Last month, the National Highway Traffic Safety Administration (NHTSA) Office of Defects Investigation opened a Preliminary Investigation into BMW 7-Series vehicles that roll away because the electronic ignition fails to shift the vehicle into Park when the driver leaves with the key fob. The agency had fielded two consumer complaints, and an unspecified number of Early Warning Reports on rollaway incidents before shipping off a Manufacturer’s Request for Information to BMW on Sept. 29.

If the 7-Series isn’t locking into Park, as consumers have alleged it should, BMW ought to be investigated. But the luxury carmaker should also be commended for designing an electronic key system which complies with the intent and letter of Federal Motor Vehicle Safety Standard 114 because many electronic key systems out there do neither. Starting with a 2002 interpretation letter to an unknown automaker permitting the electronic code to serve as the key to the vehicle, to the enshrinement of that view in a new FMVSS 114 Final Rule in 2006, NHTSA has permitted the introduction of millions of electronic key systems which allow rollaways, vehicle theft – both of which are addressed in FMVSS 114 – and, a new, deadly wrinkle that was not imagined by the standard: carbon monoxide poisonings.

In January, the Society for Automotive Engineers released a recommended practice for keyless ignitions that mostly codifies what automakers have already been doing for the last 20 years, while doing little to alleviate the hazards introduced by poor designs. More recently, NHTSA has indicated that it will re-visit the standard sometime in the near future with amendments designed to tighten the current regulation or maybe introduce standardization into electronic ignition systems.

These corrections would not be necessary if NHTSA had not allowed automakers to separate the electronic key code from its housing – the key fob, creating the two-part key. Under the current schema, the fob starts the vehicle by delivering the electronic code, but plays no role in turning it off. To do that, typically, the driver has to turn off the ignition (usually with a push-button on the dash or console), place the transmission into Park, and exit the vehicle through the driver’s door. Until that sequence is completed, your invisible key (the electronic code) is still (metaphorically) dangling in the ignition. Unfortunately, most consumers don’t know that – because it defies the well-established relationship between the ignition and the key, and because many automakers call the fob the “key” in owner’s manuals and on dashboard messages to the driver.

The Key You Can’t See

Originally, the “key” in Federal Motor Vehicle Safety Standard 114 Theft Protection was defined solely according to its security function. But in 2005, when the agency proposed amended FMVSS 114 to reflect the new, electronic systems, it redefined the key in relation to a different function. The key was now “a physical device or an electronic code which, when inserted into the starting system (by physical or electronic means), enables the vehicle operator to activate the engine or motor.” In other words, the key is what starts the vehicle.

In plain English, the fob must be considered the key, because without it, the driver cannot start the vehicle. The electronic code is more akin to the digital realization of indents on a metal key. Just as a driver could not start a vehicle using a traditional ignition system with just the bottom half of the key, a driver cannot start an electronic system without the fob. Drivers need the entire object – the traditional key’s head or the electronic key’s fob –to start the vehicle. But, not according to NHTSA and the automakers.

NHTSA has declined to enforce the regulation, as defined. In many real world instances, vehicles with electronically based systems have, in essence, two keys. One is the physical fob, which delivers the electronic code to the vehicle. You must use this key to start the vehicle. Once the fob delivers the code to the vehicle, its role as the “key” ends. To “remove” the second “key” (the electronic code), you must put the vehicle in Park, turn off the engine and open the driver’s door, or a similar sequence involving killing the engine and putting the vehicle transmission into Park.

In 1992, General Motors sought the agency’s guidance in developing an electronic lock/ignition system. In its reply, NHTSA opened the door to the two-part key. It agreed that “an electronic code which is entered into a locking ignition system by the vehicle operator to permit operation of the system comes within this definition.” The agency also affirmed that GM could re-engineer the locking function of the system to accommodate this new system, as long as the vehicle transmission was in the Park position or automatically locked in Park when the “key” was removed.

In a 2002 interpretation letter to unnamed automakers, the agency took its basic interpretation another step. Chief Counsel Jacqueline Glassman affirmed that a similar system complied with FMVSS 114 – even though, “the removal of the ‘Smart Key’ from the running vehicle would have no effect on the vehicle’s operation until the engine is stopped.”

Even as Glassman stated that the system as described was compliant, she acknowledged the human factors problem:

“We observe that if the ‘Smart Key’ device remained in the car. e.g. in the pocket of a jacket laying on the seat, a person would need only turn the ignition switch knob to start the engine. It appears to us that, with systems of this kind, there would be, in the absence of some kind of a warning, a greater likelihood of drivers inadvertently leaving a ‘Smart Key’ device in the car than with a traditional key. This is because the driver must physically touch a traditional key, unlike the ‘Smart Key’ device, as part of turning off the engine. You and/or the vehicle manufacturer may wish to consider whether there are any practicable means of reducing the possibility of drivers inadvertently leaving their ‘Smart Key’ devices in the car.”

The Hazards of Today’s Electronic Key Systems

Glassman’s reasoning – that changing the traditional interface between the driver and the key would have negative consequences for drivers – was right. Her take on the consequences, however, was not – leaving the key fob in the vehicle was the least of it. Consider these incidents that are occurring in the real world because of a key you can’t see:

In 2010, Palm Beach police concluded that 29-year-old Chastity Glisson died of carbon monoxide poisoning after she inadvertently left her 2006 Lexus running in the garage attached to her Boca Raton town house. Her key fob was found in the house.

The Porsche Panamera’s keyless ignition system was blamed in a September heist from a dealership in Lawrence, New Jersey. Police speculated that the pair of thieves – two twenty-somethings who posed as potential buyers – made off with the $148,000 vehicle by switching key fobs, and coming back for the sports car after the dealership closed.

In February, a Mercedes owner complained to NHTSA:

“I purchased a brand new 2011 Mercedes Benz gl450 4matic last night. The car has a keyless go system. When I was pulling into my driveway with my kids in the car this afternoon I accidentally turned the car off without putting the car in park and began to exit the vehicle. I noticed the car started to roll back down my driveway. The car never went into park when I turned it off. Rather it went into neutral. I have never driven a car that didn’t go into a park mode when the engine was terminated. Thank goodness a child wasn’t playing in my driveway or my dog was there. A car of this sophistication, technology and price should have shifted into the park mode, not the neutral mode when the engine was turned off even if the car wasn’t put in park. Additionally, if that is how the car works, then I would think there would be a safety switch on the driver’s seat that would disengage the gear when I went to get out of the car. I am truly concerned for the safety of others as well as parked cars with what I believe to be a major design flaw.”

These incidents are not isolated. At least two other people have died in carbon monoxide poisoning incidents similar to Glisson’s; several others have been injured. Keyless ignition systems are presenting thieves new opportunities to nick high-end vehicles. Not only have academics demonstrated methodologies to start electronic key systems using cell phones, laptops and relay antennas, but real criminals have used them to steal David Beckham’s BMW X5 – twice. Rollaways, like the incident described by the Mercedes owner, are actually a new design feature of many electronic ignition systems.

SRS recently examined some 2012 models with smart keys, running 15 vehicles from major manufacturers through a series of scenarios designed to reveal their strategies for halting vehicle operations in the absence of a key fob and for alerting the driver that the vehicle was not in Park.

Most manufacturers do not have warnings when the key fob has left the vehicle and prevent restart when the key fob is removed and the driver exits through the driver’s door. Several vehicles included visual indicators that the “key” (meaning the fob) was no longer in the vehicle when it was driven and the key fob was not in the vehicle, or that the “remote starter” was not detected or some similar language that avoided calling the fob a “key.” If a manufacturer used an audible telltale, it typically was neither distinct as a warning, nor heard from outside the vehicle. Once the driver closes the door and exits, an interior audible telltale no longer functions as an alert to the driver, because the sound is contained within the vehicle. SRS found no evidence of any automatic engine shutoff mechanisms when key fobs are removed from vehicles and the engines are left running; however, they may be embedded in software that would activate after a length of time. For the most part, the trigger for electronic code removal – which according to NHTSA and the manufacturers is the real “key” – is the driver’s door.

