report montero sua concern...

Report

Montero SUA Concern Investigation 1212070-005#01C

Prepared By: Approved By: Date:

2016-09-22

Dr Phil March Systems & Safety Consultant

Nick Fell Engineering Director

HORIBA MIRA Ltd 2016. All rights reserved, subject to client contract. Information contained in this document may not be published in any form of advertising or other matter without prior agreement of the Chief Executive Officer of HORIBA MIRA.

HORIBA MIRA Ltd. Registered Office: Watling Street Nuneaton Warwickshire CV10 0TU England www.horiba-mira.com Tel: +44 (0)24 7635 5000 Fax: +44 (0)24 7635 8000 Registered in England No 9626352 VAT Registration GB 100 1464 84

HORIBA MIRA - 1212070-005#01C Montero SUA Concern Investigation

Report : Page 1 of 111 MMC

Commercial in Confidence

Revision History

Date Revision No. Raised By Description

2016-08-12 A Phil March Formal Release

2016-09-07 B Phil March Update following additional EMC testing and ergonomics analysis

2016-09-22 C Phil March Iteration to clarify conclusions




Summary This report details the results of an engineering investigation into the cause of sudden unintended acceleration events in Mitsubishi Montero Sport vehicles between model years 2009 and 2015 operating in the Philippines.

The investigation is high level, reviewing vehicle design information available to MMC, statistical data regarding Montero production and vehicle testing using a predominantly black box approach.

The focus of the investigation was primarily to identify a plausible root cause for the sudden unintended acceleration incidents when the drivers claimed that the brakes did not respond while the vehicle was accelerating against the intention of the driver.

Statistical analysis revealed that

There is a significantly higher incident rate in the Philippines compared to other territories

Incidents have been observed only on diesel engine vehicles, although the lack of reported incidents on petrol

engine vehicles is not statistically significant due to the low number of petrol vehicles sold in the Philippines

There is a strong correlation between the incidents and left hand drive vehicles

There is a strong correlation between the incidents and automatic transmissions

There is a higher incident rate on vehicles fitted with variable geometry turbos compared to those fitted with

standard turbos

There is no indication that vehicle age or running distance affects the probability of an incident occurring

Design analysis following an Ishikawa approach revealed that

The engine management and braking systems are independent so the possibility of simultaneous failure of both systems is extremely low

The automatic transmission has no dependence upon the engine management or braking systems and can

be controlled by the driver in any state of engine operation

The automatic transmission has the capability to request an increase in engine torque to the engine

management system, but this interface is disabled within the engine management software

The capability of the braking system is sufficient to counter the effect of full engine torque

There is the possibility for the automatic transmission lever to pop out of park into reverse if not located

properly in the park position. However, creep torque is not sufficient to overcome the hand brake

Root cause hypotheses for brake failure and undemanded engine torque were considered in hypothesis testing. The only plausible root-cause identified that could simultaneously cause unintended acceleration and perceived brake failure was pedal misapplication where the driver pressed the accelerator pedal, believing their foot to be on the brake pedal.

The presence of SUA incidents predominantly in the Philippines appears to be explained by the fact that the other main territories are right hand drive. An initial ergonomics analysis has identified that the foot pedals are displaced further to the left on left hand drive vehicles which makes the left hand drive vehicle more susceptible to pedal misapplication than its right hand drive counterpart.

A suite of EMC testing was conducted which revealed that the vehicle is extremely resilient at very high EMI excitation levels. No adverse behaviour was observed during testing to internationally recognised standards.

Some opportunities for further investigation have been presented to increase confidence in the pedal misapplication hypothesis and seek an explanation for why the incident rate would be higher in the Montero compared to other left hand drive vehicles.

Additional areas for further work have been identified to investigate the possibility of engine management failures resulting in undemanded acceleration, but any such failures would not have any effect on the effectiveness of the vehicle braking systems.




Table of Contents

Table of Figures 6

References 7

1 Introduction 8 1.1 Sudden Unintended Acceleration 8

1.1.1 Known Causes of Unintended Acceleration 9 1.1.2 Driver Mitigation of Undemanded Acceleration 9

2 Initial Problem Definition 10 2.1 CCTV Video Analysis 10

2.2 Analysis of Incident Reports for Manual Transmission Vehicles 16

2.3 IS / IS NOT Analysis 20

2.4 Differences & Changes 22

2.5 Problem Definition Summary 23

3 SUA Claim Statistical Analysis 24 3.1 Vehicle configuration related trends 24

3.2 Vehicle age related trends 26

3.3 Production related trends 28

3.4 Statistical Analysis Summary 28

3.5 Incident Analysis Summary 29

4 Cause & Effect 30 4.1.1 SUA Incident Root Cause Categorisation 31

5 Investigation Plan 32 5.1 Planned Activities 32

6 Montero Design Investigation 33 6.1 Engine Management System 33

6.1.1 Pedal to Torque Request Strategy 33 6.1.2 Engine Idle Speed Controller 33 6.1.3 Internal Influences on Engine Torque Request 34 6.1.4 External Influences on Engine Torque Request 35 6.1.5 Injection Control 35 6.1.6 Supply Voltage Dependencies 36 6.1.7 Exhaust Emissions 36 6.1.8 Miscellaneous 36

6.2 Braking System 37 6.2.1 Brake Pedal 37

6.3 Automatic Transmission 38 6.3.1 Failure modes when P or N are selected: 38 6.3.2 Failure modes when D or R are selected: 39 6.3.3 Parking Lock 40 6.3.4 Shift Interlock 40 6.3.5 Auto Transmission Shifter 41 6.3.6 Miscellaneous 42 6.3.7 Diagnostics 42




6.4 Event Data Recorder 42

7 Vehicle EMC Investigation 44 7.1 Experimental Design 44

7.1.1 Test Selection 44 7.1.2 Mode Selection 44

7.2 Off-Board Radiated Immunity 46 7.2.1 Test Method 46 7.2.2 Test Parameters and Configurations 46 7.2.3 Test Monitoring 47 7.2.4 Test Results 47

7.3 On-Board Fixed Transmitter Test 48 7.3.1 Test Method 48 7.3.2 Test Parameters and Configurations 48 7.3.3 Test Monitoring 49 7.3.4 Test Results 49

7.4 On-Board Mobile Transmitter Test 50 7.4.1 Test Method 50 7.4.2 Test Parameters and Configurations 50 7.4.3 Test Monitoring 51 7.4.4 Locations & Orientations for On-board Mobile Transmitters 51 7.4.5 Test Results 51

7.5 Bulk Current Injection (BCI) to Accelerator Pedal Harness 52 7.5.1 Test Method 52 7.5.2 Test Parameters 52 7.5.3 Test Results 53 7.5.4 Test Result Summary 56

7.6 Extended BCI Testing 58 7.6.1 Test Method 58 7.6.2 Test Parameters 58 7.6.3 Test Results 58 7.6.4 Test Result Summary 63

7.7 BCI Off-Board Coupling Assessments 64 7.7.1 Test Method 64 7.7.2 Test Parameters 64 7.7.3 Test Results 65

7.8 BCI On-Board Coupling Assessments 66 7.8.1 Test Method 66 7.8.2 Test Parameters 66 7.8.3 Test Results 66

7.9 Electrostatic Discharge (ESD) 67 7.9.1 Test Method 67 7.9.2 Test Parameters and Configurations 67 7.9.3 Test Points 68 7.9.4 Test Results 68

7.10 Power Supply Under-Voltage Testing 69 7.10.1 Test Method 69 7.10.2 Test Parameters and Configurations 69 7.10.3 Test Results 69

