|
by Dr Antony Anderson C.Eng FIEE 6. Frequency of sudden unintended acceleration incidents and alleged examples Some control
system malfunctions
outside the automobile industry Alleged
incidents of sudden unintended acceleration - Litigation
- Sudden Acceleration Statistics - Denial of McMath Petition - Discussion
of
NHTSA
Denial
Intermittent electronic control
system
failures rarely leave visible traces behind
them in the form of damaged components. The evidence for the
malfunction is usually the fact that there has been an
observable, if temporary, change in system behaviour. An analogous
medical situation would be paroxismal atrial flutter where the heart is
triggered temporarily into arythmia which can only be detected during
its occurrence and not once the heart has returned to its normal state.
When subsequently tested, an intermittently malfunctioning
electronic system will also test out as normal. Very often
human
error is invoked as an explanation for such intermittent system level
malfunctions
on the
highly questionable grounds that since there is no visible physical
evidence of
a component fault therefore it must be the operator that has
malfunctioned. However, such an argument is fallacious because "Absence of proof is not proof of absence"
i.e.
the fact that no physical fault has been found does not prove that it
must have been the operator. For example, the Mull of Kintyre
Chinook helicopter
crash in 1989 was originally attributed to gross negligence on the
part
of the pilot
and co-pilot by the RAF Board of Enquiry. A subsequent Parliamentary
enquiry produced evidence that the Mark II Chinook, fitted with a full
authority digital engine control (FADEC), was subject
to spurious engine accelerations and decelerations and that, in the
event
of a malfunction, there was no provision for the pilot to
exercise
a manual override of the system. In other words, when the particular
incident was placed in the context of other "near miss" events on the
particular Chinook and others, it could be seen to be part of a pattern
of incidents that could be attributed fairly conclusively to
malfunctions of the FADEC.
Alleged
incidents of sudden
unintended acceleration Here are a few examples of
alleged sudden acceleration incidents:
Sudden Acceleration Statistics The main source of statistics
regarding sudden acceleration incidents
is the US Government's NHTSA
Complaints Database:
Castelli, Nash, Ditlow and Pecht in their analysis of the NHTSA Complaints Database through to mid May 2001 report 25,181 (4.2%) complaints of "sudden acceleration" out of more than 600,000 consumer complaints, a figure that they judge conservative. Sudden acceleration complaints to NHTSA accounted for 5,412 injuries and 303 deaths. By their estimation, ninety four vehicle types in the NHTSA Complaints Database had sudden acceleration complaint rates of at least 30 per 100,000. In my opinion, a range of between zero and 50 sudden acceleration incidents per 100,000 vehicles would seem a reasonable interpretation of the information available up until 2001. Bringing matters up to date, as of July 2010:
Litigation on alleged sudden unintended acceleration There are only two possible ways
in which
the throttle can open and cause a sudden acceleration from near
standstill:
There have been a number of
occasions where an electronic malfunction - either in the cruise
control
system or, more recently, in the electronic throttle control system -
has
been proposed in court as the possible cause
of the throttle opening and giving rise to a sudden unintended
acceleration incident. See
section 9.5 for references. In product liability cases a common
defence against a claim of an electronic malfunction is driver
malfunction, i.e. the defence asserts that the driver mistakenly
pressed the
accelerator pedal in the belief that they were applying the brake. In
criminal cases, the prosecution may argue that the absence of physical
evidence of an electronic component failure points towards the driver
having pressed the accelerator pedal to the floor, thereby causing the
vehicle to accelerate. In both product liability and criminal cases,
the pedal error hypothesis is presented as if supported by solid
evidence where, in fact, there is none. The pedal error hypothesis
supposes that it is the driver who causes the sudden acceleration to
occur and not a vehicle system malfunction. If, for the sake of
argument,sudden accelerations were the result of "pedal error" then
clearly, by definition, the vehicle could play no part in causation. If
sudden accelerations were in no way related to the vehicle, this should
become immediately apparent from a study of sudden acceleration
complaint databases. In other words, the incidence rate of sudden
accelerations per hundred
thousand vehicles should be more or less the same for all ages and
makes of car. There would be little difference in the sudden
acceleration incidence rates of vehicles (a) of different makes (b) of
the same make, but different marques (c) of different model years (d)
fitted with manual or automatic gearboxes; (e) with/without
cruise control (f) with or without electronic throttle control.
Concerning the second of the
above points, the study by Sayler and Bizzak of
sudden accelerations in 1991 to 1995 model year in Jeep Cherokees and
Jeep Grand Cherokees is particularly illuminating. They have compared
the RSAI rates of Jeep XJ/ZJ 1991 to 1995 model years up until a cut
off point of April 1997 and find a variation from a minimum of 0.75 per
10,000 vehicles for 1992 model year vehicles to a maximum of 2.7 per
10,000 vehicles for 1993 model year vehicles. The comparable figures
for Ford Explorers were 0.15 per 10,000 minimum to 0.6 maximum per
10,000 vehicles and for Chevy Blazers 0.2 to 0.6 per 10.000 vehicles.
