Toyota Has the Most Keyless Ignition Related Deaths, But Takes no Action

EDITOR’S NOTE:  Five days after publication of this article Toyota announced its plans to add auto shutoff and auto park features for 2020 models to prevent CO deaths and rollaways – 13 years after first death and 7 years after Ford and GM.

Last month, Dr. Sherry Hood Penney, 81, and Dr. James Livingston, 88, died of carbon monoxide poisoning. The couple had inadvertently left their keyless ignition 2017 Toyota Avalon running in the attached garage of their Sarasota condo. The car ran until it was out of gas and its battery died.

Penney and Livingston were distinguished in life – Dr. Penney’s resume included glass-ceiling shattering stints as interim president at SUNY Plattsburgh, the first woman at SUNY to serve as vice chancellor of academic programs, policy and planning at SUNY, and interim president of the UMass system. Dr. Livingston was a retired MIT professor, a research physicist at General Electric, and a global expert on magnets.

They died of indifference.

Toyota has the most keyless ignition carbon monoxide deaths. It had the first publicly acknowledged deaths and, now the most recent deaths. Yet, Toyota has done nothing to implement a simple, inexpensive software solution that some other major automakers introduced seven years ago.

No Manufacturer Knows the CO Keyless Ignition Hazard Better Than Toyota

The Penney-Livingston deaths bring the total of the known Toyota keyless ignition carbon monoxide fatalities to 17, with an additional 18 CO injuries. Deaths linked to keyless Toyota or Lexus models now account for 47 percent of the 37 known deaths.

Carbon monoxide deaths associated with keyless ignition vehicles represent the tip of the safety problem. The vast majority of keyless ignition vehicle owners have accidentally left their engines running at one time or another, but most incidents result in a metaphorical knock to the head – “I can’t believe I didn’t turn off my engine!” moment. In order for his error to cause injury and the death, the vehicle must be parked in an enclosed space, adjacent to an occupied living space, it must have a full, or nearly full, tank of gas, and there must be a stretch of time when interruptions from others outside the home are unlikely.

Since these deaths and injuries are not tracked in any methodical way, and because not all keyless ignition carbon monoxide deaths make the news, it is likely that there are more deaths and injuries than are publicly known.

The first known Toyota keyless CO deaths occurred in April 2006, David Colter, 89, and his 70-year-old wife Jeanette, of Port St. Lucie, Florida, were found dead of carbon monoxide poisoning in their home, after leaving their 2006 keyless ignition Avalon running. According to their son-in-law, Jeanette Colter had apparently already had one incident in which she left her Toyota running in a parking lot; and family members warned her about forgetting to turn off the car with the quiet-running engine.

“That car was so quiet, it was hard to tell if it was running or not,” Terry Wilson said in a news article. “You don’t even need a key to start it. You just push a button to turn it off and on.”

Three years later, Mary Rivera, a former college professor, left her Lexus ES 350 idling in a garage beneath her homes. Her 79-year-old partner, Ernest Codelia Jr., died of carbon monoxide poisoning. Rivera survived, but suffered permanent brain damage. The incident hit the news in November 2010, when the victims filed a civil lawsuit against Toyota. By then, there was another Toyota keyless ignition death and injury. In August of that year, 29 year-old Chasity Glisson of Boca Raton, Florida, parked her Lexus IS250 in garage to make room for boyfriend’s vehicle, and forgot to turn off the engine.  She later collapsed in bathroom on the 3rd floor, where her boyfriend, Timothy Maddock, found her, and passed out himself. The pair was found the next day; Glisson died of carbon monoxide poisoning. Maddock was critically injured and hospitalized for ten days.  An investigation revealed that the carbon monoxide came from the Lexus in the garage, which Glisson inadvertently left running.

In 2010, Safety Research & Strategies reached out to the National Highway Traffic Safety Administration’s chief counsel’s office and rulemaking engineers to alert the agency to the  rollaway and carbon monoxide hazards of keyless ignitions.

In 2011, NHTSA raised the profile of Toyota incidents in a Notice of Proposed Rulemaking to amend Federal Motor Vehicle Safety Standard 114, which regulates key systems. In a half-baked attempt to address the carbon monoxide hazard, the agency proposed mandating louder warnings. In explaining its rationale, the NPRM specifically made examples of the Glisson incident and a consumer complaint involving a close call from a 2007 Lexus LS460 owner, who inadvertently left his vehicle running in his garage, but was awakened at 2 a.m. by a carbon monoxide detector, and averted serious injury. The rulemaking was roundly criticized by industry and advocates alike, but for different reasons. Industry was opposed to the louder warnings solution for fear of annoying customers, chided the agency for proposing a rule based on consumer complaints, but also tried to block it from conducting some human factors research that would serve as the basis for rulemaking. Consumer advocates argued that auditory warnings were much less effective than a simple automatic engine idle shutdown mechanism and the agency had no data to support the effectiveness of the proposed audible alert.  (NHTSA has not advanced the rulemaking since.)

Since then, Toyota owners have suffered injuries and fatalities from carbon monoxide poisoning at regular intervals. In the first five months of 2019, there have been three known deaths caused by Toyota keyless ignition vehicles.

In February, Russell Fish, a 68-year retired member of the U.S. Army, and the National Security Administration from Hanover, Pennsylvania, and the family dog, Angel, died when Fish parked his wife’s 2011 keyless ignition Toyota 4Runner in their garage and inadvertently left the engine running. As Fish retired to his bedroom, the vehicle continued to run for nine hours until the temperature in the garage rose to levels high enough to explode the aerosol paint and insecticide cans on the garage shelves; the dash warped and the grill of the vehicle melted; and Fish slipped into death from carbon monoxide poisoning. He was found the next day by the family’s pastor, who they had check on Fish when he didn’t answer his phone.

“My research has uncovered this has been a known issue for some length of time and Toyota has had (and failed to take) the opportunity to do the right thing by correcting it,” says Fish’s oldest son, Nathaniel Fish of Phoenix, AZ. “They have failed to ensure that no other parent has to sit their children down as they’re getting ready for a party and tell them that the last time they saw their pappy was the last time; no pastor will need to find the body of one of his parishioners lying in bed in a stiflingly hot house filled with exhaust; no wife will need to get that call, while visiting grandkids, that her husband and life partner won’t be there to embrace her and welcome her home when she returns; no grandson will have his senior trip forever marred by the memory of receiving the startling news that his pappy had died from something that could have been prevented.”  

Older Drivers, Ingrained Habits

Drivers of every age can and do inadvertently leave keyless ignition vehicles running.

The design makes it easy to do. In a keyless ignition system, the key is no longer a physical object. It is an invisible code, transmitted via radio waves to and from the plastic fob and the ignition module in the vehicle. The fob must be in the vehicle to start the engine – much like a traditional metal key, but unlike a metal key, it plays no role in turning off the engine. Driver’s must execute series of actions – shift the vehicle’s transmission into PARK, push the START/STOP button and open the driver’s door, to fully remove the “key” from the ignition. Drivers exiting their vehicle with the keyless ignition fob – which manufacturers repeatedly call the “key” – believe that because they have the “key” the engine is not running. And because the fob is a proximity device that can only start the vehicle when it’s inside of the occupant compartment, many drivers believe the reverse is true – the car won’t continue to run – and if it did it would time out, like other features in vehicles including the radio. 

With a traditional metal key, a driv er cannot remove the key from the ignition without shifting the transmission into PARK and turning off the engine. Thus, the presence of the physical key outside of the vehicle provides drivers with the status of the vehicle – the engine is off, the transmission is locked in PARK – it’s a strong visual and tactile reminder. If your key was in your pocket or hanging from a hook in your kitchen, there is no way the engine could still be running or the transmission in a gear other than PARK. Those possibilities had been engineered out by regulation. That is not the case with a key fob. You could be miles away with the fob in your hand, and your vehicle could be idling away or in still in DRIVE.

It’s obvious that manufacturers conducted no human factors testing to see how drivers would perceive the new system, and what human errors the design itself would induce, because automakers did next to nothing to transition drivers to this radical shift in their relationship with the new-fangled “key.” Rather, manufacturers exacerbated the propensity for error by telling vehicle owners that the plastic fob was the key, branding their systems with names like “Smart Key” or “Intelligent Key” and depicting the fob in owners’ manuals and on the instrument panel as the “key.” They relied on auditory and visual warnings that were often never heard or seen by the driver, or, in the former case, using tones that were like other in-vehicle telltales that failed to distinguish the hazard and status of the key and lasted only seconds.

Combine these factors with today’s nearly silent engines and dashboards, headlights, radios and other electrical accessories that stay enabled for a short period after turning off the vehicle, and it is now super-easy to leave a vehicle running.

Now let’s suppose that you used a traditional metal key for the vast majority of your decades as a driver. Your key behaviors are pretty ingrained. Throw in some hearing loss and background noise, like a garage door going down to further mask that quiet engine and what are the odds you might make an error?  

Toyota Sure Loves the Mature Market’s Money

The Livingston/Penney vehicle was a 2017 Toyota Avalon, intentionally purchased, according to Mrs. Livingston’s son Michael, because “it was such a safe car.” Safety, along with quality has long been key to Toyota’s brand, and the Avalon, its full-sized sedan has long been a favorite of older car buyers.  

Eight of the Toyota CO deaths occurred in five incidents involving an Avalon.

In 2005, the year before the Colters died, “the median age of the Avalon buyer was just under 60, an age that used to signal that a consumer group – and the brand they were buying – had one foot in the grave,” according to a story published in Ward’s Auto.

Rather than disdain the aged buyer, Toyota embraced them. That same story quoted Don Esmond, Toyota Motor Sales senior vice president and general manager:

“That’s all changed now, says Esmond. “While the goal of most auto manufacturers these days is to lower the median age of their buyers as much as possible, we are quite content with the mature age profile of the Avalon buyer. To be honest, I don’t think I would have been comfortable with that number, when we launched Avalon, 10 years ago.”

Over the last 14 years, the average age of an Avalon buyer went up. Today’s “average Avalon buyer today is 66 years old, a few years older than the segment average,” according to a Forbes story published in April 2018. But, again, Toyota is bullish on older buyers. While many industry observers have written the obituary of the full-sized sedan, noting that younger buyers favor SUV crossovers, the April 2018 Forbes story marvels at Toyota’s counter-punch in unveiling a new 2019 Avalon: “As sales in the segment are sinking, several other automakers are discontinuing their big sedans and the average large car buyer is 64 and not getting any younger. Thanks to the huge baby boom populace, it will be some time yet before the market for big sedans disappears. Toyota is betting that with the redesigned it can keep its core Avalon audience happy and attract buyers who previously favored other models.”

And Toyota is supposed to be making its vehicles more age-friendly via the partnership between Toyota’s Collaborative Safety Research Center and the MIT AgeLab, which studies things like “understanding how drivers respond to the increasing complexity of the modern operating environment.”

Apparently, that effort doesn’t extend to preventing carbon monoxide deaths its keyless ignition system vehicles.

Nathaniel Fish says part of his disappointment in Toyota is the irony of its marketing keyless ignition systems to older consumers.  

“In fact, in show rooms they actively market this push button technology as a feature for older drivers who might struggle with inserting a key and turning it…to a demographic that is already conditioned through literally decades of driving cars that require a key to both turn their vehicle on and turn their vehicle off, a demographic that is often suffering hearing loss and cannot hear the increasingly quiet engines still running as they exit their vehicle while the noisy garage door is closing, to think of their “key fob” as just an easier key, without which they cannot start their car,” he says. “And so, reasonably, they view this fob as a key and treat it as such when they take it with them as they leave their vehicle, believing the vehicle cannot run without the ‘key fob’ nearby

It Will Take an Act of Congress

In February, U.S. Senator Richard Blumenthal (D-CT) introduced the Protecting Americans from the Risks of Keyless Ignition Technology (PARK IT) Act, which would require NHTSA to amend and finalize the 2011 proposed rulemaking a rule that vehicles automatically shut off after a period of time to prevent carbon monoxide poisoning, and a rule that sets a performance standard to prevent rollaway.

