file a vehicle safety-related complaint, please go online to our File a Complaint web page, or call us toll-free at 1-888-327-4236.

To find out more about NHTSA, please go to the Safercar.gov website or call our Vehicle Safety Hotline toll-free at 1-888-327-4236.



Report Receipt Date: NOV 13, 2014
NHTSA Campaign Number: 14V732000
Component(s): SUSPENSION
Potential Number of Units Affected: 56

All Products Associated with this Recall expand

Please click on the following NHTSA Campaign ID links to view the recall information.
NHTSA Campaign ID Number : 14V732
Manufacturer : Toyota Motor Engineering & Manufacturing
Make / Model Years : TOYOTA / 2011
Subject : Premature Ball Joint Wear
Thank you,
Recalls Subscription Team
Office of Defects Investigation (ODI)
National Highway Traffic Safety Administration (NHTSA)
U.S. Department of Transportation (DOT)


To file a vehicle safety-related complaint, please go online to our File a Complaint web page, or call us toll-free at 1-888-327-4236.

To find out more about NHTSA, please go to the Safercar.gov website or call our Vehicle Safety Hotline toll-free at 1-888-327-4236.

 

Details close

7 Associated Documents expand

Wednesday, December 10, 2014

MUST WATCH VIDEO: Toyota's killer firmware, A Case Study of Toyota Unintended Acceleration and Software Safety





YEAH! RIGHT!

Toyota's killer firmware: Bad design and its consequences

-October 28, 2013
 
 
On Thursday October 24, 2013, an Oklahoma court ruled against Toyota in a case of unintended acceleration that lead to the death of one the occupants. Central to the trial was the Engine Control Module's (ECM) firmware.

Embedded software used to be low-level code we'd bang together using C or assembler. These days, even a relatively straightforward, albeit critical, task like throttle control is likely to use a sophisticated RTOS and tens of thousands of lines of code.

With all this sophistication, standards and practices for design, coding, and testing become paramount – especially when the function involved is safety-critical. Failure is not an option. It is something to be contained and benign.

So what happens when an automaker decides to wing it and play by their own rules? To disregard the rigorous standards, best practices, and checks and balances required of such software (and hardware) design? People are killed, reputations ruined, and billions of dollars are paid out. That's what happens. Here's the story of some software that arguably never should have been.
Check out this related
EE Live! 2014 session:
Killer Apps: Embedded Software's Greatest Hit Jobs
For the bulk of this research, EDN consulted Michael Barr, CTO and co-founder of Barr Group, an embedded systems consulting firm, last week. As a primary expert witness for the plaintiffs, the in-depth analysis conducted by Barr and his colleagues illuminates a shameful example of software design and development, and provides a cautionary tale to all involved in safety-critical development, whether that be for automotive, medical, aerospace, or anywhere else where failure is not tolerable. Barr is an experienced developer, consultant, former professor, editor, blogger, and author.

Barr's ultimate conclusions were that:
  • Toyota’s electronic throttle control system (ETCS) source code is of unreasonable quality.
  • Toyota’s source code is defective and contains bugs, including bugs that can cause unintended acceleration (UA).
  • Code-quality metrics predict presence of additional bugs.
  • Toyota’s fail safes are defective and inadequate (referring to them as a “house of cards” safety architecture).
  • Misbehaviors of Toyota’s ETCS are a cause of UA.

A damning summary to say the least. Let's look at what lead him to these conclusions:

Hardware

Although the investigation focused almost entirely on software, there is at least one HW factor:

Toyota claimed the 2005 Camry's main CPU had error detecting and correcting (EDAC) RAM. It didn't. EDAC, or at least parity RAM, is relatively easy and low-cost insurance for safety-critical systems.

Other cases of throttle malfunction have been linked to tin whiskers in the accelerator pedal sensor. This does not seem to have been the case here.

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
The Camry ECM board. U2 is a NEC (now Renesas) V850 microcontroller.

Software

The ECM software formed the core of the technical investigation. What follows is a list of the key findings.

Mirroring (where key data is written to redundant variables) was not always done. This gains extra significance in light of …

Stack overflow. Toyota claimed only 41% of the allocated stack space was being used. Barr's investigation showed that 94% was closer to the truth. On top of that, stack-killing, MISRA-C rule-violating recursion was found in the code, and the CPU doesn't incorporate memory protection to guard against stack overflow.

Two key items were not mirrored: The RTOS' critical internal data structures; and—the most important bytes of all, the final result of all this firmware—the TargetThrottleAngle global variable.

Although Toyota had performed a stack analysis, Barr concluded the automaker had completely botched it. Toyota missed some of the calls made via pointer, missed stack usage by library and assembly functions (about 350 in total), and missed RTOS use during task switching. They also failed to perform run-time stack monitoring.

Toyota's ETCS used a version of OSEK, which is an automotive standard RTOS API. For some reason, though, the CPU vendor-supplied version was not certified compliant.