7.11 Vehicle EMC Testing Summary 70




8 Root Cause Analysis 72 8.1 Comparison of Incident Rates with Production Data 72

8.2 Existing Root Cause Theories 73 8.2.1 Dr Anthony Andersons Theories 73 8.2.2 Dr Ronald Belts Theory 73

8.3 Cause and Effect Analysis 74

8.4 Root Cause Hypothesis Testing 79 8.4.1 EMI Excitation 79 8.4.2 Pedal Misapplication 80

9 Conclusions 81

10 Recommendations for Further Work 83

Appendix 1 Incident Case Studies 84

Appendix 2 Montero Production Data 87

Appendix 3 EMC Test Equipment Lists 93

Appendix 4 BCI Investigations Vehicle 2 97

Appendix 5 Ergonomics Investigation 100

Appendix 6 4D56 Engine Comparison 111




Table of Figures Figure 1 - SUA PQR number by date raised ................................................................................................................... 22 Figure 2 - SUA Claim Distribution by Model Description and Model Year ...................................................................... 24 Figure 3 - SUA Claim Distribution by Engine Type and Engine Management HW and SW Variant .............................. 25 Figure 4 - SUA Claim Distribution by Engine Type and Model Year .............................................................................. 25 Figure 5 - SUA Claim Distribution by Transmission Type and Transmission ECU HW and SW Variant ....................... 26 Figure 6 - Frequency plot of vehicle age at date of SUA incident................................................................................... 27 Figure 7 - Frequency plot of vehicle mileage at point of SUA incident ........................................................................... 27 Figure 8 - Frequency plot of SUA claim vehicles by production date ............................................................................. 28 Figure 9 - Shift Lever Operation ...................................................................................................................................... 41 Figure 10 - Gate Type Shift Lever Example .................................................................................................................... 42 Figure 11 - E216-0785 - BCI Test - APS Cable, Injected Current (Calibrated) .............................................................. 53 Figure 12 - E216-0785 - BCI Test - APS Cable, Measured Current ............................................................................... 54 Figure 13: Vehicle speed during event (Mode 3) ............................................................................................................ 54 Figure 14: Vehicle speed during event (Mode 4) ............................................................................................................ 55 Figure 15: Vehicle speed during event (Mode 2) ............................................................................................................ 55 Figure 16: Vehicle speed during event (Mode 2 repeated) ............................................................................................. 56 Figure 17: Main & Sub - Ambient Voltages ..................................................................................................................... 59 Figure 18: Main & Sub Slight Engine Speed Increase ................................................................................................. 60 Figure 19: Main & Sub Unresponsive Pedal ................................................................................................................ 60 Figure 20: Main & Sub Modulation Frequency of 500 Hz ............................................................................................ 61 Figure 21: Main & Sub Modulation Frequency of 500 Hz = Repeat ............................................................................ 61 Figure 22: Main & Sub Modulation Frequency of 5 kHz .............................................................................................. 62 Figure 42 - Cumulative SUA PQR and Montero Volume in the Philippines ................................................................... 72 Figure 43 - Cumulative Montero Vehicle Volume on Arrival into Philippines .................................................................. 87 Figure 44 - High Level Breakdown by Transmission Type and Fuel .............................................................................. 89 Figure 45 - Quantities by Engine Variant and Model Year ............................................................................................. 89 Figure 46 - Quantities by Transmission Variant and Model Year ................................................................................... 90 Figure 47 - Quantities by Engine & Transmission Combination and Model Year ........................................................... 90 Figure 48 - Worldwide Distribution of Montero Vehicles by Territory.............................................................................. 91 Figure 49 - Quantities of Each Engine and Transmission Combination by Main Territories .......................................... 92 Figure 23 - Layout of the Mitsubishi Montero Foot Controls (Automatic Transmission) ............................................... 101 Figure 24 - Brake Pedal Wear ....................................................................................................................................... 103 Figure 25 H-point manikin installed in a vehicle ......................................................................................................... 105 Figure 26 - Foot Controls: Mitsubishi Montero Figure 27 - Foot Controls: Ford Everest ........................................... 106 Figure 28 - Foot Controls: Land Rover Discovery 3 Figure 29 - Foot Controls: Range Rover Sport ........................ 106 Figure 30 - Foot Controls: Range Rover Sport Figure 31 - Foot Controls: Volvo XC60 ............................................ 106 Figure 32 - Foot Controls: Volvo XC90 Figure 33 - Foot Controls: BMW X3 ........................................................... 107 Figure 34 - Foot Controls: Lexus NX300h Figure 35 - Foot Controls: Mitsubishi Outlander ..................................... 107 Figure 36 - Foot Controls: Mitsubishi Shogun Figure 37 - Foot Controls: Jeep Commander................................... 107 Figure 38 - Foot Controls: All vehicles .......................................................................................................................... 108 Figure 39 - Foot Controls: LHD vehicles only Figure 40 - Foot Controls: RHD vehicles only ................................... 108 Figure 41 - Foot Controls: All vehicles vs steering wheel centreline ............................................................................ 110 Figure 50 - 4D56 Standard and VGT Engine Torque Curves ....................................................................................... 111 Figure 51 - 4D56 Standard and VGT Engine Power Curves ........................................................................................ 111




References Anderson, D. A. (27 June 2012). Mitsubishi Outlander Sudden Acceleration.

Belt, D. R. (2 Aug 2012). A Detailed Electronic Mechanism for Sudden Unintended Acceleration.

Belt, D. R. (n.d.). Who is Dr Belt.

Compton, R. P. (2010). Human Factors Considerations: Unintended acceleration & Pedal Errors. NHTSA Office of Behavioural Safety Research, presentation to the National Academy of Sciences.

Daily News. (2015, 09 07). CCTV Video Footage of Montero SUA Incident at Fire Station Carp Park. Retrieved from Youtube: https://www.youtube.com/watch?v=BVZpoPm72lg

National Highway Traffic Safety Administration. (Feb 2011). Technical Assessment of Toyota Electronic Throttle Control (ETC) Systems. US Department of Transportation.

Reinhart, W. (1994). The Effect of Countermeasures to Reduce the Incidence of Sudden Acceleration Accidents. US Department of Transportation (NHTSA), Paper No. 94 S5 O 07, 821-845.

Schmidt, R. A. (1989). Unintended acceleration: a review of human-factors contributions. Human Factors 31, 345-364.

TV Patrol. (2015, Dec 7). National Media Interview of MMC on the SUA topic. Retrieved from Youtube: https://www.youtube.com/watch?v=AZD7SAodcZQ

TV5. (2015, Dec 4). National Media Report on 'Monstero' Vehicle. Retrieved from https://www.youtube.com/watch?v=S33BDy6v5i8

Wierwille, S. R. (1988). The occurrence of accelerator and brake pedal actuation errors during simulated driving. Human Factors 30, pp. 71-81.




1 Introduction There have been reports of sudden unintended acceleration (SUA) on certain Mitsubishi vehicles operated within the

Philippines. Mitsubishi Motors Corporation (MMC) already conducted an investigation in 2011 and concluded that

there was no defect with the vehicle, suggesting that the cause is driver error or in some cases accelerator pedal

entrapment due to the use of non-approved or poorly fitted floor mats. However, incidents have continued to occur

and a group of owners believe that this is caused by a vehicle malfunction. Videos of a number of these incidents

have been shared widely within the national media so public awareness is high and the negative press is harming

sales (see (TV Patrol, 2015) and (TV5, 2015)). MMC have contracted HORIBA MIRA to perform a further independent

engineering investigation into this topic to assess whether a technical malfunction could be a cause of the SUA

incidents.

It should be noted that to prove a technical malfunction could cause SUA events is relatively easy if the right stimulus

can be found, since it only requires one event to be triggered (proof by contradiction). In contrast, if there is no fault

with the vehicle, proving that a technical malfunction is not the cause is much more difficult since every technical root-

cause hypothesis would have to be investigated in detail and ruled out (proof by exhaustion).

The investigation involves a combination of engineering design analysis, statistical analysis and vehicle testing. The

vehicle testing was performed on vehicles supplied by Mitsubishi Motors Philippines Corporation (MMPC) which had

previously been owned by a member of the public and been subject to a SUA claim.

At the point of starting this investigation, the number of incidents reported totalled 212, of which most are Montero Sport vehicles and 6 being Strada vehicles. The Strada is a body-only variation of the same basic vehicle design, employing an open truck rear body and separate cab, but making use of the same chassis and drivetrain. The focus of this investigation is the Montero vehicle.

Montero vehicles are sold into many territories world-wide, but the number of SUA claims in these territories are negligible compared to those in the Philippines. In the videos of the SUA incidents captured on video (see (Daily News, 2015)), thick black smoke is often emitted from the exhaust and is assumed by the media to be evidence of a technical malfunction. At the outset of this investigation we have identified the following key questions to be addressed:

What is the cause of SUA incidents on the Montero vehicle?

Are the incidents specific to the Philippines region and why?

What is the cause of the black smoke and is it linked to a vehicle malfunction?

