Tire Industry Declares End to Era of Recall Apathy

If one listened closely in the Sonesta Hilton Head Resort meeting room at the 2018 Clemson Global Tire Conference, one could hear the strains of Kumbaya, as the Tire Industry Association and the U.S. Tire Manufacturers Association announced a new alliance to address the longstanding problems of the tire recall system. They didn’t announce much else.

The occasion was a half-hour presentation on the tire registration and recall system at the mid-April conference by David Martin, category director of tools and supply for American Tire Distributors Inc., and the current TIA president and John Evankovich, director of Sam’s Club Tire and Battery Centers, and TIA board secretary.  

TIA Executive Director Roy Littlefield introduced their talk with a confession: “Tire registration the most emotional issue for tire retailers. We now have over 10,000 members and we have seen an incredible increase in membership because of the emphasis on tire registration and recall. We have to look at how current technology can improve a system that has been outdated from the beginning.”

Then, Martin and Evankovich devoted most of their talk to recounting the regulatory history of tire registration. Nearly a half century of TIA and USTMA indifference to the system that is the foundation of the recalled tire recovery effort has produced correspondingly dismal rates – an average of 30 percent, compared to the 72 percent and above rates for recalled vehicles, equipment or child restraints. That’s because for most of the regulation’s history, the two lobbied to offload their responsibilities onto each other, or dump everything on the consumer. For example, in the early 1980s, tire dealers persuaded Congress to remove them from the tire recall system – the regulations only required dealers to hand their customers a registration card to be filled out and returned to the manufacturer.

But in 2015, the Fix America’s Surface Transportation (FAST) Act brought their existential struggle out into public view. The FAST Act compels NHTSA to write regulations requiring independent dealers to maintain customer tire purchase information and electronically transmit those records to tire manufacturers. The former Rubber Manufacturers Association (now USTMA) lobbied hard for that. The TIA won a provision requiring the Secretary of Transportation to examine the feasibility of requiring tire manufacturers to include an electronic TIN on every tire.

“You would not think you would see the TIA and the USTMA standing together,” conceded panelist Jay Spears, Continental Tire’s Director of Standards and Regulation, during a Q & A session. “We did not have the same opinion and we fought it out in public, which is not a good look for anyone.” 

While NHTSA quietly works on its Congressional to-do list, the USTMA and the TIA decided to it might be better to work together. Their discussions, described as “eye-opening,” led to the revelation that understanding each other’s perspectives was critical toward reaching a solution.

Interspersed with the history lesson were a number of comments on the system’s failures. Evankovich noted that the system is still basically a paper-and-pencil system: “The fact is if you look at it today and where we started – it’s basically the same – we are using the same technology. Things have not changed very much.” (In 1970, advanced technology consisted of liquid crystal displays and pocket calculators.)

Martin admitted that the industry had not done a good job training tire techs and sellers to properly register tires: “Education and outreach – There’s been a lack of real lack of getting the information out to installers so they will understand the proper process. We’ve just been sending out cards and it hasn’t been effective.”

But the session did not focus on solutions. When asked if a unique identifier for each tire would benefit the recall process, Martin only noted “it was a consideration that has been discussed,”

The group agreed that the solution would be rooted in technology which would impose costs on manufacturers and retailers alike, but no one would venture an opinion on what either would be.

“Both sides know that technology isn’t free,” says Evankovich. “There is going a cost associated with  whether it’s from technology that goes into a tire, whether it’s from [point of sale systems] that can handle advanced capabilities, whether it’s a scanner to scan TIN numbers, I don’t think any one answer is 100 percent right today.”

For the consumer and for the service technicians, the bottom line is this: there are too many ways for old or recalled tires to stay or be mounted on a vehicle, with catastrophic consequences. This is a problem created by both the tire sellers and the tire manufacturers, who have not supported a workable system to accurately register all tires, to ensure that manufacturers have all the data, and to provide a comprehensive, easy or quick way to determine if a tire has been recalled.  While the FAST Act requires NHTSA to create a tire recall Tire Identification Number (TIN) look-up, it has not done so yet. In the meantime, the USTMA launched one in November 2017, but only its eight members participate, so it’s not complete.

And on the subject of tire age, consumers and tire techs can choose from a set of confusing options. Most auto manufacturers have set six years as the recommended service life limit on tires. Some in the rubber industry argue that tires are ageless; some have declared a 10-year service life.

In a March deposition, a TIA official testified that if a full-size spare will be used as a replacement tire, the shop should check to see if it has been recalled. Really? Only check the full-sized spare? What about the rest of the damned tires?

These are flimsy, ad-hoc standards of care, being created in the vacuum left by the flimsy, ad hoc tire registration and recall system.

The Safety Record Blog has been writing about aged tires and the broken tire recall and registration system, if you want to catch up, follow the links below for a sampling:

RMA Launches Feel-Good Tire Recall Database

Improving the Recall System for the 21st Century

The Wrong Fix for the Broken Recall System

"Aged" Tire Case Numbers Grow: Spares and Used tires Top the List

Not Very FAST Act Tackles Recall, Tire Issues, Closes Rental Loophole

The Safety Record Blog means it sincerely when we say that it’s nice to see that manufacturers and tire retailers finally admit that the current system sucks and that it hasn’t advanced technologically since (if you are old enough) you played Pong. But we are less jazzed about the Goldilocks-like looking-for–the-technology-that-is-just-right attitude toward action. Consumers have been waiting 48 years for the industry to commit itself to taking unsafe tires off the road, and we guess they’ll have to wait some more.

General Motors Quietly Installs Keyless Engine Shutoff

In 2011, when the National Highway Traffic Safety Administration was considering countermeasures to the carbon monoxide hazard introduced by keyless ignition systems, it flat out rejected the idea of an automatic engine shut-off.  The agency argued that there was no good way to come up with a rule that would include a set time for the engine to shut itself off if the driver exited with the fob and inadvertently left the engine running.

“There are scenarios, such as leaving pets in the vehicle with the air conditioning or heating system on while the driver shops or is at a restaurant, where an automatic shut off of the propulsion system would have adverse results. It is our understanding that some drivers may stay in their vehicles for hours, for example, to sleep, with the air conditioning or heating system on. For the pet owner or the person staying in the vehicle for an extended period, it would be inconvenient if the propulsion system had to be restarted every 15 minutes or so,” the agency wrote in the NPRM.

Of course, the agency could have come up with a performance standard in which an idling vehicle in an enclosed space could only generate so many ppm of CO – whatever could lead to dangerous levels seeping into an adjoining structure – or some variant. But never mind – that’s not the news here. By Jove, now two major automakers have figured it out, over-heated puppies and car-nappers notwithstanding. And one of them – General Motors – kept this information from its customers for four years!

Both Ford and GM first implemented automatic engine shut down features in some of their MY 2013 vehicles.

According to owner’s manuals, Ford’s Automatic Engine Shutdown system automatically “shuts down the engine if it has been idling for an extended period. The ignition also turns off in order to save battery power. Before the engine shuts down, a message appears in the information display showing a timer counting down from 30 seconds. If you do not intervene within 30 seconds, the engine shuts down. Another message appears in the information display to inform you that the engine has shut down in order to save fuel.”

GM’s Extended Parking feature works this way in the 2015 Chevy Tahoe:

Extended Parking It is better not to park with the vehicle running. If the vehicle is left while running, follow the proper steps to be sure the vehicle will not move and there is adequate ventilation. See Shifting Into Park 0 259 and Engine Exhaust 0 261. If the vehicle is left in P (Park) while running and the Remote Keyless Entry (RKE) transmitter is outside the vehicle, the vehicle will turn off after one hour. If the vehicle is left in P (Park) while running and the RKE transmitter is inside, the vehicle will run for two hours. At the end of the second hour, the vehicle will turn off. The timer will reset if the vehicle is taken out of P (Park) while it is running.”

Based on GM technical service descriptions the earlier versions of Extended Parking allowed the vehicle to run in two 2.5 hour cycles, for a total run-time of five hours – if the fob was still in the vehicle while the engine was left running. The automaker eventually reduced it to two one-hour cycles in some models and two 1.5 hour cycles in others.

Ford didn’t exactly make a public relations splash when it added the automatic engine shut-off in the 2013 Ford Edge, Ford Fusion Titanium and Titanium Hybrid and the Lincoln MKZ, but at least it included a description of the safety measure in the owner’s manuals.

GM, according to service descriptions, implemented an engine shutdown feature in the 2013 Buick LaCrosse, Verano and Regal, the Chevy Cruze and Malibu and the Cadillac ATS, SRX, and XTS, without so much as a whisper to drivers. GM continued to expand the application of what it eventually branded the “Extended Parking Feature,” until all of its vehicles had it in 2017. Then, GM included a description in its owner’s manuals. 

Why the big secret?

Curiouser and Curiouser

Let’s push some timelines together.

In February 2009, Mary Rivera, a former college professor, suffered permanent brain damage when she unknowingly left her Lexus ES 350 idling in the garage beneath her home.  Her partner, Ernest Cordelia, died of CO poisoning.

(SRS began researching this issue in 2009. In August 2010 we met with the agency to express our concerns, and have submitted comments to the 2011 FMVSS 114 docket. SRS repeatedly emphasized to NHTSA that “the introduction of electronic keys in combination with push-button ignition systems has introduced new scenarios under which a driver can exit the vehicle, key fob in hand with the motor running, or with the engine off but the vehicle in a gear other than park. With today’s quiet engines, drivers can leave a vehicle, travel great distances from the vehicle with the key in their pockets while the engine is running or the transmission in neutral – all without being aware that they have done so. As we are seeing from owner complaints and litigation, the marriage of electronics with ignitions and locks have resulted in unintended consequences: carbon monoxide poisoning, rollaway crashes and easy thefts allowing manufacturers an erroneous – and as far as the consumer is aware – secret definition of the key that allows drivers to mistakenly believe that when they exit the vehicle with the fob, the engine is off and the vehicle transmission locked in the Park position – is antithetical to the spirit and letter of FMVSS 114.” You can read them here.)

In early 2009, SAE formed the Keyless Ignition Subcommittee in response to safety concerns and “concern regarding the myriad different ways manufacturers are implementing keyless ignition features,” as described in NHTSA’s Notice of Proposed Rulemaking to fix the hazards introduced by keyless ignition systems. “The committee consisted of experts in the study of how humans interact with machines (human factors experts) and designers of keyless ignition systems from auto manufacturers and suppliers,” according to the NPRM. Ford and GM each had a representative on this committee.

As we’ve said many times, the great downside to electronic key systems is the transition of the key from a physical object to an invisible electronic code – the average consumer doesn’t really understand this, and conflates the fob with the key, because you need the former to start the vehicle, and because manufacturers brand the fob with names like Smart Key, or the visual alerts in the vehicle say “Key not Detected” in reference to the fob. However, unlike a traditional key, the fob plays no role in turning off the vehicle. When a driver is standing in his kitchen with a traditional car key in his hand, it is certain that the engine is off and his vehicle transmission is in Park, because you can’t remove the key otherwise. A driver holding a key fob in his hand has no such assurances. In many models, you can turn the engine off with the transmission in any position, and in all keyless vehicles you can take the fob with you, leave the motor running, and it will not turn off, just because the key fob is out of range – contrary to what many believe. No, for that you need an engineered software solution.

In the fall of 2010, stories about carbon monoxide deaths begin to circulate in the mainstream press, first, the September 2010 death of Chastity Glisson in a keyless Lexus IS250 and in November, the New York Daily News broke the Rivera story.

In January 2011, SAE issued its recommended practice J2948 for keyless ignition controls “based on the subcommittee members' experience with their company's vehicles and systems, knowledge of consumers' comments about the operation of the systems, knowledge of human factors engineering and, in some cases, knowledge of proprietary studies done during the development of their products (actual data was not shared with the group),” according the NPRM.

SAE J2948 noted four “errors” drivers might make: the inability to start and stop the vehicle propulsion system; exiting the vehicle with the automatic transmission in a non-parking gear; exiting the vehicle while the vehicle propulsion system is enabled; and exiting the vehicle while the vehicle propulsion system is disabled, but the accessory or electrical systems are active.”

The intent of the standard is stated as: “to help minimize these errors.”

In December 2011, NHTSA published its NPRM and the Alliance of Automobile Manufacturers, which represents Ford and GM, immediately starts clutching its pearls over the very idea that NHTSA would try to make a rule to address these same conditions that the industry decided to address in early 2009.  

The Alliance proceeded to take a strip off the agency’s hide for attempting rulemaking on “anecdotal evidence,” provided by Vehicle Owner Questionnaires (VOQs) in which consumers reported rollaways or deaths from carbon monoxide poisoning when they mistakenly left their vehicles running. And the Alliance admonished NHTSA to do some human factors testing – even though it’s pretty clear that the automakers themselves didn’t do any before they installed keyless systems.

At the time there are only those two publicly known deaths – both in Toyotas. (Since then, the tally of reported carbon monoxide deaths has risen to 26 – including a couple who died in 2006 carbon monoxide deaths involving a Toyota Avalon.) Notice again that public knowledge follows industry efforts already underway that acknowledged the need to address the hazards of keyless ignitions.

In calendar 2012, both Ford and GM released MY 2013 keyless vehicles with automatic shut-off systems. Ford quietly put the information in the owner’s manuals; GM was completely silent on the issue.

Think about this timing. Given what we know about automaker’s development cycles, a Ford or GM plan to develop and implement an automatic engine cut-off feature was likely already well in the works somewhere between the time the SAE keyless ignition subcommittee convenes and the agency publishes its NPRM – yet its trade representative excoriates the agency for attempting regulations designed to prevent drivers from exiting their keyless vehicles with the fob and the engine running, by mandating what industry considers audible warnings that are too loud. Why? Because buzzers and beeps will annoy customers – a cardinal automotive design sin? Or, because at least two of their major members were quietly installing a much better solution?

And what does NHTSA know? In 2014, the agency launched a compliance evaluation of 2013-2014 keyless ignition vehicles from Toyota, Ford, General Motors, Nissan, Mazda, Hyundai and Kia, to test how their keyless ignition systems operate under different scenarios in which to determine if the Theft Protection and Rollaway Prevention Standard had been violated. Among the population tested: two Fords and all of the GM vehicles had the engine idle shut-off feature. Specifically, the 2013 Lincoln MKZ and the 2013 Buick Verano and LaCrosse and the 2014 Ford Edge and the Buick Regal, Cadillac SRX and XTS. 

In the Information Request sent to each manufacturer, the agency asked: Describe in detail how the Subject Vehicles' engine/motor is stopped or turned off. Include in your response, how hard and long the driver must press the start/stop button, to which device the code or other electrical signal is sent (i.e., immobilizer or engine control unit ("ECU")), and which devices are turned off or deactivated by the ECU (i.e., starter, fuel pump, fuel injection system, etc.). Specify when exactly those devices are turned off or deactivated (i.e. after the engine/motor stop control is pressed to turn off the engine/motor, after the driver's door is opened, etc.)

Did Ford or General Motors include an explanation of the feature in their answers? We’ll venture a guess: No.

Why Does GM Keep It Quiet?

It is odd that GM chose not to tell customers or even dealership techs about this feature, until long after it was implemented in its vehicles.

In 2015, the public learns that GM had an engine idle shutoff feature in the 2014 Volt, as a result of a recall. GM launched campaign 15V145 to retrofit 2011-2013 Chevrolet Volts with software that would automatically shut off the engine after a set time of idling, to prevent carbon monoxide poisoning. The recall states:

“If a driver exits his/her vehicle and inadvertently leaves the vehicle “on” (because the driver fails to react to the cues and warning chimes emitted by the vehicle to alert the driver that the vehicle has not been turned off), after a period of time, the vehicle’s battery will drain and the vehicle’s gas engine will begin to run. If the gas engine runs for long periods of time within an enclosed space, such as a garage, carbon monoxide could build up in the enclosed space and potentially cause injury.”

