July 17, 2014
In December 2009, as Toyota faced increasing scrutiny from Congress and the National Highway Traffic Safety Administration in the wake of the horrific unintended acceleration crash in that killed California Highway Patrolman Mark Saylor, his wife, daughter and brother-in-law, the automaker’s image-makers were prepared to go on the offensive. According to an April 2013 article in Corporate Counsel, a Toyota public relations staffer named Masami Doi wrote this email:
There are at most around 10 people who are the sources of negative tone communications. If they can be suppressed, I think we will be able to manage it somehow. Like you said, let’s go with an intention of destroying each individual person’s ability to oppose us, one by one. (To do or not to do is a separate question.)
We do not know who exactly suggested destroying each individual, but we know they tried. We know that the list at least doubled. And we know that Toyota is using Betsy Benjaminson, a private translator-turned-whistleblower who released sensitive internal Toyota documents to Corporate Counsel magazine and Iowa Senator Charles Grassley during the Toyota Unintended Acceleration crisis, as a battering ram to get at more of them.
On August 20, Benjaminson is
scheduled to be deposed in the Los Angeles offices of Skadden, Arps, Slate, Meagher & Flom LLP and to produce a slew of documents, including all communications with 20 people who have challenged Toyota’s narrative that there were no possible electronic causes of the unintended acceleration. They range from SRS president Sean Kane, to British automotive electronics experts Keith Armstrong and Antony Anderson, NASA scientists Norman Helmhold and Henning Leidecker to journalist Junko Yoshida, to Michael Barr, an embedded software specialist whose withering assessment of the safety, testability, and functionality of Toyota’s software resulted in the first jury verdict against Toyota in a UA case.
Ostensibly, Toyota is searching for the link between Benjaminson and a presentation Barr made to that jury, entitled “2005 Camry L4 Software Analysis.” While a public version, with redacted slides of some sub-routines is available, Benjaminson has posted the presentation in its native format on her website, and that has provided the opening for Toyota to go fishing for retaliatory evidence against its critics. (A legal defense fund has been set up for Benjaminson
https://www.indiegogo.com/projects/betsy-benjaminson-legal-defense-fund.) This latest legal move is of a piece with Toyota’s aggressive stance toward entities that have dared to challenge the automaker’s public relations.
Like some corporate version of Agatha Christie’s Ten Little Indians, Toyota first tried to take out Kane and Southern Illinois University automotive electronics professor David Gilbert. SRS had begun reporting on the problem in 2009, before the Saylor crash, produced several reports,
based on public documents, on the roots of the crisis. Kane also testified before the House Committee on Energy and Commerce and the National Academies of Science that the record didn’t support Toyota’s assertion that electronics were not to blame for some of the complaints.
Gilbert got in Toyota’s crosshairs when he conducted a preliminary study for Safety Research & Strategies that showed that a short circuit in the Accelerator Pedal Position Sensor could cause Toyota’s Electronic Throttle Control to go to a wide-open condition, without setting a Diagnostic
Trouble Code. Gilbert also presented his findings to Congress.
Toyota hired the Benenson Strategy Group, a prominent public relations consultant, to develop the best lines of attack against the two. And they tested the messaging, via an online poll that asked the survey takers to judge Kane’s and Gilbert’s credibility.
Toyota criticized Gilbert’s work in a web-based press conference. Toyota, which had donated vehicles, provided internships and networking opportunities for SIU’s Automotive Technology students, sent its attorneys to Southern Illinois University Carbondale to discuss their concerns with university officials. Terry Martin, manager of customer quality at Toyota and Neil Swartz, an SIUC alumnus and corporate manager for distribution in Toyota’s North American Parts division, resigned from the department’s advisory board. Mark Thompson, an SIU alum and a Toyota Motor Sales employee, e-mailed the school’s chancellor to suggest that Gilbert be fired and that Toyota might pull its support from the program.
Toyota unleashed the Cracken on James Sikes, a California Prius owner, who had the audacity to experience a UA on a San Diego highway in March 2010 as Toyota was conducting its press conference trashing Gilbert’s work. Sykes, a 61-year-old Prius owner alleged that his vehicle accelerated suddenly and would not respond to hard braking. His struggles to regain control of his vehicle were observed by a California Highway Patrol officer, who was called to the scene, and recorded on a 911 tape. The police report noted that the Prius’ brakes were burnt out and that an examination of Sykes’ vital signs by emergency medical personnel immediately after the event showed he had very high blood pressure and heart rate. The police did not charge Sykes. Toyota held another press conference to announce that a preliminary examination showed that Sykes had depressed the brakes 250 times. Toyota officials suggested, without saying so, that Sikes faked the event. Meanwhile, news outlets also reported many unflattering details of Sykes personal life, alerted by “anonymous tipsters.” His lengthy 911 call is a sound portrait of a man in extreme stress, and if he was perpetrating a hoax, he should consider a career in acting.
