Incident: Toyota Cruise-Control Software Glitch in Pre-Production Testing.

Published Date: 2012-03-01

Postmortem Analysis
Timeline 1. The software failure incident involving the electronic software problem causing "sudden unintended acceleration" in a Toyota test vehicle occurred in 2006 as reported in Article 10012.
System 1. Adaptive cruise-control software system in the model internally designated the 250L, later sold as the Lexus 460 in Japan and Europe [Article 10012] 2. Accelerator pedal position sensor in the cruise control system [Article 10012]
Responsible Organization 1. Toyota engineers identified an electronic software problem that caused "sudden unintended acceleration" during pre-production trials [Article 10012].
Impacted Organization 1. Toyota engineers found an electronic software problem that caused "sudden unintended acceleration" during pre-production trials [Article 10012]. 2. The National Highway Transportation Safety Administration (NHTSA) and Congress were involved in investigating the sudden unintended acceleration issues in Toyota vehicles [Article 10012].
Software Causes 1. The software problem identified in the Toyota engineering document was related to the adaptive cruise-control system test in the model 250L, later sold as the Lexus 460, which could cause the cruise control to activate by itself at full throttle when the accelerator pedal position sensor is abnormal [10012].
Non-software Causes 1. Bad floor mats 2. Sticky accelerator pedals 3. Driver error 4. Inappropriate sensor signal during a test of the electronic failsafe system 5. Unacceptable electronic sensor sensitivity threshold during the test 6. Failure mode identified in an earlier-model Lexus 7. Electronic problem causing unintended acceleration in an earlier-model Lexus 8. Electronic sensor malfunction causing the vehicle to accelerate on its own during a test of the 250L [10012]
Impacts 1. The software failure incident in Toyota's adaptive cruise-control system led to concerns of "sudden unintended acceleration" in a test vehicle during pre-production trials, potentially risking safety issues for drivers [Article 10012]. 2. The incident raised questions about the reliability of Toyota's electronic systems and software, casting doubt on the company's claims that electronics were not responsible for sudden acceleration in their vehicles [Article 10012]. 3. The software glitch identified in the adaptive cruise-control system required a "fail-safe overhaul" for another model in production, indicating the need for significant adjustments to prevent similar issues in future vehicles [Article 10012]. 4. The incident highlighted discrepancies between Toyota's denial of electronic or software problems causing sudden acceleration and expert opinions suggesting a tangible and fixable software issue in the test vehicle [Article 10012].
Preventions 1. Proper testing and validation procedures during pre-production trials to identify and address software glitches early on [Article 10012]. 2. Thorough sharing of engineering documents and findings with relevant authorities and stakeholders, such as the NHTSA, NASA, and Congress, to ensure comprehensive investigation and resolution of potential software issues [Article 10012]. 3. Implementation of robust fail-safe mechanisms in software systems to prevent unintended acceleration or other malfunctions caused by abnormal sensor signals [Article 10012].
Fixes 1. A fail-safe overhaul as mentioned in the Toyota engineering document could fix the software failure incident [Article 10012].
References 1. Toyota engineering document obtained and translated for CNN 2. Interviews with Toyota engineers and officials 3. Analysis by Michael Pecht, director of the CALCE Electronics Products and Systems Center at the University of Maryland 4. Analysis by Neil Hanneman, an independent automobile safety engineer 5. Analysis by Clarence Ditlow, executive director of the Center for Auto Safety