The automaker’s Part 573 submission to NHTSA noted that it had initiated an investigation in August 2014, allegedly after a single customer complaint about the build-up of carbon monoxide in a garage caused by the engine inadvertently left running. (GM told Automotive News that it was aware of two carbon monoxide injuries.)

And here’s where it gets weird. In GM’s defect chronology, which accompanies all Part 573 submissions, the automaker wrote: “it was determined that the 2014 model year and beyond Volts contain software that automatically shuts down the vehicle after being left idle in a run state for a specific amount of time.”

Now, by MY 2014, Buicks, Cadillacs and all of the Chevrolets had an automatic engine shutdown feature – a significant subset had had it since calendar 2012 (MY 2013)! Yet, GM talks about a disembodied discovery, like it had no idea that it had been systematically installing an engine shutdown system through its carlines since 2012.

Its defect chronology continues:

“GM’s Safety and Field Action Decision Authority (SFADA) concluded that, because the investigation revealed customer error in leaving the vehicle in a run state was the primary factor contributing to the condition, and considering the warnings provided to the driver that the vehicle was left running and the low number of complaints relating to this issue, the appropriate remedy would be a customer satisfaction program to update the vehicle software to power down the vehicle if the vehicle was left running for an extended period of time.”

Super weird that they only want to do a customer satisfaction campaign because of bad, bad drivers, since, clearly, GM had long ago decided that this was a hazard, and had engineered a solution that had been implemented more than two years earlier in non-hybrid vehicles, where there isn’t even the possibility that the quiet electric powered motor will revert to the gasoline engine, if left running long enough.

According to the GM defect chronology, they only decided to move to a recall, at NHTSA’s suggestion. Did NHTSA know that GM already had a cut-off feature in so many of its models?

The next time GM publicly reveals the existence of this feature in other vehicles is to its dealers and their technicians in a series of technical service bulletins that appear to begin in 2015. Did the absence of an explanation for this feature lead to customer complaints about the engine shutting down? An examination of consumer complaints to NHTSA shows that drivers with models that employed the 2.5 to 5 hour run strategy in the earlier versions of the Extended Parking feature complained that their vehicle did not shut down. This driver of a 2014 Buick Verano was so frustrated, he filed two different complaints with NHTSA:

“This is my second complaint. My wife forgot to press the stop engine button again because of a distraction.  As a result she burned a quarter tank of gas while she was gone from the vehicle. Why is there not a safety shut off like the ten minute shut off in remote start mode? If this was in my integral garage I could be dead from carbon monoxide. Is this another shove it under the rug like the GM key scandal. Since so many vehicles are going to this technology why hasn't this been looked at? My wife is only 61 and in good health. What of the older folks with problems to do?”

The Preliminary Information technical bulletins to GM service technicians inform them that “Some customers may comment that the engine stops running after extended idle with shifter in Park.” No repair is required, the bulletin states – just educate the customer about the existence of the extended parking feature.

So, customers didn’t know, the dealership techs didn’t know, GM’s Safety and Field Action Decision Authority apparently didn’t know.

And what does NHTSA know about this? If they’ve been paying attention, they know from the TSBs that GM filed with the agency

How many other automakers have secretly added this countermeasure? 


Read The Safety Record Blog prior coverage on Keyless Ignition here



Seat Heaters Still Too Hot

In October 2014, Keith and Tammie Jo Smith took a two-hour car ride from Pine Bluff, Arkansas to their home in Bastrop, Louisiana. According to a complaint filed in U.S. District Court, in Monroe Louisiana, as he exited his 2008 Chevrolet Suburban, Keith Smith put his hands on the driver’s seat and noticed that it seemed unusually hot to the touch. But, he never noticed it while driving, because an on-the-job injury had rendered Smith a paraplegic since July 1991.

That night however, when Keith undressed to bathe, his wife noticed that the skin on his left buttock appeared to be burned. When the Smiths sought medical treatment, they learned that Keith had suffered severe burns, requiring extensive medical treatment and reconstructive surgery. Keith’s paraplegia already made his skin vulnerable to break down, and even after multiple procedures, he still had to be monitored every day for redness, blisters, and other signs of skin breakdown, the complaint alleges.

Subsequent tests of the Suburban’s seat heater found that the surface temperature could get as hot as 140ºF (60ºC).

In 1947, a pair of Harvard researchers A.R. Mortiz and F.C. Henriques Jr. conducted seminal research on the effect of hot temperatures on human skin. Studies of Thermal Injury II:  The Relative Importance of Time and Surface Temperature in the Causation of Cutaneous Burns, is the source of every voluntary and many internal manufacturer standards, covering heated products – from pulse oximeters to vehicle seat heaters. Moritz and Henriques examined the relationship between time and temperature using pig skin first, then human skin, along with mathematical modeling. They found that in the humans, the lowest surface temperature responsible for cutaneous burning was 44ºC (111ºF) when exposed for six hours. As the contact temperatures increased above 44˚C, the time to damage is cut in half for each 1˚C rise in temperature up to about 51˚C (124˚F). 

Despite this well-established threshold, some automakers are still designing seat heaters to work in ranges that exceed it, are still manufacturing seat heaters that clearly get much hotter in places than their design specifications, and are still foregoing simple countermeasures that their peers have been implementing since the 1980s. These design failures have led to burn holes in clothes and seat covers, minor burns to some and severe and permanent injuries in occupants with lower body sensory deficits, such as diabetics, paraplegics, quadriplegics and individuals with neuropathy.

In February 2011, Safety Research & Strategies, with support from Dr. David Greenhalgh, a nationally recognized expert in burn surgery and burn care, and chief of burns at Shriners Hospitals for Children in northern California, and other members of the burn rehabilitation community, called upon the National Highway Traffic Safety Association, the Alliance of Automobile Manufacturers and the National Mobility Equipment Dealers Association to address this issue. (See It’s Time to Make Seat Heaters Safer) In a Safety Record Blog post, we wrote:

"With no government or industry-wide standards, manufacturers have installed a variety of seat heater systems – some that reach temperatures significantly above human tolerances or have no automatic shut-off mechanism – or both. While most drivers know when to turn a hot seat off, occupants with lower body sensory deficits don’t feel the burn. The medical literature has been documenting serious and permanent burn injuries from car seat heaters to occupants with paralysis or diabetes since 2003. Disabled motorists have been complaining about the problem to NHTSA since, at least, 2002. The industry’s response has been to bury a warning in the owner’s manual. NHTSA’s approach to seat heater defects has been: no flames, no problem. These are preventable injuries – and it’s time government and industry began preventing them."

A Lack of Substantive Action

While we heard nothing from the Alliance or the mobility dealers, NHTSA responded that it would encourage the Society of Automotive Engineers to devise a voluntary standard.

In January 2016, SAE International issued Recommended Practice J3047.

“Recommendation for Acceptable Operating Parameters of Heated Automobile Seats in Order to Mitigate Occupant Injury” was written to “promote a temperature and duration guideline that mitigates the risk of thermal injuries to the heated seat user,” and include visual cues that the seat heater is on, and warnings in owner’s manuals for users with lower body sensory deficits. The practice included an equation that included the time in hours and the threshold temperature to achieve a first degree burn, with a maximum setting at 43ºC. Like all voluntary standards, the threshold was based on the work of Moritz and Henriques, and ISO 13732, which provides temperature threshold values for burns that occur when human skin is in contact with a hot solid surface, but does not set surface temperature limit values. The practice suggested a few strategies automakers could use to ensure that seats did not exceed the threshold: using an ECU to monitor the heater system via a thermostat or temperature sensor, or set the maximum operating temperature to 43 °C, or install an auto adjustment feature that turns the heater down or off before it exceeds the time/temperature threshold.

Indeed, some manufacturers have used lower maximum temperatures and shut-off timers since the 1980s. The 1995 Volvo 850, the 1996 Mercedes-Benz E-Class, the 2006 Ford F-150, the 2007 Dodge Charger, and the 2008 Ford Mustang use shut-off strategies. The 1983 Volvo limited the seat surface temperature to 86˚F; the 2006 Saab limited the seat temperature to 104ºF.

But the automakers that have lagged their peers in adopting designs that prevent seat heaters from overheating have done little else.

Dr. Greenhalgh says his team continues to see burns – particularly affecting diabetics – from the heat output of vehicle HVAC systems, but has not treated any seat heater burn cases lately.

“It’s been quite a while since I’ve seen any activity,” he added.

But, other doctors have – recent civil complaints show that incidents continue to occur. For example, in November 2016 after a two-hour drive, a paraplegic living in Memphis, Tennessee, alleges that he sustained severe burns on his buttocks and scrotum caused by the seat heater in his 2013 Kia Sorento SX. In August 2015, Wayne Butler of Harris Heights, Texas alleges that he was severely burned in his 2008 Chevrolet Silverado during a 30-minute drive, in which the seat heating system generated temperatures over 130ºF.

In 2003, Dr. Greenhalgh and his colleagues, Drs. Pirko Maguiña and Tina L. Palmieri wrote Car Seat Heaters: A Potential Hazard for Burns, which presented the case of a 48-year-old paraplegic who sustained third-degree burns on his buttocks after driving for 20 minutes with the seat heater on. The researchers tested the seat surface temperature of a Chrysler Town and Country vehicle and found that that one of the vehicle’s four heating panels reached a localized temperature of 120°F. At this temperature third-degree burns can occur within 10 minutes.

“The car seat heaters should never reach these temperatures,” they wrote in the Journal of Burn Injury Rehabilitation. “Because there is no warning light on the dashboard to signal when the heaters are ON, patients with impaired sensation may not be aware that the car seat heater is on. In addition, the heating elements should have a control device to turn them off when they overheat. The seat heaters could be improved if they offered a temperature control instead of just an on/off button that sets to maximal heat every time. Most importantly the seat heaters on every car should be tested to prevent accidents with heaters that come defective from the factory.”

Seven years later, Dr. Kenneth Diller, a member of the SAE sub-committee that wrote the standard, and a defense expert witness who teaches biomedical engineering at the University of Texas’s Cockrell School of Engineering; chastised Greenhalgh, Maguina and Palmieri alleging they misinterpreted Moritz and Henriques research,  by stating that at 120ºF  “third-degree

burns can occur within 10 minutes.”  Diller argued that the Moritz and Henriques data showed only second-degree burns would result at that time and temperature.

“Although this article has now been in the literature for many years, it is not too late to set the record straight regarding the scientific basis of the recommendations therein. Hopefully, professionals working in the field of seat heater design will have a more accurate guide to consider in determining the criteria for the regime of safe operation.”

The trio’s reply, published in the same issue, schooled Diller on the details of the Mortiz and Henriques experiments, showing that they had accurately used that foundational research and had made no errors in their conclusions. They noted “the patient discussed in the article clearly suffered from a third-degree burn as a result of using a car seat heater. That patient, being a paraplegic, was at a higher risk than most people for a burn injury because of lack of sensation and pressure to the area, both of which increase the risk of any injury…The burns that we treat, just as we described for the person in our car seat heater report, are real. Burns often lead to lifelong scars and occasionally, deaths.”

Greenhalgh says that the attack was odd: “People write papers and disagree, but not in that way. There’s theory and then there’s the real world, and it was very surprising for someone to be so vehement in making a big issue of telling people in the burn world that burns don’t hurt people.”

One Jury Verdict, Lots of Settlements

In the last decade, attorney Daniel DeFeo, based in Kansas City Missouri, has handled more than 20 civil liability cases in which a plaintiff with lower body sensory deficits suffered serious and permanent injuries.

In the course of his casework, DeFeo has tested seat heaters from several different automakers, and found that all exceeded the recommended threshold in places, hitting temperatures of 120-150ºF in spots. He’s also identified basic design errors in the two types of seat heater designs. The wire-grid style seat heater used in older model vehicles tends to develop hot spots near the seat bite, where the seat heater wires join with vehicle’s wiring harness. Or, the wires can become fatigued and short out. Newer vehicles use a forced hot air system, in which warmed air is circulated through a network of ducts in the seat. In those designs, hot spots can develop at the exhaust ports.

In either design, if the seat’s thermostat is located away from the hot spots, it will not accurately regulate the surface temperature as required by the manufacturer’s own standards or by the medical community’s recommendations that seat temperatures not exceed 105 º F, DeFeo says.

The vast majority of seat heater cases have been settled before trial. One exception was a $500,000 verdict for the plaintiff in a California case. Erica Davis, a paraplegic who became the first woman to reach the summit of Kilimanjaro in a wheelchair and the 2012 National Paratriathlon champion, suffered severe burns from her thigh to her buttocks from a malfunctioning seat heater in 2009 Chevrolet truck. In 2013, Davis successfully sued the dealership Chase and Shellworth Chevrolet. General Motors, which assisted the dealership in its defense, issued a statement in response:

“Although it was not a party to this case, GM believes the seat heater in Ms. Davis' vehicle is safe and performed appropriately. While respecting the jury's verdict, GM does not believe the seat heater caused Ms. Davis' alleged injuries.”

That’s a typical defense, says DeFeo.

“They defend them with the fictional argument that it’s not a burn, it’s a pressure sore. It creates a question of fact,” he says. “They don’t have a credible defense. In some cases, their own specifications prove the defect in their designs.”

GM is a case in point. In deposition testimony in the Smith case, two GM experts on seat heater design have conceded that that GM’s design parameters allow a maximum temperature for its seat heaters that are within the temperature/duration range that will cause burns to occupants. One of the experts, Louis Carlin, a Senior Technical Expert in Engineering Analysis in GM’s Global Vehicle Safety division, acknowledges that it is possible that the seat surface temperature could get as high as 46ºC and it would still be within the GM design specifications. In addition, Carlin acknowledges in his deposition that a person in contact with the seat for up to 8 hours can burn at temperatures lower than 46 ºC.

Other GM employees such as Ray Bush, the former manager of the GM’s mobility program, agreed in an April 2014 deposition, upon reviewing photographs, that the wounds of one victim were “severe “burns, and  “I think if I was the engineer or the person  responsible, I certainly wouldn't want to cause injury to anyone.”

DeFeo finds it perplexing that automakers like GM have relied on owner’s manual warnings, added in the latter half of 2010, rather than add a time-out feature to their seat heaters or recommend to the customers in their mobility programs that the seat heater be disconnected.

The burns suffered by para- and quadraplegics usually occur in the area of the ischial tuberosities – boney bumps located on the back side of the ischium, three bones that form the pelvis. And because of their unique risk of developing pressure sores, para- and quadriplegics are many more times at risk of skin breakdown after a severe burn. For clients that had active lifestyles, an encounter with an over-heated seat forced them to give up leisure activities such as horseback riding, skiing and hunting.  

Terry Cole, a successful businessman, and an incomplete paraplegic (his spinal cord was bruised, rather than severed in 1976) had gone to China in 2006 for stem cell treatments, which restored his ability to grip a ball, stand, and take a few steps on his own. But in November 2007, Cole was severely burned by the seat heater in his 2007 Cadillac Escalade on a 45 mile trip from a riverboat casino in Caruthersville, Missouri to his home in Sikeston.  His recovery forced him to lay on his side for three months, putting him back in his pre-treatment condition.

In 2009, he sued GM, Amerigon, the seat heater supplier and Sapaugh Motors, which sold him the Escalade. The GM bankruptcy stayed the litigation against the automaker, but the case against the other two defendants proceeded, with GM providing legal guidance. DeFeo says that the case ended in a mistrial after Amerigon violated the court’s orders by injecting false testimony into the trial. The judge also imposed monetary sanctions against Amerigon, and the Cole case settled before a second trial.

