|
by Dr Antony Anderson C.Eng FIEE 6. Frequency of sudden unintended acceleration incidents and alleged examples Some
control system malfunctions outside the automobile
industry Alleged
incidents of sudden unintended acceleration - Litigation - Sudden Acceleration Statistics -
Denial of McMath Petition - Discussion of NHTSA Denial
Intermittent electronic
control system failures rarely leave visible traces behind
them in the form of damaged components. The evidence for
the malfunction is usually the fact that there has
been an observable, if temporary, change in system
behaviour. An analogous medical situation would be
paroxismal atrial flutter where the heart is triggered
temporarily into arythmia which can only be detected
during its occurrence and not once the heart has returned
to its normal state. When subsequently tested, an
intermittently malfunctioning electronic system will
also test out as normal. Very often human error is
invoked as an explanation for such intermittent system
level malfunctions on the highly questionable grounds that
since there is no visible physical evidence of a component
fault therefore it must be the operator that has
malfunctioned. However, such an argument is fallacious
because "Absence of proof is not
proof of absence" i.e. the fact that no physical
fault has been found does not prove that it must have been
the operator. For example, the Mull
of Kintyre Chinook helicopter crash in 1989
was originally attributed to gross negligence on the part
of the pilot and co-pilot by the RAF Board of Enquiry. A
subsequent Parliamentary enquiry produced evidence that
the Mark II Chinook, fitted with a full authority digital
engine control (FADEC), was subject to spurious engine
accelerations and decelerations and that, in the event of
a malfunction, there was no provision for the pilot
to exercise a manual override of the system. In other
words, when the particular incident was placed in the
context of other "near miss" events on the particular
Chinook and others, it could be seen to be part of a
pattern of incidents that could be attributed fairly
conclusively to malfunctions of the FADEC.
Alleged
incidents
of sudden unintended acceleration Here are a few examples of
alleged sudden acceleration incidents:
Sudden Acceleration Statistics The main source of
statistics regarding sudden acceleration incidents is the
US Government's NHTSA
Complaints Database:
Castelli, Nash, Ditlow and Pecht in their analysis of the NHTSA Complaints Database through to mid May 2001 report 25,181 (4.2%) complaints of "sudden acceleration" out of more than 600,000 consumer complaints, a figure that they judge conservative. Sudden acceleration complaints to NHTSA accounted for 5,412 injuries and 303 deaths. By their estimation, ninety four vehicle types in the NHTSA Complaints Database had sudden acceleration complaint rates of at least 30 per 100,000. In my opinion, a range of between zero and 50 sudden acceleration incidents per 100,000 vehicles would seem a reasonable interpretation of the information available up until 2001. Bringing matters up to date, as of July 2010:
Litigation on alleged sudden unintended acceleration There are only two possible
ways in which the throttle can open and cause a sudden
acceleration from near standstill:
There have been a number of
occasions where an electronic malfunction - either in the
cruise control system or, more recently, in the electronic
throttle control system - has been proposed in court as
the possible cause of the throttle opening and giving rise
to a sudden unintended acceleration incident. See section 9.5 for references.
In product liability cases a common defence against a
claim of an electronic malfunction is driver malfunction,
i.e. the defence asserts that the driver mistakenly
pressed the accelerator pedal in the belief that they were
applying the brake. In criminal cases, the prosecution may
argue that the absence of physical evidence of an
electronic component failure points towards the driver
having pressed the accelerator pedal to the floor, thereby
causing the vehicle to accelerate. In both product
liability and criminal cases, the pedal error hypothesis
is presented as if supported by solid evidence where, in
fact, there is none. The pedal error hypothesis
supposes that it is the driver who causes the sudden
acceleration to occur and not a vehicle system
malfunction. If, for the sake of argument,sudden
accelerations were the result of "pedal error" then
clearly, by definition, the vehicle could play no part in
causation. If sudden accelerations were in no way related
to the vehicle, this should become immediately apparent
from a study of sudden acceleration complaint
databases. In other words, the incidence rate of sudden
accelerations per hundred thousand vehicles should be more
or less the same for all ages and makes of car. There
would be little difference in the sudden acceleration
incidence rates of vehicles (a) of different makes (b) of
the same make, but different marques (c) of different
model years (d) fitted with manual or automatic
gearboxes; (e) with/without cruise control (f) with or
without electronic throttle control.
