Appears I’ll be eating my word re: WoT and Cruise Control. The systems I’ve seen limit opening to only about 85/90% throttle, but apparently the Camry software allows Cruise Control settings up to 125 mph. Of course, the cruise control is designed not to engage unless you are not more than 10 mph below the set speed, and NASA found no path in the software which would allow that setting to be defeated.

http://www.nhtsa.gov/staticfiles/nvs/pdf/NASA-UA_report.pdf

I don’t recall any specific issues with cruise control on the flats, driving at speeds consistent with traffic flow.

OTOH, it is very predictable that it will open full throttle, unnecessarily on uphills of a certain grade, causing the engine to rev to something like 5K RPM before I cut it off after a few seconds.

This happens for example on the northbound grade of the Grapevine on I-5 near Castaic, and on the westbound grade of SR-152 by San Luis Reservoir (a bit west of I-5), and the southbound grade of the Grapevine as you leave the Central Valley.

Without cruise control, the engine can easily handle the grades in Drive or in 4th gear at standard rpm ranges. So it is not clear to me why the software misfires consistently on predictable and common conditions.

Not wanting to risk the engine on these long grades, I am not willing to test how far the acceleration in rpm would go, but it happens very quickly and without warning, and it does not slow down and stabilize before I cut it off by turning off cruise control

No telling what the car would do if that kind of engine acceleration would happen on level ground or downhill.

I will note that without cruise control, I can not make the engine rev anything like that using the accelerator unless I am in a very very low gear or neutral, and even then I am not sure.

As a 30+ year veteran of precision complex software and hardware (you are welcome for some of those satellites you never heard of because they never crashed), without the source code to all relevant systems and the designs of all relevant chips and sensors and their system layouts, I think there well may be intermittent bugs in the system. These are the hardest kind to identify, but that doesn’t mean they are not there.

Again, you assume some unknown “something” simultaneously causes faults in all those subsystems, while not triggering any of the self checks on voltages and voltage differentials (Hall Effect Sensors are used in most pedal assemblies, with not one, but two circuits used for inputs. Both circuits are monitored for voltage, as is the difference between the two.) EMP – whether from lightning (my experiences with lightning damaged cars differ significantly from your suppositions), ground based military radar sweeps at close range, cosmic rays, or magic – are all transient events. When they affect a vehicle at all, they don’t cause it to race uncontrollably for even a second, much less a minute+, and they typically show symptoms in the vehicle’s most sensitive electronics, particularly in the supplemental inflatable restraint (air bags) system.

Anecdotes are not data – particularly when the anecdotes are offered by those whose recollections are colored by emotion and self interest.

To amplify on that comment, a serious mistake, in my view, of the NHTSA failure postmortem was moving the evidence (control system) from a crashed vehicle, rather than first examining it in place thoroughly. By disconnecting the subsystem and reassembling it later, important clues (such as an intermittent connections) could easily be lost.

Regarding Carlitguy’s comments about multiple subsystems, they are only effective if a proper overall systems design has been done and validated. If I had been part of the review board, I would have asked to see the WCA (worst case analysis) of the subsystem, and also the safety analysis; e.g. a fault tree analysis (FTA). A good FTA, for example, might find that although there are four subsystems, they are all operating on the same supply voltage, and a glitch on that voltage might lock up or in some other manner defeat the normal safety functioning of the subsystems. Also, a sneak path analysis would be requested, to see if possible but rare events (e.g. EMP from nearby lightning) might be able to likewise create a malfunction. I have not seen any of this sort of data made available by Toyota or the NHTSA, so I remain skeptical that the floor mat, or confused operators, were the only causes, particularly in light of the credible reports by drivers who claim that disabling the cruise control restored normal behavior.

In addition here are some relevant excerpts from “Toyota’s runaway-car worries may not stop at floor mats,” by Ralph Vartabedian and Ken Bensinger, 18 Oct 2009 L.A. Times:

“Toyota has blamed the incidents — apart from those caused by driver error — on its floor mats, asserting that if they are improperly installed they can jam open the accelerator pedal. A month after the Saylor crash, Toyota issued its biggest recall in company history, affecting 3.8 million vehicles in model years as far back as 2004. But auto safety experts believe there may be a bigger problem with Toyota vehicles than simply the floor mats.”

“…One remedy being considered by Toyota implicitly acknowledges what critics have been saying for almost 10 years: that the company’s highly computerized engine control system lacks a fail-safe mechanism that can quickly extinguish sudden acceleration events, whether they are caused by floor mats, driver errors or even unknown defects in the electronic control system, as alleged in some lawsuits.”

I have commented on this a few times in my Engineering Thinking blog; e.g. http://engineeringthinking.wordpress.com/2011/02/09/toyota-unintended-acceleration-no-electronics-based-cause-not-true-misleading/

I missed the facts you mention in any of the coverage I saw. Could you point us to something documenting this hazard?

But if you want to believe that a half dozen different systems spontaneously developed faults, leading to sometimes horrific events, then as suddenly and spontaneously cured themselves, erasing all other evidence of their existence….

…then we differ in the standard of “reasonableness”.

As late as last week I ran across yet another example of a driver with unsecured aftermarket floor mats on top of those that came with the vehicle.

The only “multi” variable on these events are the drivers and what’s been done to the vehicles post manufacture.

Full disclosure: No, I don’t work for Toyota, and thankfully, I have no involvement in Products claims for any car manufacturer.