Blumenthal’s bill (S.543) now idles in the Commerce, Science and Transportation Committee, awaiting a Republican sponsor before Chairman Roger Wicker (R-Miss.) will advance it. Meanwhile, U.S. Representatives Jan Schakowsky (D-Ill.), Darren Soto (R-Fla.), Seth Moulton (D-Mass.) and Joseph Kennedy (D-Mass.) introduced a House version (HR.3145) of the PARK IT Act yesterday.

Specifically, to prevent rollaway the PARK IT Act would require the Secretary of Transportation, within two years of enactment,  to issue a final rule requiring manufacturers to install technology in motor vehicles equipped with keyless ignition devices and automatic transmissions to prevent movement of the motor vehicle if  the transmission of the motor vehicle is not in the park setting; the motor vehicle speed is low enough to establish that it is stationary; the driver’s door is open and driver’s seat belt is unbuckled; and the service brake of the motor vehicle is not engaged. This is the same algorithm Fiat-Chrysler Automotive employed when it recalled Jeeps and other Chrysler vehicles to add updated software to prevent rollaway.

“Basic safety standards and technology can protect owners of keyless ignition cars from the threat posed by carbon monoxide poisoning and rollaways. NHTSA’s failure to act is indefensible and has tragic and fatal consequences. Congress must move swiftly to pass the PARK IT Act and compel NHTSA to do its job,” said Senator Blumenthal.

Accompanying Blumenthal at his April announcement in Hartford, was Suzanne Zitser.  In January 2013, Zitser, a Connecticut attorney, wrote a heartfelt letter about the carbon monoxide death of her 86-year-old father, Gerald Zitser, who owned a 2006 Avalon, to any entity she thought might be interested – the U.S. Department of Justice, the U.S. Consumer Product Safety, and Toyota.

Gerald Zitser, she wrote, still rode his bicycle around town. He loved his Yankees and his Toyota. He took meticulous care of the car, and never missed an opportunity to follow his favorite baseball team. On June 28, 2012, Gerald Zitser did his shopping at the local Publix, parked his Avalon in his garage, and took his groceries into the house. He closed the garage door, but inadvertently failed to shut off his engine. Later that evening, Zitser settled into his recliner to listen to the Yankees take on the Chicago White Sox. He never woke up. (The key fob was found in his pocket.)

“Had there just been an automatic shut off system that kicked in after a preset time when their [sic] was no weight in the driver’s seat, much like the airbags in the passenger side, then this senseless, tragedy would have never occurred,” she wrote.

His youngest daughter received replies from the DOJ, the CPSC and Toyota. The latter response included a form letter assuring her “It is through correspondence such as yours that we are able to continue to improve our services.” She got a case number, and a second round of correspondence from Toyota in which the company expressed its willingness to conduct a vehicle inspection, “However, the danger of carbon monoxide poisoning from an internal combustion engine left running in an enclosed space has been well recognized for years in the automotive industry and by the public at large,” wrote Toyota Motor Sales’ Curtis Hamilton. “Unfortunate incidents such as the one that you describe in your letter, while rare, have also occurred with mechanical key systems and are not dependent on whether the vehicle involved uses a keyless ignition system.”

In March 2013, Zitser wrote back, observing that Toyota had missed her point entirely – an engine shutdown device could be implemented in any vehicle regardless of ignition type – and she encouraged Toyota to stand with safety:

“Again, I thought by sharing this tragedy with Toyota, it might take the opportunity to come up with a very simple solution that would prevent another accidental death – by installing an automatic shut off or kill switch. I hope you will reconsider this letter and not only be a leader in the automotive industry but equally important be in the forefront as far as the safety of the consumers of your product,” Zitser wrote.

By then, it was too late for Toyota to be the safety leader in using an automatic engine shutoff mechanism to prevent carbon monoxide deaths. In calendar 2012, both Ford and GM released MY 2013 keyless vehicles with automatic shut-off systems. And in 2017, Chrysler has added a similar feature to its 2018 Pacifica hybrid mini-van,

Zitser remains baffled that Toyota has refused to address the issue, given its long history of knowledge about the problem and the deadly consequences.

“I would never, ever, ever buy a Toyota,” she says. “The number of Toyota deaths in just this past year is staggering, and I just can’t believe they are not aware of what the other automakers have done to address this problem. I just don’t understand, first, why that the PARK IT bill hasn’t passed and second of all why Toyota has done nothing.”

A Tipping Point

[Editor’s Note: The following article is a response to best-selling author Malcom Gladwell’s recent podcast “Blame Game” on the Toyota unintended acceleration crisis. Gladwell’s depiction of the controversial defect issues plaguing Toyotas is wildly inaccurate and refuted in many public record documents. In addition, the podcast reinforces the  narrative of vehicles as mechanical objects that obey the driver’s every command at a time when the automotive industry is moving headlong into autonomous vehicles that make decisions and take action without driver input, or as a countermeasure to driver input,  without adequate oversight of the safety of critical electronics and software controlling them.

Indeed, new technologies offer the opportunity to reduce the significant human carnage that result from driver errors. But these autonomous features can and do fail, taking control away from the driver in ways that are hidden beneath the millions of lines of code, and a multitude of electronic modules, sensors, and algorithms. In addition, these technologies are being tested on the public with government and manufacturer support, but few checks and balances to protect motorists from failures.

We reached out to Gladwell via email to ask him some questions about the reporting process that led to his firm conclusions in contradiction to the factual record. We received no response. We have requested that Slate correct all factual errors. ]

A Tipping Point

We can date our inability to enjoy a Malcolm Gladwell piece to May 4, 2015. That is the day The New Yorker magazine published “The Engineer’s Lament.” Gladwell, a New Yorker staff writer, and author of such popular culture best-sellers as “Blink” and “What the Dog Saw,” specializes in seductively reductive explanations for complex events. “The Engineer’s Lament” was one of Gladwell’s signature challenges to the conventional wisdom, a 7500-plus word article premised on the notion that the public’s demands that the automobiles they drive be reasonably safe were unrealistic.  

If only everyone thought like an engineer – logically and rationally – and proceeded in service to the data, we would drive better. We would stop blaming car companies for gas tanks that easily rupture into deadly conflagrations in rear-ends crashes, like the Pinto in the 1970s. We would stop blaming NHTSA for missing the obvious evidence of a safety defect, like the GM ignition switch failure. And we would train our critical eyes on ourselves – average folk, not “car guys” – who, despite our many years of successfully moving our feet between the accelerator and brake pedals without incident suddenly confuse them (coinciding, coincidentally, with the advent of electronic throttle control), like all of those people who reported Unintentional Acceleration (UA) incidents in Toyotas.   

And since he strayed into a topic with which we are intimately familiar, The Safety Record realized: Malcolm Gladwell is not a reporter in the traditional sense of a synthesizer of the available information on a particular topic. His approach is more novelistic – he has a story he wants to tell, and finds the most dramatic examples to underpin his narrative arc, and ignores critical context and any data that counters it.  Really – how does Gladwell tell the history of Ford’s decision not to recall the Pinto without mentioning the notorious cost-benefit memo that concluded that it was significantly cheaper to pay the death and injury claims than to install a countermeasure that would make it less prone to fuel leaks and explosions?

In May 2015, we contemplated firing off a letter to the editor but, frankly, there was too much to unpack, and we were busy.

Last month, Gladwell re-worked this premise for his podcast “Revisionist History,” a production of Slate Magazine’s new podcasting network, Panoply, and now we have to set the record straight. Entitled “Blame Game,” it purported to prove that pedal misapplication was the real cause for nearly all cases of Toyota UA, and it used Safety Research & Strategies founder and President Sean Kane as a straw man to make his case. 

The podcast goes like this: Toyota was forced to recall millions of vehicles for UA, and the official culprits were all-weather floor mats that could entrap the accelerator and sticking accelerator pedals that were slow to return to idle. Gladwell rightly points out that it was unlikely that the vast majority of incidents were tied to either of these causes. But Gladwell argues that the whole controversy – the Congressional hearings, the multi-million dollar fines, Toyota’s criminal fraud conviction, the recalls – were just a folie à plusieurs. The real root cause of the vast majority of UA events is pedal misapplication because brakes always overcome throttle, and because retired (and now deceased) UCLA professor Richard Schmidt said so and, ultimately, because car guys don’t think it could happen any other way. He declares pedal misapplication to be the number one cause of unintended acceleration, and anyone who believes that electronics are to blame is “deluded.” The piece concludes with Gladwell’s observation that people just don’t respect the fact that cars are “complicated” and “mechanical” machines, but if we did, we would stop finding fault with the vehicle and learn to blame UA on our own involuntary brain burps.  

Adlai Stevenson once famously quipped “Here is the conclusion on which I will base my facts,” and that pretty much sums up Gladwell’s podcast. In making his case, he mixes apples, oranges, pears and cherry-picked cherries in a Big Bowl of Wrong. He blows past important details, he forgets to mention anything that doesn’t fit his conclusion, he makes assertions supported by zero evidence and he makes factual errors, large and small. Finally, he gives drivers advice that, if followed, could be deadly.

The Saylor Incident

Gladwell bookends his podcast with the tragic deaths of Mark Saylor, his wife, daughter and brother-in-law, Christopher Estrella, who died on August 28, 2009 in a UA event on Highway 125 in Santee, California. Saylor, a 19-year veteran of the California Highway Patrol, was approaching the T-intersection of Highway 125 and Mission Gorge Road in a loaner Lexus ES 350, when his vehicle accelerated. The Lexus reached speeds of up to 100 miles an hour as it entered the intersection, struck a Ford Explorer, and then an embankment. The Lexus became airborne and came to rest in a dry riverbed where it burned for an extended period of time.

Gladwell uses the audio from the 911 call that Estrella made moments before the crash, warning the listener about its graphic content and describing Gladwell’s “hesitation” before deciding to use it. Fair enough – the phone call is a horrific auditory snapshot of four people’s impending deaths. At the same time, the Saylor crash was a watershed event in the Toyota UA crisis.

But Gladwell can’t resist trying to shoehorn the Saylor incident into his thesis about pedal errors: “So why couldn’t Mark Saylor stop his Lexus that way as he sped down Highway 125? I know it sounds ridiculous and tragic but it’s the only logical explanation – because he never put his foot on the brakes.”

Gladwell spends a breathless minute and 20 seconds speculating on how that might have occurred (Imagine a guitar thrumming ominously in the background):

“He’s driving down the highway with the cruise control on both of his feet are on the floor mat he comes up behind a car going slower than he is so he puts his right foot back on the accelerator – hard. But, as he does that, the floor mat slides under the throttle locking it open. Now comes the crucial part: he takes his foot off the accelerator to return to his     cruise control speed but the car doesn’t slow down. It surges forward. The throttle is locked open by the floor mat. He’s alarmed. He picks his foot up to hit the brake – but it’s a car he’s not familiar with. It’s a loaner. And he puts his foot on the accelerator instead of the brake and he presses it down expecting the car to slow, but it doesn’t. That’s why Lastrella says the brakes don’t work. And Saylor freaks out. So he presses down harder and the car goes even faster. And he freaks out even more. I think it’s important to note here Saylor isn’t negligent. He’s not at fault. He’s not speeding or running a red light or drunk. He’s making a mistake almost any of us could make under the circumstances. What happened to him at that moment is confusion.”

