NASA Engineering and Safety Center
Technical Assessment Report
Title:
National Highway Traffic Safety Administration
Toyota Unintended Acceleration Investigation Appendix C
Version:
1.0
Page #:
2 of 87
Table of Contents
C.1
C.1.1
C.1.1.1
C.1.1.2
C.1.1.3
C.1.2
C.1.2.1
C.1.2.2
C.1.3
C.1.3.1
C.1.3.2
C.1.3.3
C.1.3.4
C.1.3.5
C.1.3.6
C.1.3.7
C.1.4
C.1.4.1
C.1.4.2
C.1.4.3
C.1.4.4
C.1.4.5
C.1.4.6
C.1.5
C.1.6
C.1.7
C.1.7.1
C.1.7.2
C.2
C.2.1
C.2.1.1
C.2.1.2
C.2.1.3
C.2.2
C.2.2.1
C.2.2.2
C.2.2.3
C.2.2.4
C.2.2.5
C.2.2.6
C.2.2.7
Functional Areas with Functional Block Diagrams, Test Scenarios, and Test Results ................... 5
Throttle Position Control Functional Area....................................................................................... 9
Detailed Implementation Description .............................................................................................. 9
Throttle Control Loop Sensitivities and Postulated Faults ............................................................ 14
Signal Aliasing of VPA1 and VPA2 .............................................................................................. 15
Accelerator Pedal Control Functional Area ................................................................................... 18
Detailed Implementation Description ............................................................................................ 18
Pedal Control System Sensitivities and Postulated Faults ............................................................. 21
Idle Speed Control Functional Area .............................................................................................. 62
Detailed Implementation Description ............................................................................................ 62
ISC Engine Coolant Temperature .................................................................................................. 63
Idle Speed Control System Sensitivities and Postulated Faults ..................................................... 63
Engine Coolant Sensor Fault ......................................................................................................... 64
Engine Speed Signals Corruption .................................................................................................. 64
Failed Compensation for Additional Engine Loads ....................................................................... 65
Summary of Idle Speed Control Potential Faults........................................................................... 67
Cruise Control Functional Area ..................................................................................................... 67
Detailed Implementation Description ............................................................................................ 67
Cruise Control System Sensitivities and Postulated Faults............................................................ 70
Vehicle Test: Enable Cruise Control and Restrain Brake Switch Plunger .................................... 71
Vehicle Test: Short Cruise Control Signal Resistively to Ground................................................. 71
Vehicle Test: Cruise Control Shift Out Of Drive Cancel .............................................................. 71
Failed Wheel Speed Sensor ........................................................................................................... 71
Transmission Control Functional Area .......................................................................................... 71
VSC Functional Area ..................................................................................................................... 72
ECM Power System ....................................................................................................................... 72
Detailed Implementation Description ............................................................................................ 72
Power System Sensitivities and Postulated Faults ......................................................................... 74
Software Analysis .......................................................................................................................... 75
Software Functions and Implementation ....................................................................................... 75
Main CPU Functions...................................................................................................................... 76
Sub-CPU Functions ....................................................................................................................... 79
ECM Software Implementation ..................................................................................................... 79
System Integrity and Fail Safe Modes ........................................................................................... 81
Power On – Reset .......................................................................................................................... 81
Heartbeat .................................................................................................................................... 81
Watch Dog Timer .......................................................................................................................... 81
Hardware Data Checks .................................................................................................................. 81
Data Transfer ................................................................................................................................. 82
Software Data Checks .................................................................................................................... 82
Fuel Cut and Electronic Fuel Injection (EFI) and Ignition ............................................................ 82
NESC Assessment #: TI-10-00618
NASA Engineering and Safety Center
Technical Assessment Report
Title:
National Highway Traffic Safety Administration
Toyota Unintended Acceleration Investigation Appendix C
C.2.1.8
C.2.3
C.2.3.1
C.2.3.2
C.2.3.3
C.2.3.4
Version:
1.0
Page #:
3 of 87
Onboard Diagnostic Interface (OBD II) ........................................................................................ 82
Software Study and Results ........................................................................................................... 82
Software Analysis Scope and Technologies Applied.................................................................... 83
Software Implementation Analysis Using Static Source Code Tools ............................................ 84
Software Logic Model Checking Using the SPIN Tool ................................................................ 85
Software Algorithm Design Analysis Using MATLAB Models ................................................... 86
List of Figures
Figure C.1-1.