“Terry Cole lost everything he had gained,” DeFeo says. “It’s major damage, it’s the plastic surgery, it’s pain, it’s expensive. It’s a significant life-changing injury and they will have skin breakdown again.”


Is Goodyear Headed for NHTSA Sanctions?

Six years after Goodyear’s efforts to conceal the defects of its G159 truck tire enraged a U.S. District Court judge, NHTSA appears ready to take its own bite out of the tiremaker’s hide.

To close out 2017, the agency opened a Preliminary Evaluation into the field performance of the tire, based on claim and complaint data obtained via “a court order authorizing the release of Goodyear records to NHTSA.”

As loyal readers of this blog know, that case is Haeger v. Goodyear, one that we’ve written about in our decade of coverage on the G159s trail of destruction. (See links below to The Safety Record’s G159 coverage.) 

In June 2003, LeRoy and Donna Haeger, along with their son and daughter-in-law, Barry and Suzanne Haeger, of Tucson, Arizona were on their way to a medical symposium in New Mexico, when the right front tire – a G159 275/70R.22.5 – on their Spartan Gulfstream Class A motorhome, suffered a catastrophic tread separation. The steer axle failure caused the motorhome to become uncontrollable and it careened off Interstate 25 and down an embankment, where it came to rest on its side. Barry Haeger escaped with minor injuries. But his parents and wife were all pinned under parts of the collapsed motorhome and all suffered major injuries that included multiple fractures, head trauma and nerve damage.

The case, filed in Arizona U.S. District Court in 2005, morphed for more than a decade from a mere product liability case to an indictment of the G159 tire on a motorhome, and of Goodyear’s sleaze-ball trial tactics. (For an easy-to-follow outline of the case, read our Haeger v. Goodyear Timeline.)

At the heart of the controversy was a titanic discovery battle that resulted in fraud charges, career-ending attorney sanctions, a U.S. Supreme Court decision, multiple settlements, and it rages on, still.  In the meantime, LeRoy died of cancer in 2008, still blamed by Goodyear for the crash. Donna Haeger is now in her 80s, and Suzanne Haeger still struggles with partial use of one arm, a permanent injury from the crash. All of the survivors are still coping with the stress of prolonged litigation.

What got NHTSA’s interest was a Moby-Dick of a fact that the Haeger’s attorney, David L. Kurtz sought for 12 years, as relentlessly as Captain Ahab hunting a whale: The failure rate of the G159 on motorhomes. It turns out to be phenomenally high.

Kurtz represented the Haegers in two actions against Goodyear. The first was a civil liability lawsuit filed in U. S. District Court in 2005 and settled confidentially in 2010 without any disclosure of significant Goodyear documents, even though Kurtz suspected that Goodyear had been less than forthcoming. The second lawsuit, filed in Arizona Superior Court in 2013 and, again, confidentially settled in 2017, alleged fraud. In June 2010, Kurtz learned through a Safety Record Blog story that Goodyear had disclosed internal heat and speed tests performed on the G159 in Florida case, Schalmo v. Goodyear  (See Goodyear G159 Tire Failures on RVs Finally Dragged into the Public Eye). Armed with that knowledge, Kurtz began to pry the most complete record of G159 failures ever seen outside of Goodyear’s General Counsel office.

By January 2017, Kurtz had forced Goodyear to disclose all of the liability lawsuits: 41, from 1999 to 2010; all of the deaths and injuries: estimated to be 98; all of the property damage claims: more than 600; and all of the warranty adjustments: 3,484. The last piece of the equation – how many out of the 160,000 G159s produced were placed on motorhomes – came a year ago.

In 2006, Goodyear submitted information about the G159 to NHTSA as part of an investigation into Toyo tires. The agency opened Engineering Analysis 05-011 in July 2005 to probe front tire failures in 1995-2000 Country Coach Allure and Intrigue Class A motor homes equipped with Toyo s 275/70R22.5, 275/80R22.S or 12R22.5 (load range H) tires. The Office of Defects Investigation sent peer information requests to Michelin, Goodyear and General Tire in search of a basis of comparison. The agency told Goodyear that it was trying to determine the approximate “failure rates” due to tire blow-out, tread separation, abrupt loss of air, and the like, for front tires manufactured and sold by Goodyear and installed on Class A RVs; and on other vehicle applications.

Hmm. What are the odds that Goodyear gave the agency complete information?

The agency also asked for the number of tires in the specified size or size ranges that Goodyear sold each year since 2000.

All of the peer responses were deemed confidential, so it took Kurtz a while to get Goodyear’s response – through NHTSA via a court order. With this information, Kurtz was able to estimate that only a quarter of the total universe of G159s sold to the motor home market between 1996-2003. With a denominator of 40,000 and a numerator of at least 600 publicly disclosed property damage claims, according to Kurtz, the parts per million failure rate – as typically expressed – of the G159 is somewhere around 15,000 Goodyear representatives have testified that a typical ppm is 3.4 ppm, so a ppm of 15,000 would be beyond extraordinary.

(Only NHTSA or the courts can reveal the data that will bring decision to the calculation. One thing is clear, the rate will be off the charts.)

A Brief History of the G159

Goodyear began producing the G159 in 1996, the design was intended for use on delivery trucks, predominantly traveling on in-town roads making frequent stops. But the tire was also marketed to the motorhome market, because like a delivery truck, Class A motorhomes had six tires and a similar weight capacity. But the reasons behind the dual-market decision are murky, because Goodyear engineers knew from internal testing soon after the tire was offered for sale that the G159 could not withstand the prolonged heat build-up of long-distance highway driving common to RV users.

Goodyear performed at least 26 tests on the G159: crown durability tests, bead durability tests, heat rise tests and DOT endurance tests – most of which were conducted after tire was put on the market. For example, four of the heat rise tests were conducted in April 1996 to “determine the dynamic heat build-up at specific loads, speeds, and inflations.” The tests were conducted on a “67.23 [inch] diameter flywheel.” at 35 miles per hour to simulate highway speed on a road surface and checking the temperature of the tire at certain intervals.

The G159 was developed to withstand temperatures of only 194° F. But testing showed that prolonged use at highway speed could cause the tire to reach temperatures of up to 229˚F, causing a loss of strength in the material components and eventually separation of the tire's structure.

The problems began to appear in the field, almost as soon Class A motorhomes were outfitted with G159 tires. Between 1996 and 1998, RV owners filed 25 tire failure claims Nonetheless, in 1998, as many states raised their highway speed limits to 75 mph, Goodyear raised the G159’s speed rating to keep pace.

In 1999, Goodyear implemented design and compound changes to make the tire more heat-resistant and less prone to tread separations. But this did not stop the flood of failures. Claims rose steadily from 54 in 1999, to 59 in 2000. By the end of 2005, Goodyear had fielded 540 death, injury and property damage tire failure claims, and faced 29 lawsuits.

The constant tread separations forced two motorhome recalls and one customer satisfaction campaign to replace G159s with more robust tires made by other manufacturers.

The tiremaker never told Goodyear about the results of its heat rise test data nor of the tire’s limitations, instead it erroneously advised one of its OEM customers, Fleetwood RV, that “running hotter can take its toll on rubber, and asserted that the average temperature at the belt edge was 160 F at 55 mph, and increased to 185 F at 75 mph.” In November 1998, Goodyear attempted to shift the blame for failure on drivers overloading and underinflating their tires, driving too fast and failing to avoid road hazards. In a letter to Fleetwood, which ultimately tallied 41 tread separations on a G159, Goodyear wrote:

“Fatigue and separation are somewhat allied properties of tire endurance. Both can be adversely affected by excessive conditions of load, deflection, inflation and speed. All of these conditions relate to heat buildup, and heat is the greatest enemy of a tire. Excessive heat will cause a degradation of material properties which in turn can impact the tire's endurance and durability. Tires are designed to perform at specific operating temperatures, which is sometimes called 'equilibrium temperature.' At equilibrium the heat generated within the tire structure is equal to the heat dissipated from the tire surfaces. Exceeding this temperature for short periods of time is not a problem but    exceeding it for long periods begins to cause loss of strength in the material components and eventually separation of the tires structure.”

When Fleetwood questioned whether construction changes in the G159 or the tire’s increased speed rating would account for all of the tread separations, Goodyear wrote:

“A question was raised relative to the possibility of 75 MPH compromising the tire's safety margin. Goodyear evaluates the test results and then determines whether to authorize 75 MPH or keep the tire at 65 MPH. To date if a tire did not meet our standards, the tire remained at a maximum speed rating of 65 MPH. In the case of the tire in question, the tire performed to the level that satisfied our high speed requirements and we approved the tire to 75 MPH.”

In June 1999, Fleetwood recalled 17 Class A American Heritage motorhomes because of inadequate total front tire weight capacity. The company replaced the G159s with a larger Michelin XZA 275/80R22.5. On October 1, 1999, Fleetwood again recalled its 275/70R22.5 Goodyear G159 tires, this time on some 3,400 Class A models made in 1996 to 2000 after four incidents involving two fatalities. The crashes Fleetwood reported to NHTSA occurred on September 15, 1998; July 7, August 29 and September 9, 1999.

According to pleadings in the Haeger case, the Monaco Corporation – another G159 OEM – received a similar set of explanations for the rash of tread separations its customers were experiencing (a total of 93) in August 2000. The failures eventually forced Goodyear to release a Product Service Bulletin announcing that the Monaco Coach Corporation would be issuing a letter to owners of 1999, 2000 and certain 2001 Windsor model Class-A motor homes offering to replace their G159 275/70R22.5 tires with 295/80R22.5 LR H, G391 tires.

Again, Goodyear blamed consumers:

“The letter will inform the customer that it has come to Monaco’s attention that in a number of instances, it was found that tire air pressure was being reduced in order to gain better ride comfort and in doing so tires were operated in an under-inflated and overloaded condition,” the Goodyear bulletin said. “In the interest of customer satisfaction, Goodyear and Monaco are offering to replace the original 275/70R22.5 LR H, G159 with 295/80R22.5 LR H G391 tires. The higher aspect ratio tire will allow customers to operate at a lower inflation pressure that will give a more comfortable ride while maintaining tire loading that is within the operating range of the tire.”

By the first month of 2003, Goodyear stopped making the G159. But they continued to fail on motorhomes, accruing deaths and serious injuries.

Defending the G159

Goodyear’s main line of defense from Day One has been concealment, because the tests showing the G159’s unsuitability for motorhome applications and the huge number of tire failures made any other strategy untenable. During its period of manufacture, it failed to inform its OEM customers of the tire’s limitations. The Safety Record doubts Goodyear has been honest with NHTSA. But it has been in the courtroom where Goodyear did everything it could to keep the real story of the G159 under wraps.

Consider the fate of the deposition of Kim Cox – a Goodyear claims administrator who testified in Phillips v. Goodyear, a 2002 injury and property damage case in San Diego.

During Cox’s June 19, 2003 deposition, Cox, allegedly admitted that Goodyear knew that the G159 tire did not “perform properly” on Class A motor homes.”  The admission was so damning, Goodyear’s attorneys swiftly shut down the deposition, negotiated a settlement and arranged for every scrap of the deposition’s existence to be destroyed. Goodyear even unsuccessfully sought sanctions against the Phillips attorney Guy Ricciardulli for even mentioning its existence to another attorney who had a G159 case in Arizona. (see Goodyear Destroys Testimony Admitting RV Tire is Defective; Court Rules Deposition is Not Protected)

Harold and Georg-Anne Phillips made their initial complaint in August 2000, when two of the tires on the left rear side of their Monaco Windsor motor home failed, damaging the rear of the vehicle. Goodyear reimbursed the couple for the cost of replacement tires and for repairs to the motor home. But a year and a half later, the Phillips’ were again the victims of a tread separation crash. While traveling on Interstate 10 in Arizona, the motor home's left front tire failed, causing the Phillips to crash into a roadside embankment resulting in serious injuries and property damage.

Consider the trail of sanctions and frustrated judges who have dinged Goodyear for discovery abuses in at least seven cases involving the G159 and other tires.

Now consider the current NHTSA investigation – extremely late though it may be. Despite Goodyear’s Herculean obfuscations, a pretty good record of this crappy motorhome tire – which, by the way, an internet search shows that you can still buy – has accrued, even though much of the raw source material remains out of the public eye.

How are things likely to go?  

A G159 sells for upwards of $350 – so times 40,000 – that’s roughly $14 million in sales to the motorhome market. We know the Schalmos won a $5.6 million verdict against Goodyear. Now we’re down to $8.4 million. How much did Goodyear pay its National Coordinating Council, Basil Musnuff, and all of the lawyers who carried their water in local jurisdictions in 41 civil actions, or running things up the judicial chain? How much did Goodyear pay out in secret settlements? Warranty losses? How much will it ultimately owe for the Judge Silver’s sanctions in the Haeger case? How much will it pay in the forthcoming federal Consent Agreement?

The Safety Record doesn’t know. But we can guess that the numbers long ago wiped any profit Goodyear made from a boneheaded decision made in 1996 that left so much human damage in its wake.


The Safety Record Blog has been writing about motorhome tire failures, the G159 tire and Goodyear’s vicious trial tactics for more than 12 years. If you would like to get caught up, grab a beer, pull up a chair, and take a read:

August 2006 Persistent RV Tire Problems Prompt Fifth Recall; NHTSA Investigation Focuses New Attention on RV Safety

April 2008 Goodyear Destroys Testimony Admitting G159 RV Tire is Defective; Court Rules Deposition is Public

June 2010 Goodyear G159 Tire Failures on RVs Finally Dragged into the Public Eye

Nov. 2012 Pattern of Fraud Brings Down Goodyear

June 2013 The Wages of Fraud

Sept. 2013 Haeger High-Stakes Poker

June 2014 Litigating the Goodyear Way

June 2015 Federal Appeals Court Upholds Goodyear Sanctions




Ford Asks for Takata Recall Pass

On July 10, 2017, Takata recalled PSDI-5 driver air bag inflators containing phase-stabilized ammonium nitrate (PSAN) as a generant and calcium sulfate as a desiccant, which were used in vehicles sold in the United States as original equipment in frontal driver airbag modules. Recall 17E034 affected 2.7 million Ford, Mazda and Nissan vehicles produced between 2005 and 2012.

Takata’s accompanying chronology in its Part 573 Notice of Defect and Noncompliance describes a field recovery program conducted with Nissan and Ford at NHTSA’s request between March 2016 and June 2017, to gather inflators and subject them to a variety of tests. These included live dissections, chemical and dimensional propellant analysis and ballistic testing. Takata reported to the agency that the field-returned inflators had zero ruptures in ballistic test deployments, but that “some within the population analyzed show a pattern of propellant density reduction over time that is understood to predict a future risk of inflator rupture.” It also allowed that “inflator design and vehicle environment differences between the Nissan and Ford inflators/vehicles may influence their aging characteristics.” (Emphasis added.)

Nonetheless, Takata determined, “out of an abundance of caution,” to recall its first-generation PSDI-5 PSAN driver air bag inflators containing calcium sulfate. In notifying NHTSA of a defect and announcing a recall, Takata acknowledged that these inflators represent an unacceptable risk.

Nissan responded by recovering 895 inflators from the field for testing, and acquiescing to the recall without complaint. Ford responded by collecting only 400 inflators from the field, and filing a petition asking NHTSA to declare the affected Takata inflators in its vehicles to be an inconsequential risk to safety. At the same time, Ford requested that NHTSA delay a decision on its petition until the automaker can conduct more testing. Got it? Ford asked NHTSA to declare the inflators in its vehicles safe, but not until Ford does more testing to prove it.