If the incidence of sudden accelerations was related to drivers rather
than the vehicle, then it would seem fairly obvious that completely
different results would have been expected from the NHTSA complaints
database, namely that the incidence rates per 10,000 vehicles would be
more or less the same from one vehicle to another and would show very
little variation from model year to model year. In my opinion a jump
from an incidence of 0.75 to 2.7 per 10,000 for Jeep XJ/ZJ models from
one model year to the next strongly suggests that it is vehicles and
not drivers that have been malfunctioning. If we compare these
incidence figures with those for 1983-1986 model year Audi 5000s, given
above, of 586 per 100,000 vehicles, i.e. 58.6 per 10,000 vehicles, we
can see an overall incidence rate difference from lowest to highest of
0.75 to 58.6 per 10,000 vehicles, i.e. a ratio of 78:1,
which is nearly two orders of magnitude. Such a variation cannot be
explained in terms of drivers making pedal errors because there ought
to be little or no variation between vehicles. It is sometimes claimed that
sudden accelerations from standstill cannot be caused by a cruise
control malfunction because the cruise control is designed not to come
into operation until the vehicle speed rises above 30 mph. However,
witnesses often claim of sudden accelerations from standstill that the
cruise control was OFF and yet the throttle moved of its own accord.
Either
the witnesses are lying, or they are telling the truth and some
further explanation is required. See Anderson. How can a cruise control system
that seems to be OFF still be be capable of a malfunction? The answer
lies
in understanding the distinction between the functions of control and protection. Electronic
switching devices or controllers control
the voltage or current in a load, but they do not electrically isolate
a load from its power supply or provide protection against
damage in the event of a fault while in operation. For electrical
isolation and protection an electromechanical switch, a relay or a
contact breaker is required. This principle is generally adopted,
for example in domestic
electrical supply. The individual device ( Kettle, washing machine,
lawnmower etc.) has a controller of some kind and is protected by an
overload cutout and fuse so that in the event of any failure the device
is disconnected from the
electrical supply. At the next level the ring main is protected against
overload
by its own circuit breaker. If that fails, then there is a main circuit
breaker
for the whole dwelling which will operate. Should the lawnmower
controller
become jammed in the fully open condition creating a potential runaway
situation,
the connector and socked between the power lead and the lawnmower will
automatically
disconnect the moment tension is applied to the lead, so bringing the
lawnmower
to a rapid halt. A similar distinction between
control and
protection/isolation
is to be found in large turbogenerators where the speed is controlled
by
controlling the flow of steam using electrohydraulic governor valves.
Protection
is provided by emergency stop valves, which are placed in series with,
and ahead of, the governor
valves and which cut off the supply of steam from the boiler in an
emergency and
isolate
the turbine. The main point to note here is that steam turbine governor
valves, which have a similar function controlling steam input to a
steam turbine as the throttle valve does in controlling the
air/gasoline flow into an automobile engine, are only used for everyday
control. The emergency stop valves come into play in an emergency and
are separately and independently controlled. It appears that the
isolation and protection
functions normally provided for the control of power in safety-critical
industrial systems, as outlined above, are absent
in many
automobile cruise control systems and electronic throttle control
systems. The function equivalent to the emergency stop valve in the
steam turbine seems generally to have been left out altogether!
Somewhat curiously, the driver seems to be expected to act as the
fail-safe for the
speed control system by braking the vehicle against full engine power.
This seems to be the case whether the engine is under the control of a
cruise control servo or an electronic throttle. This use of the driver
as a substitute for a true and independent fail safe is one of the
reasons
why cruise control
systems and electronic throttle systems give rise to such
serious
knock-on runaway effects when they malfunction. It is in this context of an apparent lack of electrical isolation and protection of the power stages of cruise control systems, that we should consider the petition of Mr. Sandy S. McMath to NHTSA [19th July 1999] to re-open their 1989 enquiry on sudden acceleration. McMath was representing the parents of two boys injured in an alleged sudden unintended acceleration incident in Mountain Home Arkansas June 7th 1995. The grounds of what seems to me to be a very reasonable petition were:
The petition was denied
for reasons outlined in
Denial of Motor Vehicle Petition DP99-004
With reference to (1) the Denial says in Section 4.1.2 : "A review
of the [NHTSA] Study
demonstrates that this claim
is without foundation. Clearly the Study considered the possibility
that viable cruise control malfunctions could cause a SAI. But it found
no evidence
that faults "bypassing the control logic of the cruise control system"
were
a viable explanation for SAI. [SAI = Sudden Acceleration
Incident = Sudden Unexplained Acceleration] Interestingly, the NHTSA Sudden
Acceleration
Report
of
1989
ignores an
earlier NHTSA Report (DOT HS-801 737, October 1975, Section 7.6, page
196) which provided precisely the evidence that "faults bypassing the
control logic of the cruise control system" were a viable explanation
for SAI. The 1975 Report took the possibility of an EMI-induced sudden
acceleration
from standstill very seriously and came up with a very practical means
of its prevention: “If,
under
conditions
imposed
by
a
non-moving
vehicle
the
speed controller
had a serious EMI problem when the car is not moving, deactivation of
the circuit may be the least costly approach to solving the
interference problem. Such a circumstance could exist with certain
classes of electronic ignition control because of pulsing
characteristics of power transistors and the inductive load of the
ignition coil. An overlapping pulse rise and decay characteristic which
may have radiative additive components could exist at higher engine
speeds. The solution with electronic techniques would involve some
expensive shielding procedures, but with deactivation of the speed
controller, a significant cost savings in EMI assurance would be
evident.”