SRS has also examined other model year vehicles like the 2008 Toyota Highlander Hybrid and 2010 Lexus RX350 to determine whether the vehicles could be driven when the key fob was not present, whether the vehicle could be remotely started with the key and driven without the key fob present, and whether the vehicle could be left in Neutral once the key fob was physically removed from the vehicle. Our examinations demonstrated that these vehicles, like most other Smart Key-equipped models, once started, can be driven without the key fob, which most owners believe is the “key.” If the driver exits the vehicle with the vehicle running and removes the fob from the interior, reenters the vehicle without the key fob, the vehicle can be driven normally, but the Lexus dash indicator notes that the “key” is out of range (i.e., the fob is not in the vehicle). There is no consequence to mobility. The message to the driver reinforces the notion the key fob is the key. Once the vehicle is shut down, it cannot be restarted without the fob present in the vehicle.

In another scenario, if the driver remains in the vehicle without opening the driver’s door and the key fob is removed (i.e., a passenger removes the key fob in a Bag or jacket or is removed through a window or passenger door), in many vehicles there is no indication to the driver that the key fob is no longer in the vehicle. The RX 350 will alert the driver with an audible tone that the vehicle has not been put into Park. But there is no warning that the vehicle is in Park, but still running, when the key fob alone or the key fob and the driver exits the vehicle.

In the past, the driver had three cues that that the key was still in the ignition and that the vehicle was running – the physical absence of the key in his possession, the sound of the engine, and the audible telltale. The latter is mandated by FMVSS 114 because, the agency has argued, drivers need a reminder that they have left the key in the vehicle. The electronic systems coupled with today’s quiet engines have removed two of these cues, and created a scenario that the originators of FMVSS 114 never anticipated. In addition, many lighting systems remain on for some period of time whether or not the vehicle is running or off, making it hard for drivers to discern what state the vehicle is in.

How Did We Get Here? A Brief History of FMVSS 114

In 1967, the Federal Highway Administration first proposed adding a theft protection standard – FMVSS 114 – out of concern that stolen vehicles constituted a major safety hazard because unauthorized drivers were more likely to initiate crashes.

The agency’s first proposal would have required cars to be equipped with devices to remind drivers to remove keys when leaving their vehicles and require manufactures to use a large number of locking system combinations to prevent use of master keys for theft. The rule was officially established on April 27, 1968, and became effective in January 1970. The rule remained substantially unchanged from the proposal and reiterated the safety concerns related to vehicle theft. By 1980, the anti-theft rule had been tweaked and expanded to include light trucks and multipurpose passenger vehicles (MPV’s) whose GVWR of 10,000 pounds or less.

Eight years later, the agency proposed amending the rule to encompass the problem of rollaway vehicles. In 1988, the agency’s Notice of Proposed Rulemaking noted that it received complaints of accidents and injuries associated with steering wheel lock-up when a key is inadvertently removed, and inadvertent actuation of the transmission gear shift lever in vehicles with automatic transmissions. The latter, the agency said, “often results from children inadvertently moving the gear shift level [sic] from ‘park’ to ‘neutral’ in a stationary vehicle with the ignition turned off. The vehicle then rolls away. Most inadvertent gear shift accidents involve property damage only. However, there have been several reports of recent cases resulting in serious or fatal injuries. In these cases, a child inside the vehicle inadvertently moved the gear shift level [sic], and the vehicle rolled out of control injuring or killing a child inside or outside the vehicle.”

The proposed amendment would have required gear shift lever locks on automatic transmissions in place of the then-current requirement, which allowed for a steering column or gear shift lever lock, or both. The proposed requirement would have prevented shifting the transmission after the key was removed and locking the gearshift or steering column while the vehicle is in motion.

Two years later, the agency issued a Final Rule. FMVSS 114 now required vehicles with automatic transmissions that have a Park position to have a key-locking system that prevented removal of the key unless the transmission was locked in Park or became locked in Park as the direct result of removing the key. This requirement became effective for vehicles manufactured after September 1, 1992. The proposal to prevent steering lock-up was not adopted in the final rule, but the agency noted that the amendment to prevent transmission lever shifting would also serve to prevent the removal of the key while the vehicle was in motion, because the amendment allowed key removal only when the transmission is in Park.

In the early 1990s, the agency began to field inquiries from manufacturers asking how FMVSS 114 would affect the development of keyless and electronic ignition systems.

In August 2005, NHTSA decided to address these new systems. It published a Notice of Proposed Rulemaking to amend the theft protection standard to reflect technological advances since the standard was last amended. After receiving several petitions from manufacturers requesting confirmation that their new systems were in compliance, NHTSA acknowledged that the regulatory language had become outdated and incompatible with key locking systems that employ electronic codes to lock and unlock the vehicle and to turn on the engine. The agency proposed to reorganize the regulation to separate the text related to theft protection from that intended to prevent unintended rollaway. It also wanted to simplify the language, redefine the word “key” to better reflect electronic codes and other locking devices and remove provisions that unnecessarily restrict design – such as the provision allowing only override systems that prevent steering before the key can be released or the transmission lever can be shifted.

On April 7, 2006, NHTSA issued a Final Rule to address comments and amend the theft protection standard as proposed in the August 2005 NPRM. NHTSA declined to drop the audible warning requirement, proposed by the Alliance of Automobile Manufacturers, because the current fleet uniformly already employed audible warnings and the agency said it was unaware of any vehicles in production using a non-audible notification method.

FMVSS 114: Not Just for Theft Protection

For two decades, FMVSS 114 has clearly served a two-fold purpose: prevent auto theft and vehicle rollaways caused by the inadvertent actuation of the shift lever. The anti-theft purpose has been a part of the rule since 1970, and rollaway prevention became a feature of a 1988 Final Rule. The crux of those protections has been preventing drivers from leaving keys in their vehicles or in a state that rendered vehicles vulnerable to unintentional movement.

Both intentions were firmly rooted in safety concerns. From the rule’s inception, the agency argued that this rule would reduce injuries and deaths caused by auto theft. In establishing the standard, the agency cited a Department of Justice study that 94,000 stolen cars were in crashes in 1966, and more than 18,000 of these incidents resulted in injury to one or more people. According to the report, the accident rate for stolen cars was some 200 times greater than the normal accident rate for non-stolen vehicles. This standard would clearly benefit safety, by reducing the number of stolen vehicles, the agency argued.

The agency has reliably affirmed the rule’s intent every time it amended it, right through to the last Final Rule in 2006: “Our safety standard on theft protection specifies vehicle performance requirements intended to reduce the incidence of crashes resulting from theft and accidental rollaway of motor vehicles.”

Regardless of how the vehicle key is constructed – metal or digital – the operator must physically place the transmission into Park to remove the key, or the transmission must automatically lock the vehicle in Park, if the transmission is in any other position when the vehicle is turned off. As the agency noted in the 2006 Final Rule: “Systems using an electronic code instead of conventional key would satisfy the rollaway prevention provi sions if the code remained in the vehicle until the transmission gear is locked in the ‘park’ position.”

In 2006, when the agency made the last round of amendments, it again rejected the Alliance of Automobile Manufacturers argument that an audible telltale was not necessary, based on human factors:

“A warning must be sufficient to catch a driver’s attention before he or she exits the vehicle without the keys. For example, a visual dashboard telltale might be insufficient to accomplish this goal. We believe that it is necessary to carefully examine the alternatives to audible warnings in order to make sure that they are effective in reducing likelihood of drivers leaving their keys in the vehicle.”

For these reasons, the rule makes two demands on key systems. One, the vehicle must be locked in park before the key is removed, or must automatically lock in place when the key is removed. Two, once the key is removed, normal activation of the vehicle’s engine or motor; and either steering or forward self-mobility of the vehicle, or both must be prevented.

SAE: Late to Party, Came Without a Gift

In January, SAE issued an exceedingly weak keyless ignition systems standard. Issued about 20 years after manufacturers began offering the first keyless ignition systems, SAE J2948 does little to alter the status quo. Most manufacturers’ systems already meet the very generic recommendations, and many manufacturers already have developed their preferred stop/start sequences.

SAE’s J2948 does address the problem of shutting down a keyless ignition system in an open throttle situation – a problem that emerged during the Toyota Sudden Unintended Acceleration crisis. Consumers who experienced a long duration acceleration event often reported that they hit the ignition button multiple times, in an attempt to bring the vehicle to a stop – to no avail. These drivers did not know the Toyota system required the driver to hold the ignition button in for a full three seconds before it would shut down an engine that was racing at full throttle while the vehicle was underway. This was the manufacturer’s solution to prevent inadvertent shutdowns if the switch was bumped. In an emergency situation, drivers with few options to control a vehicle that is not responding to their brake commands naturally reacted by hitting the ignition button multiple times. This standard takes pains to define short and long actuations and recommends that systems underway stop when the ignition button is actuated for a long period of time or is subject to a series of short actuations. BMW vehicles, for example, will shut down the engine after three short actuations.