Safety Research & Strategies has submitted comments objecting to Ford’s petition and urging NHTSA to reject it. You can read them here. [Docket No. NHTSA–2017–0093; Notice 1]

Ford argued that 360 live dissections of Ford vehicle inflators demonstrated “consistent inflator output performance — specifically, measurements of ignition tablet discoloration, generate density, and moisture content of certain inflator constituents did not indicate a reduction-in-density trend.”  Ford also maintained that the inflators in its 2006-2007 Ford Rangers were in no danger of failing because it had taken unique steps to prevent  “potential” exposure to moisture: “the inflators contain only two, foil-wrapped auto-ignition tablets (instead of three that are not foil-wrapped), contain divider disk foil tape, and utilize certain EPDM generate cushion material (instead of ceramic) that “reduces generate movement over time, maintains generate integrity, and leads to consistent and predictable burn rates.”

There are so many things wrong with this ask and Ford’s argument, it’s hard to know where to begin, so we’ll start here: First, It has already been established that, with or without drying agents, PSAN is too volatile of a generant – period. PSAN must be used with extraordinary precision and care, or it is likely to over-pressurize, especially when exposed to temperature cycling and moisture. And we know from everything that has been publicly revealed so far that Takata had pretty bad manufacturing processes and lax quality control.

PSAN is the underlying root cause of the ruptures. Takata has affirmed this in a variety of patents filed over two decades. A study, conducted at the behest of Takata and Honda by researchers at Pennsylvania State University’s High Pressure Combustion Laboratory also showed, over Takata’s protests, that PSAN is susceptible to dynamic burning. That means that when the propellant is exposed to sudden pressure increases, it may burn at a much faster rate and at higher temperatures than expected, leading to over-pressurization.

Second, calcium sulfate, used extensively as a commercial desiccant in laboratory use, does not provide any guarantees that the inflator won’t eventually rupture. Manufacturers like it because it’s cheap, stable non-toxic and non-corrosive, but it only adsorbs 10 percent of its weight in water vapor.

Third, we suppose that it’s fine and dandy to reduce the ingress of moisture that can create porosity in the wafers of generant. If that was the only mechanism of failure, Ford might have made a decent argument. Only, it seems that Ford is putting as much effort into keeping up with the science of inflator ruptures as it has been in recovering inflators from the field. Technical experts that served as consultants to NHTSA and Takata agreed moisture intrusion is of lesser importance in inflator ruptures than temperature cycling.

For example, the Exponent report, Investigation of Takata Inflator Ruptures, emphasizes the role of thermal cycling in failure scenarios: “However, even in hot and dry environments like Arizona, the large daily temperature cycles in the absence of significant moisture ingress can also cause propellant degradation over a prolonged period. High moisture content alone in the absence of temperature cycling will not increase degradation.”

NHTSA consultant Fraunhofer ICT and Takata also acknowledged that variances among vehicle types are determinants in whether or how significantly an airbag inflator will deteriorate due to temperature cycling, stating:

“One of the key observations in the analysis of the field return data is that there exists a strong dependence on outcome based on the vehicle in which the inflator was installed. Limited vehicles studies conducted by Takata show variation in inflator surface temperatures between different vehicle types and models, given identical environmental exposure conditions. This temperature variation appears to have some correlation with different field performance of those models, as shown in Figure 19 below. This is not to say that the vehicle is the cause of the issue- only that the vehicle type may influence the rate that the inflator degrades.”

Finally, the death of Joel Knight is a warning about the price of recall delays.

On December 22, 2015, Knight, 52, of Kershaw County South Carolina, was fatally injured in an otherwise survivable and moderate crash when a defective airbag ruptured in his 2006 Ford Ranger.  Knight’s vehicle struck a cow that wandered into the road; the airbag inflator exploded during deployment, causing a piece of metal shrapnel to pierce his neck and spine.

Knight’s death was unwarranted and preventable – this defective Takata airbag inflator type, the Smokeless Driver Inflator or SDI, had already been recalled in 2014 in at least 61 other countries by Honda and Toyota. Those recalls were initiated following ruptures that took the life of at least one other driver – a pregnant woman in Malaysia.  

From June 2014 to May 2015, however, Ford dithered – and never actually recalled the SDI inflators in all of its vehicles.

The automaker issued its first Takata-related campaign as a voluntary field service action for a select group of vehicles in certain model years, which included Ford Rangers.  After July 2014, when a rupture caused by a failed SDI inflator (the very same used in Knight’s 2006 Ranger) killed a pregnant woman in Malaysia, NHTSA requested that Ford replace driver side airbag inflators in Ranger vehicles. Ford launched another regional field service campaign in November 2014 to replace driver side frontal air bag inflators in the 2004-2005 Ford Ranger vehicles.  The action was still limited to Florida, Hawaii, Puerto Rico, and the U.S. Virgin Islands, despite other manufacturers expanding the affected regions, and still, inexplicably, did not include the 2006 Ranger.

In May 2015, Ford finally converted its regional recall for passenger inflators into a nationwide recall after Takata issued a recall requesting such an action, but never converted its recall of SDI inflators from the limited regional recall into a nationwide recall, nor did it recall the 2006 Ranger with the same SDI.

Knight’s death was partly the impetus for a Takata airbag inflator recall of about 5 million vehicles, which would have included the 2006 Ford Ranger. The family of Joel Knight has publicly stated his death would have been prevented if Ford had launched a timely recall. 

We agree.

As other manufacturers have acknowledged to their customers the dangers of defective Takata airbag inflators and have begun to move more actively to recall these components, Ford continues to demonstrate its apathy. It continues to install the same non-desiccated Takata inflators that are the subject of the massive recalls in what NHTSA has dubbed” like-for-like” inflators – which very few other manufacturers are using. In the three years since NHTSA first ordered manufacturers to treat this defect as an urgent public safety issue, almost all manufacturers have procured either desiccated inflators or inflators from other suppliers. Ford sought extensions, telling the Agency that three years was not enough for it to find a safe alternative in sufficient numbers to meet the demand. Owners of these vehicles will have to go into the shop again in early 2020 for another replacement, which could lead to reduced completion rates because owners are frustrated or feel the interim remedy is safe enough.  

Astoundingly, Ford is still telling its customers that the inflators are safe, while Honda has (finally) mounted a full-court press to capture defective inflators – including a door-to-door effort to recovery a particularly dangerous subset of airbags. In contrast, Ford’s webpage entitled, “Frequently Asked Questions regarding Takata Airbag Inflator Recalls,” puts out this bull in response to a query about whether vehicles with recalled Takata airbags are safe to drive:

"Based on currently available technical data, Ford Motor Company understands that the vehicles involved in the recent Takata recall are safe to drive while you are waiting for replacement parts. You should have the repair completed as soon as possible after you are notified that parts are available.”

Ford’s got nerve – we’ll give them that. But one thing they shouldn’t be given is permission to forego the recall. NHTSA should not let Ford play Rupture Roulette with its customers.

CO and Cars: Unfinished Business

In 1975, the auto industry began to equip vehicles with catalytic converters to meet the emission limits of the Clean Air Act of 1970. Sitting unobtrusively between the engine and the muffler, the “cat” changes the noxious gases in automobile exhaust into harmless nitrogen, oxygen, carbon dioxide, and water. The result, according to the National Institutes of Occupational Health, was an 80 percent decline in the number of unintentional vehicle-related deaths caused by the most dangerous byproduct of combustion engines: carbon monoxide. 

But catalytic converters don’t entirely eliminate the CO, so their advent did not eliminate motor vehicle CO poisonings. This lingering safety issue resurfaced in 2009, when keyless ignition systems severed drivers from their relationship with traditional metal keys, making it easy to inadvertently leave their vehicle engines quietly running while CO levels built inside the garage – and then the house. Motor vehicle carbon monoxide poisonings became newsworthy again in 2017, when numerous police departments with fleets of newish Ford Explorer Interceptors (a police version of the Explorer) began to complain that their officers were being sickened in their squad cars. Just last week, WRC, NBC’s Washington D.C. affiliate, broadcast a story showing that the problem affects civilian Explorers, too. The story featured two owners who suffered from the symptoms of carbon monoxide poisoning.  

The truth is: carbon monoxide continues to kill hundreds and sicken thousands of people in the U.S. each year. 

Carbon monoxide is a colorless and odorless toxic gas produced as a by-product of incomplete combustion of carbon-based substances.  It is the most common lethal poison worldwide. When inhaled, CO is absorbed from the lungs into the bloodstream. CO binds with hemoglobin with an affinity of more than 200 times that of oxygen, forming a tight complex with hemoglobin, which impairs the oxygen-carrying capacity of blood. 

How many CO injuries and deaths are caused by motor vehicle exhaust is up for debate, because the data are hard to come by. In 2000, NHTSA’s National Center for Statistics and Analysis updated a 1996 study estimating the number of deaths caused by carbon monoxide poisoning by motor vehicle exhaust. It found that from 1995 to 1997, the total number of fatalities due to CO poisoning was 3,715, with the majority of those fatalities involving stationary motor vehicles; 665 of those fatalities were accidental. A 2002 analysis of U.S. motor vehicle CO deaths from 1968 to 1998 estimated that annual accidental CO deaths from all sources decreased from 1,417 in 1968 to 491 in 1998, with 48 percent of the 1998 deaths attributed to motor vehicles. 

Establishing a link between CO deaths and motor vehicle exhaust using the Centers for Disease Control’s WONDER database, an open access online search system using mortality data drawn from all filed and coded U.S. death certificates, has been stymied by a change in coding practices. In 1999, the International Classification of Diseases coding system dropped the identification of CO sources. 

Nonetheless, a 2004 NHTSA study on non-traffic, non-crash motor vehicle fatalities found “somewhere between 200 and 250 deaths a year that are not known to be suicides result from vehicle-generated carbon monoxide. These types of deaths occur more frequently than deaths from any of the other issues researched.” 

A more recent 2011 study of data gathered from news stories about residential CO poisoning in the United States published between March 2007 and September 2009 found 837 reported CO poisoning incidents, 59 of which were the result of a vehicle left running in the garage. The author, Dr. Neil Hampson, who has published extensively on the epidemiology of CO poisoning,  concluded that household CO poisoning from a motor vehicle left running in the garage “is relatively common.” 

The annual number of CO injuries in a much harder figure to ascertain. In 2011 the CDC, using data from the National Poison Data System (NPDS) to characterize reported unintentional, non- fire-related CO exposures, found 68,316 CO exposures reported to poison centers during 2000-2009. 

Translating exposures to injuries is tricky. The initial symptoms of CO poisoning are nonspecific and vary widely – anything from headaches to fatigue to dizziness and vomiting. Severe exposure can lead to confusion, loss of consciousness, seizure and cognitive difficulties.  Almost half of the people exposed to CO develop delayed neuropsychological responses that can be disabling and sometimes permanent. These effects can develop days or weeks after exposure. 

Petitioning for a Solution

Squishy data hasn’t stopped citizen advocates from asking the National Highway Traffic Safety Administration to require countermeasures to either warn occupants of the presence of CO in the occupant compartment, shut off the engine when it reaches pre-determined levels, or both. Since 1997, there have been three petitions for rulemaking.

In March 1997, Herb Denenberg, an attorney, former professor, journalist and consumer advocate, petitioned the agency to require carbon monoxide detectors to be installed in all motor vehicles, to mandate manufacturers to offer them as optional equipment and to alert consumers in owner’s manuals to the availability and value of installing a carbon monoxide detector.  Denenberg also requested that NHTSA issue press releases and consumer advisories regarding the availability of carbon monoxide detectors. Denenberg cited a December 1993 NHTSA Consumer Advisory showing 353 fatalities that year from accidental carbon monoxide poisoning. His petition asserted that these were preventable deaths, and that manufacturers could install CO detectors in vehicles for about $16 per unit.

Eight years later, toxicologist Albert Donnay, representing a non-profit that  focuses on Multiple Chemical Sensitivity disorders, filed a petition for rulemaking making similar requests: press releases on the dangers of vehicle carbon monoxide poisoning, more research on all CO vehicle-related fatalities, a requirement that manufacturers warn occupants about the dangers of carbon monoxide poisoning in owner’s manuals and install CO detectors in new vehicles, with the capability to cut-off the engine when carbon monoxide levels inside a stationary vehicle exceed a concentration of 200 parts per million.

In his petition, Donnay argued that there was ample evidence that the agency considered motor-vehicle CO poisoning a serious problem, but had abandoned the issue, failing to continue its research, or do more consumer education on the issue, or initiate rulemaking – even though the agency had influenced recalls related to CO exposure and had promulgated rules to address serious, but occasional problems, such as trunk entrapment.

The most recent petition was filed in March 2016 by Public Employees for Environmental Responsibility. Like its predecessors, PEER requested that the agency issue annual consumer advisories and recommend the use of onboard digital CO monitors; to track and report all CO-related fatalities; require manufactures to include information in new vehicle owner’s manuals about the health dangers of CO, and require all manufacturers to install CO detectors in the passenger compartment of all new motor vehicles; and require manufacturers to install engine shut-off technology. 

PEER echoed Donnay’s point about NHTSA’s failure to prevent continuing CO deaths:

Since NHTSA was first informed of the life-saving potential of CO detectors linked to engine cut-off switches, in excess of 20,000 North Americans have died needlessly from vehicular CO poisoning. At the same time, these CO detectors are reliable and very inexpensive. They are far less expensive than other measures that NHTSA has approved. In short, requiring these devices may one of the most significant and cost-effective vehicle safety measures since the seat belt.

NHTSA Wants Nothing to Do With It

The agency’s response to motor-vehicle CO poisoning issue has been, to put it charitably, contradictory. 

(Remember – the U.S. Environmental Protection Agency was the prime mover behind the widespread implementation of catalytic converters – not NHTSA. Prior to the addition of catalytic converters, “CO in motor-vehicle exhaust accounted for the most poisoning deaths in the United States caused by a single agent,” according to a 1996 CDC Morbidity and Mortality Weekly Report (MMWR). Out of 11,547 unintentional CO deaths during 1979-1988, 57 percent were caused by motor-vehicle exhaust; of these, 83 percent were associated with stationary vehicles.” Most of the deaths in garages occurred with the garage doors or windows open.) 

NHTSA has long regarded an unattended vehicle with the keys left in the ignition to be a safety hazard. In 1967, the impetus was auto theft, leading to police chases that often ended in fatal crashes. The agency’s first proposal for Federal Motor Vehicle Safety Standard 114 would have required cars to be equipped with devices to remind drivers to remove keys when leaving their vehicle. And the agency made it pretty clear that the solution should be based in vehicle engineering: 

It is, of course, the operator's responsibility to remove the key when the car is left unattended, and drivers should continue to be exhorted to take this elementary precaution. Nevertheless, many do not, and the interest of safety would be promoted by the existence of a visible or audible warning device on the car, reminding the driver when he has neglected his responsibility. This is an instance in which engineering of vehicles is more likely to have an immediate beneficial impact than a long-range process of mass education.

But, NHTSA has resisted regulating in any way an unattended vehicle with the keys left in the ignition and the engine running.

In the early 1990s, the agency appeared to have some interest, contracting the Carnegie Mellon Research Institute to evaluate its metal oxide semiconductor gas sensor technology for application as a low-cost carbon monoxide monitor in the automobile compartment. The study cited 500 accidental deaths each year, and, like the petitions that would follow it, observed that many “might have been prevented if the automobile passenger compartment were equipped with an appropriate CO monitor and alarm system.” The report concluded that the technology had was at the point “where a stable selective CO monitor is within reach,” and recommended that NHTSA undertake further research. 