...Under the petitioner's
theory, a vehicle involved in a
cruise control related SAI would have had to experience the following
simultaneous failures: (1) at least two electrical failures of the
vacuum servo solenoid system; (2) a mechanical failure of the MVDV and
(3) a mechanical failure of the brake system. Moreover, according to
Mr. Sero, a post-SAI vehicle inspection would find not physical
evidence that any of these systems failed. Thus Mr. Sero's theory is
based on simultaneous electrical and mechanical faults, involving more
than one element of the vehicle's control system, which would be
undetectable after the incident has occurred . Here NHTSA appears to seriously
misconstrue Mr Sero's opinions. "Mr Sero's theory" appears to be a
construct of NHTSA and , as far as I am able to assess, seems to
bear little or no relation to Mr Sero's actual views. Having
created "Mr Sero's theory", more or less out of thin air, NHTSA then
attacks the "theory". This seems to me to be somewhat unfair on Mr
Sero. http://www.forensicfacts.com/ForensicFacts/McMath_petition_denial_rebuttal.pdf ...Extensive laboratory testing of the operation of cruise controls under stress from temperature extremes, power supply variations, EMI/RFI and high voltage discharges has demonstrated no failure modes of any relevance to SAI. Analysis of their circuitry shows that for nearly all controls designed in the past few years ["all" in the case of Ford], two or more independent, intermittent failures would have to occur simultaneously to cause throttle opening in a way that would be difficult to detect after the incident. The occurrence of such simultaneous, undetectable failures is virtually impossible." In effect the NHTSA appear to be denying the following :
Further, the statement that "Extensive
laboratory
testing
of
the
operation
of
cruise
controls
under
stress from temperature extremes,
power
supply variations, EMI/RFI and high voltage discharges has demonstrated
no
failure modes of any relevance to SAI" appears to be entirely at
variance
with the published evidence of Kimseng et al quoted in Section 7, which
suggests that the PCBs of one particular cruise control system could
suffer open and short circuits in accelerated laboratory testing.
One might ask the following of anyone expressing such robust and uncompromising views as the NHTSA :
Mr Sero maybe expressing
himself in slightly ambiguous terms, but
nevertheless he appears to be suggesting, quite reasonably, in my
opinion, that account should be taken of two kinds of fault :
Re. the second type of fault,
to which the NHTSA seems to take such
exception, Mr Sero appears to be talking about faults that may
occur,
for example, in the main elements of the controller, such as the
proportional or integral control amplifiers in older analog systems or
within the microprocessor in more modern digital systems. Here he may
not be
presenting
his ideas with the utmost of clarity, but the underlying argument is
entirely
sound. i.e. that control systems can experience internal faults that
may
manifest themselves as output malfunctions that cannot be controlled by
the input. In my view, there is nothing extraordinary about this
proposition.
Runaway events would be more common were it not for the measures normally taken to prevent them. For example:
In my view, any competent
electrical engineer carrying out a fault
analysis on a control system would recognise that a single point
internal
fault was a possibility and might cause a serious malfunction at the
output, irrespective of any inputs. They would assume that such a
malfunction was possible and work backwards to deduce what particular
kind of internal faults might cause it. They would then look at the
failure evidence and see whether it matched with the possible root
causes or not.
The NHTSA refutes the claim that
it has "neglected to consider
the mechanisms that can cause sudden acceleration by bypassing the
control
logic of the cruise control system and thus can induce sudden
acceleration
in a stationary vehicle." on the basis that it found no evidence in its
original 1989 report on sudden acceleration that this postulated
mechanism was a viable
explanation
for sudden acceleration. We shall see in the next section
that, contrary to what the
NHTSA asserted in the McMath Denial of Petition the year 2000, faults
on cruise control system boards
are known to have
occurred in the field and can be induced in the laboratory and
therefore their 1989 argument loses most of its force. The NHTSA has followed very
similar arguments when denying all sudden acceleration petitions,
whatever the make or marque of vehicle. Don't forget to bookmark Section 9 Links and References before leaving this site.
|
|
©Antony Anderson Version 1.0 February 2001 and Version 1.1 July 2001 |