Sikes, an easy target, faded from public view; Gilbert was not fired; SRS continued to report on Toyota UA, but in large measure, Toyota was successful in fending off challenges to its version of reality. NHTSA, itself compromised by serial fruitless investigation into the problem, opted for a political solution by engaging the NASA Engineering Safety Center to validate its technical failures and make the whole thing go away. Various ill-informed commentators amplified the message. Toyota won some civil cases and settled the ones with fact patterns that would be hard to defend before a jury.
Then came the Bookout verdict and it was suddenly game over. In September 2007, Jean Bookout and her friend and passenger Barbara Schwarz were exiting Interstate Highway 69 in Oklahoma in a 2005 Camry, when it experienced an unintended acceleration. Bookout tried to stop her car by pulling the parking brake, leaving lengthy skid marks. Her Camry continued to rocket down the ramp, stopping only after its nose was embedded in an embankment. Schwarz died of her injuries; Bookout spent two months recovering from head and back injuries.
Toyota, perhaps, thought it would play the confused old lady card at trial. But last October, an Oklahoma jury heard testimony from Barr, who spent nearly 20 months reviewing Toyota’s source code at one of five cubicles in a hotel-sized room, staffed by security guards, who ensured that entrants brought no paper in or out, wore no belts or watches. And his testimony forced Toyota to hastily settle the suit – hours after the jury determined that the automaker acted with “reckless disregard,” and delivered a $3 million verdict to the plaintiffs – but before the jury could determine punitive damages.
There are a large number of functions that are overly complex. By the standard industry metrics some of them are untestable, meaning that it is so complicated a recipe that there is no way to develop a reliable test suite or test methodology to test all the possible things that can happen in it. Some of them are even so complex that they are what is called unmaintainable, which means that if you go in to fix a bug or to make a change, you’re likely to create a new bug in the process. Just because your car has the latest version of the firmware — that is what we call embedded software — doesn’t mean it is safer necessarily than the older one. And that conclusion is that the failsafes are inadequate. The failsafes that they have contain defects or gaps. But on the whole, the safety architecture is a house of cards. It is possible for a large percentage of the failsafes to be disabled at the same time that the throttle control is lost.
Barr explained that many of the vehicle behavior malfunctions could be caused by the death of tasks within the CPU — in particular, the death of a proprietary-name task, called Task X at trial. The name of this task was kept secret, but its functional failures took center stage at the Bookout trial. Barr dubbed it “the kitchen-sink” task, because it controlled a lot of the vehicle’s functions, including throttle control; the cruise control – turning it on, maintain the speed and turning it off – and many of the failsafes on the main CPU. Barr testified that Toyota’s watchdog supervisor design – software to detect the death of a task – “is incapable of ever detecting the death of a major task. That’s its whole job. It doesn’t do it. It’s not designed to do it.” Instead, Toyota designed it to monitor CPU overload, and, Barr testified: “it doesn’t even do that right. CPU overload is when there’s too much work in a burst, a period of time to do all the tasks. If that happens for too long, the car can become dangerous because tasks not getting to use the CPU is like temporarily tasks dying.” Barr also testified that the operating system contained codes that would throw away error information, ignoring codes identifying a problem with a task.
In March, Toyota paid a 1.2 billion fine and admitted to criminal wrongdoing – hiding defects and lying to everyone from the government to its customers. Toyota paid the money and took a deferred prosecution deal on a single wire fraud charge to end a four-year federal criminal investigation. At the time, the chief legal officer for Toyota’s North American division said: “Entering this agreement, while difficult, is a major step toward putting this unfortunate chapter behind us.”
So, all this comes down to a Powerpoint presentation? We don’t think so. NHTSA has finally begun to post Toyota’s submissions to its Timeliness Query investigation (TQ10-001) on its pedal entrapment recalls – another case in which the automaker paid the government millions to put the matter to rest. So, any enterprising researcher can take a stroll through, and learn more about Toyota’s machinations. The only people who have not been able to buy their way out of the problem are the owners of Toyota vehicles controlled – or perhaps uncontrolled by the crappy and mysterious Task X.
Unfortunately, this “unfortunate chapter” is not behind us.