However, SAE J2948 does nothing to ensure FMVSS 114’s rollaway and anti-theft protections – in fact, it’s weaker than the mandatory regulation. Today’s keyless entry systems – which already meet the provisions of J2948 – can be exited without the vehicle’s transmission being locked into Park, creating a rollaway hazard. They can also be driven away, under many conditions, when the fob is not present, rendering a vehicle susceptible to theft. Similarly, SAE J2948 does not address the problem of drivers leaving their vehicle engines on – sometimes until all the fuel is spent – with the key fob in their possession. This circumstance has already led to carbon monoxide poisoning deaths of at least three Toyota owners.

The SAE J standard does not define critical design concepts, such as “key” and “audible.” The audible telltale in many vehicles is often too soft, too similar to other auditory telltales, or confined to the interior of the vehicle, and thus completely inaudible to the driver, once he has exited and shut the door.

Finally, SAE J2948 does nothing to address the direct misinformation conveyed to the driver by the manufacturer calling the fob a “key” or using marketing monikers such as “Smart Key” or “Intelligent Key,” or by semantically associating the fob in any way with vehicle propulsion. The term “key” is used to refer to the fob in owner’s manuals and visual telltales, leading the consumer to believe that the fob is the key. For example, in some vehicles, you can remove the fob, with the vehicle running, and the dash will illuminate a message to the driver: “Key Not Detected.” Nowhere are consumers informed that the key is an invisible electronic code.

The standard would be much more effective, and, ultimately, compliant with FMVSS 114, if it established the fob as the key and encouraged manufacturers to install systems that stop engine propulsion and lock the vehicle in Park when the fob is removed from the envelope of the vehicle. Making the “key” an invisible code has created problems that are not hypothetical. They are occurring – with extreme and harmful consequences for users.

SAE’s recommended practice does nothing to address the current crop of problems. It’s unlikely that NHTSA will be able to write more words that will correct the error of the two-part key. Enforcement of the standard, as written, is another avenue of redress – equally improbable.

What happens when you put your iPad on the front passenger seat of a 2012 Buick Enclave?

That depends on which General Motors source you consult. In May, the automaker sent out a Technical Service Bulletin warning that when “certain electronic devices” such as computers, MP3 players and cell phones are placed in the front passenger seat of a wide range of recent models, the front passenger airbag indicator may illuminate, enabling the airbag, and activating the seatbelt reminder light and warning chime – due to electromagnetic interference (EMI). Even though that iPad only weighs 1.5 pounds, the seat sensor suddenly thinks that this designated seating position is occupied.

More recently, an OnStar operator told a GM owner that if a passenger is seated in the right front seat with an electronic device in his or her lap, EMI may disable the airbag. In other words, if the sensor correctly perceives that an occupant is in the seat, then interference from the iPad tells the sensor to turn the airbag off. In complaints reported to SRS GM owners said electronic devices held by a front seat passenger turned off the passenger airbag.

“We called OnStar and spoke to a tech,” said one owner. “He confirmed that this can be caused by cell phones and cell towers.”

If one consults the owner’s manual of a 2012 Buick Enclave (which is among the models covered in the May 25 TSB), it warns: “The front passenger safety belt reminder light and chime may turn on if an object is put on the seat such as a briefcase, handbag, grocery bag, laptop, or other electronic device. To turn off the reminder light and/or chime, remove the object from the seat or buckle the safety belt.” Is this a warning about lightweight objects triggering a seatbelt sensor? Does the seat sensor confuse an iPhone with an occupant too small for safe protection from the airbag? Or, more likely, is this an obfuscated EMI warning? The owner’s manual is silent on this caution.

EMI is an old problem; automakers have been designing to protect vehicle electronics from it for decades. For example, a Florida circuit judge’s scathing decision to set aside a civil jury verdict in favor of Ford Motor Company in a Unintended Acceleration case involving an Aerostar recounted evidence showing that as far back as 1976, Ford engineers obtained a patent describing a design for the cruise control system’s printed circuit board to reduce the risk of a sudden acceleration posed by EMI. The switches in the cruise control system Ford developed and installed in millions of vehicles were vulnerable at gear engagement to a current spike from electromagnetic interference that can bypass the control logic and induce the servo to pull the throttle wide open. (Ford went on to conceal this problem from the NHTSA and its own testifying experts in subsequent cases, for years. See How Ford Concealed Evidence of Electronically Caused UA.)

More recently, EMI was theorized, and discarded, by NHTSA and its research contractor, NASA’s Engineering Safety Center, as a cause of Toyota UA – although NHTSA’s Vehicle Research and Test Center was able to produce a spike in RPMs in EMI tests on a 2007 Lexus. In a report that closed a 2007 Lexus floor mat interference investigation, ODI investigators said:

“Multiple electrical signals were introduced into the electrical system to test the robustness of the electronics against single point failures due to electrical interference. The system proved to have multiple redundancies and showed no vulnerabilities to electrical signal activities. Magnetic fields were introduced in proximity to the throttle body and accelerator pedal potentiometers and did result in an increase in engine revolutions per minute (RPM) of up to approximately 1,000 RPM, similar to a cold-idle engine RPM level.”

And in Dec. 2007, a 2006 Tundra owner filed this complaint with ODI:

“I am a [sic] ASE certified master tech and mechanic of 15 years. I owned a [sic] auto repair shop for 5 years and have since returned the vehicle to Toyota lease. My 2006 Toyota Tundra would accelerate on its own at times. To stop it I would have to turn off the key, pull over and then restart it. Being a master technician I assure you it was electronic in nature. In no way was it a floor mat or accelerator pedal stuck. I did take it in for repair and was told there was no problem found. It did happen in the same location 3 times and could have been caused by EMI. Again, it was electrical in nature, there is no doubt of this.”

But, back to GM. The May 25 TSB covers 12 models over the 2009-2012 model years: the Buick Enclave; Cadillac CTS and SRX; Chevrolet Cobalt; Chevrolet HHR; Chevrolet Impala, Traverse; Chevrolet Equinox; Chevrolet Sonic; GMC Acadia; GMC Terrain; Saturn Outlook and Saturn Vue.

It warns “some electronic devices placed on the front passenger seat may interfere with the electric field generated by the PPS system, causing it to enable (turn ON) the passenger airbag and turn on the safety belt reminder light and chime – even though the seat is not occupied. The electronic device does not necessarily need to be turned on to cause this condition.”

It also cautions techs: “Never rest the diagnostic scan tool or components on the passenger front seat or touch the passenger front seat while the diagnostic scan tool is in contact with your body. This may cause the SIR lamp to illuminate while holding the diagnostic scan tool because your body can transfer the electronic ‘noise’ to the sensor mat in the passenger front seat.” (This may explain what happens when a right front seat passenger uses a cell phone.)

The fix was to simply clear the codes – which could relate to a variety of error messages involving the seat sensor or the ECU – and send the customer on his way.

If the GM owner lives in the Texas Panhandle, however, the problem is worse, and requires a more intensive fix. On May 25, the automaker issued a second and unusual warning for techs in Texas. This TSB warned that the airbag warning light could behave erratically in the presence of EMI.

“This condition may be caused by possible electromagnetic interference in the Amarillo, Texas area from external sources such as aviation airspace traffic radar, creating erratic sensor information to the SDM,” the bulletin said.

This TSB covered 18 models in the 2010 and 2011 model years including 2010-2011 Cadllac Eacalades; Chevrolet Avalanche, Silverado, Suburban, Tahoe, Yukon Denalis; and GMC Sierra and Yukon Denali. In this case, the techs were required to amend the sensor by adding ferrite clamp beads on either side of the inflatable restraint sensor wire harness.

There are several international voluntary standards and vehicle manufacturers have set their own criteria governing EMI, but no Federal Motor Vehicle Safety Standard. But as the world goes ever more wireless, are automakers and NHTSA keeping up? According to EMI Expert Keith Armstrong, “some vehicle manufacturer’s standard tests only apply to the normal operating functions of the components and subsystems. For example, an airbag should not operate, a speedometer should show the correct speed within specified tolerances, etc., but they lack requirements to test the correct operation of safety systems, by stimulating them with a signal that should make them operate, and check that they always do operate as designed whilst exposed to EM disturbances.”