Unfortunately, the facts, easily available in the public record, contradict this confidently delivered fantasy. As part of Defect Petition 09-001, NHTSA investigators who examined the Lexus indicated that it was a case of floor mat interference, based on a previous report of a pedal entrapment in that loaner ES 350 and physical evidence of the accelerator pedal melted to the upper right corner of an unsecured all-weather floor mat. The condition of the brakes showed that Saylor was clearly braking throughout the incident – hard:       

“Rotors were discolored and heated, had very rough surfaces, had substantial deposits of brake pad material, and showed signs of bright orange oxidation on the cooling fins   consistent with endured braking. Pads were melted and rough with a considerable amount     surface material dislocated to the leading edge. The friction surfaces were burned but somewhat reflective. The edges of the pads were bubbled. The calipers were also heat discolored with heat patterns in the area adjacent to the rotor.”

In addition, witnesses to the Lexus careening wildly around other vehicles with its flashers blinking reported fire coming from the wheels – another indication of braking. In an interview with the San Diego Union-Tribune, San Diego Sheriff’s lead investigator Scott Hill said that there was evidence of: “prolonged heavy, heavy, hard braking….He did everything he could to stop that car.”

There are no living witnesses inside the vehicle, so how the event started and what Saylor did in reaction to it cannot be known for sure. But Mark Saylor was braking, and the only thing that is ridiculous and tragic is Gladwell’s assertion that he was not. He owes the Estrella and Saylor families an apology.

Brakes Always Overcome Throttle

One pillar of Gladwell’s argument is the idea that brakes always overcome the throttle, so if you find yourself in a vehicle that is “suddenly and mysteriously accelerating, all you have to do is step on the brakes, because brakes beat engines!” First, this is not always true. Second, even if brakes do eventually overcome the throttle it does not mean that you will be able to prevent a crash.

To prove this point, Gladwell conducted an “experiment” in which he and three car guys from Car and Driver took a 2003 Toyota Camry to the track at the Chrysler Proving Grounds to show that even with a wide open throttle, the brakes will stop the vehicle. Unfortunately, braking against an open throttle on a track does not replicate a real-world failure. 

Time and Distance

You have to have sufficient unencumbered space on a track to bring a racing vehicle to a stop without a crash. On a highway, it may take 900 feet, as it did to the Car and Driver folks, who had previously attempted to put the brakes of a ROUSH Stage 3 Mustang – a powerful sports car – to the braking-at-wide-open-throttle test.

(As Gladwell explains: “If you’re not a car guy, I should explain: ROUSH is an independent company that takes sports cars and basically puts them of steroids.” We should explain that Gladwell, car guy, repeatedly mispronounces the name of the company. It’s “rowl-sh.” Not “roosh.”)

In a parking scenario, the amount of available space is mere inches. So, even if brakes always overcome throttle, it does not ensure that you won’t have a crash that could result in anything from a property damage claim to a fatality.

In 2007, the NHTSA researchers at the Vehicle Research and Test Center tested the braking capacity of Toyota vehicles in wide-open-throttle scenarios. They found that the distances necessary to bring a vehicle at high-speed to a stop increased from less than 200 feet to more than 1,000 feet.

Brake Assist Problems

The problem of braking against an engine operating at high speed is exacerbated by the rapid depletion of the vacuum-assisted brake booster, which multiplies the force used to push on the brake pedal, and brings the vehicle to a stop. If the driver applies the brakes firmly and consistently, he or she, with sufficient time and space, may be able to bring an accelerating car to a stop, although it will take much more force than normal. NHTSA’s 2007 tests showed that “Brake pedal force in excess of 150 pounds was required to stop the vehicle, compared to 30 pounds required when the vehicle is operating normally.” So, that’s more than five times the normal braking pressure.

However, if the driver attempts to pump the brakes, NHTSA testing showed: “With the engine throttle plate open, the vacuum power assist of the braking system cannot be replenished and the effectiveness of the brakes is reduced significantly.”

In 2011, NHTSA published the Vehicle Characterization and Performance Study of Camrys, an examination of 20 Camry vehicles, nine of which had experienced UA. The study tested Camry braking at 65 mph under different conditions – loss of vacuum, full engine power, and differing levels of brake force. It found:

“There were test situations when the accelerator was being fully depressed during braking and the applied brake force was insufficient to stop the vehicle and the test was suspended. This was also the case when the vehicle reached a slow enough speed to downshift to first gear, where the engine torque was sufficient to overcome the prescribed brake force.”

In other words, brakes did not beat engine.

There have been many real-world instances in which people are braking with all of their might and cannot, or only can barely, or don’t have enough time and distance to overcome the throttle. Here are a few:

  • Juanita Grossman was a petite 77-year-old woman who died from the injuries sustained from barreling into a building in her 2003 Camry in March 2004. When the emergency medical technicians arrived to transport Mrs. Grossman to the hospital they found her with both feet still jammed on the brake pedal.
  • In November 5, 2010, Paul Van Alfen was exiting I-80 West in his 2008 Toyota Camry when he tried to take the vehicle out of cruise control mode.  According to witnesses, he went around two stopped vehicles at the end of the ramp, and crashed into a rock wall. The surviving occupants, his wife and son said that Van Alfen was pressing the brake firmly and was communicating this action as the crash unfolded. Van Alfen was killed, as was his son’s fiancé seated in the left rear seat.
  • Rhonda Smith experienced a UA event while merging into highway traffic in October 2006 in a 2007 Lexus ES350 with 3,000 miles on it. During the six-mile event, Mrs. Smith’s vehicle reached speeds in excess of 100 mph. The engine would accelerate and decelerate independent of her attempts to stop the vehicle by changing the gears, applying the brakes with both feet and setting the emergency brake. She was finally able to shut off the engine at 33 mph and the Lexus came to a stop. The driver of the tow truck saw the vehicle attempt to start itself as Mr. Smith, who had arrived to assist his wife, put the vehicle in neutral.  When NHTSA inspected the vehicle, they found: “The damage indicates excessive brake temperatures and is consistent with the brakes being applied vigorously over an extended period while the vehicle is moving at speed.”
  • On December 2, 2010, Timothy Scott, 47, was driving at less than 15 mph, before braking to make a turn into his apartment complex, when he noticed that his vehicle was not slowing. Scott applied the brakes with all of his strength, but the engine was “screaming,” as he later described it, and the tachometer was approaching to “red-line.” Scott was able to slow his vehicle and shift into stop. He attempted to re-start his 2007 Lexus RX twice, but the engine continued to race.

Gladwell apparently is not familiar with the well-known phenomenon. But Neil Hannemann, who advised Congressional committees studying Toyota UA (as did Safety Research & Strategies), and is a car guy’s car guy, says that it is a significant factor in high-speed, long duration-UA events. He was an original Dodge Viper development engineer, the chief engineer for Ford’s 2005-06 GT program, the chief engineer at Saleen Inc. (a manufacturer of specialty high-performance sports cars) and Executive Director of Engineering at McLaren Motorcars in Woking, England.

“Gladwell said they tried ‘every trick in the book,’ but they did not evaluate the loss of vacuum assist, as NHTSA did.  Loss of vacuum assist is also a required test for the FMVSS brake certification test,” Hannemann says.  “It is hardly even a ‘trick’ yet Gladwell and his band of ‘car guys’ ignored this effect.”

Later in the piece, Gladwell heaps scorn on Jake Fisher, Consumer Reports’ director of auto testing, for advising a driver in a high-speed UA event to take his foot off the accelerator and place his foot on the brake and hold it firmly until the vehicle comes to a stop. Gladwell calls this recommendation “malpractice.”

“No, No, No, the whole problem of unintended acceleration is caused by the fact that people mistakenly think they have their foot firmly on the brake, when they don’t. He needs to say the exact opposite… it is extremely important that you lift your foot off whatever pedal it is on is because chances are your foot is already on the accelerator. Now put your foot firmly on the brake.”

A lack of knowledge is a dangerous thing. Gladwell’s assumption that the driver’s foot is most likely already mistakenly on the accelerator in a high-speed UA is wrong. Donald-Trump wrong. Most high-speed UAs began when the driver’s foot was already on the accelerator. And, if the driver actually already has his foot on the brake, and takes it off – even once – the consequences could be deadly.

“If one is to follow Gladwell’s advice, and remove their foot from the pedal (since he has decided it is always the accelerator pedal) – in the case of jammed accelerator pedals this will not help, it will cause the vehicle to continue to accelerate,” Hannemann says.  “If the brake pedal is pressed and released again, then the vehicle will lose the vacuum assist to the brake system.  This will cause the vehicle to be difficult to stop, if not impossible for some people.”

Richard Schmidt, Unsung Genius

Gladwell’s second pillar is Richard Schmidt. As Gladwell tells the listener: “Perhaps the most important person in this whole story is Dick Schmidt…the world’s leading expert on how your feet behave when you drive a car.” Dr. Richard Schmidt was a former Stanford University psychology professor, and a proponent of the pedal misapplication theory, in which the driver mistakenly depresses the accelerator, thinking it to be the brake, and continues to compound the error, pressing ever harder, panicked and unable to understand why the brakes aren’t working, until the crash occurs.  

This idea gained currency in the 1980s during the Audi UA controversy. At the time, throttle controls were largely mechanical, and pedal misapplication was used to describe a specific type of UA – when upon starting the car and shifting it into gear, the driver intends to hit the brake, but places his or her foot on the accelerator instead. Startled by the forward movement, the driver pushes harder, still believing his foot is on the brake, until the vehicle is stopped by an inanimate object. The driver is unaware of his or her mistake and will never admit otherwise.

In 1989, NHTSA published An Examination of Sudden Acceleration which lent significant credence to this notion. But this theory has no empirical basis and is not well-supported by what little research has been done to test real drivers behavior against this scenario. Even the 1988 Rogers and Weirwille driving simulation study, “The Occurrence of Accelerator and Brake Pedal Actuation Errors During Simulated Driving”, concluded that this type of pedal error (i.e. drivers slamming down the accelerator when they intended to put it on the brake) is very rare. The majority, with maybe one or two exceptions, will correct that problem almost right away.

In a deposition taken by attorney Thomas Murray Jr. in Stimpson v. Ford, Schmidt was unable to explain exactly at what point the driver mis-positions his foot in this sequence which results in what he calls a “classic” UA crash. He also testified that he knew nothing about automotive engineering or electronics, that he had never sought out any such information, and that his “model” is not derived from empirical research, but from a “thought experiment.” 

In August 2010, Schmidt was a guest at a gathering of rehabilitation specialists convened by researchers, privately contracted by NHTSA, to explore pedal misapplication as a cause of UA. The transcript of the day-and-a-half meeting of rehabilitation specialists, which SRS obtained through a FOIA request, illustrates that some, who work with clients suffering from a range of cognitive and physical ailments that might actually lead a driver to misapply the pedal, questioned their participation: 

“I’ve seen thousands of Alzheimer’s patients, dementia patients; I’ve never seen one make an application error,” said Tom Kalina, of the Bryn Mawr Rehab Hospital in Malvern, Pennsylvania. “I’ve seen people with a lot of cognitive impairments. That’s the one thing they know how to do, just going back and forth between the gas and brake. There’s a lot of other executive functioning errors, but very rarely do I ever see a pedal error. The only time I ever see it is if there’s a sensory problem with the foot, inappropriate reception or numbness. The intention is to do the right thing, but they don’t know where their foot is and they hit the wrong pedal. Just about every case has been that way.” 

Schmidt questioned the entire relevance of this panel: “Come on, guys, what is the evidence that anyone of those motor deficits caused unintended acceleration? What’s the evidence?”