1.1 Sudden Unintended Acceleration A media review was undertaken on the topic of Sudden Unintended Acceleration producing the following findings:

Sudden unintended acceleration (SUA) is a term used to describe the drivers perspective of a vehicle accelerating (or

failing to decelerate) against the intention of the driver. It is claimed to occur almost exclusively in automatic

transmission vehicles, generally with drivers over 45 years, within the first few minutes of driving, and generally in an

unfamiliar vehicle or a vehicle not regularly driven.

The term SUA describes the effect of a given failure, not a specific fault or cause. It does not necessarily mean that

the vehicle is accelerating against the drivers command because a drivers command to the vehicle and their

intention may differ.

SUA events have been reported with most major brands of automobile. Incident rates are typically 120 ppm based on

data for 1998 to 2010 model years (Compton, 2010) including Toyota, which have had a high profile investigation by

NASA due to complaints of unintended acceleration. For the Mitsubishi Montero Sport vehicles, there have been 212

incidents within the Philippines out of a population of 91,347 vehicles. This equates to an incident rate of 2320 ppm:

which is far higher.




1.1.1 Known Causes of Unintended Acceleration

There are known causes of unintended acceleration, for which some examples are listed below:

Using thick floor mats can lead to the accelerator pedal getting trapped and not releasing after being

depressed.

Using non fixed mats or having broken retention clips can allow the mat to roll up and clash with the

accelerator pedal and prevent the pedal from releasing after being depressed.

On vehicles with a cable throttle pedal, friction in the cable can prevent the pedal from returning after being

depressed.

The driver unintentionally pressing the accelerator pedal at the same time as pressing the brake can lead to

reduced braking performance which subjectively can feel like acceleration.

The driver intending to press the brake pedal but erroneously pressing the accelerator pedal will lead to the

vehicle accelerating when the driver was expecting the vehicle to slow.

According to Dr Anthony Anderson1, one cause for some unintended acceleration event found across 11

different vehicle manufacturers relates to the interaction between the A/C system and the engine control. Due

to the changing load on the vehicle engine from the A/C system as the compressor turns on and off, the

amount of propulsion torque varies and in some cases the engine speed can also change.

It is also known that for another vehicle manufacturer, unintended acceleration events were caused by poor

battery terminal connections. Intermittent connections lead to temporary reduction in engine torque due to the

drop in supply voltage. The driver pressed the pedal further in an attempt to achieve the expected

acceleration, then when the connection is restored, the engine torque suddenly increased, leading to sudden

acceleration.

1.1.2 Driver Mitigation of Undemanded Acceleration

In the event that a vehicle malfunction causes the vehicle to accelerate without command from the driver, there are a

number of corrective behaviours the driver can take in an attempt to mitigate the hazard.

The most effective mitigation is to apply the foot brake, but it is also possible to disconnect the engine from the road

wheels, shutdown the engine via the ignition or apply the parking brake as summarised in Table 1.

Driver Mitigations

Foot brake Disengage

Clutch

Shift to

Neutral

Apply parking

brake

Turn off

engine

Manual

Transmission

x x x x x

Automatic

Transmission

x x x x

Table 1 - Driver mitigations of undemanded drive torque

In a manual vehicle, the presence of a foot operated clutch gives the driver an additional mechanism to mitigate the vehicle acceleration.

1 Dr Anderson is an engineering consultant from the UK who has investigated the phenomenon of SUA and produced a report in the capacity of an expert witness to support a New Zealand legal case regarding unintended acceleration in a Mitsubishi Outlander. (Anderson, 27 June 2012)




2 Initial Problem Definition This section seeks to define the problem as described by the claimants to understand as much as possible about the scenarios in which the incidents occurred and details about the vehicle or environment that may be linked with the incidents. The information presented here will serve as a basis for developing and testing root cause hypotheses.

The information was obtained from police reports, letters from the claimants CCTV footage, notes recorded by MMC staff during meetings with the claimants and personal interviews with the claimants.

Certain cases are of particular interest. These include those for which CCTV evidence is available and those reported in manual transmission vehicles. Where driver statements were given these are summarised also. Finally, the findings are collated using an IS / IS NOT format and key events in time are presented that could influence the trend of claims with time.

2.1 CCTV Video Analysis In this section our analysis of the CCTV footage is given.




A number of CCTV videos were provided by MMC which show the following:

Veh No.

Description Drive Mode

Exhaust Rate of Acceleration

Braking Engine Temp

MY Engine Trans A/C State

Driver Comments

214 The vehicle is reversing slowly into a road while turning left, then accelerates hard when the driver should be braking, jumping up a kerb and continuing to accelerate hard in reverse for 11s, colliding with a wall before then accelerating forwards for a further 3s before stopping abruptly. Vehicle lights and wipers remain on after the vehicle stops.

R then D

Dark grey exhaust smoke seen shortly after the vehicle hits the kerb.

Gradually increasing, becoming high (full throttle).

No brake lamps observed while the vehicle was reversing. Brake lamps not visible when vehicle started to move forwards.

Unknown Unknown 4D56 2WD 4spd A/T

Unknown The driver claimed that they were pressing on the brake pedal but the vehicle did not stop, and that turning the ignition off is what caused the vehicle to stop.

151 (145)

Vehicle accelerates forwards from standstill down a ramp into basement parking

D Not visible in video, no indication of black smoke

Swift (> 50% throttle)

Not visible in video Unknown 2014 2.5D VGT

2WD 5spd A/T

Unknown None recorded




Veh No.



Braking Engine Temp


Driver Comments

123 (118)

After refuelling, the vehicle accelerates forwards, turns and crashes.

D Not visible in video due to poor quality

Swift (> 50% throttle)

No brake lights seen as vehicle accelerates. Driver must have engaged gear without foot on brake. Brake lights were previously seen to work. Brake lights seen just before impact.

Unknown 2010 2.5D 2WD 4spd A/T

Unknown Driver stepped hard on the brakes but could not stop the vehicle. Vehicle doors would not open for some time after the crash.

120 (115)

Vehicle accelerates in reverse, impacts then accelerates forward, crashing into parked vehicles.

R then D

Lots of black smoke as vehicle impacts in D

High (full throttle)

R selected without use of footbrake. No braking applied until after collision.

Warm 2013 2.5D VGT

2WD 5spd A/T

ON Driver states the hand brake was engaged in N when he entered the vehicle. He then pressed the foot brake and disengaged the hand brake. Driver claims to have applied hand and pedal brakes to try to avoid the collision.

113 (108)

Vehicle drives forwards into a wall.

D No black smoke observed

Cannot be judged due to low frame rate.

Brake lights not visible until impact. Brake lights transition from off to on after impact.

Warm 2012 2.5D VGT

2WD 5spd A/T

ON Driver claims that the engine ran wild and they tried to stop the vehicle using foot and hand brake.




Veh No.



Braking Engine Temp


Driver Comments

109 (104)

Vehicle drives forward into parked motorcycles. Not visible in the video.

D Not visible in the video

High (full throttle) based on driver description

Not visible in video Warm 2010 2.5D 2WD 4spd A/T

Unknown Driver describes starting the car with right foot on the brake pedal. When shifting into D, and releasing the brake pedal the vehicle accelerated very abruptly, knocking over a metal sign and dragging it with concrete base several feet.

90 (86)

Vehicle is edging forwards through a crowd, pauses, then gradually accelerates into the crowd.

D Black smoke seen as the vehicle impacts and is slowed

Slow initially, perhaps restricted by driver braking, then high (full throttle).

Speed indicates more than creep torque. Brake lights had been working, but difficult to see any evidence of braking during the event due to video quality.

Unknown 2012 2.5D VGT

4WD 5spd A/T

Unknown Driver states that the vehicle was operating correctly in drive then started to accelerate out of control.

73 (70)

Reverse gear selected then vehicle accelerates backwards through gates in heavy rain, vehicle stops (presumably under its own brakes) then black smoke is seen.

R Black smoke seen after vehicle is brought to a halt

Swift (>50% throttle)

Reversing lights come on then after a pause the vehicle drives off and appears to be stopped using the brake.


4WD 5spd A/T

Unknown Driver states that they shifted from P intending to reach D but when passing through R the engine accelerated to ~5000 rpm and the vehicle accelerated backwards. After the crash, they selected P and shut the engine off.




Veh No.



Braking Engine Temp


Driver Comments

72 (69)

Vehicle accelerates forward, turning to the left, oversteering then hitting a pillar. Reversing lights appear to light as the rear of the vehicle passes through the angle of the camera. Vehicle appears to be powering forwards consistently until impact.