Figure C.1.1.1-1.
Figure C.1.1.1-2.
Figure C.1.1.1-3.
Figure C.1.1.2-1.
Figure C.1.1.3-1.
Figure C.1.1.3-2.
Figure C.1.2.1-1.
Figure C.1.2.1-2.
Figure C.1.2.2-1.
Figure C.1.2.2-2.
Figure C.1.2.2-3.
Figure C.1.2.2-4.
Figure C.1.2.2-5.
Figure C.1.2.2-6.
Figure C.1.2.2-7.
Figure C.1.2.2-8.
Figure C.1.2.2-9.
Figure C.1.2.2-10.
Figure C.1.2.2-11.
Figure C.1.2.2-12.
Figure C.1.2.2-13.
Figure C.1.2.2-14.
Figure C.1.2.2-15.
Figure C.1.2.2-16.
Fishbone Diagram of Postulated UA Causes ............................................................... 6
Throttle Valve Control Block Diagram ...................................................................... 10
ThrottleValve Sensor Output Voltage Relation between VTA2 and VTA1 and the
DTCs .......................................................................................................................... 12
Contributions to Throttle Command .......................................................................... 13
Summary of Postulated Faults Identified by Throttle Function Fishbone Diagram... 14
Summary of postulated EMI faults identified from Fishbone analysis ...................... 16
500 Hz injected common to both VPA signals (top Yellow trace) results in driving
the motor and roughly 0.2 Hz aliasing sensed on VTA (bottom Blue trace) ............. 17
Block Diagram of Pedal Control Function ................................................................. 19
Range for VPA1 and VPA2 ....................................................................................... 20
Summary of postulated faults identified by Pedal Function Fishbone Diagram ........ 22
Pedal DTC Map, 07 Camry V6, red is P2121 wide limit ........................................... 24
The upper operational lane with the latent fault influence and wide open throttle
location. ...................................................................................................................... 26
Chronological steps of a dual fault in the upper operational lane .............................. 27
Fault resistance locations for the postulated double fault of shorts to the +V supply 28
Potentiometer sensor type pedal with latent resistive short between VPA signals .... 29
Potentiometer Sensor Type pedal with faults outside the operational lane ................ 30
For Hall Effect type pedals, Resistance range required for latent fault between VPA
signals and second fault of VPA2 resistive shorted to +V ......................................... 31
Hall Effect sensor type pedal with Latent fault and second fault resistive open circuit
of VPA2 and pedal stroke affects ............................................................................... 33
Potentiometer sensor Type Pedal with examples of resistive shorts of the VPA
signals to the +V supply and the relationship to the operational lane for the full pedal
stroke .......................................................................................................................... 35
Hall Effect sensor Type Pedal with examples of resistive shorts of the VPA signals to
the +V supply and the relationship to the operational lane for the full pedal stroke .. 36
Resistance range required for simultaneous resistive open circuit in the VPA return
line for all three pedal types. [Note: common area highlighted] ................................ 37
Potentiometer Type Pedal with examples of resistive open circuits in the VPA signal
Return and the relationship to the operational lane for the full pedal stroke.............. 38
Hall Effect Pedals response to Resistive Open Circuits in return [Note the CTS pedal
converges to 5.0V at approximately 8kohms] ............................................................ 39
Denso Hall Effect sensor output as a function of the lower supply voltage ............... 40
Two Hall Effect Pedals with examples of resistive open circuits in the VPA signal
Return and the relationship to the operational lane for the full pedal stroke.............. 42
NESC Assessment #: TI-10-00618
NASA Engineering and Safety Center
Technical Assessment Report
Title:
National Highway Traffic Safety Administration
Toyota Unintended Acceleration Investigation Appendix C
Version:
1.0
Page #:
4 of 87
Figure C.1.2.2-17. Resistance range required for simultaneous resistive faults between the VPA signals
and the +V supply for all three pedal types ................................................................ 43
Figure C.1.2.2-20. One of two rotating contact assemblies (left), resistive elements (center), and
electrical diagram (right) for the potentiometer pedal sensors showing defective
accelerator pedal assembly fault region ..................................................................... 48