People do make pedal errors. But they are rare, and what scant research exists shows that they are almost always self-corrected. If one bothered to read the public record, or the complaints in the NHTSA Vehicle Owner Questionnaires or, even better, interview people who have experienced high-speed, long-duration UA events, one would understand that pedal misapplication is not a cause. These events go on for too long, and people are not static in their responses. They take many actions to try to stop the vehicle, including pumping the accelerator and the brakes, and looking down at their feet to ensure they are pressing the right pedal.

For example, Jeffery Pepski, of Plymouth, Minn., was able to keep his 2007 Lexus from crashing as it sped under its own command for several miles one February evening in 2009, until suddenly stopping.  But the incident was so disturbing, he refused to drive the vehicle again and filed a detailed petition to NHTSA in March, describing his nearly uncontrollable drive home, reaching speeds of almost 80 miles per hour. Applying the brakes with all the force he could muster, Pepski was able to slow the vehicle to 40 mph. In his original complaint to the agency, Pepski noted: “I alternated between pumping the accelerator pedal and pulling up on it from the underside with my right foot as it became clear that the throttle was stuck in an open position. The vehicle continued to speed back up to over 65 mph with less pressure on the brake pedal.” Pepski tried pressing the ignition button, and shifting the vehicle into neutral, without bringing the event to an end. Suddenly, the acceleration stopped.

NHTSA tried to squeeze the Pepski incident into its pet floor mat theory, but Pepski’s vehicle only had the OE carpeted mat. Here’s Toyota in an internal May 2009 email explaining NHTSA’s conundrum in dealing with an incident that didn’t conform to conclusions:

“I have discussed our rebuttal with them, and they are welcoming of such a letter, They are struggling with sending an IR letter, because they shouldn’t ask us about floormat issues because the petitioner contends that NHTSA did not investigate throttle issues other than floor mat-related. So they should ask us for non-floor mat related reports, right? But they are concerned that if they ask for these other reports, they will have many reports that just cannot be explained, and since they do not think that they can explain them, they don’t really want them. Does that make sense? I think it is good news for Toyota.”

Floor Mats Cause Pedal Misapplication?

Floor mats have been implicated in some UA events. This occurs when the edge of the accelerator pedal becomes trapped in the groove of a heavy all-weather floor mat. Gladwell has another theory: the real reason that floor mats are implicated in UA events is because “they throw off the expected geometry of the car. A big, thick winter mat stacked on top of an existing mat raising the floor of the footwell and makes the accelerator and brake seem much closer to your right foot and if you are in a strange car, that just increases the odds of impulse variability. It’s one of the little things that leads to a garble between intention and action.”

There is zero evidence that this occurs. 

In 1989, Schmidt, the “leading expert” on where drivers place their feet, “and perhaps the most important person in his story,” postulated that in UA, “the farther the foot is from the intended pedal when the driver initiates a movement toward it, the larger the variable errors will be in hitting the pedal (due to the greater force).”

Revisionist History?

“Blame Game” does not revise the history of UA in the least. Gladwell merely recounts the official record that, to this day, only acknowledges mechanical causes and driver error as the causes of UA, going all the way back to the Audi Sudden Acceleration controversy. 

Audi became the poster child for what was then called Sudden Unintended Acceleration (SUA) after more than 1,000 consumers alleged that their Audi 5000 vehicles had accelerated without driver input; 175 had been injured and four died in SUA crashes. The company denied that there was anything wrong with the vehicles and blamed the problem on shorter than average drivers who did not have much experience driving an Audi. These confused drivers had mistakenly depressed the gas pedal when they meant to step on the brake, Audi said. Between 1982 and 1987, Audi issued six recalls to address SUA in its vehicles: one shielded the accelerator pedal to prevent floor mat entrapment; another moved the brake pedal to prevent pedal misapplication; three recalls replaced worn idle stabilizer units. The final recall added a brake-to-shift interlock, which prevents drivers from shifting the vehicle out of park unless the brake is applied. That component is now nearly an industry-wide standard.

Gladwell conflates the Audi explanations – short drivers who were unfamiliar with the vehicle and experienced an incident upon start-up – with the Toyota UA incidents. There is no evidence to link the two.

If Gladwell truly wanted to revise history of Toyota UA, he would focus on the electronic/software causes which have been given short shrift, and he would take the time to understand the nuances that make Event Data Recorders (EDR) less-than-objective and unassailable witnesses to crashes. He might have read “Technical Support to the National Highway Traffic Safety Administration (NHTSA) on the Reported Toyota Motor Corporation (TMC) Unintended Acceleration (UA) Investigation,” the January 2011 NHTSA-NASA report which concluded: “Due to system complexity which will be described and the many possible electronic software and hardware systems interactions it is not realistic to prove that the ETCS-i cannot cause UAs. Today’s vehicles are sufficiently complex that no reasonable amount of analysis or testing can prove electronics and software have no errors. Therefore, absence of proof that the ETCS-i caused a UA does not vindicate the system.”

Retired NASA Failure Analyst Norman Helmold, who worked on the NASA Engineering Safety Center team that looked at Toyota UA, said that Gladwell’s single-minded pursuit of pedal misapplication left him “speechless. There’s more than one cause of unintended acceleration; there’s more than two causes, and there’s more than three.”

He is currently working on a technical paper further analyzing NHTSA Vehicle Owners Questionnaires involving UA complaints for 1998-2010 model year Toyota vehicles that the NESC team “reviewed with the objective of exploring clues of potential failure modes.”

Helmold says that project managers never completed a thorough analysis of the data, which was unfortunate, because they clearly show that the hazard risk estimate for the Camry rose significantly after Toyota installed electronic throttle controls. What that means is that drivers experienced UA events in Camry vehicles with mechanical throttles – via pedal misapplication, trapped accelerator pedals or mechanical causes, such as bound Bowden cables – and continued to experience the problems with those root causes after the introduction of Toyota’s Electronic Throttle Control System Intelligent. But the sharp upward tick after Toyota implemented ETCS-i shows that additional mechanisms of UA were likely introduced.

“On some of the Toyota car models, after 2002,  the hazard rate estimate goes up and stays way up by three to six times, indicating that electronics probably introduced a whole new family of problems that were not present when the Toyotas were mechanical,” he says. “In 2010, this would have told [the NESC team] which cars to look at.  The models with higher hazard rate are very similar – they have common chassis components. “

And, the NESC report shows that Toyota’s main defense in previous UA investigations is false. The team found scenarios in which engine speed can be increased, RPMs can surge, and the throttle can be opened to various degrees in contradiction to the driver’s command and not set a Diagnostic Trouble Code. The NESC team uncovered numerous design inadequacies in Toyota’s electronic architecture, as well as thousands of software coding violations.

The NESC team found several ways that Toyota’s electronic throttle control system could cause a UA event.

Among those was one real-world cause of electronic malfunction: tin whiskers in the APP Sensor of potentiometer-type pedals. Tin whiskers are hair-like structures which can cause electrical shorts. The team found the presence of this well-known electronics phenomenon in virtually every potentiometer accelerator pedal assembly inspected. The NESC report document says that the NESC team found 17 tin whiskers long enough to be easily seen using a hand lens and a bright light, in Toyota Camry vehicles that had shown driving misbehaviors they examined.  Two of these tin whiskers were long enough (more than a millimeter) to bridge between connectors inside the potentiometer. One caused a short circuit between these connectors that resulted in an electrical misbehavior while driving, but could clear later when the car is inspected.

The NESC team showed that the pedal potentiometers in Toyota Camry vehicles in the 2002-2006 model years grow whiskers during the natural aging of the car, and these tin whiskers can create shorts between connectors that induce misbehaviors.

Further, the team found that the bridging tin whisker induced a ‘galloping mode’ in the car’s behavior:  when one’s foot was applied to depress the pedal, the engine did not respond to the first part of the pedal-depression, but would continue to run at idle.  However, if the driver – in search of a response — pressed the pedal far enough, it would elicit a sudden engine speed up that would rapidly take the car into the range 20 to 25 mph.  Removing the foot from the pedal would return the engine speed to idle.  The brakes would work.  The “fault indication” would clear after the car was started several times.

“Not in the NASA report is the list of reports of accidents in which a car is claimed to suddenly develop this ‘galloping mode’, and then strike people, as the driver is not able to adjust to this sudden change in behavior.  Examination of the records will show many such claims,” says Dr. Henning W. Leidecker, Jr. the chief Failure Analyst at NASA Goddard Space Flight Center, and a member of the team that found the tin whiskers.

Rigged UA Tests

Exhibit C in Gladwell’s prosecution of electronic errors is an ABC story by reporter Brian Ross in which he attempted to show how a short circuit in the accelerator pedal position sensor could cause a Camry to go to wide-open throttle, based on the research of Dr. David Gilbert of Southern Illinois University Carbondale. Ross and ABC were criticized for a misleading edit in which a shot of the tachometer spiking at 6,000 RPMs purported to occur while the vehicle was underway, was actually induced while the vehicle was in park and the door was ajar. A month after the story aired, on February 22, the recently shuttered gossip and politics website Gawker reported that sharp-eyed viewers noted the lighted telltales in the shot showing that the parking brake was on and a door was open. ABC admitted the error and acknowledged Gawker’s story pointing it out. The network explained that it had swapped shots because the video taken while the vehicle was moving was too shaky.   

Like most of the podcast, Gladwell doesn’t quite get it quite right. He says that the story aired in March and involved a Prius that ABC rigged to give a fake demonstration of UA. Gladwell was conflating Ross’s February 22, 2010 story about simulating a UA event in a Camry with a March 2010 story about James Sikes, a 61-year-old Prius owner who alleged that his vehicle accelerated suddenly and would not respond to hard braking. His struggles to regain control of his vehicle were observed by a California Highway Patrol officer, who was called to the scene, and recorded it on a 911 tape. The police report noted that the Prius’ brakes were burnt out and that an examination of Sykes’ vital signs by emergency medical personnel immediately after the event showed he had very high blood pressure and heart rate. The police did not charge Sikes. 

Gladwell brings in Patrick George, an editor of Jalopnik, a Gawker-affiliated automotive site, to deliver the coup de grâce:

“They got a university professor to cut three wires within the electronic throttle system and then connect two of the wires to each other in a specific pattern with a specific resistor to create a link between the two final wires, with a switch so that he could control it. In other words this vehicle was rigged. It was rigged in such a way that you would never produce these results in real life.”

Gilbert is an associate professor of automotive technology who has taught automotive electronics diagnostics for 30 years to students who are frequently hired by car companies as high-level technicians in their field service divisions. He has also been hired by automakers, such as Honda, to develop technical teaching materials for their vehicle electronics instructors. His preliminary research showed that there are conditions under which the redundancy of Toyota’s electronic circuitry in the electronic throttle control is lost, resulting in a wide-open throttle without the generation of an error code. Gilbert’s research was simply born of curiosity – Toyota UA had become a staple of the nightly news, and he had just purchased a Toyota Tundra. Gilbert wanted to understand how a vehicle could have an uncommanded acceleration without setting an error code.

Gilbert’s preliminary tests, done for Safety Research & Strategies and presented to Congress, focused on the Accelerator Pedal Position Sensor (APPS), a high-priority sensor which electrically coveys the driver’s commands. The sensor system contains two circuits as a failsafe – if one fails the other is programmed to witness the failure (i.e. lodge a fault code in the Electronic Control Module) and put the vehicle into a limp-home mode. However, if the circuit redundancy is lost, the failsafe system no longer works as programmed. The system will not detect an error – no “Diagnostic Trouble Codes” are set.  Further, without a redundant failsafe, the Electronic Control Module (ECM) can be induced into a wide-open-throttle condition without any input from the driver. For example, simply increasing the voltage to the APP Sensor while in a compromised state can result in an uncommanded wide-open throttle condition, with no detectable codes. These scenarios can occur because the Toyota failsafe parameters are broad – the design allows a wide window of opportunity for problems to occur that are not seen by the system as abnormal

Toyota commissioned the science-for-hire firm Exponent to attack Gilbert’s work.  In a March 2010 report, Exponent concluded: “Dr. Gilbert has presented no evidence of his postulated sequence actually occurring in a real vehicle, or even evidence of an incipient event (e.g., signs that a resistive fault was developing), and did not look at any incident vehicles for “fingerprints” of any such fault.”