D Black smoke seen during oversteer after reversing lights become lit until point of impact.

High (full throttle)

Brake lights flash on upon impact.


4WD 5spd A/T

Unknown None available

60 (58)

Vehicle reverses then drives forward over an obstacle (sand bags / rubble) and crashes.

R then D

Black smoke seen as vehicle rides up over an obstacle


Brake lights not visible in the video but brakes must have been used prior to engaging drive.

Warm (parked for 82 mins)

2011 2.5D VGT

2WD 4spd A/T

Unknown Driver reports uncontrolled engine speed when in reverse, and also after shifting to drive. Driver claims to have applied the brakes but failed to stop the vehicle.

57 (55)

Side view only. Vehicle accelerates hard a short distance into a pillar then comes to rest.

D No black smoke seen


Side view only. Accelerates hard into a pillar

Unknown

2012 2.5D VGT

2WD 5spd A/T

ON Driver reports park brake on and shifter in N, feet hanging out of the driver door (sitting sideways), the vehicle suddenly moves forward.




Veh No.



Braking Engine Temp


Driver Comments

37 (36)

Vehicle is stationary, drivers swap, then exhaust issues black smoke just prior to reversing lights being lit and the vehicle accelerates backward into another vehicle, then accelerates forwards into another.

R Black smoke seen prior to reversing lights being lit and vehicle starts to accelerate, there is a pause, then much thicker smoke. After the vehicle starts moving forwards, no smoke until impact.

High (100% throttle)

Full throttle reverse then drive, lots of black smoke, even before vehicle starts to move. Exhaust smoke seen before reversing lights appear. Occurs after change of driver. Footage too poor to see brake lights.

Warm

2012 2.5D VGT

2WD 5spd A/T

ON Owner stated that driver stepped on the foot brake, released the hand brake and shifted from park to reverse. The vehicle shot backwards and collided with another vehicle and without doing anything the vehicle then shot forwards. After multiple collisions, the car finally stopped.

Observer (car owners wife) checked and found that the hand brake was up and gear was in P after the incident.

25 (24)

Occurs after fuelling vehicle with driver still in position. Only seen from front and side. Vehicle reverses then accelerates forward and up a kerb into a shop. Unknown what stops the vehicle.

R then D

Black smoke seen during vehicle acceleration but not upon impact


Rear light state changes after crash, but unclear from what to what.

Warm (after 10 min journey)

2011 2.5D VGT

2WD 4spd A/T

OFF Driver states that the engine was started in P without pressing the accelerator and with hand brake off. The vehicle reverses at speed. After pressing the brake pedal hard, the vehicle stops then shoots forward. The driver said they pressed the brake pedal hard to try and avoid the collision.




2.2 Analysis of Incident Reports for Manual Transmission Vehicles

Veh No.

Description Exhaust Rate of Acceleration

Braking Engine Temp

MY Engine Trans A/C Driver Comments

146 (140)

No video evidence. Dismissed by DTI.

Unknown Unknown Unknown Unknown 2014 2.5L D M/T Unknown Driver claims transmission was in N with hand brake applied and no driver in place, when the vehicle started moving forwards.

148 (142)

Sudden forward acceleration when clutch released and accelerator pedal pressed slightly. Original floor mat is used. No additional information given.

Unknown Unknown Unknown Unknown 2014 2.5L D M/T Unknown Driver stated that vehicle had been left 1.5 hrs in neutral position. Sudden forward acceleration occurred as the clutch was released while the accelerator pedal was pressed slightly.

181 (175)

Driver reports brakes and steering not functioning, causing the vehicle to swerve off the road. Complaint sent to the Department for Trade & Industry (DTI), but did not attend mediation so there is no account of what happened. The complaint was raised Mar 2016 regarding incident in May 2015.

Unknown Unknown Unknown Unknown 2014 2.5L D M/T Unknown None given




Veh No.


Braking Engine Temp


182 (176)

High speed impact to rear of another vehicle GVV-330 with trailer GVC-616. Driver only had a temporary drivers licence. A passenger of the Montero died after the incident. PQR raised in March 2016. Incident happened in May 2015.

Driver and occupants had been on a drinking session. Incident occurred at 1am and police did not breath test the driver.





Veh No.


Braking Engine Temp


183 (177)

Vehicle reversed into a pedestrian and another vehicle when reversing from a McDonalds car park into a two lane dual carriageway. Police requested CCTV footage but it was not provided.

Unknown Unknown Unknown Unknown 2012 2.5 D

VGT

5spd M/T

ON The driver stated that they selected reverse and were pressing the brake pedal ready to release and roll down the slope into the road. As reverse was selected, the engine roared and the vehicle accelerated backwards. The driver claimed that the hand brake was still engaged, the clutch pedal depressed and because the brake pedal did not cause the vehicle to stop, he pulled the hand brake with two hands.




Veh No.


Braking Engine Temp


192 (186)

No description of incident in documentation.

Description from MMC staff is as follows. There was no accident. After a long drive in queuing traffic at night time they felt the vehicle was moving backwards. Claimed the handbrake was on. Could easily have been movement of adjacent vehicles rather than rolling back. Vehicle test shows handbrake holds the vehicle even on an incline.

Drivers cousin is a reporter for one of the largest TV stations. He is the one who called MMPC and demanded immediate attention. A service vehicle was provided within 2hrs.





2.3 IS / IS NOT Analysis

Problem Description

IS IS NOT (but logically could have been)

Considerations

WH

AT

Object Vehicle

Reported in the following vehicles - Montero Sport MY2009

- Montero Sport MY2010





- Strada MY2012

Not reported on other Mitsubishi vehicles operated in the same territory.

Not reported on MY2016 Montero vehicles.

Shift interlock and brake override introduced when?

Reported that 86% occur on 2012 model year and earlier (prior to shift interlock).

From 630,000 Outlanders produced up to Mar 2012, there have been 10 SUA reports globally2

Check if the lack of reports in 2016 MY vehicles is statistically significant.

Transmission R4A5A (4spd Auto RWD)

R5A5A (5spd Auto)

R5MB1 (5spd Manual RWD)

V4A5A (4spd Auto 4WD)

V5A5A (5spd Auto 4WD)

V5MB1 (5spd Manual 4WD)

R5M21 (5spd Manual, not sold in Philippines)

8spd auto (in 2016 MY vehicles)

Check if the sales of V5MB1 are too small for the lack of reported cases being statistically significant.


Engine 4D56 (2.5L Diesel 4 cyl)

4M41 (3.2L Diesel 4 cyl)

6B31 (3.0L Petrol 6 cyl)

6G74 (3.5L Petrol 6 cyl, not sold in Philippines)

4G64 (2.4L Petrol, not sold in Philippines)

2.4L Diesel VGT (in 2016 MY vehicles)

Check if the lack of reports with the 3.0L petrol engine is statistically significant.


Defect Mechanism of Failure

The vehicle accelerates hard either in forward or reverse, usually straight after selecting a gear.

Engine racing while Park or neutral is engaged.

Customer Usage Cycle

Heavy Traffic (lots of idling and low speed operation).

Express way driving.

Short journeys on clear roads.

WH

ER

E First

Observed & Seen Since

After sale to end customer At the production facility or in-territory distributor.

2 Source: Expert report regarding SUA case for vehicle registration DUE287 in New Zealand, report date 27 June 2012, authored by Dr Anthony Anderson.




Problem Description


Considerations

Location Operating in the Philippines Thailand, Indonesia and rest of World

Obtain actual figures of any claims made outside Philippines including claim detail.

Obtain geographical distribution in the Philippines.

WH

EN

Driving Condition

Observed at park or low speed manoeuvring.

When shifting into gear.

Some report incident while in Park

Vehicle Age Under 1 yr to 8 yrs

Vehicle Mileage

~223 km up to 160,000 km

Vehicle State of Maintenance

Battery condition unknown (not checked by MMC until 2016).

Well maintained vehicles.

Vehicles that have had replacement batteries

Environmental Conditions (including seasons)

While raining, in the heat.

Consider if the season has an impact

Time of Day Daytime, evening and night.

Occurrence by operating life cycle

Incidents only reported in the field while in use by the end customer.

Not observed during production and vehicle test drive.

Not observed during vehicle service.

HO

W B

IG

Magnitude 212 vehicle incidents have been reported in the Philippines at the point of starting the investigation.