But, The Safety Record couldn’t find evidence that NHTSA took this research any further. Instead, it knocked down most of the 1997 Denenberg petition, but grudgingly allowed that it might add some information about carbon monoxide poisonings to future advisories. NHTSA dismissed CO poisoning incidents as a cold weather phenomenon, most likely caused by people running their engines in an enclosed space to keep warm or failing to clear snow from the tail pipe area. “For this reason,” the agency wrote, “we do not think it is justifiable to require that all vehicles be equipped with these detectors. A large portion of the vehicles sold in this country will rarely, if ever, be driven in cold weather.” Besides, the agency said, mandatory installation of carbon monoxide detectors industry wide would cost at least $240 million, eventually consumers would be forced to replace them after six years. And, since the problem really affected the older models in the fleet, a regulation would not benefit the vehicles that needed it most.

In 2005, it denied the Donnay petition, claiming the data showed that the number of CO incidents was falling absent any regulation and because a mandate for in-vehicle carbon monoxide detectors would fail to address more than 70 percent of vehicle-related carbon monoxide deaths, because the victims are outside the vehicle. NHTSA argued that “a home CO detector would be substantially more effective than a vehicle CO detector at preventing these deaths because 92% of the fatalities occurred at the home.” The agency rejected the idea of an engine shut-off that would prevent CO accumulating to dangerous levels because it “could prove to be a hazard. For example, in a tunnel with congested traffic, the concentration of CO may cause the device to shut off the engine, resulting in further traffic congestion or even possible crashes.”

The agency hasn’t yet articulated a position on the PEER petition.

In 2011, for the first time the agency considered the unattended key-in-vehicle scenarios with the engine running, and the problem of CO poisoning. A FMVSS 114 Notice of Proposed Rulemaking – as yet unfinalized – attempted to deal with the proliferation of keyless ignition systems. The NPRM recognized that current keyless ignition systems had led to driver confusion, and that these designs allowed drivers to exit the vehicle without the transmission locked in Park, and sometimes without actually turning off the engine. The NPRM noted that the lack of standardization in combination with the lack of visual and tactile cues about the status of the vehicle engine has set the stage for the real world incidents in which drivers, mistaking the fob for the key, inadvertently leave a vehicle running and/or exit the vehicle without putting the transmission into “Park.” The proposal specifically deleted the door opening alert exclusion currently in FMVSS No. 114 for a running vehicle, but only for vehicles equipped with keyless ignition. The agency’s strategy for addressing the rollaway and carbon monoxide safety issues are for internal and external audible alerts, based on the Platform Lift standard, which is part of FMVSS 403.  

As part of the rulemaking, NHTSA said that it had considered “a requirement for an automatic shut-off feature applied to vehicles fitted with electronic key code systems.” But, it declined to propose such a feature because: “We have been unable to conclude that there is a specified period of time after which the propulsion system should be shut down to effectively address various scenarios mentioned in VOQs submitted to the agency.”

What, no mention of the simultaneous-shut-offs-in-a-tunnel scenario?

Motor Vehicle CO as a Function of Vehicle Design and Wear

In 1972, research sponsored by the Insurance Institute on Highway Safety noted that the available data suggested “that over 500 Americans die each year from carbon monoxide poisoning because their vehicles are defective due to deterioration, damage, or poor automotive design.”

That last bit is still the case, and the Ford Explorers currently sickening lots of people are good examples. In July 2016, NHTSA’s Office of Defects Investigation opened a probe into reports of occupants smelling exhaust odors in the occupant compartments of 2011-2015 Explorers. By the time it bumped the probe up to an Engineering Analysis, a year later, Ford had tallied 2,051 complaints, while NHTSA’s Vehicle Owner’s Questionnaire hotline received 791. The high-profile victims were police departments across the country, which were reporting that at least five officers lost consciousness, were hospitalized for CO exposure or crashed their SUVs, poisoned by the cabin air of their Interceptors.  You can read more about it here

Ford, which does a booming business with the law enforcement market, rushed to investigate the CO problem in those vehicles, and promised to cover the costs of any modifications. The automaker blamed the problem on unsealed spaces and wiring holes drilled in the course of implementing after-market features specific to police work, such as emergency lights and radios, and said that none of those problems affect civilian Explorers.

So why are so many Explorer owners complaining? In its August 2016 response to NHTSA’s Information Request, Ford argued that really not that many people complained. An analysis showed that “approximately 0.29 percent of all 2011 through 2015 model year Explorer owners have complained of some sort of exhaust odor in their vehicle,” and even if Ford included all of the ambiguous reports the percentage is still a piddling 0.38 percent of all vehicle owners. 

As for the cause, Ford isolated it to the unique combination of driving at “wide open throttle (WOT) events with the vehicles climate control system in the recirculation mode.” Ford said that “the fuel enrichment used for the exhaust catalyst protection strategy commonly used during wide open throttle events caused a more detectable odor being emitted from the tailpipe. Second, a negative cabin pressure was created from the vehicle climate control system being in recirculation mode. Ford notes that the vehicle drive cycle necessary to reproduce this condition is beyond what Ford would consider normal or typical customer usage.” In any event, the CO readings never topped 8 parts per million (ppm), and dissipated within 10 seconds. 

This does not seem to comport with real-world incidents. In preparing the WRC story, reporter Susan Hogan teamed up with toxicologist Albert Donnay, who measured the presence of CO in the occupant compartment of an Explorer whose owner had been complaining to Ford for months. Donnay gathered readings of CO with sophisticated detectors in the front and back seat. At low speeds, with the vehicle in re-circulation mode, there was no change in air quality, the report said. When the vehicle speed climbed to over 40 miles per hour, the CO level was 9 parts per million (ppm) in the front and 30 ppm in the back. You can read it here

Further, Hogan says that Donnay’s testing showed that the CO levels evened out at 15 ppm-17 ppm and stayed there for a good 10-15 minutes. The levels didn’t drop until they brought fresh air into the cabin.  

Another good example is General Motors’ 2015 “emission recall involving certain 2008 Chevrolet Avalanche, Silverado, Suburban, and Tahoe; and GMC Sierra, Yukon, and Yukon XL vehicles equipped with California Bin 4 emissions RPO NU5.” GM said that “the design of the fuel control system did not adequately control carbon monoxide emissions under certain operating conditions.” The remedy was a reflashing of the engine control module with a modified fuel control calibration.

Combatting Motor Vehicle Carbon Monoxide at the Source

There are several design solutions to the motor vehicle carbon monoxide problem, and for nearly forty years, individual inventors, suppliers such as Lear Corporation, and automakers have put forward ideas or implemented them. There are patents, dating back to at least as early as 1974, related to carbon monoxide detectors in motor vehicles that either warn the driver when the in-board air reaches a certain threshold and/or shut off the engine. 

Automakers have been using engine cut-off designs as a safeguard to remote start features for at least a decade. Two automakers have also added extended engine idle shut-offs to their keyless vehicles to prevent CO poisonings when drivers mistakenly leave their vehicles running. In 2013 Ford became the first automaker to add an engine idle cut-off to its keyless vehicles. This feature shuts off the engine after 30 minutes if there have been no inputs from the driver.

In March 2015, General Motors remedied 50,249 2011-2013 Chevrolet Volt vehicles with a software fix that would shut off the engine after an hour and a half, to prevent drivers from inadvertently leaving the vehicle running. GM was reportedly prompted to implement the recall after two injuries and push from NHTSA. The 2014 and beyond model years already have this feature. 

Another design includes the use of air classification or control module (ACM). This technology combines CO and nitrogen dioxide sensors to protect the cabin air.  Some automakers offer ACMs on vehicles with electronic climate control. While ACMs alone do not solve the problem of accumulating CO emanating from a running vehicle, they can be paired with auto shutoff mechanisms or alarms.  In 2007, AppliedSensor, chemical sensor components and modules manufacturer, and Sensata Technologies, a developer of industrial sensors and control solutions, announced that their Air Classification Module was being integrated into the 2007 BMW X5 Sport Activity Vehicle: “This ACM prevents the intake of harmful combustion fumes – such as carbon monoxide, nitrogen dioxide and volatile organic compounds: “The module includes a built-in sensor with two separate sensing elements to enable continuous detection of the presence of diesel and gasoline exhaust fumes faster and more reliably. Through integration of a corresponding module in the air intake duct of the vehicle’s heating, ventilation and air conditioning system (HVAC), the sensor can signal accurately timed, automatic activation of air circulation to the vehicle's controls.” 

More than 40 years after the advent of the catalytic converter, we still have a CO problem that endangers public health – and we have a menu of technologies that might all but eliminate the threat. The will to fix it seems to be the last obstacle.

NHTSA, Ford and CO Poisoning: Sickening

If your local police department has a fleet of Ford Explorer Interceptors, it’s probably trying to determine if the vehicle – an Explorer modified for law enforcement use – is sickening its officers during long periods of idling or hard acceleration. But if you are the civilian owner of one of these vehicles, keep a close eye on the noises Ford or the National Highway Traffic Safety Administration makes about a recall.     

In July 2016, NHTSA’s Office of Defects Investigation opened a probe into reports of occupants smelling exhaust odors in the occupant compartments of 2011-2015 Explorers. “Complainants expressed concerns about exposure to carbon monoxide.” At the time, the agency had tallied 154 complaints. What happened in the Preliminary Evaluation was – up until two weeks ago – anyone’s guess, because other than the Opening Resume and an Information Request letter to Ford demanding a response by August 24, 2016, nothing else was ever added to the public file.

In the space of a year, the complaints piled up. Ford reported fielding 2,051, while 791 drivers complained to NHTSA’s Vehicle Owner’s Questionnaire hotline. Some of those complaints were getting mad press because they came from police departments from Auburn, Mass. to Austin, Texas. Ford owns a large share of the law enforcement vehicle market. Introduced to the fleet in 2012, the Interceptor accounted for 60 percent of Ford police vehicle sales in 2013 – more than 14,000 police SUVs. By 2015, Ford was bragging in a press release that the Interceptor “quickly became America's best-selling police vehicle – which has helped Ford capture 61 percent market share through June 2015.”

Inconveniently for public safety, and Ford’s bottom line and brand ID as the go-to automaker for law enforcement, at least five officers lost consciousness, were hospitalized for CO exposure or crashed their SUVs after huffing the cabin air of their Interceptors.  For example, in September 2015, a Newport Beach, California officer “passed out while driving his Interceptor,” swerving “across two lanes of oncoming traffic, nearly hitting another car head on, and crashed into a tree at 55 mph,” according to CNN. After an Auburn, Massachusetts officer rear-ended another vehicle in late July, he and the vehicle tested positive for carbon monoxide.  

As stories of police departments parking their Interceptors have proliferated, Ford has been dispatching investigative teams to municipalities to assess the damage and assure its customers whose vehicles are paid for by the taxpayers that it will “cover the costs in every Police Interceptor with this issue, no matter what its age, mileage or post-purchase modifications,” according to news reports. 

If you paid for an Explorer directly from your own pocket, Ford seems a lot less interested in solving your problem – although there have been civilian Explorer buy-backs, and several apparently unsuccessful Technical Service Bulletins. Nonetheless, the company has been very careful to build what is known in Ford internal circles as the “defendable fence,” a way to limit the defect to a discreet population of vehicles, protecting the company from a much bigger recall that could include more than a million vehicles. This term surfaced in a 1995 memo on ignition switch fires in 28 million 1983 to 1995 light trucks and passenger cars with the same design. Ford has used this strategy to limit recalls of Ford F-150 cruise control deactivation switch fires, thick film ignition and stuck throttles.

The Explorer’s Chief Engineer Bill Gubing has been out there pushing the idea that the carbon monoxide is entering the occupant compartment via unsealed spaces and wiring holes drilled in the course of implementing after-market features specific to police work, such as emergency lights and radios. Other Ford Explorer owners need not be concerned Gubing reportedly said:

From a carbon monoxide perspective, the police duty cycle is very different than what a retail customer drives…It creates more combustion gas at the back of the vehicle because the engine’s working harder and faster. At the same time, there are modifications done to the back of the vehicle that certainly provide leak paths when those modifications are not done properly. We don’t see the retail customers driving like that. We don’t see retail customers with those modifications.

So that’s how carbon monoxide is getting into police Explorers. How is it getting into many, many, many more Explorers owned by regular folk? According to several Technical Service Bulletins Ford issued in 2012, 2014 and 2016, this problem surfaces when “the auxiliary climate control system is on,” and “may be worsened when the climate control system is in recirculate mode and the vehicle is heavily accelerated for an extended period.” The fixes concerned replacing vents, checking drain valves and reprogramming the heating ventilation air conditioning module to the latest calibration. 

In late July, ODI bumped up the investigation to an Engineering Analysis. By then the agency had collected 791 complaints and identified 41 injuries such as headaches, nausea and light-headedness in 25 incidents. Only 11 complaints involved police Interceptors. 

NHTSA’s first take on the Interceptor problem is cracks in the exhaust manifold, not deliberate, aftermarket perforations. Its tests at the Vehicle Research and Test Center (VRTC) in East Liberty, Ohio, along with field inspections, has led it to theorize that “CO levels may be elevated in certain driving scenarios, although the significance and effect of those levels remains under evaluation as part of the EA.” But it has also suggested that NHTSA may well respect Ford’s fence: “To date, no substantive data or actual evidence (such as a carboxyhemoglobin measurement) has been obtained supporting a claim that any of the alleged injury or crash allegations were the result of carbon monoxide poisoning, the alleged hazard.” 

The consumer-reported Vehicle Owner’s Questionnaires certainly support the notion that CO levels can become elevated during acceleration. Civilians, who also need to accelerate their vehicles – even if not engaging in a high-speed chase – have been reporting that the fumes engulf them when they hit the gas hard.

An owner from Strabane, Pennsylvania told NHTSA in June 2016:

Several times when driving two of my children ages 2 and 10 complained of a bad smell coming from the third row seating. They both became strangely ill, but only my 2 year old began vomiting. My 10 year old complained of being light headed during several long trips. I noticed on many occasions that during high acceleration anyone that sits in the third row complains of stomach aches after a lengthy time in the vehicle. I chalked it up to car sickness, but remembered this only became relevant when leasing this ford. Please help us. I have three kids and no other vehicle.

An Explorer owner in Canyon County, California told NHTSA in February 2017:

While driving the car on the freeway and under acceleration there is a horrible exhaust smell that makes my kids and myself nauseous. It also gives me constant headaches. I didn't realize what was happening until my husband got in the car for the first time and noticed the exhaust smell.

An owner from Brandon, Missouri reported in January 2017:

The smell is very harsh smells like burnt hair or sulfur. On long trips my wife has had severe headaches. This Explorer is the vehicle my wife and kids (ages 14, 5, & 2) use to get to work and school; I need to get this vehicle repaired or replaced. Please help!!!

From the owner of a 2015 Explorer in Juno Beach, Florida:

After heavy acceleration, the cabin has a strong foul sulfur odor that is unbearable. We have had it in to a Ford dealership to have both TSBs performed – the second took 5 days! And it still has not changed. Disgusting smell. This happens when we accelerate as on to the highway or to pass in challenging situations. I only have to press the gas pedal about half way down for 4-5 seconds and the smell is overwhelming. Activating the turbo chargers for any length of time brings this smell into the cabin. Then all of the windows have to go down to clear the smell. My mother can't take this anymore and my wife complains of headaches. This has been an ongoing for a year and a half!