Figure C.1.2.2-21. Pedal Resistive Fault Event Sequence Diagram......................................................... 50
Figure C.1.2.2-22. Simulated Pedal Fault Behavior ................................................................................. 51
Figure C.1.2.2-23. Tests Performed on the MY 2005 L4 ETC Simulator ................................................ 52
Figure C.1.2.2-24. Disassembled Accelerator Pedal Assembly Potentiometer ........................................ 54
Figure C.1.2.2-25. Shorting whisker VPA1 to VPA2 (top) and long whisker on VCPA1 (bottom) ........ 56
Figure C.1.2.2-26. The current to bring a tin whisker to its melting temperature versus the length
of the tin whisker ........................................................................................................ 57
Figure C.1.2.2-27. Lognormal cumulative probability distribution of tin whisker lengths (left) and
thicknesses (right) for a sample set ............................................................................ 58
Figure C.1.2.2-28. CTS Hall Effect Pedal Assembly Connector and Circuit Card .................................. 59
Figure C.1.2.2-29. CTS Pedal Assembly Circuit Board X-ray Detail ...................................................... 60
Figure C.1.2.2-30. X-ray of Denso Pedal Assembly ................................................................................ 61
Figure C.1.2.2-31. Denso Pedal Assembly Circuit Board X-ray Detail ................................................... 61
Figure C.1.3-1.
Idle Speed Control Functional Block Diagram .......................................................... 63
Figure C.1.3-2.
Summary of postulated faults identied by Idle Speed Control Function Fishbone
Diagram ...................................................................................................................... 64
Figure C.1.3.5-1. NE signal (Crankshaft, top yellow) and G (Camshaft, bottom blue) signal at idle .... 65
Figure C.1.3.6-1. Test results with coolant temperature sensor failed to 150Kohms resulting 2000 rpm
increase with vehicle in neutral .................................................................................. 66
Figure C.1.3.6-2. Upper resistance range of the Coolant Temperature Sensor including the DTC error
range ........................................................................................................................... 67
Figure C.1.4-1.
Cruise Control Block Diagram ................................................................................... 68
Figure C.1.7-1.
Power Supply ASIC for MY 2005 L4 ........................................................................ 73
Figure C.2-1.
Software Functions and System Safety ...................................................................... 75
List of Tables
Table
Table
Table
Table
Table
Table
Table
Table
Table
Table
C.1-1.
C.1.2.2-1.
C.1.2.2-2.
C.1.2.2-3.
C.1.4-1.
C.1.4-2.
C.1.4-3.
C.1.4-4.
C.2.1-1.
C.2.1-2.
Fishbone Summary of Potential UA Sources ............................................................... 7
Summary of Dual Fault Conditions............................................................................ 44
Potentiometer Accelerator Pedal Assembly Resistances ........................................... 48
Tin whiskers observed on the tin-plated copper leads soldered to the PCB............... 55
Cruise Control Switch Voltage Output ...................................................................... 69
Cruise Control States .................................................................................................. 69
Cruise Control Diagnostic Codes ............................................................................... 70
Cruise Control Auto Cancel ....................................................................................... 70
Cruise Control States .................................................................................................. 77
Basic Code Size Metrics Camry05 Software ............................................................. 80
NESC Assessment #: TI-10-00618
NASA Engineering and Safety Center
Technical Assessment Report
Title:
National Highway Traffic Safety Administration
Toyota Unintended Acceleration Investigation Appendix C
C.1
Version:
1.0
Page #:
5 of 87
Functional Areas with Functional Block Diagrams, Test Scenarios, and
Test Results
An Ishikawa (fishbone) diagram, Figure C.1-1, lists in a functional hierarchy potential failure
causes of UA postulated based on the NESC team’s assessment. Each postulated failure cause
was dispositioned through analysis or test and the closure of each of the elements of the fishbone
was documented in a table. The analysis and disposition of fishbone elements is contained in
Appendix B.