This equates to 2320 ppm.

Based on worldwide sales of ~405,000, at the incident rate reported in the Philippines, this would correspond to 940 vehicles.

Obtain figures for number of reported SUA events in Montero vehicles in other territories.

HO

W B

IG

Defects per Object

Only one incident has been observed per vehicle.

Multiple incidents on the same vehicle.

Consider what the probability of more than one incident occurring on the same vehicle would be based on the incident rate.




Problem Description


Considerations

HO

W B

IG

Trend Hazard Plot(s)

After the first 10 cases were logged formally by MMC in Jan 2011, claims increased at a fairly consistent rate through to November 2015.

The trend is not exponential which might have been expected if the probability of an incident was dependent on the net operational time of all vehicles on the roads.

2.4 Differences & Changes Figure 1 shows the count of SUA PQRs (Product Quality Reports) as a function of the date raised.

Figure 1 - SUA PQR number by date raised

The first incident was reported in May 2010, then on 10 Jan 2011 the first PQR was raised summarising 10 incidents. Following this, the rate of PQRs being raised was quite consistent until December 2015, when the rate increased significantly. During March 2016 the rate was extremely high and since then the rate has started to reduce. The obvious outlier (count number 100) could indicate a typographical error in the data. The spread in the rest of the data is likely to be caused by the method in which PQR numbers are assigned since a form is completed by MMPC but a PQR number is assigned only once reviewed and approved by MMC Japan, and it is possible that approvals could occur out of sequence.

0

50

100

150

200

250

13-Dec-09 13-Dec-10 13-Dec-11 12-Dec-12 12-Dec-13 12-Dec-14 12-Dec-15 11-Dec-16

SUA

Co

un

t (P

QR

SA

P N

o.)

SUA PQRs by date raised




The table below relates specific events with changes in the incident rate by date. This shows correlation but does not imply causation.

Differences Changes Date

First model introduced to Philippines (2nd generation Montero) as 3.2L D 4x4 A/T and M/T in late 2008 (2009 MY)

No incidents for 2 years Dec 2008

First incident report was in May 2010 and an internet blog was started.

First 10 incidents recorded in MMC PQR system ~6 months later

May 2010

First quality report logged within MMC in Jan 2011 10 incidents recorded in MMC PQR system Jan 2011

Brake override system introduced in vehicles produced from Oct 2011.

No noticeable change in incident rate Oct 2011

Internet blog removed Incident rate reduces slightly over the next 6 months

26 Jun 2012

Shift interlock system introduced in vehicles produced from Sep 2012.

Incident rate remains approximately constant Sept 2012

Active Stability Control (ASC) was introduced as an option in 2014 MY

No observable change Late 2013

Nationwide broadcast of SUA videos in mainstream news during or shortly before Dec 2015

Sharp spike in number of claims Dec 2015

2.5 Problem Definition Summary The descriptions given by the different vehicle owners and drivers are not all the same. All report the engine racing and causing the vehicle to accelerate, most also report that the brakes were not responsive, and some reported that the vehicle moved when park was selected.

Key attributes that define the problem are summarised below:

212 claims have been recorded at the start of this investigation, corresponding to 2320 ppm

There is a significantly higher incident rate in the Philippines compared to other territories

The incidents have been observed on all vehicle model years of this generation

The incidents are predominantly observed on automatic transmission vehicles

The incidents have only been observed on diesel engine vehicles

The vast majority of incidents occur while engaging a gear from park or during low speed manoeuvring




3 SUA Claim Statistical Analysis This section builds on the initial problem definition in Section 2 and presents an analysis of the 212 SUA claims, looking for any trends present within the data.

3.1 Vehicle configuration related trends Figure 2 shows that SUA claims occur on a wide variety of Montero models across all model years.

Figure 2 - SUA Claim Distribution by Model Description and Model Year

Figure 3 shows that the claims occur on all diesel engine variants and with multiple engine management ECU HW and SW versions. Of the SUA claims for vehicles with 4D56 engines, 58% have the variable geometry turbo. Data presented in Appendix 2 shows that of the Philippine Montero vehicle population, only 41% of vehicles with the 4D56 engines are equipped with the VGT. Expressed in another way, the SUA incident rate for 4D56 standard turbo equipped vehicles is 0.16%, but the SUA incident rate for 4D56 VGT equipped vehicles is 0.3%. This bias suggests that the variable geometry turbo may have an influence on the likelihood of encountering a SUA event. The SUA claims are shown against model year in Figure 4. It can be seen clearly how the number of claims are higher in 2011 and 2012. The increase from 2011 correlates with the time when the VGT was introduced.

No SUA claims have been observed on petrol engine vehicles. However, this is not statistically significant, since with the low numbers of petrol engine Montero in the Philippines, even with a high ppm of over 2300, the expected number of SUA events on petrol vehicles would be less than one. Therefore, the data does not suggest that only diesel engine vehicles are susceptible.

0

5

10

15

20

25

30

35

40

45

50

MO

NTE

RO

3.2

L G

LS D

SL A

T

MO

NTE

RO

SPO

RT

2.5

L G

LSD

SL A

T4x2

MO

NTE

RO

SPO

RT

3.2

L G

LS D

SL A

T

MO

NTE

RO

SPO

RT

SE 3

.2L

GLS

DSL

AT

MO

NTE

RO

3.2

L G

LS D

SL A

T

MO

NTE

RO

SP

OR

T G

LS D

SL A

T 4

x2

MO

NTE

RO

SP

OR

T G

LS S

E D

SL A

T4x4

MO

NTE

RO

SP

OR

T G

LS D

SL A

T 4

x2

MO

NTE

RO

SP

OR

T G

LS S

E D

SL A

T4x4

MO

NTE

RO

SP

OR

T G

TV D

SL A

T 4

X4

MO

NTE

RO

SPO

RT

GLS

VG

T D

SL A

T4x2

MO

NTE

RO

SP

T G

LS V

2.5

D 2

WD

AT

MO

NTE

RO

SP

T G

LX 2

.5D

2W

D A

T

MO

NTE

RO

SP

T G

LX V

LE

2.5

D2

WD

MT

MO

NTE

RO

SP

T G

T-V

2.5

D 4

WD

AT

MO

NTE

RO

SP

T G

LS V

2.5

D 2

WD

AT

MO

NTE

RO

SP

T G

LS V

2.5

D 4

WD

MT

MO

NTE

RO

SP

T G

LX 2

.5D

2W

D A

T

MO

NTE

RO

SP

T G

LS V

2.5

D 2

WD

AT

MO

NTE

RO

SP

T G

LX 2

.5D

2W

D A

T

MO

NTE

RO

SP

T G

LX 2

.5D

2W

D A

T SE

MO

NTE

RO

SP

T G

LX 2

.5D

2W

D M

T

MO

NTE

RO

SP

T G

T-V

2.5

D 4

WD

AT

2009 2010 2011 2012 2013 2014

SUA VIN Count by Model Description and Model Year

Total




Figure 3 - SUA Claim Distribution by Engine Type and Engine Management HW and SW Variant

Figure 4 - SUA Claim Distribution by Engine Type and Model Year

Figure 5 shows the SUA claim distribution against transmission variant, and transmission ECU HW and SW versions. SUA incidents have been reported on both manual and automatic variants, and with various combination of hardware and software. Of the 212 cases, 206 relate to automatic transmission which is 97%. In the Philippines the proportion of automatic transmission vehicles is 72%. This strong bias towards automatic transmissions suggests that the automatic transmission is linked to the increased number of SUA incidents.