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident related to sudden unintended acceleration due to an electronic software problem was found in a test vehicle during pre-production trials at Toyota. The incident was documented in a 2006 engineering document obtained and translated by CNN. The document described a cruise-control software test in a model internally designated the 250L, later sold as the Lexus 460 in Japan and Europe. The issue led to a "fail-safe overhaul" needed for another model in production, internally designated the 180L, later sold as the Toyota Tundra [Article 10012]. (b) The software failure incident related to sudden unintended acceleration due to an electronic software problem at Toyota was not isolated to the company. The incident raised concerns about the adaptive cruise control system causing the car to move forward on its own. While Toyota denied that electronics were responsible for sudden acceleration, experts and analysts who reviewed the translated document concluded that there was indeed an electronic issue identified in the vehicle. The incident was seen as a tangible, repeatable, and fixable issue related to software problems [Article 10012].
Phase (Design/Operation) design The software failure incident related to the development phases can be summarized as follows: (a) Design: The incident involved a software problem discovered during pre-production trials of a Toyota vehicle, specifically related to the adaptive cruise-control software test. Engineers found that the cruise control system would activate by itself at full throttle when the accelerator pedal position sensor was abnormal, indicating a design flaw in the software [10012]. (b) Operation: The incident did not involve failure due to operation or misuse of the system but rather highlighted a potential software issue during the testing phase of the vehicle's development [10012].
Boundary (Internal/External) within_system (a) The software failure incident described in the article is within the system. The failure was related to an electronic software problem found during pre-production trials of a Toyota vehicle, specifically in the adaptive cruise-control software test. Engineers identified that the cruise control system could activate by itself at full throttle when the accelerator pedal position sensor was abnormal, indicating an issue originating from within the system's software [10012]. (b) The article does not provide information indicating that the software failure incident was due to contributing factors originating from outside the system.
Nature (Human/Non-human) non-human_actions (a) The software failure incident occurring due to non-human actions: The translated Toyota engineering document revealed that there was an electronic software problem causing "sudden unintended acceleration" during a test of the adaptive cruise-control system in a pre-production vehicle [Article 10012]. The document described how the cruise control system would activate by itself at full throttle when the accelerator pedal position sensor was abnormal, indicating a software glitch as a contributing factor to the acceleration issue. This incident points to a failure introduced by non-human actions, specifically related to the software programming of the cruise control system. (b) The software failure incident occurring due to human actions: The same incident mentioned in the article does not directly point to any contributing factors introduced by human actions. The focus of the incident was on the software glitch identified during the test of the adaptive cruise-control system, indicating a failure primarily related to non-human actions [Article 10012].
Dimension (Hardware/Software) hardware, software (a) The articles discuss a software failure incident related to hardware. The translated Toyota engineering document revealed that there was an electronic software problem that caused "sudden unintended acceleration" during a test of the adaptive cruise-control system in a pre-production vehicle [10012]. The document described how the cruise control would activate by itself at full throttle when the accelerator pedal position sensor was abnormal, indicating a hardware-related issue. Toyota engineers identified an electronics issue that caused unintended acceleration in an earlier model and took steps to prevent the same problem in a subsequent model, highlighting hardware-related contributing factors to the software failure incident.
Objective (Malicious/Non-malicious) non-malicious (a) The articles do not provide any information indicating that the software failure incident was malicious in nature, i.e., caused by contributing factors introduced by humans with the intent to harm the system. (b) The software failure incident described in the articles is non-malicious in nature. It was related to an electronic software problem that caused "sudden unintended acceleration" in a test vehicle during pre-production trials. The failure was attributed to an adaptive cruise-control software test in a model internally designated the 250L, later sold as the Lexus 460 in Japan and Europe. The document highlighted concerns that the adaptive cruise control system would start the car moving forward on its own due to a software glitch [10012].
Intent (Poor/Accidental Decisions) accidental_decisions [10012] The software failure incident described in the article relates to the accidental_decisions category. The incident involved a test conducted by Toyota engineers on the adaptive cruise-control software in a pre-production vehicle, which led to concerns about the system starting the car moving forward on its own due to an abnormal signal from the accelerator pedal position sensor. The engineers identified an electronics issue that caused unintended acceleration in an earlier model and took steps to prevent a similar problem in another model by conducting tests to refine the cruise control system. Toyota officials stated that the test was intentionally designed to produce an inappropriate sensor signal to test the electronic failsafe system, indicating that the incident was not due to poor decisions but rather accidental decisions made during testing and development.
Capability (Incompetence/Accidental) development_incompetence (a) The software failure incident related to development incompetence: The translated Toyota engineering document revealed that there was an electronic software problem causing "sudden unintended acceleration" in a test vehicle during pre-production trials. The document highlighted concerns about the adaptive cruise-control software test in a model designated the 250L, later sold as the Lexus 460 in Japan and Europe. Engineers identified that the cruise control would activate by itself at full throttle when the accelerator pedal position sensor was abnormal, indicating a software issue [Article 10012]. (b) The software failure incident related to accidental factors: The incident described in the translated Toyota engineering document was not attributed to accidental factors but rather to an electronic software problem identified during pre-production testing. The document detailed concerns about the adaptive cruise-control software test and the activation of the cruise control system without driver input due to an abnormal sensor signal, indicating a systematic issue rather than an accidental one [Article 10012].
Duration temporary The software failure incident described in the article is more aligned with a temporary failure rather than a permanent one. The incident involved a test conducted on a Toyota vehicle where the cruise control system activated by itself at full throttle when an abnormal signal was inputted during the test. Toyota engineers identified this issue during pre-production trials and made adjustments to refine the cruise control system before it went into production. The company stated that the issue did not physically move the vehicle forward and that it was fixed before the vehicle was sold to customers [Article 10012].
Behaviour value, other (a) crash: The articles do not mention any software failure incident related to a crash where the system loses state and does not perform any of its intended functions. (b) omission: The software failure incident described in the articles does not involve the system omitting to perform its intended functions at an instance(s). (c) timing: The software failure incident does not involve the system performing its intended functions correctly, but too late or too early. (d) value: The software failure incident is related to the system performing its intended functions incorrectly. The translated Toyota report described an electronic software problem that caused "sudden unintended acceleration" during a test vehicle trial, indicating a failure in the cruise control system [10012]. (e) byzantine: The software failure incident does not exhibit the system behaving erroneously with inconsistent responses and interactions. (f) other: The behavior of the software failure incident is related to the system starting the car moving forward on its own due to an abnormal signal from the accelerator pedal position sensor, leading to concerns about the adaptive cruise control system [10012].