NESC Assessment #: TI-10-00618
NASA Engineering and Safety Center
Technical Assessment Report
Title:
National Highway Traffic Safety Administration
Toyota Unintended Acceleration Investigation Appendix C
Version:
1.0
Page #:
6 of 87
Figure C.1-1. Fishbone Diagram of Postulated UA Causes
NESC Assessment #: TI-10-00618
NASA Engineering and Safety Center
Technical Assessment Report
Title:
National Highway Traffic Safety Administration
Toyota Unintended Acceleration Investigation Appendix C
Version:
1.0
Page #:
7 of 87
The fishbone for this investigation was developed to address functional failures and,
consequently, does not devolve to the part level. It is configured into 9 major areas: Throttle
Function, Pedal Function, Cruise Control Function, Idle Speed Control Function, Transmission
Shifting and VSC Function, Software, Environmental Effects, Power, and Mechanical Effects.
While not absolute, in general, the NESC team focused on those failures that could increase the
throttle opening, without generating a DTC. Any failure or set of failures that were identified as
a potential source of a UA, without generating a DTC, is discussed in the body of the report in
their functional area. Those elements that have been identified as potential sources of UAs are
identified by a red square in the diagram and are summarized in Table C.1-1. This is a subset of
all possible failures and does not include design features that intentionally open the throttle or all
possible variations of a given failure mode.
To decompose this system, the design was separated into the major control loops or functional
areas in the ETCS-i that regulate engine power output: throttle control, pedal control, idle speed
control, cruise control, transmission control, and VSC. The main focus of this study was in the
first three control loops. Cruise control was considered a potential cause of UA because the
electronics is placed in direct control of the vehicle speed. There were a number of VOQs
involving cruise control. However, most of these could be traced to normal operational
characteristics of the cruise control function. The maturity of cruise control systems and the
multiple driver mitigations and electronic control limitations made this functional area a less
likely candidate for causing UAs than the other throttle control electronic functional areas.
The remaining two control loops, transmission control and VSC were studied briefly to
determine the magnitude of their influence on throttle opening. They were determined to have
limited ability to influence throttle opening.
NESC Assessment #: TI-10-00618
Version:
1.0
NASA Engineering and Safety Center
Technical Assessment Report
Title:
Page #:
8 of 87
National Highway Traffic Safety Administration
Toyota Unintended Acceleration Investigation Appendix C
Table C.1-1. Fishbone Summary of Potential UA Sources
Major
Fishbone Area
Failure Mode Category
Finding
Addressed in Report
Section
1 Throttle
Control
Postulated Throttle Position Sensors Supply (Vc) Increased Resistance
Postulated Throttle Position Sensors Return (E2) Increased Resistance
with Learning
Throttle Postulated Resistive Fault Summary
Throttle Stuck
Throttle Motor Drive electronics PWM, H-Bridge, transistor failure, and
or latchup
Single event upset
EMI
Postulated Pedal Position Sensors Supply (Vc) Increased Resistance with
Learning
Pedal Single Faults of VPA1 or VPA2
Pedal Postulated Dual Faults placing VPA1 and VPA2 in the operational
lane
Hall Sensor External Magnetic Fields
Signal Aliasing of VPA1 and VPA2:
EMI, Noise Coupled into VPA1 and VPA2
Engine Coolant Temperature
Engine Speed signals
Compensate for Additional Engine Loads
Cruise Control Signal
Cruise Control Brake Switch Cancel
Cruise Control Gear Shift Cancel
Vehicle Speed Sensor Failure
Sensing incorrect gear selection
F6
F6
6.6.1.2.1
6.6.1.2.2
F6
F6
F6
6.6.1.2.3, 6.9
Appendix B-1
Appendix B-1, AppendixC, 6.9
Appendix B-1
Appendix B-1, 6.8, 6 9
6.6.2.2.1
2 Pedal
Command
3 Idle Speed
Control
4 Cruise Control
5 Transmission
Shifting
6 VSC
7 Power
8 Software
9 Environmental
Sensing incorrect vehicle motion
+12v or +5v Ripple or Transients
Coding Defects
Algorithmic Flaws
Task Interference
Insufficient Fault Protection
