Kirk Freeman
Grandmaster
Apparently a car maker who is not owned by the federal government has the temerity to suggest that cars do not magically rewire themselves.
Considering that this Chicago shakedown is based on magic, there will be heck to pay for Toyota making a statement based on reason and science.
**********************************************************
Toyota Sudden Acceleration Backlash - Popular Mechanics
I wrote here last week how improbable it was that electromagnetic interference (EMI) could fool the Hall-effect sensors that were the subject of the massive recall of 2.4 million late-model Toyota and Lexus vehicles. Specifically, I talked about how the sensors were redundant and isolated, and how it was extremely unlikely that random radio waves could induce spurious signals that trick the engine computer into commanding the engine to go full throttle.
Then professor of automotive technology Dave Gilbert, of Southern Illinois University's auto technology department, went ahead and modified a new Avalon to go to full throttle with the flip of a switch, by altering the same circuits I wrote about. Gilbert appeared on ABC news and testified before Congress that his manipulations demonstrate how easy it is for Toyotas to accelerate out of control. And there's more: He suggested that his analysis shows how all electronic throttles are inherently dangerous, because Toyota's throttle-pedal electronic architecture is similar to that used by almost every car manufacturer.
Whew. I must say the video footage that ABC aired is compelling. Gilbert demonstrates how a seemingly simple short in the throttle pedals' circuitry can make the car go to wide-open throttle (WOT) at whim. Hide the women and children.
Except he's wrong.
Let's get specific: The Toyota throttles (as well as a lot of others) use two Hall-effect sensors, which operate between 0 and 5 volts DC. The voltage increases by 2 to 2.5 volts between the pedal position representing idle and the position for WOT. There are two discrete sensors on separate circuits. The second circuit runs about 2 volts higher than the first. Both sensors have independent 5-volt supplies and independent 0-volt reference returns (meaning they don't share a ground), and they aren't grounded to the chassis. The engine control module (ECM) calibrates the sensors' idle position at every engine start. And if the two sensors don't agree fairly closely as to the percentage of engine throttle called for, the ECM goes into a low-power, limp-home mode, sets a trouble code, and turns on the "Check Engine" light. This means that a sticky pedal may cause the engine to return slowly to idle or not at all. This also means that a using a cell phone or driving under a power line isn't very likely to make you crash and burn.
Here's what Gilbert had to do to make his Avalon go rogue: He had to cut open three of the six wires that travel from the pedal assembly to the engine computer. Two of the wires send the accelerator-position signals—one for each Hall-effect sensor—and one is a 5-volt power supply. Next he had to insert a specific 200-ohm resistor between the two signal wires. Finally, he had to generate a direct short between the 5-volt supply lines and the signal leads. The new wiring essentially mimicked a size-12 mashing of the pedal to the carpet and the engine went to WOT. Also, the order of the modification is important. Apply the 5-volt power lead to the wires before inserting the resistor and the computer would instead throw a fault code and go into limp mode.
Gilbert has managed to prove that he can game the system. Let's examine what would have to happen for such a fault to occur in a real-world situation: Say that, maybe, water is getting into the pedal assembly, or the pedal's wire loom connector is shorting stuff out. First off, the only moving part in the pedal is the part you step on, which has a magnet mounted to the far end. The magnet sweeps inbetween a pair of Hall-effect sensors, which are potted in epoxy to keep them dry and safe. The wiring connector on the pedal has an 0-ring seal to keep out moisture. The individual wires that go into the mating end of the connector have individual seals on them that do the same, and the whole business has a mechanical latch to keep it nice and tight.
There's more. The two signal wires aren't adjacent inside the connector; they're separated by two other wires, one signal ground and one supply wire. So our theoretical 200-ohm, corrosion-induced electrical path would have to bypass two other conductors. That's another big hurdle. Typically, when you find corrosion inside wiring like this, the resistances are closer to 2000 or 2 million ohms, not as small a resistance as 200 ohms. And the resistance value is very specific: A 10 percent difference up or down would put the two sensors out of the acceptable voltage range and wouldn't call up WOT. Even if heavy corrosion were to bridge the connector, how likely is it to be exactly the resistance that's needed?
The next thing in the sequence is a dead short from either of the signal lines to a 5-volt power line. Again, the resistance path usually seen as a result of corrosion is customarily thousands of ohms or more, not the very low resistance needed to energize the signal lines. And, yes, it has to happen in that order. Shorting the power line to the signal line has to happen last.
One pertinent factoid: Not a single case of sudden unintended acceleration (SUA) has been attributed to bad wiring. None. Toyota has been harvesting parts from vehicles with documented SUA issues as part of the recall, and they're checking them all. None of them have shown any sign of corrosion or shorted wiring. Toyota also illustrated that Gilbert's modification works on cars from many different manufacturers. During a webcast explaining the modifications, Toyota had a half-dozen cars built by a half-dozen companies that were rewired in the same manner. All of them produced the same result as that Avalon. The question is: What would make an engineering professor stick his neck out so far?
We can't answer that, but we do know that Gilbert was paid $1800 for his engineering study by Sean Kane, a safety consultant. Kane's for-profit firm Safety Research & Strategies Inc. works with lawyers who are currently suing Toyota over the sudden acceleration issue. He blames Toyota for making the fail-safes and redundancies in the accelerator system too easy to circumvent, arguing that Toyota should have engineered the system to be more robust.
My take on it is this: You can engineer around any safety system if you try hard enough. I had a car come to my repair shop years ago with the throttle stuck open partway. The cause was easy to find—the driver had used a coat hanger to hold the carburetor throttle blades partway open, because the throttle cable had snapped and he had no way to drive the vehicle with the engine at idle. Sort of the same thing as Gilbert's demonstration.