Gilbert never claimed that Toyota UA was caused by short circuits in the APP Sensor; he was testing the fault detection system. However, the NASA failure analysts who examined Camry accelerator pedals found that short-circuits in the APP Sensor, capable of inducing a wide-open throttle, could happen in the real world via the growth of tin whiskers bridging circuits. Leidecker says that the argument that these faults could not occur in the real world “is an ignorant claim.”

In a 2014 St. Louis Post- Dispatch story, Leidecker praised Gilbert’s work:

“Leidecker and other NASA scientists were so taken by Gilbert’s research that they call the unique sequence of events required for a pedal sensor to short out ‘the Gilbert Mechanism.’

‘I think he’s a hero. What he found was ingenious,’ Leidecker said.”

Edmund’s Inability to Award its Million Prize Proves Driver Error

Gladwell does not address the possibility of an electronic malfunction, except to marvel at’s inability to award a million dollar prize to anyone who could prove that UA could be caused by the vehicle. Edmunds, a web-based car-selling company, offered this prize in 2010 at the height of the Toyota UA scandal. In Gladwell’s mind, the unclaimed million dollars is the ultimate proof that there is no cause other than pedal misapplication. He sneers at Kane for calling the Edmunds offer a stunt with little probative value:

“Remember Sean Kane – Mr. Sudden Acceleration – the guy with the software coding gone awry theory? Not even he wants the million dollars. A media circus?  Kane doesn’t  want to try to win a million dollars? Because it’s a media circus? I’ll tell you what’s a media circus: the entire Toyota sudden acceleration scandal, because people like Sean Kane insisted that there’s some elaborate electronic cover-up behind it. Because people like Sean Kane couldn’t admit that this was just overwhelmingly a matter of human error.”  

And, neither had plaintiffs’ lawyers alleging electronic software defects in fatality and injury UA crashes sought the prize, says the website’s Director of Testing Dan Edmunds, “because of the nature of litigation, they probably wanted to focus on that.”

As Gladwell mentions, Toyota now settles its UA litigation. But it’s not due to a case of mass hysteria. It’s because of one particular case: Bookout and Schwarz v. Toyota.

In September 2007, Jean Bookout and her friend and passenger Barbara Schwarz were exiting Interstate Highway 69 in Oklahoma in a 2005 Camry. As she sped down the ramp, Bookout realized that she could not stop her car. She pulled the parking brake, leaving a 100-foot skid mark from right rear tire, and a 50-foot skid mark from the left. The Camry, however, continued speeding down the ramp, across the road at the bottom, and finally came to rest with its nose in an embankment. Schwarz died of her injuries; Bookout spent two months recovering from head and back injuries.  

In October 2014, an Oklahoma jury determined that Toyota acted with “reckless disregard,” awarding $1.5 million in damages to Bookout and another $1.5 million to the Schwarz family. But before the trial could move to the punitive damages stage, Toyota quickly settled the case.

The case turned, in part, on the testimony of two plaintiff’s experts in software design and the design process, who reviewed Toyota’s software engineering process and the source code for the 2005 Toyota Camry, and concluded that the system was defective and dangerous and riddled with bugs and gaps in its failsafes that led to the root cause of the crash.

Michael Barr, a well-respected embedded software specialist, spent nearly 20 months reviewing Toyota’s source code at one of five cubicles in a hotel-sized room staffed by security guards, who ensured that entrants brought no paper in or out and wore no belts or watches. Barr testified about the specifics of Toyota’s source code (see trial transcript and his slides) based on his 800-page report. Phillip Koopman, a Carnegie Mellon University professor in computer engineering and safety critical embedded systems specialist who authored a textbook, Better Embedded System Software, and performs private industry embedded software design reviews, including some for the automotive industry, testified about Toyota’s engineering safety process (part 1 and part 2). Both used a programmer’s derisive term for what they saw: spaghetti code – badly written and badly structured source code.

Barr testified:

“There are a large number of functions that are overly complex.  By the standard industry metrics some of them are untestable, meaning that it is so complicated a recipe that there is no way to develop a reliable test suite or test methodology to test all the possible things that can happen in it.  Some of them are even so complex that they are what is called unmaintainable, which means that if you go in to fix a bug or to make a change, you’re likely to create a new bug in the process.  Just because your car has the latest version of the firmware — that is what we call embedded software — doesn’t mean it is safer necessarily than the older one.  And that conclusion is that the failsafes are inadequate.  The failsafes that they have contain defects or gaps.  But on the whole, the safety architecture is a house of cards.  It is possible for a large percentage of the failsafes to be disabled at the same time that the throttle control is lost.” 

Even a Toyota programmer described the engine control application as “spaghetti-like” in an email Barr read into his testimony.

Koopman was highly critical of Toyota’s computer engineering process. The accepted voluntary industry coding standards were first set by the Motor Industry Software Reliability Association (MISRA) in 1995. Accompanying these rules is an industry metric, which equates broken rules with the introduction of a number of software bugs: For every 30 rule violations, you can expect on average three minor bugs and one major bug. Toyota made a critical mistake in declining to follow those standards, he said.

When NASA software engineers evaluated parts of Toyota’s source code during their NHTSA contracted review in 2010, they checked 35 of the MISRA rules against the parts of the Toyota source code to which they had access and found 7,134 violations. Barr checked the source code against MISRA’s 2004 edition and found 81,514 violations.

Toyota substituted its own process, which had little overlap with the industry standard. Even so, Toyota’s programmers often broke their own rules. And they failed to keep adequate track of their departures from those rules – and the justification for doing so – which is also standard practice. Koopman testified that if safety is not baked into the recipe in the process of creating the product, it cannot be added later.

Barr and Koopman persuaded the jury that Toyota’s process was so flawed, and its software so tangled, that electronics were most certainly the cause of the Bookout crash.

Source code is proprietary; and even if an automaker willingly let an outsider examine it to find the weaknesses in the system – which it wouldn’t – the task would cost more than $1 million to go through the code line by line as Barr did. So Edmunds did not take any risks in offering a prize, and no serious expert would even consider it.

What a Car Is and What It Isn’t

Central to Gladwell’s podcast is a paradox. A car is: “a complicated mechanical object that requires attention and skill to be operated safely.” At the same time: “Cars do not have minds of their own; they just do what the driver tells them to do.”

Neither of these statements is correct. The cables and rods that once linked the accelerator to the throttle butterfly began to pass into history in 1988, when BMW introduced the first electronic throttle controls in its 7-Series. According to a 2009 IEEE story This Car Runs on Code: The “current S-Class Mercedes, for example, had 20 million lines of code and nearly as many ECUs as the new Airbus A380… Even low-end cars now have 30 to 50 ECUs embedded in the vehicle.” As Kane pointed out in the “Blame Game” podcast, the F-35 Joint Strike Fighter is running on about 7 million lines of code; a luxury car today can run on 100 million lines of code – the complexity is exponentially greater.

When a driver depresses an accelerator pedal, he is not controlling a Bowden cable. Virtually all vehicles produced today employ electronic throttle systems that rely on sensors to relay the driver’s intentions to the engine control module, a computer that controls the opening and closing of the throttle. The ECU makes the decision, based on algorithms, and acting in concert with other vehicle systems to honor that request. Or not. Like any electronics, these systems can be subject to error – caused by electrical shorts, mis-manufactured microchips or faulty software – and may not leave a trace.

The industry is well aware of the problems that have been caused by the proliferation of automotive electronics. In 2003, Mercedes removed 600 electronic functions because of quality concerns. Executives at Bosch, a major global supplier, declared at a 2004 industry meeting that there was direct correlation between the size of a vehicles’ electronic architecture and the number of defects. Other industry experts have acknowledged that automakers have overloaded vehicles with electronics without understanding how these systems, which might work well in isolation, operate together.

This complexity means that a vehicle does not always do what the driver tells it to do. For example, in 2013, Honda recalled 344,187 2007 and 2008 model year vehicles because of a combination of system components and software malfunctions that caused the Vehicle Safety Assist System to apply the brakes unexpectedly and hard – without illuminating the brake lights. In July 2015, Toyota recalled 713,000 Toyota Prius vehicles to fix a software malfunction that could cause the vehicles to automatically shut down while underway and go into limp-home mode.

Vehicle ECUs are processing and interpreting hundreds of signals in milliseconds to determine what actions it will take and how they will be done. Even when a vehicle functions as designed, it does not follow all of the driver’s commands. For example, today’s cars will not obey a driver’s command to keep the throttle at wide open for very long. In most modern vehicles, the driver can depress the accelerator pedal to the floor with the car in Park and the engine may race for a few minutes. But even with the pedal held down the software interprets the driver’s actions as unwarranted and reduces the engine RPMs. When accelerating hard on a slick surface, many vehicles will cut the engine power and apply the brakes when wheel spin is detected.  This is a far cry from mechanical controls that followed simple driver inputs.

As the industry speeds toward self-driving cars, Gladwell’s assertion that drivers exert complete control over a vehicle is sweetly old-fashioned, if wrongheaded. It certainly isn’t the pronouncement of a car guy.

Car Guys

One thing is clear: If you own a Porsche, you will instantly have Gladwell’s regard. For example, in “The Engineer’s Lament,” he mentions that his main character – Denny Gioia, who worked Ford’s recall office in the 1970s – “is a car guy. His everyday drive is a 2013 Porsche 911 S, and his weekend ride is a red 1979 Ferrari 308 GTS – the kind with an engine that can rattle windows.” In “Blame Game”, he tells us that Schmidt is a remarkable man, because, among other achievements “he owned five Porsches and raced cars – a car guy.”

And that’s because Malcolm Gladwell is also a car guy. As he tells us: at age 13 he sent away for the marketing brochures for every vehicle in the world, except the Russian-made ZiL, and he still has them. And “Blame Game” is littered with references to the things car guys know, such as, car guys call the accelerator pedal the throttle.

Car guys do know a lot about some aspects of cars. But they don’t know everything about cars. The days when you could throw open the hood and identify every mechanical part that made your car stop and go are gone. Detecting intermittent electronic or software-related faults is difficult, and you will never find them by driving a 2003 Camry around the Chrysler Proving Grounds.

But some car guys, we notice, are so in love with their enthusiasm for cool cars, that they don’t realize or acknowledge their own information gaps. For them, the world is divided between car guys and the rest of us poor slobs. A car may be a “complicated and dangerous” machine, as Gladwell says. But it is also a mass-produced consumer commodity, and you shouldn’t have to know what a ROUSH Stage 3 Mustang is – or how to pronounce it – to be able to make it stop and go without incident. So they tend to dismiss the lived experience of the average every-day driver, even as that driver is giving them important information about a defect.

And a car guy’s confidence can lead to the kind of arrogance that causes one to assert that a highway patrol officer who was braking his vehicle in an attempt to save his life and those of his family never put his foot on the brake in clear contradiction to the record, or that pedal misapplication is the “number one” cause of UA, or tell a driver in a UA incident that all he or she has to do is apply the brakes – and, by the way, take your foot off the brake, because you are actually stepping on the accelerator. The kind of arrogance that leads you to call anyone who does not accept the received  truths of Richard Schmidt “deluded,” “nutty” “crazy” or “insane.”  