EMI Radiated Fields
EMI Conducted Noise
EMI Transients
Single Event Upset
Electrostatic Discharge
Mechanical Vibration
Thermal
F6
F7
F4
F6
F5
F6
Appendix B-2
6.6.2.2.2, 6.9
6.9
6.6.2.2.3, 6.8
Appendix B-2, 6.8
6.6.3.1, 6.8
6.6.3.4, 6.8
6.6.3.5
6.6.4.4
6.6.4.3
6.6.4.5
Appendix B-4
6.6.5, Appendix B-5
F6
6.6.6
6.6.7, 6.8, Appendix B-6
F8
6.7, Appendix B-7
F7
Appendix B-8, 6.8, 6 9
Appendix B-8, 6.9
The following sections will cover the functional control areas starting with the inner most control
loop (i.e., the throttle control). Although not a direct link to controlling the throttle, the power
supply system effect on throttle opening was also evaluated and is presented at the end of the
functional areas. The last three areas shown in the fishbone diagram include software error,
environmental effects (e.g., mainly EMI), and mechanical effects (e.g., throttle binding).
Software is addressed in Section 6.7, EMC/EMI, and mechanical effects in Section 6.8. Several
external theories were also studied by the NESC team, and these are dispositioned in Section 6.9.
NESC Assessment #: TI-10-00618
NASA Engineering and Safety Center
Technical Assessment Report
Title:
National Highway Traffic Safety Administration
Toyota Unintended Acceleration Investigation Appendix C
Version:
1.0
Page #:
9 of 87
It is important to recognize that the vehicle has nominal design features which will result in an
increased engine speed and these are not considered faults. Some examples of nominal design
features are:
•
The vehicle is designed to increase the engine speed under the increased load of the
air conditioning.
•
The transmission torque converter lock-up is another design feature which results in
an increased engine speed. See Section 6.6.5, Transmission Control.
•
Under cold conditions, the vehicle is designed to idle faster and to gradually decrease
the idle as the engine warms.
•
The engine fuel injection and ignition timing was delayed as part of the knock sensor
software. When the accelerator pedal is pressed the increased airflow combines with
the fuel resulting in a driver-sensed delayed acceleration greater than when this
condition is not present.
•
When the cruise control is in use on hilly terrains, the automatic transmission may
downshift to maintain set speed which results in significantly higher engine speeds.
C.1.1 Throttle Position Control Functional Area
C.1.1.1 Detailed Implementation Description
The throttle control loop maintains the throttle motor at the commanded throttle position based
on throttle position sensor feedback. The throttle functional block diagram that describes this
operation is shown in Figure C.1.1.1-1. The control loop consists of six major components: 1)
the throttle motor and its associated mechanisms, 2) the motor drive IC, 3) two throttle position
Sensors, 4) the Sub-CPU, 5) the Main CPU, and 6) the software for both the Main and SubCPUs. Refer to Figure C.2-1 for the Software Block Diagram.
NESC Assessment #: TI-10-00618
NASA Engineering and Safety Center
Technical Assessment Report
Title:
National Highway Traffic Safety Administration
Toyota Unintended Acceleration Investigation Appendix C
Version:
1.0
Page #:
10 of 87
Figure C.1.1.1-1. Throttle Valve Control Block Diagram
Once the Main CPU determines the desired throttle drive position, it outputs the commands to
the H-Bridge on four signal lines (HI, HI, LO and LO). The circuit path from these four lines to
the motor winding is an important electrical area to review since it is beyond the direct CPU
control yet faults exist which can drive the throttle valve motor. Faults in this area are captured
by either over current and/or over temperature sensing. The throttle valve motor is a DC motor
that operates on pulse width modulation (PWM) drive to control the current delivered to the
throttle motor and thus control the throttle valve position. The PWM signals are supplied thru
the M+ and M-lines which can supply pulses of either polarity to the motor by an “H Bridge”
circuit. The throttle valve is counteracted by a spring, and upon removal of power to the throttle
motor, the throttle valve will return to its “Spring Detent” position (6.5 degrees above fully
closed position).