0

10

20

30

40

50

60

70

18

60

A8

91

18

60

B1

67

18

60

B5

52

18

60

B5

52

18

60

C1

81

18

60

C2

71

18

60

C2

71

18

60

A8

91

18

60

B6

88

18

60

C0

20

18

60

B7

91

18

60

C0

20

18

60

C2

75

18

60

A7

66

18

60

B5

61

18

60

A7

66

112500 131300 131302 131302 NoRecord

131300 131302 131302 112200 131300 NoRecord

4D56 4D56 VGT 4M41

SUA VIN Count by Engine Type and Engine Management ECU HW and SW versions

0

10

20

30

40

50

60

4D56 4M41 4D56 4M41 4D56 4D56 VGT 4M41 4D56 4D56 VGT 4D56 4D56 VGT 4D56 4D56 VGT

2009 2010 2011 2012 2013 2014

SUA VIN Count by Engine Type and Model Year




Figure 5 - SUA Claim Distribution by Transmission Type and Transmission ECU HW and SW Variant

3.2 Vehicle age related trends Figure 6 shows the distribution of vehicle age at the point of the SUA incident. The general trend is that the frequency of incidents drops with increasing age i.e. an inverse linear characteristic. This is not surprising as all 91,000 vehicles in the Philippine market have experienced being new, but only the first sold have experienced being 7 years old and then number of these are far less. As the number of vehicles in the Philippines has increased linearly with time (Figure 26), if the SUA events were entirely random, we would expect the frequency to reduce linearly with age. The characteristic observed in the data is very similar which suggests that the SUA events are not linked to wear and tear of the vehicle. The low number of incidents when the vehicles are very young (within the first 50 days) is interesting but may be explained by the driver taking extra care as they get used to the vehicle.

Figure 7 shows the distribution with vehicle mileage also follows an inverse linear characteristic. This also suggests that the SUA events are not related to wear and tear on the vehicle.

59

47

59

33

14

4

14

44

1

13

68

0

5

10

15

20

25

30

35

40

45

50

D34505 NoRecord

D34503 D34804 NoRecord

D49201 D49802 D34804 D49603 D49602 D50302 D50301 N/A N/A

8631A615 8631A618 8631A9778631B0148631B016 8631B007 8631B019 N/A N/A

4A/T 5A/T 5M/T N/A

SUA VIN Count by T/M Type, T/M ECU H/W and S/W Part Numbers




Figure 6 - Frequency plot of vehicle age at date of SUA incident

Figure 7 - Frequency plot of vehicle mileage at point of SUA incident

280024002000160012008004000

30

25

20

15

10

5

0

Age (days) at incident date

Fre

qu

en

cy

Histogram of Age (days) at incident date

1500001200009000060000300000

30

25

20

15

10

5

0

Odometer (km)

Fre

qu

en

cy

Histogram of Odometer (km)




3.3 Production related trends Figure 8 shows the distribution of SUA claims with production date of the vehicles. This does not show a clear trend. If the probability of experiencing an SUA incident was proportional to the length of time the vehicle had been operating for, we would expect this also to follow an inverse linear characteristic.

However, the characteristic observed is more similar to a normal distribution. This could suggest that between 2008 and 2010 something changed that made the vehicles more susceptible to SUA incidents. Vehicles produced between March 2010 and March 2012 have significantly higher incident rates than subsequent years.

Figure 8 - Frequency plot of SUA claim vehicles by production date

3.4 Statistical Analysis Summary The following observations were made from analysis of the SUA claims:

SUA events have occurred on all model years and trim levels

There is a marked bias towards VGT equipped diesel engines which were introduced in 2011

Although no events have been recorded on petrol engine vehicles, petrol engine vehicles may still be

susceptible

There is a very strong bias towards automatic transmission vehicles, suggesting that the automatic

transmission is related to SUA events

The SUA events do not correlate to any specific auto transmission or transmission ECU variant

The age or mileage of the vehicle appears to have no impact on the likelihood of an SUA event occurring

Vehicles produced between March 2010 and March 2012 have significantly higher incident rates than

previous and subsequent years.

02-Mar-1502-Mar-1402-Mar-1301-Mar-1202-Mar-1102-Mar-1002-Mar-0901-Mar-08

30

25

20

15

10

5

0

PRODUCTION DATE

Fre

qu

en

cy

Histogram of PRODUCTION DATENormal




3.5 Incident Analysis Summary In most cases, the floor mats used were genuine.

In most cases, the events occurred with the vehicle stationary or manoeuvring at low speed, so engine at idle speed.

The events occurred mainly during transition from P or N to D or R, but also while D was engaged.

In most cases, the A/C was turned on.

In most cases, the events occurred when the engine was warm, so the idle speed would not be elevated due to low engine temperature (~650 rpm or ~900 rpm with A/C on).

The incidents occurred on road surfaces that were predominantly flat, not on significant inclines.

Incident reports state that the driver braked but that braking was ineffective. In some cases, there were no brake lights visible, which indicates that it is unlikely that they were pushing the brake pedal. However, this could be caused by a brake system failure.




4 Cause & Effect The following table summarise our analysis of relevant systems, functions and external influences that could contribute to the SUA incidents and require further investigation.

System / Category Cause Description Possible Effect

Accelerator Pedal Assembly

Stuck accelerator pedal Unexpected acceleration

Engine Management Software malfunction Unintended acceleration

Engine Management Supply voltage dips or poor grounding causing brown-out

Unintended acceleration

Engine Management DMA transfer error (Belt D. R., 2 Aug 2012) Unintended acceleration

Engine Management Random corruption of SRAM data (Belt D. R., 2 Aug 2012)


Cruise Control Erroneous cruise control activation Unintended acceleration

Braking System Vacuum pump failure Impaired braking performance

ABS / ASC Solenoid failure Impaired braking performance

ABS / ASC Software malfunction Impaired braking performance

ABS / ASC Loss of electrical power to the ECU or solenoids

Loss of ABS / ASC functionality

Transmission Improper retention in park position Unintended acceleration

Transmission ECU Erroneous selection of drive gear when shifter is in N or P


A/C Interaction with engine management causing increased engine torque


Environmental Conditions

Humidity influencing PCB function Unknown

Environmental Conditions

EMI Unintended acceleration

Component ageing Humidity influencing connectors Unknown

Component ageing Tin whiskers Unknown

Manufacture Tolerances

Intermittent harness connections Unknown

Driver Behaviour Floor mats retain accelerator pedal in fully depressed position

Unexpected acceleration

Driver Behaviour Pedal misapplication Unintended acceleration and lack of braking simultaneously

Table 2 - Cause & Effect Table




4.1.1 SUA Incident Root Cause Categorisation

The possible causes of the SUA incidents in the Montero could be categorised into a number of groups:

Driver behaviour

Hardware malfunction

Software malfunction

Systematic design error

With the driver behaviour category, the vehicle has not malfunctioned so it is unlikely that any evidence would be

available to prove this as a root cause. In the case of fitting inappropriate floor mats, the drivers operation of the foot

pedals may be correct but the vehicle does not respond according to their command at the pedals. In the case of

pedal misapplication, the drivers command to the vehicle differs from the drivers intention and the vehicle will

respond to the pedal command rather than the drivers thoughts of what they want the vehicle to do. In both cases, the

driver may believe they have operated the vehicle correctly.

Hardware malfunction could include stuck accelerator pedals, electronic component malfunction (including engine

management ECUs) and stuck fuel injectors, for example. Such hardware errors are typically repeatable and therefore

easy to diagnose and solve. On-board diagnostic systems are designed to detect such failures and mitigate the effect

by causing the vehicle to revert to a safe-state such as a limp home mode. If detected, the event is also recorded in

the memory of an ECU which can serve as evidence.

Software malfunctions occur because the software is incorrect, meaning that it has been designed or implemented

incorrectly. As such, if the same circumstances occur again, the software will malfunction again in the same way.

Although this means a software malfunction is repeatable, due to the complexity of software, it could be very difficult

to repeat the same conditions. Although software diagnostic functions may exist, it is quite likely that these would not

detect the failure if the failure was missed in the design phase.

Systematic system design errors imply that the vehicle systems have been designed incorrectly or configured

incorrectly. For example, the sizing of a vacuum pump may be sufficient for a base vehicle with brake booster and

ABS only, but may not be sufficient for a vehicle with additional systems making use of vacuum pressure, leading to

degraded braking performance in certain use cases. Again, as these errors are systematic, whenever the conditions

occur the problem will reoccur so the malfunction would be repeatable. However, the erroneous behaviour is unlikely

to be detected as a fault as each system is operating correctly to its own requirements.




5 Investigation Plan To target the investigation, a cause and effect analysis was conducted to identify relevant systems, functions and external influences that could contribute to the SUA events reported.