As the transformation of an automobile continues from a collection of mechanical parts to a computer on wheels with communication interfaces to non-vehicle wireless devices from the driver and passengers inside, or from sources outside the vehicle, today’s vehicles are expected to function correctly in a very noisy electrical environment.

WASHINGTON, D.C. – Unable to derail the consumer products database mandated by the 2008 Consumer Product Safety Improvement Act in Congress, one manufacturer has turned to the courts. Meanwhile, the Government Accounting Office’s first run at the publicly accessible complaints database shows that SaferProducts.gov works pretty much as advertised.

On October 17, “Company Doe” filed a motion in a U.S. District Court in Maryland to prevent the U.S. Consumer Product Safety Commission from publishing a report alleging that a product caused an injury to a child. According to news accounts, the report emanated not from the alleged victim or his caregivers, but from another government agency, which could range from federal to a local entity, such as a fire or health department. The unnamed manufacturer characterized the report as “baseless” and sought anonymity for all filings, arguing that revealing its identity was tantamount to publishing the report in the database. The CPSC has said that it would be filing a motion to unseal the claim, but declined to comment further.

The publicly accessible and searchable complaint database was a cornerstone of CPSIA, which was signed into law by President George W. Bush and passed with bi-partisan support and overwhelming majorities. (Only one representative and three senators voted against it.) Implementation, however, has been much less popular. Manufacturers, who have had near total control of the flow of public information since the CPSC was established in 1972, have fought it every step of the way. While consumers routinely file complaints against automakers in the National Highway Traffic Safety Administration’s Vehicle Owner Questionnaire database without controversy or discernible effect on the vehicle manufacturers, other industries that have enjoyed the privilege of shielding complaints about their products from public view have reacted with great alarm. They have complained endlessly that the database would publish inaccurate information about their products and serve as a breeding ground for lawsuits. The Commission’s two Republican appointees Anne Northup and Nancy Nord have taken up industry’s cause, voting against it.

Republicans now serving in Congress have re-thought the GOP’s support. Last summer freshman Rep. Mike Pompeo (R-KS) introduced a measure prohibiting funds for a publicly available and searchable consumer database, even though the CPSC had already invested $3 million to complete it. On the Senate side, Senator Rand Paul (R-KY) proposed a Senate amendment that would have eliminated the CPSC altogether. This session, Pompeo has re-introduced his bill, and the Republican-dominated U.S. House is likely to approve it again, predicts Rachel Weintraub, Consumer Federation of America’s Director of Product Safety and Senior Counsel. But, the rock-solid support of Senators Rockefeller (D-WV), Durbin (D-IL) and Pryor (D-AR) ensured the viability of the database last session, and Weintraub expects they will protect it in the future.

The impact of the lawsuit is harder to assess: “Certainly what the lawsuit shows is the extent to which certain entities will go to keep information from consumers,” Weintraub says.

The GAO’s analysis of SaferProducts.gov, also released this month, found little to criticize in the database’s first six months of operation. The GAO’s only conclusion and related recommendation was for the commission to better analyze each report for evidence of a product number or serial number.

The CPSC actually puts each complaint through one of the most rigorous vetting of any federal agency. It reviews each report to determine if the submitter has included all the required information. (Those that don’t meet the minimum criteria are saved for internal use.) The CPSC then transmits a copy to the manufacturer, importer, or private labeler, allowing the company the opportunity to comment. Qualifying reports and manufacturer comments are posted.

CPSIA requires, at a minimum, that the submitter include eight pieces of information, including a description of the consumer product sufficient to distinguish it as something regulated by the CPSC; the identity of the manufacturer or private labeler by name; a description of the harm related to use of that product; and contact information and consent to publish the complaint. Many reports of harm submitted to CPSC as of July 7, 2011, were missing information required for publication on the web site. The GAO’s analysis of CPSC data showed that as of July 7, 2011, 5,464 reports of harm were received; 2,084 (38 percent) contained the minimum; and 1,847 (34 percent) were published. Consumers submitted 97 percent (1,786) of the published reports. 61 percent (1,128) of submitters reported that the harm or risk of harm occurred to themselves or a family member; 72 percent of reports contained numeric identifiers, such as a serial number or product number.

The GAO criticized the agency for failing to adequately identify all reports in need of a serial number or photograph of the product, a new requirement that was signed into law on August 12:

“While the model and/or serial numbers remain optional information for the submitter to include, under the recent amendments to CPSIA, CPSC now must contact submitters who did not report a model number or serial number to attempt to obtain this information, or a photograph of the product, before sending the report of harm to the manufacturer for comment. Unless CPSC strengthens the analytic methods used to identify reports with missing model numbers or serial numbers, it will not be able to identify all reports that require the agency to contact the submitter for more product information because it currently does not track all reports of harm missing such information. To effectively implement the recent amendments to CPSIA, we recommend that CPSC enhance the analytic methods it uses to identify product information in a report of harm, such as by verifying whether the model field in its data contains a number (versus a text response, which would not meet the statutory requirement) or by searching for model numbers or serial numbers that may be listed in other fields.”

In a response from the Democratic majority, three commissioners Robert Adler, Inez Tenenbaum and Thomas Moore agreed with the GAO’s analysis and said that they were already working on ways to address the Accounting Office’s recommendation.

The DOT Office of Inspector General has found that NHTSA’s Office of Defect Investigations followed its established procedures in conducting its inquiries into Toyota Sudden Acceleration for nearly a decade, but the OIG rapped the agency for its lack of transparency and documentation.

The new audit concluded NHTSA needs to make improvements in its handling of auto safety investigations, but offered no substantive evaluation of the agency’s use of science in examining Toyota unintended acceleration. The OIG did not seek any independent source of technical knowledge, relying instead on a layman’s understanding of easily observable phenomena: “Although we did not contract for any scientific or engineering expertise to assess independently any UA-related technical issues, we participated in and observed simulated pedal misapplication and pedal entrapment in Toyota vehicles with ODI officials. As the driver in the simulation depressed the gas pedal to accelerate, the floor mat trapped the pedal. The simulations clearly showed the potentially serious consequences that could result during pedal entrapment without the brake override system,” the report stated.

The audit instead focused on improved training and better documentation on how complaints are addressed and investigations opened and closed.

The OIG initiated the audit in February to assess the effectiveness of ODI’s processes for identifying and addressing safety defects. It was later expanded at the request of Congress and the Secretary of Transportation to include: an analysis of ODI’s industry-wide UA complaints and investigations; an evaluation of its resources to identify and address safety defects and of its compliance with government ethics rules; and a comparison of ODI’s processes with other countries’ defect investigation and recall programs.

While accelerator pedal entrapment is a cause of UA, OIG failed to address any of the issues dogging the NHTSA investigations. It made no comment on allegations that ODI ignored complaints that did not fit its theories, or mis-categorized complaints that could not be attributed to floor mat entrapment or driver errors. It did not investigate the numerous deficiencies in the NASA Engineering Safety Center evaluation of Toyota UA. The NASA study – led by NHTSA – for example, purported to draw conclusions about high-speed, long-duration events, but the researchers only examined vehicles that had experienced low-speed, short-duration events. The OIG was silent on NHTSA’s failure to further investigate NASA findings related to substandard electronics and its reliance on Toyota and its litigation defense expert Exponent to dismiss important findings identified with electronic failures.

The report did note the lack of ODI staff training, but did not discuss the implications of the agency’s technical ignorance in mounting an effective defect investigation. Nor did the OIG study show how ODI’s lack of training in modern electronic engine management and controls affected their ability to investigate and question the manufacturer’s representations of sophisticated and interconnected vehicle systems.

The OIG did find fault with ODI’s lack of documentation and transparency:

“Without comprehensive documentation of pre-investigation activities, ODI’s decisions are open to interpretation and questions after the fact, potentially undermining public confidence in its actions.” Because NHTSA routinely fails to document meetings manufacturers, OIG recommended “a complete and transparent record system with documented support for decisions that significantly affect its investigations.”

The audit was an opportunity to delve into the myriad inconsistencies and omissions outlined in e-mails and other documentation released as a result of Congressional investigations and FOIAs, and recounted in independent analyses of the agency’s process, but if OIG investigators took it, the answers are missing from the final report. SRS has reported many of ODI’s investigatory abuses, the effect on Toyota investigations, and implications for future defect probes (see SRS web page Toyota Unintended Acceleration):

- NHTSA relied on Toyota’s defense litigation expert Exponent for a warranty analysis used to dismiss the significance of physical evidence of an electronic cause of UA in some Toyotas. This conflict of interest was not disclosed.