Power to the throttle motor is controlled by the Main CPU via the Motor Drive IC and three
external FET switches. One external FET switch is in series with fused +12V drive power to the
IC and can be switched on or off by either the Main or Sub-CPU (as notionally represented as
“sub cut” and “main cut” in the block diagram. In actuality these are complementary logic
signals). The other two external FETs are a part of an H-Bridge that switches either side of the
motor winding to ground in response to PWM signals (two HI and two LO) from the Main CPU
at an approximately 500 Hz. The other two H-Bridge FETs PWM switch the +12V power and
these are located inside the IC. These internal FETs also have a current monitoring feature,
which provides an analog current signal to the Main CPU. If the measured current exceeds
threshold values a limit flag is sent to the Main CPU and can also cut off PWM drive signals to
the H-Bridge. The IC also has a signal from the Sub-CPU and a different signal from the Main
CPU that can inhibit PWM drive signals to the H-Bridge, as shown as inputs to the Motor Drive
I.C. in Figure C.1.1.1-1. Also, certain sensed voltage conditions can trigger an IC reset with
NESC Assessment #: TI-10-00618
NASA Engineering and Safety Center
Technical Assessment Report
Title:
National Highway Traffic Safety Administration
Toyota Unintended Acceleration Investigation Appendix C
Version:
1.0
Page #:
11 of 87
PWM drive signal inhibit, as well as an internal IC temperature sensor that can inhibit the PWM
signals.
The throttle position sensors are used by the ETCS-i to monitor and verify the physical angle of
the throttle valve. These consist of two sensors, operated in parallel, sharing the same power
supply and return lines. Two basic types of throttle position sensors have been used by TMC
since the inception of the ETCS-i, resistive sensors for MYs 2002 and 2003, and Hall Effect
sensors for all Camry models from MY 2004 and on. The potentiometer sensor uses a
mechanical contact and thus would be more prone to wear out failure modes than the non-contact
Hall Effect sensor. It is important to point out that a poor electrical connection in the
potentiometer contacts would lead to an open circuit which combined with the internal ECM pull
up resistor would result in generation of a DTC and entry into a fail safe mode of operation.
These sensors monitor the physical angle of the throttle valve via a mechanical or magnetic
coupling between the sensors and the valve, for the resistive sensor or Hall Effect sensors,
respectively.
To effectively understand and evaluate the range/area of valid or invalid values, the team used
the software models and vehicle hardware to generate “diagnostic maps” shown in Figure
C.1.1.1-2. These maps, or plots, identify the relationship between the two VTA1 and VTA2
throttle position sensor voltages, with VTA1 as the horizontal axis and VTA2 as the vertical axis.
The acceptable range of throttle sensor values creates an operational “lane” on these maps where
the sensor voltages can reside without generating a DTC. Other throttle sensor value
relationships outside this operational lane can generate DTCs and possible fail-safe modes.
NESC Assessment #: TI-10-00618
NASA Engineering and Safety Center
Technical Assessment Report
Title:
National Highway Traffic Safety Administration
Toyota Unintended Acceleration Investigation Appendix C
Version:
1.0
Page #:
13 of 87
coming from the PID control software. The duty cycle dictates the closing/opening rate which
is controlled by changing the on and off times of four FETs. As previously noted, the H-Bridge
drive IC is thermally protected and current limit protected and cuts off the motor drive if an over
temperature or over current condition occurs.
The main function of the PID controller is to assure the throttle value is properly positioned per
the desired throttle command. If the throttle valve is not in its desired position the PID receives
an error signal driving the throttle motor and valve towards the desired position. If the motor
does not respond and an error signal persists, the integral term of the PID controller will integrate
the error resulting in more motor torque until the electronics current limit is reached setting a
Stuck Open or Stuck closed DTC.
The PID controller involves three separate parameters, the proportional, the integral and
derivative values, denoted P, I, and D. The proportional value determines the reaction to the
current error, the integral value determines the reaction based on the sum of recent errors, and the
derivative value determines the reaction based on the rate at which the error has been changing.
