Incident: Incorrect ECU Software Leads to Lack of Reverse Speed Limiter.

Published Date: 2018-07-30

Postmortem Analysis
Timeline 1. The software failure incident involving the lack of a reverse speed limiter in the 2017 Mercedes-AMG G65 SUV occurred between September 6, 2016, and October 10, 2016 [73967]. 2. The incident happened in September-October 2016.
System 1. ECU software used in the 2017 Mercedes-AMG G65 vehicles built between Sept. 6, 2016, and Oct. 10, 2016 [73967].
Responsible Organization 1. Mercedes-Benz was responsible for causing the software failure incident by attributing it to a documentation error in the development process, leading to the incorrect ECU software being used, which resulted in the lack of a reverse speed limiter [73967].
Impacted Organization 1. Customers who own the affected 2017 Mercedes-AMG G65 vehicles were impacted by the software failure incident as they faced the risk of the vehicle rolling over due to the lack of a proper speed limiter in reverse [73967].
Software Causes 1. Incorrect ECU software may have been used due to a documentation error in the development process, leading to the lack of a reverse speed limiter in the affected vehicles [73967].
Non-software Causes 1. Incorrect documentation in the development process [73967]
Impacts 1. The software failure incident led to a safety risk for the affected vehicles, as accelerating above 16 mph in reverse without the proper speed limiter could result in a chance of rolling over, significantly increasing the risk of injury [73967].
Preventions 1. Proper documentation and verification processes during the software development phase could have prevented the software failure incident [73967]. 2. Implementing thorough testing procedures, including testing for all possible scenarios such as driving in reverse at different speeds, could have caught the lack of a reverse speed limiter before the vehicles were released to the market [73967].
Fixes 1. Adding the correct software to the affected vehicles' computer at the dealership [73967].
References 1. Mercedes-Benz recall notice [73967]

Software Taxonomy of Faults

Category Option Rationale
Recurring unknown (a) The software failure incident related to the lack of a proper speed limiter in reverse for the 2017 Mercedes-AMG G65 SUV was attributed to a documentation error in the development process by Mercedes engineers. This led to incorrect ECU software being used, resulting in the issue. A fix was implemented for vehicles built after the affected dates to address the software failure incident [73967]. (b) There is no specific mention in the provided article about a similar incident happening again at other organizations or with their products and services.
Phase (Design/Operation) design (a) The software failure incident in the Mercedes-AMG G65 SUV was attributed to a documentation error in the development process. Mercedes-Benz mentioned that incorrect ECU software may have been used during the development, leading to the lack of a reverse speed limiter in the affected vehicles [73967]. This indicates a failure related to the design phase of the software development process.
Boundary (Internal/External) within_system The software failure incident described in Article #73967 is related to a boundary that falls under the category of within_system. The issue with the Mercedes-AMG G65 SUV's reverse speed limiter was attributed to a documentation error in the development process, specifically mentioning incorrect ECU software being used, which led to the lack of a reverse speed limiter [73967]. This indicates that the contributing factors leading to the software failure originated from within the system itself.
Nature (Human/Non-human) non-human_actions (a) The software failure incident in the Mercedes-AMG G65 SUV recall was attributed to a documentation error in the development process, specifically related to incorrect ECU software being used, which led to the lack of a reverse speed limiter. This non-human action resulted in the vehicles not having the proper speed limiter in reverse, potentially causing safety risks when accelerating above 16 mph in reverse [73967]. (b) The article does not provide specific information about human actions contributing to the software failure incident.
Dimension (Hardware/Software) hardware, software (a) The software failure incident in the Mercedes-AMG G65 SUV recall was attributed to a hardware-related issue. The problem with the reverse speed limiter not functioning correctly was traced back to "a documentation error in the development process" which led to incorrect ECU software being used, resulting in the lack of a reverse speed limiter [73967]. This indicates that the root cause of the failure originated in the hardware aspect of the vehicle's electronic control unit (ECU) software.
Objective (Malicious/Non-malicious) non-malicious (a) The software failure incident described in Article 73967 is categorized as non-malicious. The issue with the Mercedes-AMG G65 SUV's reverse speed limiter was attributed to a documentation error in the development process, specifically mentioning incorrect ECU software being used due to the error. This indicates that the failure was not due to malicious intent but rather a mistake in the software development process [73967].
Intent (Poor/Accidental Decisions) accidental_decisions The software failure incident related to the Mercedes-AMG G65 SUV's lack of a proper speed limiter in reverse was attributed to a documentation error in the development process. This error led to incorrect ECU software being used, resulting in the absence of a reverse speed limiter. This indicates that the failure was due to accidental decisions or mistakes made during the development process rather than poor decisions [73967].
Capability (Incompetence/Accidental) development_incompetence (a) The software failure incident in the article is related to development incompetence. Mercedes blames the problem on "a documentation error in the development process." Incorrect ECU software may have been used, leading to the lack of a reverse speed limiter. This indicates that the failure was due to a lack of professional competence in the development process [73967].
Duration temporary The software failure incident described in Article 73967 is temporary. The issue with the lack of a proper speed limiter in reverse for the affected Mercedes-AMG G65 vehicles was attributed to a documentation error in the development process that led to incorrect ECU software being used. This specific issue only affected vehicles with build dates between Sept. 6, 2016, and Oct. 10, 2016. A fix was issued for vehicles built after those dates, indicating that the software failure was not permanent but rather temporary and limited to a specific set of circumstances [73967].
Behaviour omission, value, other (a) crash: The software failure incident in the article does not involve a crash where the system loses state and stops performing its intended functions. (b) omission: The software failure incident in the article is related to omission. The affected vehicles did not have the proper speed limiter in reverse due to a documentation error in the development process, leading to the omission of this critical function [73967]. (c) timing: The software failure incident in the article is not related to timing issues where the system performs its intended functions but at the wrong time. (d) value: The software failure incident in the article is related to a value issue. The incorrect ECU software used in the affected vehicles led to the lack of a reverse speed limiter, causing the system to perform its intended function (speed limiting) incorrectly [73967]. (e) byzantine: The software failure incident in the article is not related to a byzantine behavior where the system behaves erroneously with inconsistent responses and interactions. (f) other: The other behavior exhibited in this software failure incident is a flaw in the system's design and implementation process, specifically a documentation error in the development process that resulted in the omission of a critical safety feature [73967].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence harm, theoretical_consequence The consequence of the software failure incident described in the article is the potential harm to individuals. Due to the lack of a proper speed limiter in reverse caused by incorrect ECU software, affected vehicles could roll over if they accelerate above 16 mph in reverse and make an abrupt steering input. This drastically increases the risk of injury to the occupants of the vehicle [73967].
Domain transportation (a) The software failure incident reported in Article 73967 is related to the automotive industry, specifically involving the Mercedes-AMG G65 SUV. The issue stemmed from a documentation error in the development process that led to incorrect ECU software being used, resulting in the lack of a reverse speed limiter in some vehicles [73967].

Sources

Back to List