- NHTSA and NASA based analyses on miscoded data and unsupported assumptions while failing to record and maintain the original data they on, preventing replication.

- NHTSA/NASA withheld from public view pieces of their latest report that are not related to Toyota’s confidential business.

- NHTSA has continually misrepresented or ignored owners’ complaints to buttress its belief that floor mat interference was to blame. (SRS online articles and reports on this issue include: Exclusion of Early Camry Deaths Hamper Later Investigations; Makin’ it Fit so We Can Acquit; Another Attack of the Killer Floor Mats: Sarasota Edition.)

NHTSA’s latest effort to prevent independent assessments of owners’ complaints that don’t match pedal interference or driver error is to keep the report and associated documents out of the public record. In some cases, the agency has claimed that photos and data are part of its “deliberative process” and exempt from public disclosure under the Freedom of Information Act.

A new study shows that many parents know that adult seat belts do not fit their older children properly, but use them anyway.

Researchers from the University of Michigan’s Child Health Evaluation and Research Unit and its Transportation Research Institute set out to determine the frequency with which drivers reported improper seat belt positioning among the Forgotten Child set – so named by the safety community, because these children have outgrown five-point child safety restraints, yet are too small for seat belts. This group of children needs the aid of a booster seat to achieve a proper belt fit, with the lap portion of the belt extended low across the hips, and the shoulder belt resting over the shoulder, rather than on the child’s neck.

The analysis, published in Academic Pediatrics, focused on caregiver responses to five questions in the phone-based 2007 Motor Vehicle Occupant Safety Survey regarding children, 4-9 years of age, and problems attributed to the lap belt, the shoulder belt or both.

Among 891 adults who drove children 4 to 9 years of age, the vast majority, 534 (60 percent) reported they always used a child safety seat. The second largest group, 241 (27percent) reported that they always used the vehicle seat belt. The remainder reported that they sometimes used either, or used no restraints at all. But the rate of child seat use steadily dropped as the children aged. By 9 years old, only 20 percent were always secured in child safety seats, compared to 61 percent of 4-6 year olds, according to parents’ responses.

Parents reported using seat belts for 334 (37 percent) of 4- to 9-year-old child passengers. And, of those, 78 percent of the drivers reported improper belt fit, with improper shoulder belt position accounting for 44 percent and improper lap belt position for 62 percent. At least one improper belt position was reported by about 78 percent of drivers, which, the researchers concluded, is the most important finding of the analysis: “Children who are prematurely restrained in an adult seat belt that does not fit properly are at increased risk of injury to the head, spine, and abdomen. Although improper lap belt positioning was more common, of greater clinical concern is that almost one-half of children were reported to have improper shoulder belt positioning. Our findings are consistent with laboratory evidence that demonstrates incorrect belt positioning is commonly the result of a mismatch between child body proportions and rear seat belt geometry. Even at age 9, most children’s thighs are too short to sit in most vehicle rear seats without slumping. The slumped postures invariably lead to poor lap belt fit. In regard to shoulder belt positioning, the discomfort associated with having the belt against the face or neck can trigger the child to put the belt under their arm or behind their back. Putting the belt under the arm or behind the back is a much more serious belt fit problem than a belt that rides close to the face or neck because these positions result in greater travel of the torso, compression of the abdomen, and stress on the spine as the body comes to a stop in a crash.”

The researchers surmised caregivers “may not be aware of proper seat belt positioning for the lap and shoulder belts or may not understand the serious and potentially permanent injuries that result from improper seat belt fit.” That confusion likely stems, at least in part, from state seat belt laws that do not address older children and “may indicate to parents that their child is ready to be transitioned from a belt-positioning booster seat to an adult seat belt before reaching the stature and maturity to ensure proper seat belt fit on every trip.” The researchers recommended that pediatricians inform their patients about the importance of seat belt fit.

New Child Dummies for Booster Seat Testing Offer Advancement – and Raise Significant Questions

Acknowledging concerns about the biofidelity of the new HIII 6-year-old dummy, the National Highway Traffic Safety Administration issued a Final Rule on Sept. 9 allowing manufacturers of child restraint systems to test for FMVSS 213 compliance with either the Hybrid II 6-year-old dummy (H2-6C) or the advanced Hybrid III 6-year-old dummy (HIII-6C).

Touted by NHTSA as the state-of-the-art, more biofidelic child dummy, the HIII 6C also has increased instrumentation allowing for better assessment of impact responses such as neck moments and chest deflections not measured by the HII 6C. However, the new dummy is also designed differently than the HIII-6C – the neck and ribs are softer, and the thorax is stiffer, which can significantly alter the kinematics of the dummy during testing.

Outside testing entities, however, were not as impressed with the HIII-6C. TraumaLink test lab raised significant concerns with the performance of the dummy when their tests revealed extremely large neck elongation unlikely to be seen in children in real crashes, which resulted in high calculated injury values. TraumaLink suggested that this would predict a pattern of injuries not seen in the real world. They argued that the “softer neck” caused increased neck elongation and forward excursion resulting in higher Head Injury Criteria (HIC) from chin-to-chest contact and in some cases, head-to-knee contact.

SafetyBeltSafe concurred, documenting “unrealistic stretching and bending of this dummy’s neck while tightly restrained by a lap shoulder belt in a booster. The result was that the dummy’s face directly contacted the chest, generating an unrealistic and unacceptably high HIC.”

In fact, NHTSA’s Vehicle Research and Test Center (VRTC) tests with the dummy generated head excursion increases from 2 to 4.5 inches.

Researchers also expressed concern about the new HIII-6C dummies permanently flexed hips which don’t allow for a slouched position and may inhibit submarining in non-optimal booster designs.

The real question is whether the dummy differences are more or less like what occurs in the real world. It is clear from a variety of recent testing of child dummies in child restraints, booster seats and vehicle seat belts, that there are significant concerns with the ability of child dummies to predict child occupant kinematics. NHTSA states that these issues are still under investigation as research and development of the HIII-6C dummy continues, but until they are resolved, the manufacturers will have the option of using the dummy of their choice.

CPSC Addresses Table Saw Safety

This month, the U.S. Consumer Product Safety Commission issued an Advance Notice of Proposed Rulemaking to require performance standards for a system to reduce or prevent injuries from contact with the blade of a table saw. The Oct. 11 announcement, in response to a 2003 petition, requested comments about performance safety standards to address injury. The CPSC study documented more than 60,000 blade contact injuries annually at a cost of $2.63 billion dollars each year, in 2007 and 2008.

Standard safety devices on table saws come in two forms: blade guards and kickback prevention devices. Traditional blade guards, however, can hinder table saw use, leading users to remove them. Blade guards can jam the work piece, block the user’s view and poorly align the splitter and the blade. In addition, difficult cuts actually require removal of the guard.

The initial voluntary standard published in 1971 by Underwriters Laboratories (UL987 Stationary and Fixed Electric Tools) has been revised many times, but essentially requires a guard that consists of a hood a spreader and a kickback device. The guard must completely enclose the sides and top of the saw blade above the table and automatically adjust to the thickness of the work piece. Performance requirements were subsequently added, which required new table saws to have a permanent riving knife that was adjustable for all table saw operations. The CPSC is still concerned that the UL standard does not adequately address blade contact injuries or the potential for removal of the safety components from the saw. In its proposal, CPSC documents an innovative modular blade guard design, and a new blade contact detection and reaction system that stops and retracts below the table when it detects contact with skin.

The Occupational Safety and Health Administration (OSHA) also has a regulation on table saws in the workplace that requires a guarded hood, inspections and maintenance of wood working machinery. The OSHA standards are effective in the workplace, but CPSC determined that home use by consumers needed additional protection.

The Commission requested comments on whether it should issue a voluntary standard, a mandatory rule or a labeling requirement for warnings on the device. They specifically requested suggestions for potential requirements for such a standard and information on new technologies that make table saws safer.

CPSC Proposes Mandatory Standard for Child Play Yard – Many Manufacturers’ Ignore Voluntary Standard

The CPSC has issued a Notice of Proposed Rulemaking to regulate children’s play yards. A “play yard” is a framed enclosure that has a floor and mesh or fabric-sided panels, primarily intended to provide a play or sleeping environment for children, that can fold for storage or travel. They are intended for children who are less than 35 inches tall who cannot climb out of the product.