Concerning the second of the
above points, the study by Sayler and
Bizzak of sudden accelerations in 1991 to 1995 model
year in Jeep Cherokees and Jeep Grand Cherokees is
particularly illuminating. They have compared the RSAI
rates of Jeep XJ/ZJ 1991 to 1995 model years up until a
cut off point of April 1997 and find a variation from a
minimum of 0.75 per 10,000 vehicles for 1992 model year
vehicles to a maximum of 2.7 per 10,000 vehicles for 1993
model year vehicles. The comparable figures for Ford
Explorers were 0.15 per 10,000 minimum to 0.6 maximum per
10,000 vehicles and for Chevy Blazers 0.2 to 0.6 per
10.000 vehicles. If the incidence of sudden accelerations
was related to drivers rather than the vehicle, then it
would seem fairly obvious that completely different
results would have been expected from the NHTSA complaints
database, namely that the incidence rates per 10,000
vehicles would be more or less the same from one vehicle
to another and would show very little variation from model
year to model year. In my opinion a jump from an incidence
of 0.75 to 2.7 per 10,000 for Jeep XJ/ZJ models from one
model year to the next strongly suggests that it is
vehicles and not drivers that have been malfunctioning. If
we compare these incidence figures with those for
1983-1986 model year Audi 5000s, given above, of 586 per
100,000 vehicles, i.e. 58.6 per 10,000 vehicles, we can
see an overall incidence rate difference from lowest to
highest of 0.75 to 58.6 per 10,000 vehicles, i.e. a ratio
of 78:1, which is nearly two orders of
magnitude. Such a variation cannot be explained in terms
of drivers making pedal errors because there ought to be
little or no variation between vehicles. It is sometimes claimed that
sudden accelerations from standstill cannot be caused by a
cruise control malfunction because the cruise control is
designed not to come into operation until the vehicle
speed rises above 30 mph. However, witnesses often claim
of sudden accelerations from standstill that the cruise
control was OFF and yet the throttle moved of its own
accord. Either the witnesses are lying, or they are
telling the truth and some further explanation is
required. See Anderson. How can a cruise control
system that seems to be OFF still be be capable of a
malfunction? The answer lies in understanding the
distinction between the functions of control and protection.
Electronic switching devices or controllers control
the voltage or current in a load, but they do not
electrically isolate a load from its power supply
or provide protection against damage in the event
of a fault while in operation. For electrical isolation and
protection an electromechanical switch, a relay or a
contact breaker is required. This principle is
generally adopted, for example in domestic electrical
supply. The individual device ( Kettle, washing machine,
lawnmower etc.) has a controller of some kind and is
protected by an overload cutout and fuse so that in the
event of any failure the device is disconnected from the
electrical supply. At the next level the ring main is
protected against overload by its own circuit breaker. If
that fails, then there is a main circuit breaker for the
whole dwelling which will operate. Should the lawnmower
controller become jammed in the fully open condition
creating a potential runaway situation, the connector and
socked between the power lead and the lawnmower will
automatically disconnect the moment tension is applied to
the lead, so bringing the lawnmower to a rapid halt. A similar distinction
between control and protection/isolation is to be found in
large turbogenerators where the speed is controlled by
controlling the flow of steam using electrohydraulic
governor valves. Protection is provided by emergency stop
valves, which are placed in series with, and ahead
of, the governor valves and which cut off the supply
of steam from the boiler in an emergency and isolate the
turbine. The main point to note here is that steam turbine
governor valves, which have a similar function controlling
steam input to a steam turbine as the throttle valve does
in controlling the air/gasoline flow into an automobile
engine, are only used for everyday control. The emergency
stop valves come into play in an emergency and are
separately and independently controlled. It appears that the
isolation and protection functions normally provided for
the control of power in safety-critical industrial
systems, as outlined above, are absent in many automobile
cruise control systems and electronic throttle control
systems. The function equivalent to the emergency stop
valve in the steam turbine seems generally to have been
left out altogether! Somewhat curiously, the driver
seems to be expected to act as the fail-safe for the
speed control system by braking the vehicle against full
engine power. This seems to be the case whether the engine
is under the control of a cruise control servo or an
electronic throttle. This use of the driver as a
substitute for a true and independent fail safe is one of
the reasons why cruise control systems and electronic
throttle systems give rise to such serious knock-on
runaway effects when they malfunction. It is in this context of an apparent lack of electrical isolation and protection of the power stages of cruise control systems, that we should consider the petition of Mr. Sandy S. McMath to NHTSA [19th July 1999] to re-open their 1989 enquiry on sudden acceleration. McMath was representing the parents of two boys injured in an alleged sudden unintended acceleration incident in Mountain Home Arkansas June 7th 1995. The grounds of what seems to me to be a very reasonable petition were:
The petition was
denied for reasons outlined inDenial
of Motor Vehicle Petition DP99-004
With reference to (1) the Denial says in Section 4.1.2 : "A
review of the [NHTSA] Study demonstrates that this claim
is without foundation. Clearly the Study considered the
possibility that viable cruise control malfunctions
could cause a SAI. But it found no evidence that faults
"bypassing the control logic of the cruise control
system" were a viable explanation for SAI. [SAI
= Sudden Acceleration Incident = Sudden Unexplained
Acceleration] Interestingly, the NHTSA Sudden
Acceleration
Report
of
1989
ignores an earlier NHTSA Report (DOT HS-801 737,
October 1975, Section 7.6, page 196) which provided
precisely the evidence that "faults bypassing the control
logic of the cruise control system" were a viable
explanation for SAI. The 1975 Report took the possibility
of an EMI-induced sudden acceleration from standstill very
seriously and came up with a very practical means of its
prevention: “If, under conditions imposed by a non-moving
vehicle the speed controller had a serious EMI problem
when the car is not moving, deactivation of the
circuit may be the least costly approach to solving
the interference problem. Such a circumstance could
exist with certain classes of electronic ignition
control because of pulsing characteristics of power
transistors and the inductive load of the ignition
coil. An overlapping pulse rise and decay
characteristic which may have radiative additive
components could exist at higher engine speeds. The
solution with electronic techniques would involve some
expensive shielding procedures, but with deactivation
of the speed controller, a significant cost savings in
EMI assurance would be evident.”