Considering that this Chicago shakedown is based on magic, there will be heck to pay for Toyota making a statement based on reason and science.
**********************************************************
Toyota Sudden Acceleration Backlash - Popular Mechanics
I wrote here last week how improbable it was that electromagnetic interference (EMI) could fool the Hall-effect sensors that were the subject of the massive recall of 2.4 million late-model Toyota and Lexus vehicles. Specifically, I talked about how the sensors were redundant and isolated, and how it was extremely unlikely that random radio waves could induce spurious signals that trick the engine computer into commanding the engine to go full throttle.
Then professor of automotive technology Dave Gilbert, of Southern Illinois University's auto technology department, went ahead and modified a new Avalon to go to full throttle with the flip of a switch, by altering the same circuits I wrote about. Gilbert appeared on ABC news and testified before Congress that his manipulations demonstrate how easy it is for Toyotas to accelerate out of control. And there's more: He suggested that his analysis shows how all electronic throttles are inherently dangerous, because Toyota's throttle-pedal electronic architecture is similar to that used by almost every car manufacturer.
Whew. I must say the video footage that ABC aired is compelling. Gilbert demonstrates how a seemingly simple short in the throttle pedals' circuitry can make the car go to wide-open throttle (WOT) at whim. Hide the women and children.
Except he's wrong.
Let's get specific: The Toyota throttles (as well as a lot of others) use two Hall-effect sensors, which operate between 0 and 5 volts DC. The voltage increases by 2 to 2.5 volts between the pedal position representing idle and the position for WOT. There are two discrete sensors on separate circuits. The second circuit runs about 2 volts higher than the first. Both sensors have independent 5-volt supplies and independent 0-volt reference returns (meaning they don't share a ground), and they aren't grounded to the chassis. The engine control module (ECM) calibrates the sensors' idle position at every engine start. And if the two sensors don't agree fairly closely as to the percentage of engine throttle called for, the ECM goes into a low-power, limp-home mode, sets a trouble code, and turns on the "Check Engine" light. This means that a sticky pedal may cause the engine to return slowly to idle or not at all. This also means that a using a cell phone or driving under a power line isn't very likely to make you crash and burn.
Here's what Gilbert had to do to make his Avalon go rogue: He had to cut open three of the six wires that travel from the pedal assembly to the engine computer. Two of the wires send the accelerator-position signals—one for each Hall-effect sensor—and one is a 5-volt power supply. Next he had to insert a specific 200-ohm resistor between the two signal wires. Finally, he had to generate a direct short between the 5-volt supply lines and the signal leads. The new wiring essentially mimicked a size-12 mashing of the pedal to the carpet and the engine went to WOT. Also, the order of the modification is important. Apply the 5-volt power lead to the wires before inserting the resistor and the computer would instead throw a fault code and go into limp mode.
Gilbert has managed to prove that he can game the system. Let's examine what would have to happen for such a fault to occur in a real-world situation: Say that, maybe, water is getting into the pedal assembly, or the pedal's wire loom connector is shorting stuff out. First off, the only moving part in the pedal is the part you step on, which has a magnet mounted to the far end. The magnet sweeps inbetween a pair of Hall-effect sensors, which are potted in epoxy to keep them dry and safe. The wiring connector on the pedal has an 0-ring seal to keep out moisture. The individual wires that go into the mating end of the connector have individual seals on them that do the same, and the whole business has a mechanical latch to keep it nice and tight.
There's more. The two signal wires aren't adjacent inside the connector; they're separated by two other wires, one signal ground and one supply wire. So our theoretical 200-ohm, corrosion-induced electrical path would have to bypass two other conductors. That's another big hurdle. Typically, when you find corrosion inside wiring like this, the resistances are closer to 2000 or 2 million ohms, not as small a resistance as 200 ohms. And the resistance value is very specific: A 10 percent difference up or down would put the two sensors out of the acceptable voltage range and wouldn't call up WOT. Even if heavy corrosion were to bridge the connector, how likely is it to be exactly the resistance that's needed?
The next thing in the sequence is a dead short from either of the signal lines to a 5-volt power line. Again, the resistance path usually seen as a result of corrosion is customarily thousands of ohms or more, not the very low resistance needed to energize the signal lines. And, yes, it has to happen in that order. Shorting the power line to the signal line has to happen last.
One pertinent factoid: Not a single case of sudden unintended acceleration (SUA) has been attributed to bad wiring. None. Toyota has been harvesting parts from vehicles with documented SUA issues as part of the recall, and they're checking them all. None of them have shown any sign of corrosion or shorted wiring. Toyota also illustrated that Gilbert's modification works on cars from many different manufacturers. During a webcast explaining the modifications, Toyota had a half-dozen cars built by a half-dozen companies that were rewired in the same manner. All of them produced the same result as that Avalon. The question is: What would make an engineering professor stick his neck out so far?
We can't answer that, but we do know that Gilbert was paid $1800 for his engineering study by Sean Kane, a safety consultant. Kane's for-profit firm Safety Research & Strategies Inc. works with lawyers who are currently suing Toyota over the sudden acceleration issue. He blames Toyota for making the fail-safes and redundancies in the accelerator system too easy to circumvent, arguing that Toyota should have engineered the system to be more robust.
My take on it is this: You can engineer around any safety system if you try hard enough. I had a car come to my repair shop years ago with the throttle stuck open partway. The cause was easy to find—the driver had used a coat hanger to hold the carburetor throttle blades partway open, because the throttle cable had snapped and he had no way to drive the vehicle with the engine at idle. Sort of the same thing as Gilbert's demonstration.