Of the 2.9 million play yards sold in the US each year, only about half of the manufacturers have certified them to the ASTM voluntary standard established by the Juvenile Products Manufacturers Association (ASTM F-406-11). This may explain the numerous injuries and fatalities associated with play yards. The CPSC’s Directorate for Epidemiology reported 2,128 incidents from early November 2007 until early April 2011, including 49 fatalities and 165 nonfatal injuries. These incidents include suffocation from soft or extra bedding, and contusions and lacerations caused by the collapse of the side rail or sides of the structure, broken or detached component parts, and sharp surfaces.

The current ASTM standard for play yards is the basis for the proposed rule. This voluntary standard restricts sharp points and protrusions, lead paint and flammable solids and establishes requirements for stability, side height, floor strength, side deflection and corner bracket strength. The ASTM standard also contains requirements to protect children from entrapment and mattress displacement, and requirements that eliminate the risk that the outside rails collapse in a v-shape or result in a scissoring effect.

The new CPSC standard would incorporate the ASTM standard with a few changes intended to reduce the potential for improper testing, specifically related to the floor strength test and the corner bracket test.

Carolyne Thorne; the families of Jackie and Raechel Houck and Levi Stewart – these were not among the stakeholders interviewed by Government Accounting Office investigators in compiling their latest report on problems with automotive recalls. Yet, they are arguably among the many who are most affected by the shortcomings in the current system. Thorne was seriously and permanently injured and Stewart and the Houcks died, because defective and recalled components in their vehicles had not been remedied. Each case illustrates a different type of failure and why the recall system is due for an overhaul, but NHTSA Has Options to Improve the Safety Defect Recall Process, published last month, conveys none of this urgency.

This report was yet another outgrowth of the Toyota Unintended Acceleration crisis and the tsunami of recalls. The GAO notes that 2010 saw the largest number of automotive recalls in the history of the National Highway Traffic Safety Administration – largely boosted by the millions of vehicles Toyota recalled for floor mats and sticky pedals. It also acknowledges that the failure to remedy a defect poses a risk to the public – but it does not define the magnitude of this risk.

The GAO frames the issue as a two-fold communication problem: the language used in recall notifications tends to be confusing for the average consumer, and there are problems with notifying secondary owners of vehicles, from individuals to used car dealerships, and primary owners who move. It recommended that NHTSA modify requirements for notification letters and publicize its website. The GAO also recommended that NHTSA make better use of manufacturers’ recall completion rate data; and “seek legislative authority to notify potential used car buyers of recalls.”

While these suggestions might improve the recall remedy rate, by not taking a closer look at the most harmful results, the GAO missed an opportunity to put a sharper point on its observations and challenge some of the claims made by those the GAO relied upon in formulating its recommendations.

Take the issue of NHTSA and recall completion data. The agency told the GAO that “they evaluate the effectiveness of a recall campaign by comparing a specific recall campaign’s progress to similar campaigns based on factors such as the age of vehicles recalled and the number of vehicles recalled.” The agency said that “monitoring recalls on a campaign-by-campaign basis provides them with the flexibility necessary to capture the unique aspects of each recall campaign and that by focusing on communication and discussion with manufacturers, the agency can develop solutions to improve completion rates when a campaign is achieving a completion rate that is below its expectation.”

In practice, the agency has no set procedures for determining if a manufacturer has adequately met its recall obligations. It rarely holds a hearing on recall non-compliance. In the last decade there were two scheduled – one in December 2008 against BMW for refusing to recall Mini-Cooper S Vehicles for burn hazards from the exhaust pipe tips which protruded at the center rear of the vehicle, and another in October 2009 against U.S. Bus Corporation. (In both cases, the manufacturers acquiesced to the agency’s request before the hearing occurred.)

In the latter case, U.S. Bus had filed 21 defect and non-compliance reports to the agency between 2001 and 2007 and followed up with quarterly reports that indicated a very low remedy rate. It took the agency years to notice that the New York school bus manufacturer was not actually making any repairs and take action against it – even though the defects were serious and widespread among the nation’s fleet of in-service school buses.

Levi Stewart, 18, of Idaho, was killed in a crash caused by a relay rod failure in a Toyota pick-up truck in September 2007. In October 2004, the automaker disclosed to NHTSA that it had recalled Hilux and Hilux Surf vehicles sold in Japan for defective relay rods – but not its U.S. counterparts, Toyota 4Runner, the Toyota Truck and Toyota T100. The rods had a tendency to snap, leaving the driver with no steering controls. Toyota told NHTSA that it had not received any reports of relay rod failures. In fact, Toyota had actually received at least 44 reports in the U.S. since as early as 2000, including crashes involving rollovers and injuries. In September 2005, Toyota finally recalled the defective steering relay rods on 1989-1995 Toyota pickups and 4Runners in the U.S. The repair rate was so low – 30 percent – that Toyota took the unusual step of issuing an owner re-notification in 2007. NHTSA never noticed that so few consumers had gotten the fix. Stewart had bought the used vehicle months before the crash.  Stewart’s family received the recall re-notification weeks after Levi’s death. (Last year, NHTSA fined Toyota for failing to recall the relay rods in 2004, when it recalled them in Japan after prompting from the Stewart’s lawyer.)

The GAO report criticized NHTSA for not using recall repair rate data to analyze trends and institute best recall practices:

“Based on our analysis of NHTSA data, without conducting a broader aggregate level analysis to look for outliers, patterns, or trends, the agency may be missing an opportunity to identify underlying factors that affect recall campaign completion rates.”

But it should have also pointed out that cases like U.S. Bus and the Toyota relay rod recall show that NHTSA is not consistently looking at the data to monitor in the short term whether deadly defects are being fixed – which is the purpose of a recall.

NHTSA claimed to the GAO that 70 percent of all recalled vehicles are fixed within the 18-month period during which manufacturers are required to file reports. The GAO, however, found considerable variation in looking at recalls between 2000 and 2008. The average repair rate ranged from 55 to 75 percent, but “within any given year,” the report stated, “some manufacturers have safety defect recall completion rates as low as 23 percent to 53 percent per year, whereas other manufacturers have completion rates between 90 percent and 96 percent… Furthermore, some manufacturers have consistently higher or lower rates across the 9 years we included in our analysis.”

In probing the problems of notification, the GAO noted another longstanding problem: “there is no single source of information on safety recalls—such as a centralized VIN database—that can be accessed to determine if a car in a dealership’s possession has an outstanding recall.” This is not just an issue for car dealers – it affects any subsequent owner, like a motorist who purchases a car via a private sale.

The lack of a central database using vehicle identifiers is a particular problem for tires. (In a 2007 white paper Tire Recalls and Tire Safety: The RFID Solution, Safety Research & Strategies examined the flaws in the tire recall system and the absence of a mechanism that allows consumers, tire dealers and technicians to easily identify a recalled tire. The report addressed the potential for Radio Frequency Identification Devices to advance recall performance.)

Today’s tire recall system was established more than 40 years ago, at a time when recalls and government defect investigations of tires were rare, and manufacturers neither desired nor expected the consumer to be an active participant in the process. The system is based on two components: the Tire Identification Number (TIN) – the primary means of distinguishing a tire by size, plant and date-of-manufacture (often referred to at the DOT number) and tire registration. The regulatory history shows that manufacturers and retailers successfully fought the agency’s attempts to make recalls consumer-friendly. Tire sellers are only required to provide consumers with the means to register the tire – either via a paper card or electronically. They aren’t required to register the tires they sell, although some do.

Research shows that consumers and tire dealers do not consistently register tires – the manufacturer may not provide the registration cards to retailers; a retailer may not give the card to the consumer; or the consumer may not fill it out. In addition, consumers change addresses and tires change hands when a vehicle is sold.

As for identifying tires, current regulations require manufacturers to mold the complete TIN on only one side of the tire; they can mold a partial number on the other side. But more importantly, manufacturers are not required to specify the range of TINs under recall. Some provide the agency with this information; some do not.

The only public repository of tire recall information is located on the NHTSA website. It does not allow users to search tire recalls by the TIN. Rather, a consumer would have to enter the tire’s make and model to first determine whether it has been recalled. Then, users have to retrieve the documents the manufacturer filed in support of the recall and find the one that specifies the size and which TIN lots are being recalled – if the manufacturer actually provided it. If they haven’t, consumers, tire dealers or other service providers have to contact the tire maker.

All of these gaps allow tire technicians to service tires without detecting they are defective. The GAO did not address these longstanding and systemic failures.