The input throttle command, which the PID controls to, is a combination of the throttle request
from the pedal/cruise/VSC, the request from the ISC, and the learned throttle spring position.
Figure C.1.1.1-3. Contributions to Throttle Command
The base for the throttle command comes from the learned fully closed value. This value
represents the position of the throttle valve when it is not actively controlled. This value is
“learned” from
ms to
ms after ignition, when power is not applied to the throttle motor and
it is assumed to be held open by the spring only at its “spring detent” position (6.5 degrees above
fully closed position). This value is stored for future ignition key cycles. During the ms
learning period, if a sensed position difference between the previous and current ignition key
cycle (trip) is greater than 1 degree, the new learning value is adjusted by a maximum of
degree per ignition cycle.
NESC Assessment #: TI-10-00618
NASA Engineering and Safety Center
Technical Assessment Report
Title:
National Highway Traffic Safety Administration
Toyota Unintended Acceleration Investigation Appendix C
Version:
1.0
Page #:
14 of 87
The learned value is the foundation for the determination of all other throttle control, including
diagnostics. The learned throttle value is used in the determination of thresholds. Note that if the
throttle diagnostics determines the existence of a fault, the learning is not reset until ignition off.
C.1.1.2 Throttle Control Loop Sensitivities and Postulated Faults
Figure C.1.1.2-1 shows the summary of postulated faults that might possibly produce a UA
identified from the fishbone diagram analysis for the throttle control functional area. Based on
the preceding understanding of the throttle control design, a fishbone diagram was generated and
used to identify potential sensitive entry points into the throttle control loop. See Appendix B for
the entire fishbone analysis results. In the throttle control loop two sensitivities were identified
where postulated faults can produce an increase in engine speed. The fishbone identified a poor
electrical connection either in the throttle position sensor and wiring, ECM circuit card, and/or
ASIC hardware may combine with the learning algorithm to create the two potential faults listed
below. In addition, the fishbone identified sensitivity to coupled energy which is discussed in
the pedal function area.
Figure C.1.1.2-1. Summary of Postulated Faults Identified by Throttle Function Fishbone Diagram
NESC Assessment #: TI-10-00618
NASA Engineering and Safety Center
Technical Assessment Report
Title:
National Highway Traffic Safety Administration
Toyota Unintended Acceleration Investigation Appendix C
Version:
1.0
Page #:
15 of 87
C.1.1.2.1 Postulated Throttle Position Sensors Supply (Vc) Increased Resistance
A postulated resistance (0.5 seconds without dropping below 0.40 and, VPA2 has to
simultaneously drop below 1.4V, but cannot drop below 1.2V.
This postulated fault does require the sequence of having the fault present while the engine is
started and with the pedal pressed and the software being in the mode of expanded acceptable
operational range for the VPA signals. When the accelerator pedal is no longer pressed, the
accelerator new learned value became its lowest possible 9.8 degrees value. If the fault is then
removed, the ECM will interpret the step change as a valid pressed pedal and will increase the
engine speed. The accelerator pedal system contains software logic that expands acceptable
NESC Assessment #: TI-10-00618
NASA Engineering and Safety Center
Technical Assessment Report
Title:
National Highway Traffic Safety Administration
Toyota Unintended Acceleration Investigation Appendix C
Version:
1.0
Page #:
23 of 87
operational ranges during operation after encountering off-nominal pedal sensor inputs or power
on CPU reset. This condition is necessary to be present for this postulated fault. The pedal
learning algorithm limits a new value to 0.4V or 10 degrees of commanded throttle opening.
The NESC team demonstrated this postulated double fault by increasing the resistance of up to
1.6kohms (for maximum learned values) in both pedal sensor supply voltage (VCP1 and VCP2)
signals. Lower postulated resistances in the supply lines had a lower learned value thus lesser
effect in engine speed and higher resistances resulted in a DTC for the pedal signal faults. Such
specific simultaneous failures affecting both VPA1 and VPA2, to such small voltage ranges (0.4
< VPA1