Despite this defect’s high profile, the public information has only dribbled out of the National Highway Traffic Safety Administration’s Office of Defects Investigation. Neither Ford’s response to the Preliminary Evaluations or any work the agency has done has been shared with the public. As it opened the Engineering Analysis, ODI summarized parts of Ford’s response and testing it was doing out in East Liberty. The files themselves are not accessible, despite the agency’s regular transparency proclamations. 

For example, in 2012, the agency requested a $10,611,000 appropriation for Safety Defects Investigation activities, $782,000 above the FY 2010 funding level, to, among other things, “ensure that all public information related to investigations, recalls, and complaints is current.” In June 2015, NHTSA released a Workforce Assessment report in which one of its purported goals for ODI was: “Assure that information relating to investigations and recalls is readily available to the public.” On its website, NHTSA states that “NHTSA is committed to providing the most accurate and complete information available to its customers, the American traveling public, in a helpful and courteous fashion.”

Unfortunately, help and courtesy does not come cheap. In June, Safety Research & Strategies submitted a Freedom of Information Request for the non-confidential documents in the investigative file, and the agency told us that they’d be happy to oblige for about $780 dollars. 

First, these materials shouldn’t require a FOIA request – at least according to NHTSA. By law, all federal agencies are required to publish records that because of “the nature of their subject matter, the agency  determines have become or are likely to become the subject of subsequent requests for substantially the same records; or that have been requested 3 or more times.” In addition, agencies are required to publish a general index of those frequently-requested records. NHTSA’s Electronic Reading Room webpage listing those categories of records that “are available without the need for a FOIA request:” includes such “frequently requested records and information” such as downloads of defect investigation records. 

We’ve argued that these documents should be released at no charge because the information is squarely in the public interest, and because NHTSA by custom and by regulation is supposed to put non-confidential investigative material in the public files. We’ve requested that the fee be waived. Stay tuned.

Quality Control Systems Corp. Sues DOT for Tesla Data

Quality Control Systems (QCS) Corp. has filed a Freedom of Information Act (FOIA) lawsuit in the U.S. District Court for the District of Columbia in pursuit of Tesla airbag deployments data that the National Highway Traffic Safety Administration (NHTSA) has withheld from public view.

R. A. Whitfield, the company’s director, said that the company wanted to test the validity of claim made by NHTSA that airbag deployments in Tesla vehicles dropped by almost 40 percent after the installation of a component of the Tesla’s Autopilot system, Autosteer. NHTSA asserted this decrease in a report accompanying the Closing Resume of Preliminary Evaluation 16-007. The investigation was prompted by the May 2016 death of Joshua Brown, a Tesla enthusiast who was driving his Tesla Model S in Autopilot mode, when it crashed into an 18-wheel tractor-trailer truck that was turning left in front of it on US 27A, west of Williston, Florida. The report stated:

“ODI analyzed mileage and airbag deployment data supplied by Tesla for all MY2014 through 2016 Model S and 2016 Model X vehicles equipped with the Autopilot Technology Package, either installed in the vehicle when sold or through an OTA update, to calculate crash rates by miles travelled prior to and after Autopilot installation. Figure 11 shows the rates calculated by ODI for airbag deployment crashes in the subject Tesla vehicles before and after Autosteer installation. The data show that the Tesla vehicles crash rate dropped by almost 40 percent after Autosteer installation.”

Whitfield says he wants to know if the methodology NHTSA used is scientifically valid and whether their results can be replicated. Other questions include whether the reduction in crash rates is actually due to Autosteer itself and whether the claimed crash reductions could be expected to continue over a longer period of time.

“The surprising improvement in crash safety that NHTSA associates with Autosteer would be very welcomed if the dramatic safety claims prove to be scientifically sound. But it is concerning that the crash reductions are associated with the installation of Autosteer, rather than the actual use of Autosteer,” Whitfield says. “And NHTSA’s analysis is just as astonishing for the fact that it lacks the most basic, information necessary for reaching well-founded conclusions about the claimed crash rate reductions. It is very remarkable that the published description of the Agency’s findings do not meet long-established scientific standards that would allow for an assessment of statistical confidence intervals or of statistical significance. Even the numerators and the denominators of the calculated crash rates are AWOL.”

NHTSA’s Office of Defects Investigation opened the Tesla probe on June 28, 2016, focusing on whether the Automatic Emergency Braking (AEB) or Autopilot systems had functioned as designed, increasing the risk of a crash. It closed six months later with no defect finding, saying that the system performed as designed, and blaming Brown for the crash. Tesla’s four responses submitted to the public investigation file were almost wholly redacted. For more information about PE16007 and its lack of transparency, read Autonomous Vehicles, the Beta Test Coming to a Roadway Near You.

Safety Research & Strategies has long advocated for NHTSA transparency. For example, in February 2014, SRS submitted comments in advance of the agency finalizing its 2014 – 2018 Strategic Plan, highlighting its concern with NHTSA’s lack of transparency. SRS founder and President Sean Kane wrote: “Access to NHTSA’s investigations and data are increasingly difficult and expensive for the public and researchers as the agency assigns significant costs to provide information in response to FOIA requests. In some cases they have also refused to release information that should be public requiring FOIA litigation that has cost the Agency thousands of tax-payer dollars to settle.”

Since 2010, SRS has sued the Department of Transportation six times seeking public records on everything from child safety seats to unintended acceleration. All of these cases have been settled to our satisfaction. The four against NHTSA have ended with the agency agreeing to turn over more records and paying our fees, before a court judgement was rendered. You can read about our latest FOIA lawsuit here.

Whitfield says such an important conclusion by the agency should not be based on data that the government is withholding from researchers who want to examine NHTSA’s results.

“If the safety benefits of Autosteer are as positive as the Agency claims, why wouldn’t they want independent scientists to have the data in order to replicate these extraordinary results?” Whitfield asked.


Autonomous Vehicles – The Beta Test Coming to a Roadway Near You

The National Highway Traffic Safety Administration’s Automated Vehicles web page breathlessly forecasts: “Vehicle safety technologies signal the next revolution in roadway safety. We see great potential in these technologies to save lives—more than 30,000 people die on our roads every year and we can tie 94 percent of crashes to human choice—transform personal mobility and open doors to communities that today have limited mobility options.”

Sounds like an amazing marvel of tomorrow – and none too soon in the wake of recent news that traffic fatalities may have risen 6 percent over 2015. The National Safety Council estimated last month that 40,200 people died in motor vehicle crashes in 2016– the highest annual death toll since 2007. The increase comes on the heels of an 8 percent rise in traffic deaths in 2015. The two-year jump would be the largest in 53 years, according to the safety group.

But will autonomous vehicles – already driving among us with little to no oversight, regulation, or data collection – really deliver on its promise?

Already, two Tesla drivers have died in crashes that occurred while the vehicle was in Autopilot mode. In January 2016, a 23-year-old Chinese man died when his Tesla Model S crashed into a road-sweeper on a highway south of Beijing, according to a report on a Chinese government news channel. Five months later, Joshua Brown, a 40-year-old Tesla enthusiast died when his Tesla Model S crashed into a semi-trailer that had made a left-hand turn in front of it. NHTSA later said that the Tesla’s sensing system failed to distinguish the white tractor trailer against the sky and did not apply the brakes.  

By September, Tesla Motors Chief Executive Elon Musk announced that Tesla would impose limits on the vehicle’s semi-autonomous Autopilot function that would have potentially prevented Mr. Brown’s demise. According to news reports, the improvements were delayed by fears of the system over-reacting to information in the driving environment.

Musk said he had wanted to improve Autopilot’s capabilities last year but was told it was impossible to do so without incurring more “false positives.”  Two months after the Brown crash, Musk tweeted publicly that supplier Bosch had given him encouraging news about   improvements to its radar.

“I wish we could have done it earlier,” Musk said in an interview. “The perfect is the enemy of the good.”

Feds Bypass Regulation

The federal government, for the most part, has responded to the advent of automotive autonomy by vigorously shaking its pom-poms, consistently declaring its intention to “speed the deployment of lifesaving technology”

From The Federal Automated Vehicle Policy: “At each level, the safety potential grows as does the opportunity to improve mobility, reduce energy consumption and improve the livability of cities. To realize these tremendous benefits, NHTSA believes it should encourage the adoption of these technologies and support their safe introduction.”

From the preamble of NHTSA Enforcement Guidance Bulletin 2016–02: Safety-Related Defects and Emerging Automotive Technologies: “As the world moves toward autonomous vehicles and innovative mobility solutions, NHTSA is interested in facilitating the rapid advance of technologies that will promote safety.”

From NHTSA’s Automated Vehicles website: “The DOT Federal Automated Vehicles Policy sets the framework for the safe and rapid deployment of these advanced technologies.”

To hurry things along, NHTSA has issued two guidance bulletins, accompanied by requests for comments and held two public meetings, billed as an exploration of related topics, such as adapting the Federal Aviation Administration’s pre-market approval approach as a replacement for self-certification.

Enforcement Bulletin

First, NHTSA re-asserted its powers under The Safety Act to regulate autonomous vehicles. In April, the agency published in the Federal Register Enforcement Guidance Document 2016-02, a brief declaration of the agency’s “broad enforcement authority, under existing statutes and regulations, to address existing and emerging automotive technologies. technologies—including its view that when vulnerabilities of such technology or equipment pose an unreasonable risk to safety, those vulnerabilities constitute a safety-related defect—and suggests guiding principles and best practices for motor vehicle and equipment manufacturers in this context.”

The five-page Federal Register Notice walked readers through some of the seminal court cases of the 1970s that established enforcement standards: The 1975 “Wheels” decision, involving broken wheels in GM pickup trucks, which defined a safety defect; and the 1977 Pitman Arms Case, involving the failure of the steering mechanism in GM Cadillacs, which defined the concept of “unreasonable risk to safety.”

Then, the agency defined automated vehicle technologies, systems, and equipment – including software, even code that enables devices not located in or on the vehicle – as motor vehicle equipment, whether original equipment or after-market.

The agency warned would-be violators to iron out the kinks in their systems before bringing their products to market and to promptly follow the requirements of The Safety Act. At the same time, the agency was clear that it was not establishing a binding set of rules, or implementing a one-size-fits-all enforcement policy. In fact, it rallied its all-purpose, case-by-case approach to the cause:

 “NHTSA’s statutory enforcement authority is general and flexible, which allows it to keep pace with innovation.” (To the contrary, the agency’s history has repeatedly shown that it trails innovation badly, that it will ignore deaths and injuries caused by changes in automotive technology until Congress forces it to act, or regulates after a particular technology – warts and all – is already in widespread use, and codifies bad designs. For example, the agency has yet to correct the rollaway and carbon monoxide poisoning introduced by keyless ignitions via regulations.)

And, the agency signaled that its approach would be expansive:

“NHTSA considers the likelihood of the occurrence of a harm (i.e., fire, stalling, or malicious cybersecurity attack), the potential frequency of a harm, the severity of a harm, known engineering or root cause, and other relevant factors. Where a threatened harm is substantial, low potential frequency may not carry as much weight in NHTSA’s analysis.”

In the case of an unprotected network that hackers might access, the agency said that it would weigh several factors in determining the probability of a malicious cyber-attack: the amount of time that had elapsed since the vulnerability was discovered, how hard it would be to breach the system, the level of expertise and the equipment needed; whether the public had access to information about how the system works and the window of opportunity to exploit the system.

NHTSA offered the following example of a foreseeable vulnerability that might trigger agency action, even if no incidents have occurred:

“If a cybersecurity vulnerability in any of a motor vehicle’s entry points (e.g., Wi-Fi, infotainment systems, the OBD–II port)allows remote access to a motor vehicle’s critical safety systems (i.e., systems encompassing critical control functions such as braking, steering, or acceleration), NHTSA may consider such a vulnerability to be a safety related defect compelling a recall.”

The enforcement bulletin drew 37 commenters. (Safety Research & Strategies was among them, expressing concern that the framing language in the Guidance Bulletin was contradictory and its emphasis misplaced: “More importantly, we note that the agency, is in fact, doing very little to regulate automotive software and new technology, and absent rulemaking in this area, the rapid cycle automotive defect crises will continue and potentially accelerate.”)

The Telecommunications Industry Association re-stated a position it has long held – that the agency has no jurisdiction over their products: “We are concerned that NHTSA’s proposed guidance would potentially bring a broad range of  technologies under the agency’s enforcement authority beyond what is intended by the governing statute.”

Carmakers were more alarmed by the agency’s intentions of enforcing The Safety Act as it relates to cyber security. Tesla, the Alliance of Automobile Manufacturers and the Global Automakers all pushed back against the agency’s intention to treat a cyber-vulnerability as a defect:

“The Alliance submits, however, that a defect related to motor vehicle safety does not automatically exist merely because the engineering or root cause of a cybersecurity “vulnerability” is known. As discussed in more detail below, a theoretical “vulnerability”       to potential system failures through hacking or otherwise is not the same as an actual “risk” that is currently present in an item of motor vehicle equipment.”

NHTSA responded in the Final Notice of its enforcement bulletin, published that September by backing off, saying that it would take up cyber-security issues in a future interpretations and guidance.  

The Federal Automated Vehicles Policy

In tandem, the agency published the Federal Automated Vehicles Policy. The 116-page document, also released for comment in September 2016, was “intended as a starting point that provides needed initial guidance to industry, government, and consumers.” The document outlined what the agency deems best practices in safe design, development and testing prior to sale or deployment on public roads.

NHTSA declined to undertake actual rulemaking “to speed the delivery of an initial regula­tory framework and best practices to guide manufacturers.”

Instead, the Guidance is full of fine, vague language regarding system safety, cyber security, consumer privacy and education. Automakers should “follow a robust design and validation process based on a systems-engineering approach with the goal of designing HAV systems free of unreasonable safety risks.” They should “follow guidance, best practices, design principles, and standards developed by established standards organiza­tions.” Given how automakers have introduced innovations such as keyless ignitions and drive-by-wire systems without regulations, this gives us little comfort.

The agency also noted its interest in automakers’ definitions of the Operational Design Domain (ODD) of their HAVs – meaning the vehicle’s capabilities according to roadway types, the geographic area, the speed range and the environmental conditions in which it will operate – and its Object and Event Detection and Response (OEDR) – how it detects and responds to other vehicles, pedestrians, cyclists, animals, and objects in a variety of conditions.

The Model State Policy is another aspect of the guidance document. Neither NHTSA nor automakers want a patchwork of state regulations impeding the agency’s damn-the-torpedoes strategy. In fact, it advises states to “evaluate their current laws and regulations to address unnecessary impediments to the safe testing, deployment, and operation of HAVs.” So, it has been working with the administrators of state Department of Motor Vehicles to develop the first set of ground rules for states that allow manufacturers to test their HAVs on public roads (See what California is doing below.) NHTSA wants each state to create a special bureaucracy for automated vehicles including a “jurisdictional automated safety technology committee,” to establish rules and authority for regulating autonomous cars, including registrations, and applications for testing vehicles and licenses for test drivers.

In the absence of federal regulations, the agency intends to rely on some new regulatory tools. In the short-term, the agency wants to launch a new quasi-certification report called a Safety Assessment. Safety Assessments are used by the Nuclear Regulatory Commission and the Food and Drug Administration in various forms as a way of methodically evaluating risks to food safety and the handling of nuclear waste. NHTSA is proposing that manufacturers voluntarily provide reports about how closely they are hewing to the recommendations in the guidance document. Automakers and suppliers would submit these assessments to the Chief Counsel’s Office outlining their adherence to NHTSA’s broad outlines, their timelines for testing and deployment on public roads. They would cover data recording and sharing; privacy; system safety; vehicle cybersecurity; human machine interface; crashworthiness; consumer education and training; registration and certification; post-crash behavior; federal, state and local laws; ethical considerations; operational design domain; object and event detection and response; fall back (minimal risk condition).