In June 2002, Carolyne Thorne of Montgomery, Alabama, replaced all four of the tires on her 2000 Ford Expedition when the left rear Continental Grabber AW P275/60R17 tire de-treaded at low speed. In August 2002, Continental Tire recalled the original equipment Grabber AWs, because they had a lower-than-specified rubber gauge between the belt edges, leading to a tread separation, resulting in loss of control of the vehicle and a crash. Like many Continental tire owners, Thorne promptly sent in her proof-of-purchase and was reimbursed for her new tires. Thorne took her Expedition into the dealership to check the tires again to ensure that none had been recalled. Thorne also had purchased a lifetime tire maintenance service with Wal-Mart so that her tires would be regularly inspected, balanced and rotated. Between 2002 and 2004, Wal-Mart auto technicians serviced her tires nine times. In April 2004, Thorne’s Expedition rolled over on the highway after her left rear tire experienced another tread separation. Thorne, who was wearing her seatbelt, suffered a permanent spinal injury when the Expedition’s roof collapsed. When Thorne had her first tread separation crash, a tire technician left the spare on the vehicle and put three of the new Continental P265/70R16 tires on the ground and the fourth in the spare well, under the vehicle. After the recall, no technician had ever noticed that her left rear tire was actually among those that should have been replaced. There is no system in place that would have allowed the technician to check the Tire Identification Number against a list of recalls, nor had Wal-Mart developed one, despite its position as one of the largest tire and service providers in the country.

Even today, Firestone Wilderness and ATX tires, recalled in 2000, still show up in current tire-related crashes. They were often full-sized spares stored under the vehicle, never replaced in the recall, and later rotated into service.

The GAO report documented that rental car companies, which operate large fleets that are used by, and later sold to the public, are not required to remedy a defect.

The companies interviewed by the GAO said that they had systems in place that prioritized recalls. If the defect concerns safety, the rental company takes it out of service immediately until the repair is complete. If the defect is not “safety-related,” the vehicle can be rented, but is put in the queue for service. (By definition, if a manufacturer has filed a defect and noncompliance notice with NHTSA, which initiates a recall, the problem must be safety-related.) In practice, this system is far from ironclad, if it actually exists.

Last year, a jury awarded $15 million to the parents of Jackie and Raechel Houck, who died in a head-on crash with a heavy truck in 2004. The Houck sisters had rented a 2004 PT Cruiser from Enterprise, which was recalled for the replacement of a power steering hose that could leak and ignite, causing an under-hood fire. Enterprise had been informed of the recall a month earlier, but did not repair the vehicle, renting it out to four other customers before putting the Houcks in it. Managers in training testified that it was a company practice to overbook vehicles to get customers in the door.

Rental car companies suggested that NHTSA and the manufacturers categorize the potential for harm for each defect and create national standards that would inform the public if a vehicle can be operated pending completion of a recall or if a vehicle needs to be grounded until serviced. NHTSA said that they opposed classifying defects this way for fear that consumers would ignore too many recalls.

“This could result in fewer consumers remedying their vehicles due to the fact that NHTSA has categorized the recall as ‘less serious,’ and therefore, consumers may perceive the safety risk to be decreased,” the report said.

In response, “NHTSA agreed to consider our recommendations,” the report said.

In August, Toyota Motor Corporation recalled 1.2 million Corolla, Corolla Matrix, and Pontiac Vibe vehicles for improperly manufactured Engine Control Modules. The problem? Cracks at solder points or on varistors on the circuit board that could cause harsh shifting, or a car that won’t start or would suddenly stop.

In October 2010, Nissan recalled 2004-2006 Armada, Titan, Infiniti QX56 and model year 2005-2006 Frontier, Pathfinder and Xterra vehicles, because of a compromised engine control module relay within the intelligent power distribution module. The automaker told NHTSA that a diode in the relay could allow silicon vapors to form, causing silicon oxide to develop on the ECM relay and arcing. This, Nissan said, could lead to a sudden engine stall.

On November 17, Volvo recalled more than 6,000 XC70, XC90 and S80 and S60 vehicles within certain chassis ranges because the engine and transmission software calibration was so sensitive, the vehicle could suddenly stall after a stop, and go into a reduced power mode. Volvo had to update the software.

In April 2011, Toyota recalled 307,848 2008 Highlander and Highlander Hybrid and 2007-2008 Rav4 vehicles because simultaneous faults in two roll-angle sensors in the curtain shield airbag assembly could cause inadvertent deployment of the side-air curtain and activation of the seat belt pretensioners. The problem first presented itself in October 2007 but Toyota, which has argued that dual simultaneous faults do not occur in the real world in refuting an electronic cause of unintended acceleration, similarly posited that dual simultaneous faults were highly unlikely to trigger inadvertent deployments. When complaints continued, Toyota concluded that the likelihood of a double fault triggering a deployment was much higher than anticipated and launched a recall.

As automakers continue to migrate mechanically-based components to electronic systems, so do the types of recall campaigns they launch to correct defects. According to a Siemens VDO Automotive report estimate in 2004, electronics was the fastest growing sector in the industry with the total value of such systems expected to reach $3.8 billion in 2010.

In the last 12 months, SRS examined the prevalence of electronic recalls, reviewing 722 recall campaigns since July 2010 to determine how many involve defects associated with electronic systems. Ultimately, defining electronics recalls is challenging – they range from severed cables and fluid leaks into electronic components that result in short circuits to hardware failures to complex software algorithm issues. When defined broadly, electronics recalls comprised more than a quarter of recalls submitted to NHTSA over the last year. Of those, 24 recall campaigns address software defects.

As SRS has previously reported, automakers have known for at least a decade that electronics have their advantages – and their reliability headaches. At a 2004 industry conference, Mercedes Benz’s vice president for electrical and electronics and chassis development. Steven Wolfsreid, “railed against the temptation to overload vehicles with electronic functions that are useless to the customer,” according to an Automotive News story. The German automaker had removed 600 electronic functions from its vehicles because of quality concerns that were damaging its reputation and ticking off its customers. Electronics are challenging to integrate into a vehicle’s electrical architecture, he said, and what works well in isolation can be a disaster in combination with other electronic components.

The growth has also seen a corresponding rise in the number of warranty claims and defects.  JD Powers data has shown that as the number of electronic functions a vehicle has rises, so do the number of defects. German electronics supplier Robert Bosch affirmed that connection in a trade-pub article, noting “a direct correlation between the number of electronic functions and the number of defects per vehicle.”

But identifying the root cause of these electronic failures can be tricky.

The Ford thick film ignition module might qualify as the first high-profile electronic recall. It also bears the distinction of being the first court-ordered recall outside of NHTSA – in part because initially the failure was difficult to identify. This two decades-long saga of failures, investigations and litigation began in 1982, when Ford began to replace its mechanical breaker point ignition system, Duraspark, with an electronic system using a thick film 3 integrated ignition module. This new electronic system was heat-sensitive, yet Ford had placed it in the hottest location under the hood. At temperatures exceeding 125 C, the module would cut out, causing the vehicle to stall at highway speeds. After four years in service, Ford consulted its warranty data to test its durability projections for the component. The automaker found that the return rate far exceeded projections, but many of the returned parts did not exhibit the failure mechanism, because, once the vehicle cooled down, the component would resume working. Ford eventually identified the problem, but failed to act on its knowledge.

In the 1980s, NHTSA launched five investigations, but could not isolate a root cause, in part because Ford withheld documents that would have shown the effect of thermal stress on the ignition modules. A class action lawsuit on behalf of Ford owners prompted NHTSA to open a sixth investigation in 1997, which revealed that Ford had failed to produce documents to the agency. By then, Ford was beyond the agency’s grasp; the eight-year statute of limitations on recalls had passed. In 1999, the civil lawsuit ended in a hung jury, but the second phase before a California state judge resulted in a judicially ordered recall. Ford eventually settled the class-action litigation in 2003 by doubling the component’s warranty to 100,000 miles.

Another factor in the search for finding root causes is the new connectivity to which Wolfsreid alluded. Many of vehicle systems, such as braking and steering, were previously independent and solely mechanical. Today’s vehicles communicate between systems using Controller–area Networks (CAN or CAN-bus). Developed and released by Robert Bosch GmbH in the late 1980s, CANs allow controllers and other components to communicate with each other using a message-based protocol designed for automotive applications. The CAN transmits messages based on a priority system wherein the message with the highest priority will succeed, and the lower priority messages follow.