In Conclusion

In pushing pedal error, Gladwell would have done better to stick to parking scenarios, which make up the vast number of UA complaints. In these circumstances, drivers are moving their feet between the accelerator and the brake, so the pedal error theory is at least more plausible, although it would still be inaccurate to call it the number one cause of UA, and there is plenty of evidence to suggest that it is not the cause of most UAs.

But fender-benders don’t produce frantic 911 calls. And parking lots aren’t nearly as much fun as test tracks.

UA events occur in parking scenarios, they occur on neighborhood streets when the driver is going 30 mph, and they happen on highways in high-speed, long-duration events. There’s too much variation in the data to definitely state there is only one cause. NHTSA tried for nine years.  To this day, Toyota UA events are still occurring – long after the media circus struck this particular tent and moved on. Drivers are still lodging complaints with NHTSA, and the issue shows up frequently in the death and injury claims that manufacturers must file quarterly with the agency as part of their Early Warning Reporting obligations.  For two years, The Safety Institute has published a list of the top fifteen vehicle defects, by make, model, model year, and coded defect component, associated with the most death and injury claims, as a means of determining what potential defects might need further investigation. The Toyota Camry – in various model years – has made the list every quarter for speed control issues.

UA remains a controversial topic because it is a multi-root cause phenomenon – and because pinpointing intermittent electronic and software-related problems is very difficult and costly. Blaming all UA events on the humans who drive the cars, as opposed to the humans who design or build the cars, in the age of drive-steer-and-brake-by-wire is merely convenient. Like a car, this story is complicated. And misinformation promulgated by podcasts like “Blame Game,” riddled with factual errors, bad assumptions, logical fallacies, poor reporting and poor sources, is one of the reasons that the debate rages on.

Gladwell plays the blame game, too, but he cheats.


Out-of-Control Toyotas, Out-of-Luck Owners

Earlier this month, Rich Grandy of Crystal Beach, Florida was easing his 2005 Toyota Tacoma into a parking space in front of his local 7-Eleven, when it took off, hit the front doors of the convenience store and shattered the adjacent picture window. The only thing that kept the Tacoma from advancing further into the convenience store was the low wall that framed the window and Grandy’s foot clamped on the brake. As his vehicle attempted to labor forward, Grandy shut off the ignition, and the event stopped.

Grandy loved his Tacoma – he bought it used in May 2013 after much research, and with full knowledge of Toyota’s unintended acceleration problems.

“I’ve read the newspaper my whole life. I probably knew more than the average person about Toyota, and I was familiar with the [fatal Saylor crash] in California,” says Grandy, a retired general contractor. “I thought there was probably a problem, but I also thought they were a big corporation dodging a bullet. I figured that it was such an isolated problem, it probably would not happen to me.”

But it did. Twice. In late March 2014, Grandy was making a slow right into a head-to-head parking space, and was braking to a stop, when the Tacoma accelerated forward and over a Honda sedan, which became wedged under this truck. In both cases, the UA occurred after the same sequence of events: Grandy had taken his foot off of the accelerator, and was coasting with his foot resting on the brake. When he actually engaged the brake to bring the vehicle to a full stop, it surged forward.

“I left a really big tire patch on the asphalt, and you could hear the tires squealing like crazy while I was trying to hold it back on the brake,” he recalled.  

With the GM ignition switch crisis, closely followed by the exploding Takata airbag inflator crisis, it may be hard to recall that just five years ago, our dearly departed Secretary of Transportation Ray LaHood declared: “The jury is back. The verdict is in. There is no electronic-based cause for unintended high-speed acceleration in Toyotas. Period.” But, far from ancient history, Toyota unintended acceleration incidents continue to happen with regularity to older vehicles, newer vehicles, hybrid vehicles, vehicles that received the sticky pedal and floor mat recalls and those that did not. Vehicles that….well, you get the picture. Neither public relations, nor the intervention of NASA and the National Academy of Sciences, nor million dollar fines, nor billion-dollar deferred settlement agreements between the government and Toyota have done anything to solve this technical issue.

To date, consumer complaints to the National Highway Traffic Safety Administration and Safety Research & Strategies (vetted to eliminate as many duplicates as possible) have reached more than 9,400. Speed control complaints for two Toyota vehicles, the 2006 Camry and the 2010 Corolla, continue to occupy spots on The Safety Institute’s Vehicle Watch List, a quarterly report monitoring potential vehicle defect trends and NHTSA’s recall and enforcement activities, using death and injury claims and early warning reports filed to the agency. Here are a couple of typical complaints added to the VOQ database this month involving late model Toyotas:

From Louisville, KY: “The contact owns a 2015 Toyota Camry. While attempting to shift the vehicle in reverse, the vehicle independently accelerated and the check engine indicator illuminated on the instrument panel. As a result of the independent acceleration, the contact crashed into her neighbor's car port. The air bags failed to deploy. There were no injuries and a police report was filed. The vehicle was towed to the dealer, but was not repaired. The manufacturer was not made aware of the failure. The failure mileage was 5,400.” (ODI 10839884)

In Plano, Texas, the owner of a 2015 Lexus ES 350 complained: “I was pulling into my garage slowly, braking to stop, when the car accelerated.  I could hear the engine rev and I pressed hard on the brake and put the car in park.  The car traveled about 4 feet before it came to a stop.  I reported to Lexus who turned over to 'legal' and I have been waiting for a week for an investigator to contact me to look at the car, after which they say it will be another 30 days for a finding.   The paperwork I filled out termed this as 'unintended acceleration".  This is the second time this has happened with this car, which I purchased new and have had for a little over a year.” (ODI 10840059)

Amazing. No one can get a Toyota in or out of a parking space without making a big whoopsie! NHTSA is so concerned about this new generation of inept drivers not seen since the advent of electronic throttle controls, that in May it actually issued a consumer advisory entitled Reducing Crashes Caused by Pedal Errors. It makes the dubious claim that each year “approximately 16,000 preventable crashes occur due to pedal error when drivers mistake the accelerator for the brake.” And it contains helpful hints such as: Adjust your seat, mirrors, steering wheel and pedals; aim for the middle of the brake and wear light-weight, flat soled shoes when driving.

The agency, however, is not concerned enough to actually investigate the causes of these preventable crashes; it’s too busy gas-lighting the public. To date, NHTSA has fielded nine defect petitions for Toyota Unintended Acceleration. Nine! This is an astounding number of petitions for a single defect that has no parallel in agency history. But, it’s given the Office of Defects Investigation plenty of time to refine its driver error arguments and smooth out its boilerplate petition denial language.

In the last two years, the agency turned back three requests for defect investigations from Robert Ruginis (Read NHTSA Denies Unintended Acceleration Defect Petition), James Stobie, and Gopal Raghavan, Toyota owners who experienced UA events in parking scenarios. The trio used the contradictions in their Event Data Recorder (EDR) readouts to buttress their arguments that NHTSA ought to pursue a vehicle-related cause. But, its pedal error today, pedal error tomorrow and pedal error forever over at 1200 New Jersey Avenue, SE.

In the past, NHTSA argued that pedal misapplication is the result of a driver accidentally depressing the gas instead of the brake, and, when the vehicle moves forward or backward, the driver compounds this error by pressing the accelerator pedal harder until the inevitable crash. Never mind that that this theory was derived from a “thought experiment,” (Read The Pedal Error Error.) is not supported by any empirical research, and makes no sense in high-speed unintended acceleration incidents when one’s foot is already on the accelerator or in parking scenarios where practiced drivers ease on and off the pedals, because NHTSA made up its mind in 1989.

Access to EDR data made this theory a little trickier to apply. Luckily, NHTSA found a trapdoor in the asynchronous nature of individual datum points to justify their denials. EDR records the pedal voltage at vehicle idle, while the rpms zoom upwards? The driver’s just hitting the pedal in the milliseconds in between data samples. In this way, investigators can read the data any way they want.

The agency took particular pains to sneer at Gopal Raghavan, an electrical engineer with a PhD from Stanford University and more than 20 years’ experience in high-speed circuit design and device modeling. Dr. Raghavan worked as a senior engineer with Intel Corporation, and a principal engineer at Conexant designing integrated circuits. He also holds 10 patents and has published more than 30 technical publications.

He submitted the EDR readouts of two other crashes that shared similarities to his, but NHTSA dismissed the idea that the pattern indicated anything other than pedal misapplication and informed Dr. Fancy-Pants-Ten-Patents that “the common pattern is that the ‘glitches’ occur at the moments in the events when the driver should be initiating braking, but no braking has occurred,” and called this “a signature of pedal misapplication by the driver.”  

Electrical engineer Antony Anderson, who frequently writes about unintended acceleration in automotive electronics, published a critique of NHTSA’s denial in IEEE Access. Case Study: NHTSA’s Denial of Dr Raghavan’s Petition to Investigate Sudden Acceleration in Toyota Vehicles Fitted with Electronic Throttles, notes:

In the hypothetical case of such a panic-induced sudden acceleration the accelerator rate signal would go to its maximum value very shortly after the pedal was fully depressed and would stay there. Such a constant accelerator rate signal is not found in any of the examples cited by Dr Raghavan. In an attempt to explain this failure of the EDR results to fit the pedal error hypothesis, NHTSA has developed a new hypothesis in this DP which appears to require that drivers when coasting in to park, engage in some kind of multiple foot stomping action on the accelerator pedal which isn’t detected by the EDR.

Consider such hypothetical pedal stomping activity, assuming for the moment that is a realistic possibility. Since the EDR data sampling rate is once per second (1 Hz), any stomping would also have to take place at the same frequency and be precisely syncopated with the EDR data sampling over a period of 4 to 5 seconds. To carry out a successful sequence of stomps, the driver would have to synchronise his foot actions with the data sampling of the EDR. NHTSA has so far failed to produce any experimental evidence, peer-reviewed articles, or research reports that demonstrate that panicked drivers either could, or would, ever go into such a precisely timed, synchronized and syncopated pedal stomping routine.

Anderson says he was moved to dismantle NHTSA’s “formulaic approach” out of “a real annoyance” with the agency’s “disdain” of a competent engineer “who came forward with a good case to do some investigation. It was so nasty. It’s not right.”

Toyota Keeps on Settling

The automaker has taken a different, but complementary tack to NHTSA’s denial of electronic defects – it settles death and injury cases. To date, the Intensive Settlement Process (ISP) has resolved 422 cases. The ISP is a two-step process that begins with an initial settlement conference, and if the matter is not resolved, proceeds to a formal mediation. More than half of the cases – 233 – were settled, 196 were dismissed or awaiting dismissal, and the rest are in some stage on the process.

It only took one stinging loss in civil litigation to persuade Toyota that it was much better to negotiate confidential settlements than risk a wave of headlines about spaghetti code. Bookout v. Toyota turned the tide in October 2014, after an Oklahoma jury determined that the automaker acted with “reckless disregard,” and delivered a $3 million verdict to the plaintiffs. The trial emanated from a September 2007 crash. Jean Bookout and her friend and passenger Barbara Schwarz were exiting Interstate Highway 69 in Oklahoma in a 2005 Camry when it experienced a sudden acceleration. Bookout tried to stop her car by pulling the parking brake, leaving lengthy skid marks. Her Camry continued to rocket down the ramp, stopping only after its nose was embedded in an embankment. Schwarz died of her injuries; Bookout spent two months recovering from head and back injuries.