5.1 Planned Activities Based on our analysis of the problem, we have identified the following areas for investigation that will provide a wide coverage of the potential root-cause categories described above:

Design analysis of vehicle systems for which failure could cause increased engine torque, braking failure or

failure to engage park

EMC screening tests to assess any possible external excitation that could cause increased engine torque

Ergonomics analysis to identify if there is anything unusual about the layout or operation of the main vehicle

controls that could make the vehicle more susceptible to pedal misapplication

Based on the outcomes of the above, root cause hypotheses will be generated and assessed for how well

they fit the problem definition

MMC have provided three vehicles that have been subject to a SUA claim to support testing as follows:

VIN Engine Transmission Drivetrain Trim Level Model Year

MMBGRKG40AF010591 4D56 4spd Auto 2WD GLS 2010

MMBGYKH40BF019057 4D45 VGT 5spd Auto 4WD GTV 2011

MMBGYKG40CF022879 4D56 VGT 5spd Auto 2WD GLS V 2012




6 Montero Design Investigation To identify plausible failures that could lead to increased engine torque, we have selected to assess the functional design of the engine management system consisting of engine management ECU and accelerator pedal assembly. To identify plausible failures that could lead to braking malfunction, we have selected to assess the functional design of the hydraulic braking system and ABS / ASC (Active Stability Control) systems. To identify plausible failures that could lead to acceleration occurring in contradiction to the shift level position, we have selected to assess the functional design of the automatic transmission.

During our investigations a number of additional aspects of the vehicle design were investigated to get an overview of the whole vehicle architecture and systems, but this report only presents information on the systems found to be pertinent to the conclusions.

6.1 Engine Management System The engines in the Montero Sport vehicles are electronically controlled by an engine management ECU and electronic pedal assembly. The same ECU and common rail system is also used in the Mitsubishi ASX vehicle although with different engine mechanical components.

The engine management supplier state conformance to JSAE standards (no specific standards mentioned) but not MISRA, IEC 61508 or ISO 26262. MMC were not permitted by the supplier to release the software specification for detailed review by HORIBA-MIRA.

The engine management system uses a heartbeat type signal from a separate microprocessor for part of the safety case. A detected failure in this system will cause an ECU reset which turns off the injectors. No redundant second path is used in this engine management system.

The engine torque command is generated primarily from a set of gain scheduled pedal position to torque maps to which an idle speed torque request is summed since the base torque and pedal to torque maps are not sufficient to maintain idle speed. The engine torque command is then transformed into an injection quantity and actuated.

6.1.1 Pedal to Torque Request Strategy

The pedal position is determined using two individual sensors with slopes in the same direction but with different gradients. The pedal position is diagnosed using Out of Range and Out of Correlation checks to determine the validity of the signals. This is an industry standard way of diagnosing pedal validity.

It should be noted that the Out of Correlation check has a failure limit of 18% which is higher than is generally used. However, without detailed knowledge of the pedal to torque calibrations it is unknown if this is an acceptable limit.

The validated pedal position is then fed into the torque controller. This performs a look-up based upon pedal position, transmission type/gear and engine speed to produce a pedal torque request. The pedal torque request is then processed by the torque controller in order to include items such as idle speed control torque inputs, cruise control torque requests, transmission torque limits, minimum and maximum torque limits, ASC torque limits and smoothing functions. The output from the torque controller is a Final Torque Target.

6.1.2 Engine Idle Speed Controller

The idle speed controller operates when the engine speed is below 1400 rpm, and contributes a positive engine torque command within the range [0, 500] Nm, so has full torque authority over the engine. This means that the idle speed controller has the ability to increase the torque of the engine but this should not cause the engine to race as it cannot act above 1400 rpm.

The target speed is set dependent upon the engine coolant temperature to either 900 rpm (cold) or 650 rpm (hot).

For the A/C system, although there is no feedforward term in the idle speed control torque term, through vehicle testing it is observed that the idle speed set-point is increased when the A/C is turned on (MMC stated that there is no feedforward terms to compensate for additional loading such as when the A/C compressor turns on).




The controller always operates in closed loop feedback control mode regardless of whether the transmission is disconnected (in P or N) or a gear is engaged (D or R). Different maps are used for these two cases although the calibration is the same. The control structure is based on a classical PID scheme with some application specific modifications.

There are no slew rate limits applied to the idle speed torque command.

6.1.3 Internal Influences on Engine Torque Request

Function Request Type Description Limiting Conditions

Lambda control Maximum torque limit Lambda torque limit is applied at high engine loads to limit the lambda in order to reduce emitted tailpipe smoke.

The limiting is calibrated such that it will reduce the torque request at high engine loads.

Cruise control Torque increase request Cruise control torque request acts in the same manner as the base torque request from the pedal to torque maps

Activation and resume allowed only above 40 km/h.

Disabled if brake pedal is depressed.

Disabled if clutch is depressed (manual T/M).

Disabled upon ASC intervention.

Not allowed if an engine fault is detected or cross-check between dual brake pedal sensors fail.

Idle speed control Torque increase / decrease request

Additive torque request used to control the idle speed. This can increase and decrease the engine torque. (Described in more detail above)

Torque request is removed above 1400rpm.




6.1.4 External Influences on Engine Torque Request

The engine torque request is calculated primarily from the accelerator pedal position. However, other systems can also make torque requests as defined below:

System Request Type Description Limiting Conditions

Transmission Torque reduction request Engine torque limit reduces with high oil temperature

Torque reduction request Engine torque limit reduced for shift

Torque increase request Torque increase command can be applied but is not used in the Montero

Torque increase is not possible in the Engine management system.

Active Stability Control Torque reduction request Engine torque limit reduces during ASC interventions

Torque reduction request Engine torque limit reduces during traction control interventions

Air Conditioning Idle speed increase request

Engine idle speed target increases when A/C is turned on, causing the engine to produce more torque to achieve the increased idle speed

Limited to a maximum engine speed of 1400rpm due to implementation in idle speed controller

ABS No request

6.1.5 Injection Control

The injection control is based upon a series of lookup maps that are calibrated specifically for the engine. The basic strategy is described below:

The overall fuel injection quantity is based upon a map that uses Final Torque Target and engine speed to produce a fuel injection volume.

Any pilot, pre or post injections are calculated from a map using Final Torque Target and engine speed as inputs.

The main fuel injection quantity is calculated by subtracting the pilot, pre and post injection quantities from the overall injection quantity.

The injection sequence and the position of the main injection is based upon a series of lookup maps using engine temperature, final target torque and engine speed as inputs.

A map is then used to determine the injector opening time based upon the fuel pressure and quantity. No compensation is performed based on fuel temperature.

Engine temperature is not used to compensate the amount of fuel injected.




6.1.6 Supply Voltage Dependencies

Supply voltage sampling is used for the following functions:

Linear solenoid control for VGT Look-up table based, only for high power 4D56 engine.

Electric throttle valve Look-up table based compensation to ensure throttle remains fully open on the diesel

engines while running. Erroneous control can only lead to reduced air-flow.

EGR valve position control Look-up table compensation. Affects air only, not fuelling.

There is no compensation on injectors or fuel pressure based on supply voltage.

If there is a sharp drop in supply voltage, the engine management ECU goes into a brown-out mode. When the voltage recovers, the system resets and comes back to life with all injectors off i.e. the engine is cut and needs to be restarted.

It is possible that an erroneously low sample of supply voltage could cause the turbo to provide excessive boost, but as there is no fuelling compensation based upon air flow or Lambda. The only influence of Lambda on the system is to reduce torque in high load conditions in order to reduce emitted tailpipe smoke.

6.1.7 Exhaust Emissions

The incidents often involve black smoke being emitted from the exhaust which was perceived as due to an engine malfunction. However, this was investigated and found to be normal behaviour for the vehicle under certain conditions. Typical conditions are low speed stop-start driving, causing the exhaust system to store excess soot, then during high load acceleration this soot is ejected from the exhaust. It has been confirmed in vehicle tests that this can occur simply by pressing the accelerator pedal while in neutral.

6.1.8 Miscellaneous

If the ignition is turned off when the engine is at high speed, the engine cuts. There is no keep alive function.




6.2 Braking System The vehicle braking system is a conventional vacuum power assisted diagonally split hydraulic system with anti-lock braking as 100% fitment and active stability control as an option from the 2010 model year. The same part is also reported to be used on competitor vehicles, but for the Montero there is an MMC-specific calibration. The system employs two discrete hydraulic circuits, one for the front left and rear right wheels; the other for the front right and rear left wheels. Vacuum pressure for the brake booster is provided by a vacuum pump which is powered by the engine rotation. The same vacuum system also provides a vacuum feed for the diff-lock on 4x4 vehicles and actuation of the vane angle control on the variable geometry turbo engines.