Automakers probably have plenty of time to prepare. NHTSA won’t publish a Federal Register notice implementing this reporting it until it clears the Paperwork Reduction Act, a 1995 law requiring that any public information request to get Office of Management and Budget approval. Given the anti-regulatory bent of the GOP Congress and the near-daily turmoil that is the Trump White House, we don’t see any disclosures happening anytime soon.

In the long-term, NHTSA is looking at several options to ensure that HAVs enter the marketplace safely. One is the pre-market approval authority process, modeled after that used by the Federal Aviation Administration. Another is a hybrid certification and approval process, in which manufacturers could certify compliance with FMVSS and NHTSA or a third-party expert could conduct pre-market approval for those HAV features that are not covered by an FMVSS

NHTSA has already held two meetings on this policy, gathering panels of stakeholders, which did not seem to include too many domain experts, to engage in short discussions about topics such as  Safety Assurance,  Pre-Market Approval Authority,  Imminent Hazard Authority; Expanded Exemption Authority for HAVs.

But, as the guidance documents tells us, this is just a first step. NHTSA needs to conduct more research, scout out new standards to govern the initial testing and deployment of HAVs, and the agency’s approach will evolve as the level of automation in HAVs rises. Or so the document promises.

The First HAV Investigation

If the agency’s first six-month enforcement investigation into the alleged failure of an automated vehicle is any measure, manufacturers shouldn’t fear that NHTSA is going to stray too far from its well-established habits.

On May 7, 2016, Joshua Brown, died when his Tesla Model S, in Autopilot mode, crashed into an 18-wheel tractor-trailer truck that was turning left in front of it on US 27A, west of Williston, Florida. According to the Florida Highway Patrol, the vehicle underrode the truck, tearing off its top before it proceeded east on U.S. 27A. The vehicle left the roadway and struck several fences and a power pole, before coming to rest about 100 feet south of the highway. Brown, a 40-year-old Tesla enthusiast from Ohio, died at the scene.

June 21, 2016, NHTSA sent a Special Crash Investigations team to the crash site to evaluate the vehicle and study the crash environment. It concluded that Brown had increased the cruise control speed to 74 mph two minutes before the crash, and took no evasive action, nor did he apply the brake. The tractor trailer should have been visible to the Tesla driver for at least seven seconds prior to impact.” This report has not yet been made publicly accessible.

On June 28, 2016, the Office of Defects Investigation opened Preliminary Evaluation 16-007 into the crash that killed Brown. Officially, the investigation focused on “the Automatic Emergency Braking (AEB) or Autopilot systems that “may not function as designed, increasing the risk of a crash.”

The agency’s nine-page Information Request, issued on July 8, contained very specific questions. Question 7, for example had 12 sub-parts, seeking – among other things – information about Tesla’s object recognition and classification process for rear-end collision and crossing path collisions, how the Tesla S’s system detects compromised or degraded sensor/camera signals, the kinematic models the Tesla S used to judge collision risk, and all inhibit and override/suppression conditions.

Over the course of the seven-month investigation, Tesla filed four responses that were placed in the publicly accessible file.

On January 19, the agency closed the investigation with no defect finding, saying that the system performed as designed, and blamed the Brown for the crash:

“NHTSA’s examination did not identify any defects in the design or performance of the AEB or Autopilot systems of the subject vehicles nor any incidents in which the systems did not perform as designed. AEB systems used in the automotive industry through MY 2016 are rear-end collision avoidance technologies that are not designed to reliably perform in all crash modes, including crossing path collisions. The Autopilot system is an Advanced Driver Assistance System (ADAS) that requires the continual and full attention of the driver to monitor the traffic environment and be prepared to take action to avoid crashes. Tesla’s design included a hands-on the steering wheel system for monitoring driver engagement. That system has been updated to further reinforce the need for driver engagement through a “strike out” strategy. Drivers that do not respond to  visual cues in the driver monitoring system alerts may “strike out” and lose Autopilot function for the remainder of the drive cycle.”

Yet, this investigation was full of oddities. For one, the agency played hardball in wresting information out of Tesla, and its former supplier Mobileye. Under the regime of the recently-departed Administrator Mark Rosekind, the agency did not hesitate to bring its full authority to bear on the information-gathering portion of the probe. In an unusual move, the agency actually issued a subpoena for the diagnostic log data for another apparent Autopilot failure, involving a Tesla Model X.

The agency also issued three Special Orders.

One Special Order was issued to supplier Mobileye, a technology company that makes advanced- driver assistance systems using cameras and software to scout objects in a vehicle’s path. The Order sought communications between it and Tesla regarding hands-free operation in Autopilot mode. The Order also asked for an explanation of the “proper and substantial technological restrictions and limitations” Mobileye thought should have been in place before hands-free operation was permitted; and any other safety concerns, guidance or warnings that Mobileye might have communicated to Tesla about Autopilot’s limitations, intended use and potential misuse.

The agency’s first Special Order to Tesla sought information about incidents (or alleged incidents) of Autopilot failures that Tesla was receiving – especially if Tesla wanted to make a public statement about it before reporting it to NHTSA – for the duration of the investigation. An Amended Special Order, issued in October, required Tesla to continue weekly reporting of incidents – by COB every Friday – until further notice.

These Special Orders appear to be responses, in part, to public statements by Tesla and Mobileye. It is not unheard of for a manufacturer or supplier to defend its reputation during an ongoing investigations – especially if it involves high profile deaths. However, Tesla and Mobileye were particularly determined to get out in front of the probe, and direct public attention to their own analyses.

Two days after receiving NHTSA’s Information Request, Tesla issued a public statement about the crash, attributing the Autopilot’s indifference to a large object directly in its path to a white-out conditions:

“Neither Autopilot nor the driver noticed the white side of the tractor trailer against a brightly lit sky, so the brake was not applied. The high ride height of the trailer combined with its positioning across the road and the extremely rare circumstances of the impact caused the Model S to pass under the trailer, with the bottom of the trailer impacting the windshield of the Model S. Had the Model S impacted the front or rear of the trailer, even at high speed, its advanced crash safety system would likely have prevented serious injury as it has in numerous other similar incidents.”

In September, Mobileye issued a press release, pushing back against any suggestion that it bore responsibility for the crash. The release asserted that it had warned Tesla that the Autopilot should not have been allowed to operate hands-free “without proper and substantial technological restrictions and limitations,” but that Tesla disregarded those admonitions, releasing it “hands-free” in late 2015, after assuring Mobileye that it would not do so.

“Mobileye has made substantial efforts since then to take more control on how this project can be steered to a proper functional safety system. Tesla’s response to the May 7 crash, wherein the company shifted blame to the camera, and later corrected and shifted blame to the radar, indicated to Mobileye that Mobileye’s relationship with Tesla could not continue. Failing agreement on necessary changes in the relationship, Mobileye terminated its association with Tesla. As for Tesla’s claim that Mobileye was threatened by Tesla’s internal computer vision efforts, the company has little knowledge of these efforts other than an awareness that Tesla had put together a small team.”

Finally, this investigation was notable for the amount of black on Tesla’s four responses submitted to the public file. In its August 8 and September 2 submissions to the questions in the IR, every answer is redacted, as are separate submissions to answer Question 7 and Question 10, about the automaker’s assessment of the alleged defect. A fifth response has a few bits of information available for public consumption, but most of the test is blacked-out.

In reviewing literally hundreds of investigations, The Safety Record can honestly say that we have never seen investigation responses in the public file so redacted – especially with no request for confidentiality on file. In fact, the IR specifically instructs Tesla to submit all confidential business information directly to the Office of Chief Counsel. In addition, the IR notes, “do not submit any business confidential information in the body of the letter submitted to this office [ODI].” Instead, Tesla addressed its responses to ODI, which presumably painted them black and put them in the public file. There are no requests from Tesla for confidentiality in the public file.

Also missing from the public file were any responses Mobileye filed in response to its Special Order.

In the end, we know very little about Tesla’s responses to the crash, except – Tesla’s first response was to blame it on a white-on-white interpretation error. Only later did Tesla argue that its Automatic Emergency Braking system was never designed to recognize a front-to-side crash. According to one answer that escaped the censor’s Sharpie:

“Like other manufacturers’ AEB systems, Tesla’s AEB is designed to mitigate front-to-rear collisions,” Tesla said.

If that was the case, why didn’t Tesla say that from the beginning?

State Legislation

In the absence of federal regulations, several states have passed legislation related to autonomous vehicles, and more – six in 2012 to 20 in 2016 – consider such legislation each year. Currently California, Florida, Louisiana, Michigan, Nevada, North Dakota, Tennessee, Utah and Virginia—and Washington D.C. have laws on the books, while Arizona and Massachusetts governors have issued executive orders, according to the National Council on State Legislatures related to autonomous vehicles.

California was one of the most active regulatory schemas. In 2014, the state passed regulations for the registration of autonomous vehicles with the Department of Motor Vehicles. Currently, 22 companies have registered, including Google, Bosch, Delphi, Honda, Mercedes-Benz, Tesla, Ford, Volvo, Nissan, Subaru and GM. (Transportation problem child Uber has been  testing its autonomous vehicles without seeking a permit, throwing the litigation-magnet into more conflict.)

The state is now in the process of writing regulations to cover the deployment of autonomous vehicles.

California is also the only state collecting autonomous car crash data. Manufacturers are required to report all crashes involving autonomous vehicles within 10 business days. Once a year, they must also report instances when a human test driver seizes control of the vehicle from its autonomous system for safety’s sake.

To date, the California has collected reports in 24 crashes since October 2014. The majority involve Google vehicles – not surprising, as the tech giant has the largest fleet of self-driving  vehicles – including Toyota Prius, Lexus RX450 and other prototype vehicles on the road in Mountain View since 2009 and expanded to Kirkland, WA, Austin, TX and Phoenix, AZ. This year, Google, which has spun off its autonomous car project to a company called “Waymo,” intends to add 100 new 2017 Chrysler Pacifica Hybrid minivans to the fleet.

All were minor, non-injury crashes. Oddly, more than 60 percent of the crashes involved a conventional vehicle rear-ending a Google HAV in a scenario in which the driver in the striking car, clearly thought that the vehicle in front of it ought to have been moving. For example, here’s a narrative from an October 26, 2016 incident:

“A Google prototype autonomous vehicle (“Google A V”) traveling southbound in autonomous mode on Shoreline Boulevard in Mountain View was involved in an accident. The Google AV entered a slip lane in order to tum right onto El Camino Real and came to a stop to yield to westbound traffic on El Camino Real. As the Google A V began to move forward onto El Camino Real, another vehicle immediately behind the Google AV collided with the rear of the Google AV. At the time of the collision, the        Google AV was traveling at approximately 3 mph, and the other vehicle was traveling at approximately 6 mph. The Google A V sustained minor damage to its rear hatch. The        other vehicle sustained minor damage to its front bumper. There were no injuries reported by either party at the scene.”

NHTSA has estimated that rear-end crashes make-up about 23-30 percent of all crashes, so the reason for the high number of rear-enders bears more analysis.

There are many more disengagements – incidents, as defined by the California DMV, in which “a failure of the autonomous technology is detected,” or “when the safe operation of the vehicle requires that the autonomous vehicle test driver disengage the autonomous mode and take immediate manual control of the vehicle.” In 2016, nine companies who tested autonomous vehicles reported 2,887 disengagements, for reasons including poor lane markings, weather and road surface conditions, construction, emergencies, and collisions

Ensuring the Safety of Autonomous Vehicles?

Are vehicles driven by LIDAR, cameras and algorithms safer than those driven by that passe technology, people? The federal government, Tesla and other autonomous vehicle enthusiasts are insulted that you have even posed the question.

This groups loves the numerator of crashes and the denominator of vehicle miles travelled to show that so far, the self-driving fleet should feel very proud of its record. For example, NHTSA used this simple division to acquit Tesla’s autopilot function, as it closed PE16-007, a probe into the crash that killed Brown, in January with no defect finding.

“ODI analyzed mileage and airbag deployment data supplied by Tesla for all MY 2014 through 2016 Model S and 2016 Model X vehicles equipped with the Autopilot Technology Package, either installed in the vehicle when sold or through an OTA update, to calculate crash rates by miles travelled prior to and after Autopilot installation. Figure 11 shows the rates calculated by ODI for airbag deployment crashes in the subject Tesla vehicles before and after Autosteer installation. The data show that the Tesla vehicles crash rate dropped by almost 40 percent after Autosteer installation.”

(NHTSA mis-characterizes these figures as crash data, when it is actually instances of airbag deployments. There are two problems with this: there are many more crashes than airbag deployments; and it is unlikely that Tesla knows about all airbag deployments. Both of these factors affect how we interpret the comparison.)

Tesla relies on this basic calculation, as does Waymo, which, in an uplifting video, talks about the million vehicle miles travelled without incident.

Nidhi Kalra and Susan M. Paddock, researchers from the RAND Corporation, have recently challenged these assessments, and concluded that the paucity of data make it impossible to determine whether autonomous vehicles will have a measureable effect on death and injury rates. The duo’s statistical analysis shows that “Autonomous vehicles would have to be driven hundreds of millions of miles and sometimes hundreds of billions of miles to demonstrate their reliability in terms of fatalities and injuries.” Further, “Under even aggressive testing assumptions, existing fleets would take tens and sometimes hundreds of years to drive these miles—an impossible proposition if the aim is to demonstrate their performance prior to releasing them on the roads for consumer use.”

Therefore, Kalra and Paddock note, in terms of fatalities and injuries, the entire raison d’etre for pushing vehicle autonomy ahead of their oversight and regulation, test-driving alone “cannot provide sufficient evidence for demonstrating autonomous vehicle safety.” They call for the development of new and innovative ways to demonstrate safety and reliability and most importantly for the development of “adaptive regulations that are designed from the outset to evolve with the technology so that society can better harness the benefits and manage the risks of these rapidly evolving and potentially transformative technologies.”

Big Promise, Mixed Messages

What, ultimately, do we expect from autonomous cars? That we will be passengers in our own vehicles. The informational video fronting Waymo’s website shows a couple snuggling, a grandmother and a child absorbed in an I-pad screen, and teens chatting as the landscape flies by, like back-seat passengers in a cab, wholly unconcerned about how they will get to their destination. As Waymo originally envisioned it, fully autonomous cars would have no steering wheels or foot pedals. That future raises a lot of questions: do we license vehicles instead of drivers? What do public roads look like when then large numbers of driverless vehicles mingle with equally large numbers of conventional vehicles? What are the fail safes?

The present reality is the semi-autonomous vehicle, equipped with software such as Tesla’s Autopilot, which is not reliable enough to offer a hands-free experience, let alone an attention-free experience. Some Tesla drivers have found that out the hard way. A video posted earlier this month shows a Tesla operated in the Autopilot mode clip the side of a highway barrier after the lanes suddenly shift to the right due to construction.

The official, explicit message is that that Autopilot “is an assist feature that requires you to keep your hands on the steering wheel at all times,” and that “you need to maintain control and responsibility for your vehicle” while using it. And the system is designed to warn drivers who test its limits with visual and audible alerts, gradually slowing the vehicle down until the steering wheel detects the presence of the driver’s hands.

But there is another message out there – one that promises that you can ride shot-gun while the car does all of the work. At an April conference in Norway, Musk told the Norway Transport and Communications Minister Ketil Solvik-Olsen:

“The probability of having an accident is 50 percent lower if you have Autopilot on, even with our first version. So we can see basically what’s the average number of kilometers to an accident — accident defined by airbag deployment. Even with this early version, it’s almost twice as good as a person.”