Embedded software expert Michael Barr, who spent nearly 20 months reviewing Toyota’s source code, testified that the software code was poorly written and the safety architecture was “a house of cards. (See Toyota Unintended Acceleration and the Big Bowl of “Spaghetti” Code) Barr explained that many of the vehicle behavior malfunctions could be caused by the death of tasks within the CPU; in particular, the death of a proprietary-name task, called Task X, at trial. Barr dubbed it “the kitchen-sink” task, because it controls a lot of the vehicle’s functions, including throttle control; the cruise control – turning it on, maintaining the speed and turning it off ; and many of the failsafes on the main CPU. Barr testified that Toyota’s watchdog supervisor design – software to detect the death of a task — “is incapable of ever detecting the death of a major task. That's its whole job. It doesn't do it. It's not designed to do it.” Instead, Toyota designed it to monitor CPU overload, and, Barr testified: “it doesn't even do that right. CPU overload is when there's too much work in a burst, a period of time to do all the tasks. If that happens for too long, the car can become dangerous because tasks not getting to use the CPU is like temporarily tasks dying.” Barr also testified that the operating system contained codes that would throw away error information, ignoring codes identifying a problem with a task.

Toyota hastily settled Bookout before the jury could determine punitive damages, and it’s been cutting deals ever since.

None of this helps owners like Grandy, who took his complaints to Toyota, to no avail.

“As soon as it happened, I knew I was screwed.”

NHTSA Denies Toyota Unintended Acceleration Defect Petition

Eight months after a Bristol, RI Toyota Corolla owner petitioned the National Highway Traffic Safety Administration to investigate low-speed surges into Toyota Corollas, the agency has denied the petition, concluding:

In our view, a defects investigation is unlikely to result in a finding that a defect related to motor vehicle safety exists or a NHTSA order for the notification and remedy of a safety-related defect as alleged by the petitioner at the conclusion of the requested investigation. Therefore, given a thorough analysis of the potential for finding a safety related defect in the vehicle and in view of the need to allocate and prioritize NHTSA's limited resources to best accomplish the agency's safety mission and mitigate risk, the petition is respectfully denied.

The Safety Record shares this view. NHTSA’s Office of Defects Investigation (ODI) is unlikely to find a defect. For one, they lack the resources to find an intermittent electronic defect that produced unintended acceleration (UA). Two, ODI does not want to find an electronic defect. After 12 years of investigations – including six petitions filed by consumers (Six! Has any one defect ever prompted that many petitions for investigations? Toyota – another record. Yay, you!), NHTSA has never been able to determine why so many Toyota drivers continue to complain about unintended acceleration. The endless dead-ends and denials have amounted to a deep hole that the agency will never climb out of.

Bob and Kathy Ruginis sought NHTSA’s help after Kathy experienced a UA while parking her 2010 Corolla last June. The vehicle surged forward while her foot was on the brake and crashed into an unoccupied parked Jeep in front of it. The car, which had already been remedied under the floor mat entrapment and sticky accelerator recalls, had been briefly surging – usually at higher speeds, since the couple bought the vehicle new in May 2010. Kathy Ruginis, a Catholic school educator, used the Corolla for commuting to her job in Massachusetts. Early in her ownership, she had taken the vehicle twice to the dealership complaining of these surges. The dealership techs drove her car in a circle around a big box store-parking lot and proclaimed that the surges were just the result of downshifting.

Bob Ruginis was not surprised that NHTSA failed to find an electronic source for the malfunction and advance his petition. For one, after the electronics engineer turned the errant Corolla over to NHTSA for testing and asked for the agency’s test protocol, he never received anything from the agency.

“I knew it most likely wouldn’t help me,” he said. “But I hoped it would help some other people.”

 Neither NHTSA, nor Toyota has ever believed a driver’s report about what occurred in a crash. In general, narratives are given no weight if ODI investigators don’t have a pretty good handle on the technical issue already. In addition to Kathy Ruginis’s report, and the affirmation of her passenger in the front seat, she had another witness – the Event Data Recorder (EDR), which showed at the time of the crash that the brake was on, the accelerator was off, but somehow the speed increased and the engine rpms doubled. A Toyota EDR read-out that actually reflects the driver’s and passenger’s account of the crash pretty well is not so common.  

But, for ODI, the EDR is a Rorschach – it means whatever the engineers want it to mean and it always means driver error. However, the agency really had to work to make this reading count against the driver, and for this they turned to the asynchronous nature of the various data points. ODI argued that just because the readout shows the brake on and the accelerator off and the speed increasing at the same time, does not mean that all of those events occurred at the same time. Nonetheless the logic employed to make this a case of pedal misapplication plus late braking is contradictory and tortured.  


NHTSA argued that her brake was on at the final data-point read out “proves” that she braked after the crash. However, according to NHTSA, the three data-points showing the accelerator off during the last three of five seconds of the EDR readout shows that Kathy Ruginis rapidly punched the accelerator in the milliseconds between recorded data points. The denial states:

ODI does not believe that the brake switch data recorded by the EDR is consistent with the petitioner's statement that the vehicle accelerated with the brake applied and vehicle testing demonstrated that acceleration would not occur if the brake pedal had been applied with any meaningful force. In addition, although the EDR does not show any increase in accelerator pedal voltage in the final 2.8 seconds prior to impact, this does not mean that the accelerator pedal was not depressed during that time period.

Got that? The brake data is gospel, but the accelerator data is suspect. In short, they called Kathy Ruginis a liar. Chris Caruso, an EDR expert who examined Toyota EDRs as a consultant for the multidistrict litigation economic loss case against Toyota  agreed that NHTSA could not logically or credibly use the data’s asynchronicity to conclude that the driver only engaged the brake after the crash, but that she definitely depressed the accelerator sometime before it.

“We could make the same plausible argument that she was pumping the brakes for the entire five seconds, in between the one-second intervals.” Caruso said.

What is harder to explain, says Caruso, is the absence of a corresponding rise in engine RPMs as the speed of the vehicle doubled in the last two seconds. NHTSA did not address the RPM readings, which showed the RPMs remaining constant at 800 until the last data-point, in which they doubled 1,600. Caruso said that it is impossible for the vehicle speed to increase by 50 percent in 2 seconds leading to the trigger point, while the engine rpms remain at idle. And even if the driver punched the accelerator in-between the 1-second intervals of data collection sometime in the last two seconds, the engine rpms would rise and stay elevated afterwards, because they take time to decrease.

NHTSA’s EDR analysis is “deceiving,” he added.

“She would have to floor it to get that 50 percent increase in throttle. Why don’t the rpms go up?” Caruso said. “If you look at the last two seconds, even if she blipped the accelerator to increase the speed from 3.7 to 5 in one second, the engine rpms cannot recover to idle in that same amount of time. To me, it’s a smoking gun that doesn’t jibe with anything else.”

ODI also pooh-poohed the suggestion that Michael Barr’s analysis of Toyota’s faulty software could provide them some clues of how software could faults could cause UA events not recorded by the engine control module. Barr’s theories were unproven, and applied to a different vehicle with a different electronic system, NHTSA said. Never mind that Barr, a well-known embedded software expert, did something ODI did not – examine Toyota software for the Camry line by line for the plaintiffs in Bookout v. Toyota, a UA case involving a 2007 crash that seriously injured the driver and killed her passenger. Never mind that his detailed explanation of Toyota’s horrible software persuaded an Oklahoma jury in October 2013 to rule against Toyota, awarding the plaintiffs $3 million, before assessing punitive damages and persuaded Toyota hence forth to settle somewhere north of 250 death and injury UA cases since. Just, never mind.

Barr says that shortly after the Ruginis petition became public, he “attempted to contact NHSTA’s Office of Defects Investigation, to ensure they were aware of my relevant work and conclusions.  However, no one from ODI ever reached out to me.”

He also defended the relevance of his work to the task of determining why so many Toyotas run away from their drivers:

"Barr Group's analysis of Toyota’s ETCS-i software was more extensive, both in breadth and in depth, than the software analysis by NASA.  We had access to more software source code than NASA did, and also information about many more vehicle models and model years.  My team of software experts spent over a year pushing the review of Toyota’s engines considerably deeper, he said. “Ultimately, we identified a set of defects in Toyota’s ETCS-i software that NASA specifically worried about in its report but didn’t have sufficient time to find.  We used fault injection testing in a pair of production Toyota vehicles to trigger the defects we found and these tests confirmed that software malfunctions can explain at least some of the reported incidents of sudden acceleration.”

"The evidence supporting my conclusions was documented in full detail in my expert report, which contains more than 500 pages of facts and analysis.  It is my understanding that no one from NHTSA or NASA has ever read this report,” he said. “As I testified in the Bookout trial in Oklahoma in October 2013, the defects in Toyota’s ETCS-i software can be deadly.  As far as I know, these defects have never been remedied by any recall."

ODI did throw the Ruginises a bone. It agreed that: “uncontrolled vehicle accelerations in parking lot environments represent a clear safety hazard to surrounding traffic, pedestrians and even building occupants, as vehicles often accelerate inside of businesses with facing parking spaces where they have caused serious and sometimes fatal injuries.”

But, the good folk at ODI concluded that any possible technical cause would remain a mystery. 

Let’s face it: Jesus, Mary or Joseph McClelland could come to the agency and show ODI investigators unintended acceleration as it happened in real time, and ODI would find a way to dismiss it. In May 2012, two ODI engineers witnessed a 2004 Prius, owned by Joseph McClelland, an electrical engineer and high-ranking government official with the Federal Energy Regulatory Commission, accelerate on its own several times while on a test drive with the owner, without interference from the floor mat, without a stuck accelerator pedal or the driver’s foot on any pedal. They videotaped these incidents and downloaded data from the vehicle during at least one incident when the engine raced uncommanded in the owner’s garage and admonished the owner to preserve his vehicle, untouched, for further research. “They said: Did you see that?” McClelland recalled in a sworn statement.  “This vehicle is not safe, and this could be a real safety problem.” Three months later, the agency dumped the investigation. Investigators told McClelland that they weren’t interested because it was an end-of-life issue for the battery and told The New York Times that it wasn’t a safety issue: [NHTSA] also noted that the vehicle “could easily be controlled by the brakes” and “displayed ample warning lights” indicating engine trouble.”

For all intents and purposes, the Ruginis’s Corolla has been parked ever since the crash. Kathleen Ruginis refused to drive the vehicle ever again. Bob Ruginis took it out a few times to be inspected in preparation for selling the Corolla.

“I’ve taken it to a couple of car dealers, and told them about the incident and that this car was investigation and none of them cared. They would all take it from me, and they all gave me pretty much what the car is worth.”

To the Ruginis family, that 2010 Corolla was worthless as a mode of transportation. To NHTSA, the vehicle could have been the start point for an honest examination of electronic malfunction. But NHTSA’s always much more focused on the task of proving everyone and anyone other than themselves wrong. In that way, they are much like Toyota electronics – infallible.

But one day, NHTSA will understand today’s automotive electronics – probably around the time that cars move from self-driving to flying.

Unfortunate Chapter Continues: Toyota Bounced for $11 Million in UA Case

Toyota’s runaway success in blaming drivers for its defective vehicles, hit an $11 million pothole yesterday, after a Minnesota federal jury found that the automaker was 60 percent responsible for an Unintended Acceleration (UA) crash that killed three and severely injured two.

Attorney Robert C. Hilliard, who represented plaintiffs Koua Fong Lee, the driver, and the family in the vehicle that was struck, says it’s the first jury verdict against Toyota in a UA case involving a mechanical defect. The automaker made no offer to settle the case prior to the January trial.