Unintentional RTOS task shutdown was heavily investigated as a potential source of the UA. As single bits in memory control each task, corruption due to HW or SW faults will suspend needed tasks or start unwanted ones. Vehicle tests confirmed that one particular dead task would result in loss of throttle control, and that the driver might have to fully remove their foot from the brake during an unintended acceleration event before being able to end the unwanted acceleration.

A litany of other faults were found in the code, including buffer overflow, unsafe casting, and race conditions between tasks.


Thousands and thousands

The Camry ETCS code was found to have 11,000 global variables. Barr described the code as “spaghetti.” Using the Cyclomatic Complexitymetric, 67 functions were rated untestable (meaning they scored more than 50). The throttle angle function scored more than 100 (unmaintainable).

Toyota loosely followed the widely adopted MISRA-C coding rules but Barr’s group found 80,000 rule violations. Toyota's own internal standards make use of only 11 MISRA-C rules, and five of those were violated in the actual code. MISRA-C:1998, in effect when the code was originally written, has 93 required and 34 advisory rules. Toyota nailed six of them.

Barr also discovered inadequate and untracked peer code reviews and the absence of any bug-tracking system at Toyota.

NASA, which was involved in an earlier investigation, discussed in its report the five fail-safe modes implemented in the ETCS. They comprise three limp-home modes, RPM limiting, and finally, engine shutdown. All fail-safes are handled by the same task. What if that task dies or malfunctions?

Watchdog

Many embedded systems use watchdog timers to rein in errant processors; in safety-critical systems, they're mandatory. But as systems increase in complexity, the watchdog subsystem must mirror that complexity.

Ideally in a multitasking system, every active task should be required to "check in" to the watchdog. In the Toyota ETCS, the watchdog was satisfied by nothing more than a timer-tick interrupt service routine (ISR). A slow tick. If the ISR failed to reset the watchdog, the ETCS could continue to malfunction due to CPU overload for up to 1.5s before being reset. But keep in mind that for the great majority of task failure scenarios, the ISR would continue happily running along without resetting the controller.

It was also found that most RTOS error codes indicating problems with tasks were simply ignored – a definite MISRA-C violation.

Who watches the watcher?

Toyota's ETCS board has a second processor to monitor the first. The monitor CPU is a 3rd-party part, running firmware unknown to Toyota, and presumably developed without any detailed knowledge of the main CPU's code.

This is potentially a good thing, as it would be a truly independent overseer. This chip communicates with the main CPU over a serial link, and also contains the ADC that digitizes the accelerator pedal position.

Anyone working with safe systems knows that single points of failure are to be avoided at almost any cost, yet here is one – the single ADC that feeds both CPUs their vehicle state information.

Also, the failsafe code in this monitor CPU relies on the proper functioning of a main CPU task Barr identified to the jury only as "Task X" (due to secrecy rules surrounding the source code itself), an arguably outsize task handling everything from cruise-control to diagnostics to failsafes to the core function of converting pedal position to throttle angle. Task X could be viewed as another single point of failure.

Resolutions

What can be learned from this story of software gone wrong? Here are some thoughts, inspired by Toyota's experience:
  • It all starts with the engineering culture. If you have to fight to implement quality, or conversely, if others let you get away with shoddy work, quality cannot flourish. The culture must support proper peer review, documented rule enforcement, use of code-quality tools and metrics, etc.
  • In complex systems, it's impossible to test all potential hardware- and software-induced failure scenarios. We must strive to implement all possible best practices, and use all the tools at our disposal, to create code that is failure-resistant by design.
  • Use model-based design where suitable.
  • Use tools with the proper credentials, not an uncertified RTOS as was done here.
  • The system must undergo thorough testing by a separate engineering team. Never make the mistake of testing your own design. (To be true, Toyota's overall test strategy was not specifically described.)
  • The underlying hardware must work with the firmware to support reliability goals:
    • Single points of failure, in HW and SW, must be avoided.
    • Architectural techniques that contribute to reliability, such as lockstep CPUs, EDAC memory, properly implemented watchdogs, MMU to implement full task isolation and protection, must be implemented.
    • A thorough FMEA to characterize failure modes and guide design improvements should be employed.


Are you involved with safety-critical devices? If so, are you satisfied with the quality processes and culture at your company? What are your thoughts on Toyota’s design work and the investigation’s findings?


http://www.edn.com/design/automotive/4423428/2/Toyota-s-killer-firmware--Bad-design-and-its-consequences


https://mediatech-stream.andrew.cmu.edu/Mediasite/Play/7c2451b6ec764be4bee295095a642c691d?catalog=35969fb7-4f63-4ebb-85d2-5b5a17a3b979






MUST WATCH VIDEO:

A Case Study of Toyota Unintended Acceleration and Software Safety
Oct 3, 2014: updated with video of the lecture


(one hour video presentation starts at the 1:15 min mark)
 

Below is an interview with Michael Barr after his EE Live! keynote "Killer Apps: Embedded Software's Greatest Hit Jobs".