The ABS system is of standard base design, releasing pressure from individual brake callipers when wheel-lock is detected.

The optional ASC system adds in two additional functions to the standard ABS system:

Stability Control: This system compares measured yaw with a yaw rate threshold determined from vehicle

speed and steering position. Yaw rate is controlled by selectively braking individual wheels and also reducing

an engine torque limit.

Traction Control: This system is achieved by braking the fastest spinning wheel to ensure no more than 5

km/h faster than the lowest wheel speed and setting a torque limit to reduce the engine torque

The amount of slip / wheel-lock is measured using wheel sensors that are hard-wired into the ABS / ASC controller.

Mechanical failure modes have been identified that could lead to degraded braking performance or loss of braking, but the effect would persist for all subsequent journeys until fixed. This does not fit with the incident reports of SUA, so we concentrated on identifying failure modes that could cause a temporary loss of braking performance.

Failure of the vacuum pump will not cause the brake booster to fail since there is a one-way valve that maintains vacuum in the brake booster, allowing for 2-3 hard braking events after pump failure.

For 2010 model year vehicles and later with ABS and ASC, there are 10 solenoid controlled valves that are managed by the ABS / ASC controller. Two failure mechanisms have been identified that could temporarily inhibit braking capability:

If two specific valves are closed erroneously in either hydraulic circuit, the fluid flow from the master cylinder is

prevented, so the pedal would become very hard and inhibit the driver applying any braking force.

If two specific valves are opened erroneously in both hydraulic circuits (4 in total), the pedal would become

very soft and push all the way to the floor without achieving any braking force.

The two failure mechanisms above require the braking controller to erroneously actuate specific combinations of the solenoid valves. To judge how plausible they are would require in depth analysis of the braking controller.

This failure mode would also give a very distinctive feel to the pedal which was not reported in any of the cases.

6.2.1 Brake Pedal

The brake pedal assembly contains a switch to illuminate the brake lamp. Based on standard adjustment, the brake pedal would move by ~10-14mm before the brake lamp will illuminate, and the free travel of the pedal is between 3 and 8mm, so it is normal that some force would be applied at the pedal before the brake lamps illuminate. This means that if it was possible for a braking system failure to prevent brake pedal movement, the brake lamps may not illuminate.

Having reviewed the electrical circuit controlling the brake lights, no plausible failures modes were found that could temporarily prevent the brake lamps from illuminating when the pedal is pressed past the point at which the switch is activated.

The mass and mass centre position of the brake pedal assembly was checked to determine whether in a frontal impact the momentum of the pedal could cause the pedal position to change and cause the brake lights to illuminate. Even in high-g crash tests, it is not normal for this to occur. HORIBA-MIRA crash specialists assessment of the Montero brake pedal assembly is that if the drivers foot is not on the brake pedal, the brake lights would not illuminate even in a frontal impact. For the brake lights to illuminate upon impact, it implies that one of the drivers legs has been thrown forward (or at an angle) in the impact and moved the pedal.




6.3 Automatic Transmission The automatic transmissions used on the Montero Sport were designed in the 1990s. The transmissions comes in two main variants, a 4spd and a 5spd. 4x4 variants have an additional transfer box with diff-lock but make use of the same main gearbox. The transmission is a basic design, making use of a combination of mechanically controlled and solenoid controlled hydraulic valves to actuate the clutches that engage the transmission and select gear ratios. The safety concept is primarily provided by the mechanical design.

2WD transmissions power the rear wheels only

4WD transmissions can operate in two modes:

4WD mode

2WD mode where rear wheels are powered only

The shift lever is mechanically connected to a main valve that diverts hydraulic fluid to different hydraulic circuits.

When P or N is selected, no hydraulic pressure is provided to any of the hydraulic circuits that can connect the input shaft to the output shaft.

When R is selected, hydraulic pressure is provided to the reversal gear and the transmission ECU can engage or disengage the torque path by controlling another clutch via a solenoid. If the vehicle is moving forward at a speed above 7 km/h, When R is selected, the ECU will not engage the gear which results in a false neutral.

When D is selected, hydraulic pressure is not provided to the reversal gear, but the transmission ECU actuates different combinations of solenoid controlled valves to engage gears of different ratios. If the vehicle is moving in reverse at a speed above 7 km/h, the ECU will not engage the gear which results in a false neutral.

6.3.1 Failure modes when P or N are selected:

Because the main valve does not provide hydraulic pressure to the solenoid controlled valves when P or N are selected, for a properly calibrated transmission, it is not possible for engine torque to be applied to the road wheels when either P or N are selected. If the calibration between shift lever position and main valve position is poor, it is plausible that the main valve position could differ from the selector position sensed electrically by the transmission ECU. The effect of such poor calibration would be obvious to the driver and require corrective maintenance but could not lead to undemanded transfer of engine torque to the driving wheels without simultaneous failure of the transmission ECU or solenoid valves. The different out of calibration scenarios and their effects on torque transfer through the gearbox are described in Table 3:




Main Valve Position

Electrically Sensed Shifter Position

Effect on Torque Transfer

P R No torque transfer as main valve does not supply hydraulic pressure to solenoid controlled valves

R P No torque transfer as although the main valve applies hydraulic pressure to enable reverse gear, the transmission ECU controls the solenoid valves to engage park (neutral)

R N No torque transfer as although the main valve applies hydraulic pressure to enable reverse gear, the transmission ECU controls the solenoid valves to engage neutral

N R No torque transfer as although the transmission ECU would control solenoid valves to select reverse, the valves would receive no pressure from the main valve

N D No torque transfer as although the transmission ECU would control solenoid valves to select drive, the valves would receive no pressure from the main valve

D N No torque transfer as although the main valve applies hydraulic pressure to enable drive, the transmission ECU controls the solenoid valves to engage neutral

Table 3 - Transmission Out of Calibration Effects

Based on the above, we conclude that it is not plausible for there to be a temporary failure mode that could result in undemanded transfer of engine torque to the driving wheels when P or N is selected.

6.3.2 Failure modes when D or R are selected:

When the driver selects D or R, the transmission ECU and solenoid controlled valves influence the behaviour of the transmission. Plausible failure modes identified are the following:

Failure to engage the gear (lack of drive torque)

Loss of gear engagement (loss of drive torque)

Intermittent gear engagement (intermittent drive torque)

Erroneous gear selection (incorrect ratio)

Locked transmission (locked drive wheels)

It is not possible for the transmission to engage reverse when the shifter is in D or engage a forward gear when the shifter is in R as the clutch controlling the reversal gear is actuated only by the main valve.




6.3.3 Parking Lock

The parking lock is a mechanically sprung pin that is brought into contact with the output shaft when the shifter is moved into the P position and mates with slots located around the circumference of the shaft to mechanically lock the shaft in position and prevent vehicle movement. Depending upon the orientation of the output shaft when the shifter is moved to the P position, the pin may not immediately engage with the shaft. However, for a correctly calibrated transmission, any small rotation of the shaft (for example when the driver releases the foot brake) will cause the pin to engage.

From vehicle tests performed in the UK, it was found that if the shift lever is not pushed fully into the park position, it could rest in that position for some time then spring back into reverse automatically. This could potentially lead to unintended acceleration in reverse if the hand brake is not also applied. If this were to happen, the rate of acceleration would be low assuming that the engine is running at idle speed. For this failure to result in a high rate of acceleration, an additional independent failure would be required causing the engine to apply high torque. By design, the transmission ECU will not increase the engine torque command.

6.3.4 Shift Interlock

In Montero Sport vehicles produced before September 2012 there was no shift interlock or key lock fitted.

Shift interlock requires the brake to be pressed in order to move out of park. The absence of a shift interlock

allows the driver to engage a driving gear without their feet on the pedals, meaning that they are not prepared

to be able to control the vehicle.

Key Lock prevents the ignition keys from being removed without first selecting park position of the

transmission shift lever.

These issues have been addressed in all vehicles produced from September 2012. A solenoid controlled latch at the shifter engages when park is selected and releases only when the brake pedal is pressed, so the driver has to press the brake pedal and squeeze the button on the lever in order to shift out of park.

This shift interlock may also prevent the shifter popping out of park as described in Section 6.3.3. However, this has not been evaluated as a test vehicle of this age has not been provided.

The inclusion of a solenoid latch in the ignition barrel also prevents the keys bein

report montero sua concern...

Documents