A 2010 GM recall for the 2005 and 2006 Corvette illustrates how the interconnectivity of components can create unusual defects. The recall addressed an intermittent or open condition in a connector in the Steering Wheel Position Sensor (SWPS) that resulted in a short-duration brake application to a single wheel. In its defect notification, GM stated that in rare cases repeated movement of the steering column could cause signal interruption within the column triggering a “Service Active Handling System” message on the vehicle dash, followed by the application of one or more brakes, which could cause the vehicle to pull one direction or the other.

The much-heralded NHTSA-NASA reports on Toyota Electronic Throttle Controls open other windows into the complexities of electronic defects. While Secretary of Transportation Ray LaHood and Toyota pronounced their electronics exonerated by NASA in unintended acceleration incidents, a read of the scientific findings shows something very different. One prominent issue found by NASA that can lead to real-world UA was the identification of “tin whiskers” in the Accelerator Pedal Position Sensor (APPS) of Toyota potentiometer-type accelerator pedals. Whisker formation was first discovered in the 1940s in cadmium coatings, but the problem intensified in 2003, as manufacturers switched from lead to tin solder to satisfy a European Union directive for environmentally-friendly products. According to NASA “Tin whiskers are electrically conductive, crystalline structures of tin that sometimes grow from surfaces where tin (especially electroplated tin) is used as a final finish.  Tin whiskers have been observed to grow to lengths of several millimeters (mm) and in rare instances to lengths in excess of 10 mm.  Numerous electronic system failures have been attributed to short circuits caused by tin whiskers that bridge closely-spaced circuit elements maintained at different electrical potentials.” They are complex and their behaviors are still not fully understood. According to NASA, which maintains laboratories and experts who study whiskers, “Tin whiskers pose a serious reliability risk to electronic assemblies.”

As studies continue into the role of tin whiskers in Toyota pedals, some industry experts suggest that they may also be playing a role in other malfunctions of electronic components like the circuits in engine control units and electronic throttle bodies. Expect this topic to heat up as the role of tin whiskers in the automotive environment becomes the subject of further technical examination.

Interconnectivity and the intermittent nature of these electronic issues creates a whole new level of diagnostic and forensic challenges for engineers and technicians and greater challenges for regulators examining potential safety-related defects – particularly in absence of baseline regulations for safety-critical systems.

Metal Whiskers Shapes and Sizes

Source: NASA; http://nepp.nasa.gov/whisker/background/index.htm

Exponent, a research firm supporting the automobile industry in litigation, has been collecting data to build a database of available injury mitigation technologies by vehicle make, model and year. The Menlo Park, CA firm presented surprising research at last month’s Enhanced Safety of Vehicles Conference using this resource, showing that vehicles do not sacrifice fuel efficiency to safety technology; side impact airbag effectiveness; and how the evolution of safety technology could be the basis for rulemaking.

The database documents what safety features were provided as standard and optional equipment and when they were introduced. The database was assembled using Ward’s Light Vehicle Specifications from 1996-2010 and NHTSA’s NCAP database from 1990-2010 as well as Exponent’s own individual technology surveys.

Specific technologies include depowered or advanced technology air bags, side impact air bags, rollover airbags, automatic occupant classification and air bag suppression, electronic stability control, advanced belt restraints including energy management and pretensioners, tire pressure monitoring, and built in child restraints, among other safety features.

Robert Lange, former safety executive for General Motors, now Exponent’s vice president of vehicle engineering, used this data in three papers he presented. In one, he concluded that there was little association between the addition of new safety technologies and changes in the overall vehicle mass, price and fuel economy because they have been largely offset by operational efficiencies or advanced designs and weight reductions elsewhere in the vehicle.

The second paper examined the evolution of safety technology as chronicled by the Exponent database. Lange observed that as injury control technologies were developed, they tended to be introduced in limited numbers of vehicle models and that the number of applications grow with model penetration over time resulting in substantial use in five years. He argued that most features preceded rulemaking mandates and that many could serve as a basis for justifying rulemaking.

In a third paper, Exponent used the database to assess the side impact airbag effectiveness on fatality reduction. Following the implementation history made possible by the master database, Exponent researchers developed a matrix of Head Curtain Airbag Availability from 1998 – 2009 for various make/model combinations. This allowed them to directly compare percent reduction in Fatality Rate within model pairs year-to-year with and without side impact airbags. They found improvement in occupant protection in near side crashes for torso and head curtain bags. Torso bags were 16 percent effective in reducing the probability of near side impact fatal injury and head curtain air bags were about 33 percent effective in reducing near side impact fatal injury.

In his presentation, Bob Lange noted that the database is not publicly available.

(Source: Installation Patterns for Emerging Injury Mitigation Technologies, 1998 Through 2009; Robert Lange, Harry Pearce, Eric Jacuzzu; Exponent)

Earlier this month, a Georgia man died at the bottom of a water slide at a popular Atlanta-area attraction. Sergio Edwards, 21, reportedly a strong swimmer, was found unconscious at the bottom of Lake Lanier Islands Resort’s Fun Dunker. The police officials called his death accidental, but had yet to pinpoint a cause.

Waterparks gained popularity in the 1980s, and today there are some 1,000 such facilities, according to the World Waterpark Association. In 2010, these facilities attracted 79 million people looking for entertainment and relief from the heat. Yet, Edwards’ death underscores that waterparks are also a source of drowning and a range of non-submersion injuries. According to 1998-2007 emergency room data from the National Electronic Injury Surveillance Survey (NEISS), 3,819 people sought treatment for injuries sustained at waterparks – making waterpark attractions the leading sub-category of amusement park injuries. Roller coasters and flume rides were second with 3,344 injuries over the same time period. The vast majority of complaints, 1,605, came from injuries while careening down a waterslide.

The medical community has also documented the types of injuries park patrons are likely to sustain. In 2007, researchers documented amusement park injuries seen in two Pennsylvania hospital emergency rooms during 2006. They noted that out of 325 discharge diagnoses, 15 percent occurred on water-related rides; with 18 percent extremity fractures, 18 percent lacerations, 15 percent extremity sprains, 15 percent head injury/concussions, and six percent extremity contusions.

One contributor to these injuries is the velocity patrons attain while rushing down the water slides. A 2007 Australian study looked at their exit velocities at an open water slide and found that people hurtled down the chute at velocities ranging from 1.69 m/s (6.1 km/hour) to 5.63 m/s (20.3 km/hour) – exceeding speeds sufficient to crush cervical vertebrae and creating the potential for a severe head injury from impact with a solid object, such as the sides of the slide or the bottom of the pool.

One of the most serious consequences of these impacts is a spinal cord injury. In 2008, a trio of Turkish doctors documented in the Clinical Journal of Sports Medicine four cases of spinal cord injuries sustained at waterparks. In each case, the men were injured by sliding head-first down the chute. The subsequent injuries were analogous to those sustained by individuals diving into shallow water:

“Cervical spine injuries are the most common complications due to recreational aquapark activities, and they are almost irreversible. Over 90 percent of these accidents result in quadriplegia, causing tremendous impact to the patient and society. Spine injuries due to diving into water mostly affect young men, and almost 50 percent of these patients present with complete [Spinal Cord Injuries].”

Some of the first medical journal articles on waterpark injuries tagged design features as a culprit of injuries. A 1988 Southern Medical Journal article by Charles Saunders cited a Centers for Disease Control study in which 94 percent of injuries occurred in one section of the slide. A second study associated injuries with sharp turns in the slide, and sliding over the seams or other rough surfaces of the slide. Saunders concluded that waterslide operators should be required to seal exposed seams and smooth rough edges, eliminate sudden tight turns, install non-slip surfaces and cover intake drains with secure grating.

But human behavior is also a factor. In 1998, British researchers published the results of a controlled experiment in safety management at a pair of enclosed, 90-meter long waterslides at a community swimming pool. The paper, published in Injury Prevention, illustrated the difficulties in maintaining safety at waterparks. The poll management installed a traffic-light controlled system to maintain order on the slides, instituted an organization-wide safety culture, and focused on improving user behavior. These efforts failed.

“Despite a battery of safety features including closed circuit TV, citizen’s band radios, a traffic light controlled system, part time supervision, and warning notices, the system was found to be inherently “unsafe” as operated. It placed a small but significant percentage of users in a hazardous situation whereby consecutive riders could collide with each other while in the flume even when conforming with all instructions. The realized risk might have been even higher were not staff and users adopting their own precautionary measures.”

Author David Ball concluded that the risk of injury was high, leaving operators liable for failing in their duty of due care.