...Under the petitioner's
theory, a vehicle involved in a cruise control related
SAI would have had to experience the following
simultaneous failures: (1) at least two electrical
failures of the vacuum servo solenoid system; (2) a
mechanical failure of the MVDV and (3) a mechanical
failure of the brake system. Moreover, according to Mr.
Sero, a post-SAI vehicle inspection would find not
physical evidence that any of these systems failed. Thus
Mr. Sero's theory is based on simultaneous electrical
and mechanical faults, involving more than one element
of the vehicle's control system, which would be
undetectable after the incident has occurred . Here NHTSA appears to
seriously misconstrue Mr Sero's opinions. "Mr Sero's
theory" appears to be a construct of NHTSA and , as far as
I am able to assess, seems to bear little or no
relation to Mr Sero's actual views. Having created "Mr
Sero's theory", more or less out of thin air, NHTSA then
attacks the "theory". This seems to me to be somewhat
unfair on Mr Sero. http://www.forensicfacts.com/ForensicFacts/McMath_petition_denial_rebuttal.pdf ...Extensive laboratory testing of the operation of cruise controls under stress from temperature extremes, power supply variations, EMI/RFI and high voltage discharges has demonstrated no failure modes of any relevance to SAI. Analysis of their circuitry shows that for nearly all controls designed in the past few years ["all" in the case of Ford], two or more independent, intermittent failures would have to occur simultaneously to cause throttle opening in a way that would be difficult to detect after the incident. The occurrence of such simultaneous, undetectable failures is virtually impossible." In effect the NHTSA appear to be denying the following :
Further, the statement
that "Extensive laboratory testing of the operation of
cruise controls under stress from temperature extremes,
power supply variations, EMI/RFI and high voltage
discharges has demonstrated no failure modes of any
relevance to SAI" appears to be entirely at variance
with the published evidence of Kimseng et al quoted in
Section 7, which suggests that the PCBs of one particular
cruise control system could suffer open and short circuits
in accelerated laboratory testing.
One might ask the following of anyone expressing such robust and uncompromising views as the NHTSA :
Mr Sero maybe expressing
himself in slightly ambiguous terms, but nevertheless he
appears to be suggesting, quite reasonably, in my opinion,
that account should be taken of two kinds of fault :
Re. the second type of
fault, to which the NHTSA seems to take such
exception, Mr Sero appears to be talking about
faults that may occur, for example, in the main
elements of the controller, such as the proportional or
integral control amplifiers in older analog systems or
within the microprocessor in more modern digital systems.
Here he may not be presenting his ideas with the utmost of
clarity, but the underlying argument is entirely sound.
i.e. that control systems can experience internal faults
that may manifest themselves as output malfunctions that
cannot be controlled by the input. In my view, there is
nothing extraordinary about this proposition.
Runaway events would be more common were it not for the measures normally taken to prevent them. For example:
In my view, any competent
electrical engineer carrying out a fault analysis on a
control system would recognise that a single point
internal fault was a possibility and might cause a serious
malfunction at the output, irrespective of any inputs.
They would assume that such a malfunction was
possible and work backwards to deduce what particular kind
of internal faults might cause it. They would then look at
the failure evidence and see whether it matched with the
possible root causes or not.
The NHTSA refutes the claim
that it has "neglected to consider the mechanisms that can
cause sudden acceleration by bypassing the control logic
of the cruise control system and thus can induce sudden
acceleration in a stationary vehicle." on the basis that
it found no evidence in its original 1989 report on sudden
acceleration that this postulated mechanism was a viable
explanation for sudden acceleration. We shall see in the next
section that, contrary to what the NHTSA asserted in the
McMath Denial of Petition the year 2000, faults on cruise
control system boards are known to have occurred in the
field and can be induced in the laboratory and therefore
their 1989 argument loses most of its force. The NHTSA has followed very
similar arguments when denying all sudden acceleration
petitions, whatever the make or marque of vehicle. Don't forget to bookmark Section 9 Links and References before leaving this site.
|
|
©Antony Anderson Version 1.0 February 2001 and Version 1.1 July 2001 |