In an October 19 blog post, the company published: “We are excited to announce that, as of today, all Tesla vehicles produced in our factory – including Model 3 – will have the hardware needed for full self-driving capability at a safety level substantially greater than that of a human driver.”

YouTube is full of videos showing Tesla owners demonstrating Autopilot, including Musk’s two-time wife and ex-wife (the pair married in 2010, divorced in 2012, re-married in 2014 and divorced again in 2016.)  Talulah Riley turned to a camera, giggling with fluttering jazz hands as her car zips down a crowded highway.

And that gives the public a very different impression – one which NHTSA recognized in its automated vehicle guidance document carries some dangers:

“New complexity is introduced as HAVs take on driving functions, in part because the vehicle must be capable of accurately conveying information to the human driver regarding intentions and vehicle performance. This is particularly true of SAE Level 3 systems in which human drivers are expected to return to the task of mon­itoring and be available to take over driving responsibilities, but drivers’ ability to do so is limited by humans’ capacity for staying alert when disengaged from the driving task. Manufacturers and other entities should consider whether it is reasonable and appropri­ate to incorporate driver engagement monitoring to Level 3 HAV systems.”  

And really, what is the point of Autopilot if you have to pay constant attention – and be prepared to grab the wheel in a split second? That seems more stressful than actually driving.

After the Brown crash, Musk got roundly criticized for these contradictory messages, and updated the software to lock-out drivers from the feature who fail to heed the system’s warning to keep their hands on the wheel.  

He also back-pedaled a bit, saying that Autopilot “is by far the most advanced driver assistance system on the road, but it does not turn a Tesla into an autonomous vehicle and does not allow the driver to abdicate responsibility.”

And what about NHTSA? What is its responsibility? Musk has always been very clear that Autopilot was introduced to the marketplace as a beta test. Just to be perfectly clear, a beta test is “a trial of machinery, software, or other products, in the final stages of its development, carried out by a party unconnected with its development.” Not only is the Tesla driver participating in this beta test on public roads, but so is every vehicle, pedestrian, and cyclist that share those roads.

How is Tesla permitted to dragoon the public into testing its automotive software?

Well, there’s no law against it.

Who Are the Victims of Takata’s Fraud?

For more than a decade, airbag supplier Takata manufactured what turned out to be ticking time bombs – airbag inflators with a volatile propellant called Phased-Stabilized Ammonium Nitrate (PSAN) – that were placed in vehicles worldwide by the hundreds of millions.

Takata was churning them out at several dollars a bag less than airbags manufactured by rivals, such as Autoliv. According to an August 16 New York Times story, in the late 1990s, Autoliv engineers examined Takata airbags manufactured with PSAN, and concluded that the company could not and would not replicate them, because PSAN was too volatile and dangerous for that application. Autoliv reportedly informed General Motors, which had asked the Swedish supplier to match Takata’s price, and warned other OEMs as well. 

In fact, the dangers of PSAN were common knowledge in the industry – enumerated in patents by airbags makers, including Takata – and in the scientific literature. Later, there were the ruptures that made this knowledge manifest to at least some of the Original Equipment Manufacturers (OEMs), in real-world incidents – a BMW in 2003 and a Honda in 2004. The 2006 explosion that rocked Takata’s plant in Monclova, Mexico, was another flare fired into the industry’s consciousness about PSAN’s stability and Takata’s ability to handle it safely. By 2008, when Honda launched its first mini-recall of 4,000 vehicles, OEMs using Takata airbags learned of two more ruptures through Honda’s Notice of Defect and Noncompliance. By 2009, Honda was aware of 11 ruptures and one death. On Christmas Eve of that year, another woman died in an airbag rupture after a fender-bender. In the years to follow, the rolling recalls and changing root cause explanations provided ample warning about Takata’s systemic manufacturing and quality control issues.

What did the OEMs do with this knowledge? Nothing. They continued to buy and install Takata airbags with PSAN propelled inflators. By 2015, Takata had captured 22 percent of the global airbag market and had its biggest year since 2007, with sales topping out at 254 billion yen.

But that is not the story told by Attachment B of the $1 billion plea agreement struck by the Department of Justice and Honda – dumped out on a Friday before a holiday weekend. Takata pled guilty to one count of wire fraud and agreed to pay hefty fines and compensation, submit to the oversight of an independent monitor (who needs no airbag experience) and initiate a corporate compliance program. Other Takata entities escaped charges, including Takata Holdings, the U.S. arm, which performed the testing, investigated the ruptures, and participated in the fraud.

This plea appears to be more obviously designed to preserve Takata’s ability to enter bankruptcy without the costs of the massive recall discouraging would-be buyers of the ailing manufacturer. So far, Takata’s suitors have filed plans requiring that the company rid itself of its liabilities. But the OEMs did not want to bear the brunt of the recall costs.  The lion’s share of the $1 billion penalty – $850 million – goes to those “victims.” 

In the process, the agreement trades the whole truth for a Reader’s Digest version in which the OEMs hadn’t a clue that Takata had quality control problems until 2015 and likely continues to grapple with today. (Take out your hankies.) According to the plea agreement:

“…had the OEMs been provided with the true and accurate test information and data, the OEMs either would have: (a) insisted that any problems with the PSAN inflators be resolved prior to installation into their vehicles; or (b) refused to put the airbag systems containing the faulty or problematic PSAN inflators into their vehicles.”

To this, we can only say: Nonsense!

Fake Data

It is true that Takata falsified test data showing that inflators using PSAN were not meeting targets for effluent gas and ballistics. The plea agreement described the scheme as the work of a cabal composed of Shinichi Tanaka, 59; Hideo Nakajima, 65; and Tsuneo Chikaraishi. For 15 years, the trio and others hid failures and ruptures during production testing, using the code term “XX” in written communications, as a verb for falsifying data. This mostly involved trimming the extreme ends off the test results to make it seem like there was less variability in the data.

But was this really the missing bit of information that would have led the OEMs to insist that the problems be resolved, or to refuse to buy Takata airbags? A 2015 Takata Engineering Integrity Audit performed at Honda’s behest, by an independent team, suggests it wouldn’t have made much of a difference:

Based upon the information provided by Takata and Honda, and despite the numerous examples of data manipulation, the audit team did not identify any potential safety risks from the audited test reports and test data for three of the four inflator designs (PSDI-5, PSDI-X and PSPI-X) as installed in Honda vehicles. For the PSPI-6 inflators, however, recent information from Takata indicates that after the PV program was completed there were a number of instances of closure burn through or closure erosion in tests of production inflators. This suggests that the burn through problems identified in this audit had not been resolved in the production inflators. This audit did not find any test results with peak pressure results in either DV or PV test programs that could have caused explosive ruptures.

The OEMs – Shoulda, Coulda, Woulda 

The three executives, all Japanese citizens, were indicted separately on fraud and conspiracy counts. Bringing criminal charges against auto-manufacturing executives is a relatively new phenomenon. In 2015, some auto-parts higher-ups were indicted on price-fixing charges. Last year, the DOJ indicted six Volkswagen managers in the diesel emissions cheating scandal. Serious consequences for corporate criminality in the auto sector represents some progress. But, as long as there is a financial incentive to ignore or cover up problems, they won’t be the last to be indicted.

And this brings us around to Takata’s co-conspirators – the OEMs. Despite industry knowledge in the late 1990s that Phase-Stabilized Ammonium Nitrate was a risky choice for an airbag inflator – vulnerable to explosions when subjected to temperature changes and moisture exposure –  it sure was cheap. Ultimately, GM, Honda, Toyota, and others chose to use it as a significant cost-saving.

And in order for Takata to succeed in maintaining the fiction that PSAN posed no problems, the automakers had to look the other way as each red flag was hoisted and ignore their own supplier quality control procedures. Honda, is perhaps, the most egregious example – as we pointed out in May (Honda Finds Convenient Scapegoat in Takata)

Honda experienced its first rupture in an inflator using PSAN as a propellant in 2004, but passed it off as an anomaly, and waited a year to tell Takata. Even before that, Honda had a rupture with a Takata Unibody-style inflator, which was determined to be the result of a bad weld, indicating a manufacturing problem. By 2009, Honda was aware of 11 ruptures and at least one death – which it concealed from the National Highway Traffic Safety Administration.

A more recent report Takata was compelled to submit to NHTSA under the terms of a 2015 Consent Order, illustrates how involved Honda was in Takata’s design and manufacturing decisions going back to 2000.

Around that time, Takata and Honda were performing sled tests using modules containing PSDI inflators with propellant wafers in the shape of a shark fin and others in the batwing configuration. When a module with a shark fin wafer failed to satisfy one of the test criteria, Honda insisted that Takata use batwings, even though Takata argued that the problem could be remedied and that the shark fin design would produce more consistency in the wafer density, and therefore less variability in ballistic performance. Honda’s February 2000 decision to go with the batwing design came just four months before production was slated to begin, rushing the normal design and production validation processes and leaving Takata insufficient time to test and set up a new production line at its inflator assembly facility in LaGrange, Georgia.

This caused Takata to perform its initial production validation testing using pre-production batwing wafers pressed on a non-production press. And to meet Honda’s volume needs, Takata had to ship a Stokes 340 press – a machine intended for research and development, not mass production – to its Lake Moses, Washington plants to augment the work of its Gladiator presses. The problems with using the Stokes press were later implicated as a possible root cause for the first Honda recalls.

In 2010, Honda and Takata hired outside scientists from Pennsylvania State University and University of California Berkeley to investigate the inflator ruptures. PSU’s analysis of Takata’s PSAN propellant between 2011 and 2014, concluded that it is susceptible to dynamic burning – when it is exposed to sudden pressure increases, such as that created by low-density wafers, it may burn at a much faster rate and at higher temperatures than expected, leading to over-pressurization. Penn State believed this dynamic burning effect contributed to the ruptures and published a paper to that effect in 2012, warning that “the effect of dynamic burning behavior of the propellant needs to be accounted for when designing or analyzing systems that subject the PSAN propellant to high pressurization rates.” Honda was an active participant in all discussions.

Honda’s close relationship with suppliers is legendary – written up regularly in the business press. And even when business professors are not lauding your super-tight collaborations with suppliers, every automaker has a system in place to communicate with and check on component manufacturers, from design to post-production. OEMs, which are ultimately responsible for the end product, can and do require proof of a product’s safety. For example, Design Failure Modes and Effects Analyses (DFMEA) identify potential failures, rank them by severity, and identify fail safes to mitigate them. DFMEAs and other analyses are the bases of Production Parts Approval Process (PPAPs), packets which OEMs use to choose their suppliers. These documents would have predicted that ruptures could happen as a result of over-pressurization and given them a severity 10 – which engineers consider a red flag that the design needs to change. Significantly, according to the plea agreement, Takata had minimal internal controls and compliance systems until 2006. How did that escape the OEMs’ notice when they audited Takata before selecting it as a supplier?

Contrary to the DOJ’s fairytale predictions about what the OEMs would have done with information about bad tests, automakers’ design analyses and audits should have identified and disqualified the use of PSAN in airbag inflators before they went into any vehicle. Later, the public record of ruptures, recalls, and revolving root causes gave them enough reason to galvanize their supplier quality control processes into action. By their own policies, the OEMs should have ceased using Takata as a supplier no later than 2009, when it was clear Takata could not control its systemic issues, with deadly consequences. But none of that actually did happen – because ammonium nitrate is cheap.

The OEMs simply gambled, and their customers lost. 

How to Read the Plea Agreement

The Safety Record gets the fact that legally, the wire fraud charge necessitates that the “victim” in the transaction be the entity that paid Takata for its services, i.e, the OEMs. But, we wouldn’t want our readers to confuse the legal victims with the real victims.

Takata airbag ruptures are responsible for 16 deaths worldwide and more than 180 injuries in the U.S. The most recent U.S. death occurred in September. A 50-year-old California woman on her way to get a flu shot died of inflator shrapnel injuries after a front-end collision. The plea agreement sets aside only $125 million to compensate those who have not already resolved their claims against Takata. The payouts will be administered by attorney Kenneth Feinberg, who denied 91 percent of the claims while performing the same service for GM during the ignition switch crisis. This is a pittance, considering that the some of the injuries include serious neck and chest wounds, and facial lacerations necessitating long and costly recoveries.

This restitution fund lives for only five years – the current estimate for completing the recall. After that, any leftover monies go to the government. What happens to people injured after recalls? People are still being injured on a regular basis. And some of the airbag replacements use the same inflators, under the theory that the inflators don’t become dangerous until age six, giving the OEMs the leeway to worry about those inflators later. Even if the deterioration rate of PSAN bought the manufacturers six more years, Takata’s continuing manufacturing problems wipe that margin out. Takata airbag inflators have been subject to four recalls since 2014 for manufacturing defects that could lead to ruptures.

  • June 2014: GM recalled model year 2013 and 2014 Chevrolet Cruze vehicles after an investigation of a rupture in a 2013 Cruze showed that some SDI-X inflators were made using outer baffle components intended for the PSDI-X inflator.  Nissan also issued a U.S. recall, and Nissan and Honda issued foreign recalls.

  • July 2014: Mercedes-Benz recalled 311 model year 2014 SLK and SL class vehicles because inadequate fasteners could come apart, allowing the diffusor to detach and enter the passenger compartment.

  • September 2015: GM recalled 395 model year 2015 vehicles after the body bore seal separated from a side airbag inflator (SSI-20 inflator) during lot acceptance testing. The root cause remains unknown.

  • October 2015: Honda recalled 515 model year 2016 CR-V vehicles after a PSDI-X inflator failed during lot acceptance testing. Takata concluded there was either a stamping issue or a weak metal canister.

  • January 2016: Volkswagen recalled 734 model year 2015 vehicles after an SSI-20 side airbag ruptures in a 2015 Tiguan. Takata subsequently combined the GM and Volkswagen vehicles into one equipment recall for SSI-20 airbags in 1,129 vehicles, noting that it had not yet determined a root cause.

And what about the millions forced to drive vehicles with potentially deadly airbags while waiting years for a replacement? Will the recall really be done in five years? GM, for example, reacted to all these revelations about Takata’s fraud, the dangers of PSAN and Takata’s ongoing manufacturing issues by asking NHTSA for a one-year extension to comply with the agency order that recalls of certain model years must be completed by December 31, 2016. GM had flouted the Consent Order for months. At the time it requested the extension, its repair rate for Takata-related recalls was a dismal .17% (only 552 vehicles).

After initially informing customers that GM “strongly recommends that you have this safety recall repair performed immediately” and urging occupants not to sit in the passenger seat, GM’s later customer communications deemed its campaign a “preliminary recall,” and refused to actually repair the vehicles:

“GM continues to believe that there is no immediate danger of inflator rupture in the recalled GM vehicles and that these vehicles are presently safe to drive. You will be notified when there is a need to take action.”

The plea agreement’s section entitled “The Victims” only contains two points devoted to the OEMs who purchased the defective bags based on false data. But what made Takata’s deception truly criminal were the deaths and injuries that resulted long after the doctored validation test results were shoved in a file. And the DOJ spared not a word for those individuals who never had any hand in the decision to roll the dice on PSAN, or saw a ballistic test, but suffered the most severe consequence.

Since 2009, there have been 11 deaths in the U.S. caused by inflator ruptures – people who had their necks sliced open – some in crashes so minor, they should have walked away. Save one 13-year-old, we know their names, and since the government didn’t mention them in the official record, The Safety Record will:

Ashley Parham

Gurjit Rathore

Hai Ming Xu

Jewel Brangman

Hien Thi Tran

Carols Solis

Kylan Langlinais

Joel Knight

Huma Hanif

Delia Robles