IoT System Layer

Layer Option Rationale
Perception sensor, processing_unit, embedded_software (a) sensor: The software failure incident related to the sensor layer of the cyber physical system that failed was due to an abnormal signal from the accelerator pedal position sensor causing the cruise control to activate at full throttle [10012]. (b) actuator: The articles did not specifically mention a failure related to the actuator layer of the cyber physical system. (c) processing_unit: The failure was related to the processing unit of the cyber physical system, specifically the adaptive cruise-control software test that led to concerns about the system starting the car moving forward on its own [10012]. (d) network_communication: The articles did not mention a failure related to the network communication layer of the cyber physical system. (e) embedded_software: The failure was directly related to embedded software, as the software glitch in the adaptive cruise control system was identified as a potential cause of sudden unintended acceleration in the test vehicle [10012].
Communication unknown The software failure incident reported in the articles does not specifically mention whether the failure was related to the communication layer of the cyber physical system that failed at the link_level or connectivity_level. The focus of the incident was on an electronic software problem causing "sudden unintended acceleration" in a test vehicle during pre-production trials, specifically related to the adaptive cruise-control system test in a Toyota model [10012]. The articles primarily discuss the concerns raised by engineers regarding the software glitch in the cruise control system and the subsequent testing and adjustments made by Toyota to address the issue.
Application FALSE The software failure incident reported in the articles related to Toyota's electronic software problem causing "sudden unintended acceleration" was not explicitly attributed to the application layer of the cyber physical system. The failure was described as an electronics issue involving the adaptive cruise-control software test in the vehicles, specifically related to the cruise control system activating by itself under certain conditions due to abnormal sensor signals. The failure was more focused on the electronics and software aspects rather than being explicitly categorized as an application layer issue [Article 10012].

Other Details

Category Option Rationale
Consequence death, harm (a) death: People lost their lives due to the software failure - The article mentions that there were reports of sudden unintended accelerations in Toyota vehicles in 2010, some of which caused severe accidents and several fatalities [Article 10012].
Domain transportation <Article 10012> The software failure incident discussed in the article is related to the transportation industry. Specifically, the incident involved an electronic software problem in a test vehicle during pre-production trials for a model that was later sold as the Lexus 460 in Japan and Europe, and as the Toyota Tundra in the United States. The issue was related to the adaptive cruise-control software test in the vehicle, which led to concerns about sudden unintended acceleration [10012].

Sources

Back to List