On June 10, 2006, Lee was exiting a Minnesota Highway 94 in a 1996 Camry when his accelerator became stuck in the wide open position. Lee was driving his pregnant wife and children home from services when, at 75 miles per hour, he plowed into the rear of an Oldsmobile Ciera that was stopped at an intersection. Fong alleged that he pushed on the brakes, but they failed to stop the Camry. Driver Javis Trice-Adams Sr., and his 9-year-old son were killed, his father, Quincy Adams and Trice-Adams’ daughter Jassmine Adams were injured. Trice-Adams’ niece Devyn Bolton, 6, was paralyzed and died in October 2007. 

Lee was convicted of vehicular manslaughter in 2008, and served two-and-a-half years of an eight-year sentence. Then, in 2009, the Toyota Unintended Acceleration crisis began to build doubts about the certainty of driver error in the crash. In August 2010, Ramsey County Judge Joanne Smith ordered a new trial. The prosecutor dropped the charges and declined to retry the case. Lee was released from prison.

Hilliard argued that Lee and the Adams family were victims of a design defect in which the plastic pulleys in the cruise control assembly overheat and bind the accelerator cable in the open position. Each time the accelerator was tapped, the throttle would open wider. Lee testified that he tried to bring the car to a stop, but the brakes could not overcome the open throttle. In previous testing the National Highway Traffic Safety Administration showed that vacuum brakes lose their effectiveness if pumped continually. Toyota argued that Lee mistakenly floored the accelerator for six seconds before the crash.

Hilliard attacked that notion in his closing arguments, with an exemplar pedal and a timer.

“Their theory was that Koua Fong Lee, without any panic situation, for some unexplained reason, after driving normally for 30 minutes, suddenly floored it for six full seconds as he is approaching a stop light with a bunch of cars in front of him,” Hilliard said. “I told the jury, for you to believe this, you have to believe that at the top of that hill — I floored it and pushed timer. Six seconds seems like an eternity.”

Toyota had attempted to counter Hilliard’s defect theory with the testimony of a Toyota engineer in Japan who claimed that the company’s “robust protocols” included days-long heat testing at 280 degrees. Then shortly before trial, Toyota filed a declaration from that engineer stating that the company actually did no such testing.

“It was the most amazing declaration I’ve ever seen,” Hilliard recalled, “where he was so proud of that test that it turns out they never did.”

Hilliard also bolstered his case with testimony from other who experienced a UA event, such as a doctor and a Black Hawk military helicopter pilot, who was flown in from Kuwait to testify.

The $10.94 million verdict was divided among the crash victims. Lee’s award was reduced by 40 percent for contributory negligence, but Hilliard says that he will file a post-verdict motion to challenge it — if Toyota’s defective design was the direct cause of the crash, then Lee should receive his full share. 

Meanwhile, Toyota has settled more than 250 injury and death claims under its Intensive Settlement Program in the multi-district litigation involving UA in Toyota vehicles equipped with electronic throttle controls, says West Virginia attorney Hike Heiskell, who represents several plaintiffs with UA claims. 

“They have settled a very high percentage of pending cases. One of the interesting things is how many new incidents are being reported after Toyota entered into the deferred prosecution agreement,” he says of Toyota’s March agreement to plead guilty to one charge of wire fraud and pay a $1.2 billion fine.  

While he sees no applicability of the Lee verdict to cases involving electronic throttles,“still — it’s a system that took control of throttle and produced tragic consequences,” Heiskell says. “It pierces the Toyota defense that this doesn’t happen in the real world. Bookout was a great breakthrough, and this case is a great breakthrough, in letting the public see that it does happen in the real world.”

Toyota’s Billion Dollar Web

Normal 0 false false false EN-US X-NONE X-NONE

Back in 2010, after Toyota announced that a federal grand jury in New York had subpoenaed the company on June 29 for documents regarding relay rod failures in Toyota truck models, we asked if the automaker would be the first to be prosecuted under the Transportation Recall Enhanced Accountability and Documentation Act (TREAD).

Well, right question, wrong defect.

Under the settlement with the Department of Justice announced today, Toyota is banged for $1.2 billion, and prosecution for committing one count of wire fraud is deferred for three years, for the lies it told about the floor mat entrapment and sticky pedal recalls. According to Toyota’s Statement of Facts, the automaker sought to limit its floor mat recalls, even though the entrapment hazard affected other models, and resisted the sticky pedal recall, even though Toyota had addressed the problem in Europe.

“This sends a mixed message,” says Sean Kane, president of Safety Research & Strategies. “On the one hand, a $1.2 billion fine is a very significant hit. But the government’s focus is only on the narrow areas of the floor mats and sticky pedals. The bulk of Toyota vehicles experiencing Unintended Acceleration problems were never recalled.  That billion dollars doesn’t do a thing for Toyota owners stuck with defective vehicles.”

The skeleton of this particular set of lies have been in the public domain for several years. In April 2010, when former Secretary of Transportation Ray LaHood announced that the agency had imposed a $16.4 million fine on Toyota for failing to recall 2.3 million vehicles with defective accelerator pedals – then the largest civil penalty NHTSA had levied against an automaker – the Secretary failed to make public the documents laying out his rationale. In May 2011, NHTSA quietly posted the sternly worded demand letter that explained why Toyota got slapped.

To remind our readers, Toyota recalled the CTS supplied pedal in Europe in September 2009, but waited until January 2010 to recall the pedals in the U.S. However, on October 7, 2009, “a staff member of the Toyota Motor Corporation Product Planning and Management Division sent a copy of an Engineering Design Instruction describing the pedal remedy that was already implemented in Europe to someone at Toyota Motor Engineering and Manufacturing North America, Inc. for the accelerator pedal of a RAV 4 manufactured in Canada. Two weeks later “a member of the TMC PPM inexplicably instructed a member of the TEMA PPM not to implement this Engineering Change Instruction. Furthermore, in November 2009, Toyota provided NHTSA with FTRs regarding sticking accelerator pedals on vehicles in the United States but not with information regarding Toyota’s extensive testing and determinations regarding the cause of the sticking accelerator pedals or an explanation of the significance of the FTRs, the demand letter said. Continue reading

The Toyota Owners Left Holding the Bag

Normal 0 false false false EN-US X-NONE X-NONE

John Biello was not ready for the cruise control malfunction that sent his 2009 Tacoma careening down an exit ramp, then skidding into a rollover last June. But Tuesday, when he and his wife Diane appeared before the Commonwealth of Massachusetts Division of Insurance Board of Appeals to fight an automatic rate increase mandated by state law, Biello was fully prepared to educate the hearing officer about Unintended Acceleration problems in Toyotas.

As the great tide of cash washes from Toyota into the pockets of the U.S. government, attorneys, research institutions and some death and injury victims to settle fines and claims without an admission that the automaker’s electronic throttle control system is defective, owners like John and Diane Biello represent those left to deal with Toyota’s mistakes on their own. The Rehoboth, Massachusetts couple had no counsel, just a compelling account and a binder of public documents showing that Toyota Unintended Acceleration problems continue today and that juries and technical experts recognize what the National Highway Traffic Safety Administration has not: Toyota’s badly designed electronic architecture can cause UA.

“I knew that there had been this unintended acceleration problem. I had read about it a couple of years ago,” John Biello says. “But I thought it pretty much done. I thought the problem was fixed and I didn’t really think my vehicle was involved because I got no Unintended Acceleration recall notices.” Continue reading

Toyota Lawsuits Wrapped?

Normal 0 false false false EN-US X-NONE X-NONE

Toyota is looking to close out its unintended acceleration crisis, with a speedy resolution to the remaining lawsuits out there. According to news reports, the automaker has been inspired by the Bookout verdict to settle a whole passel of UA lawsuits. Last month, for example, Toyota came to terms with Opal Gay Vance, a West Virginia woman who injured her neck and back, when her 2010 Camry suddenly accelerated, striking a trailer. The confidential settlement forestalled a trial set to begin on Jan. 21. In California, orders from judges in the U.S. District Court in Santa Ana and Los Angeles Superior Court opened the door to settlements in nearly 300 death and injury plaintiffs’ cases.

“We’re glad to see that Toyota has decided to approach this in a systematic and forthright way, and we look forward to seeing most of the pending claims settled in early 2014,” says attorney Donald Slavik of Robinson, Calcagnie, Robinson, Shapiro, Davis Inc. of Newport Beach, CA.

The race to empty the court dockets should not be confused with a conclusion to Toyota’s UA technical problems, which continue unabated. SRS took a stroll through the Vehicle Owners Questionnaire database, looking for 2013 UA complaints and found more than 300. They cover all of the classic scenarios, like this one:

“I backed my 2006 Toyota Corolla into a friend’s driveway, and then put the car into drive to straighten it a bit. The car suddenly without warning shot across the street (perhaps at 45-50 mph), went over a 6″ high cement retaining curbing, and across a lawn into another driveway. All the while I had my foot firmly on the brake (not the gas pedal). I swerved the wheel to avoid hitting a telephone pole, and the house. I finally got the car into neutral, and at last the brakes engaged, and I was able to stop the car avoiding a pick-up truck in the driveway and a tree. During this entire time the engine was loudly revving. Other than 3 shredded tires and 2 ruined rims, the car seems to be intact. I have contacted Toyota and hope for a successful resolution. The service manager at the dealership where this vehicle was purchased, however, said that since it is not under recall there is nothing they can do. Meanwhile I will be fearful every time I get behind the wheel, which I have yet to do!    3 new tires and 2 new rims is a small price to pay – it could have been my life! Had cars been passing by on this normally busy street, or children walking on the sidewalk on their way home from school – other lives as well could have been taken. This was a terrifying event! Judging from all of the similar stories written regarding this make, model and year, Toyota needs to do a recall to solve this problem once and for all.” (ODI 10496026) Continue reading

Toyota Unintended Acceleration and the Big Bowl of “Spaghetti” Code

Last month, Toyota hastily settled an Unintended Acceleration lawsuit – hours after an Oklahoma jury determined that the automaker acted with “reckless disregard,” and delivered a $3 million verdict to the plaintiffs – but before the jury could determine punitive damages.

What did the jury hear that constituted such a gross neglect of Toyota’s due care obligations? The testimony of two plaintiff’s experts in software design and the design process gives some eye-popping clues. After reviewing Toyota’s software engineering process and the source code for the 2005 Toyota Camry, both concluded that the system was defective and dangerous, riddled with bugs and gaps in its failsafes that led to the root cause of the crash. Continue reading

Toyota Electronics = Guilty In Bookout

Toyota this morning quickly settled an Unintended Acceleration case, before it could move into the punitive damages phase – hours after an Oklahoma jury has returned a $3 million verdict against the automaker in a 2007 crash that seriously injured the driver and killed her passenger.

In September 2007, Jean Bookout and her friend and passenger Barbara Schwarz were exiting Interstate Highway 69 in Oklahoma in a 2005 Camry. As she sped down the ramp, Bookout realized that she could not stop her car. She pulled the parking brake, leaving a 100-foot skid mark from right rear tire, and a 50-foot skid mark from the left. The Camry, however, continued speeding down the ramp, across the road at the bottom, and finally came to rest with its nose in an embankment. Schwarz died of her injuries; Bookout spent two months recovering from head and back injuries.

 The jury yesterday awarded $1.5 million in damages to Bookout and another $1.5 million to the Schwarz family and determined that Toyota acted with “reckless disregard.”

This was the first trial in which the plaintiffs, represented by Graham Esdale and Cole Portis of Beasley Allen in Montgomery, Alabama, made Toyota electronic malfunctions the centerpiece of an Unintended Acceleration case. And what may be significant going forward is not the verdict – although Oklahoma juries are not known for being overly sympathetic to plaintiff – but what is entered into the public record about what Toyota knows about the failures of its Electronic Throttle Control System– Intelligent (ETCS-i) and when they knew it. And what facts will fly from the nest of civil jurisprudence and into the public consciousness. Continue reading