March 10, 2014
With a 2011 rulemaking on standards governing electronic key systems still pending, the National Highway Traffic Safety Administration has opened a compliance investigation into 34 recent model-year vehicles that allow the vehicle to be turned off in a gear other than park, allow the key fob to be removed from a running vehicle with no warning to the driver, and allow vehicles to be restarted without the key fob present – all conditions that defy the letter and intent of Federal Motor Vehicle Safety Standard 114. And, incidentally, all conditions that Safety Research & Strategies informed the agency about in a 2010 meeting.
SRS obtained these documents after submitting a Freedom of Information Request for agency documents related to keyless ignition investigations.
On January 28, the agency’s Office of Vehicle Safety Compliance sent information requests to Toyota, Ford, General Motors, Nissan, Mazda, Hyundai and Kia regarding 2012 and 2013 model-year vehicles, based on tests of how their keyless ignition systems operate under different scenarios in which to determine if the Theft Protection and Rollaway Prevention Standard had been violated.
The agency said that the probe was initiated by a Ford recall (13V-475), for 23,000 Ford Focus vehicles, equipped with keyless starting systems that did not have an audible warning when the driver exited the vehicle. But actually, the compliance investigation had its origins in a routine FMVSS 114 compliance test of a 2013 Ford Focus. After discovering that the vehicle did not meet the warning aspect of the regulation, NHTSA’s Office of Vehicle Safety Compliance (OVSC) contacted Ford in March 2013. The two met to discuss how its Intelligent Access key system worked. And OVSC asked Ford if it could use its MyCANIC tool. Used with Ford software, the MyCANIC is plugged into the OBD-II diagnostics port to read specific data channels from the vehicle’s computer, namely to access how the “Power Mode” communicated either a “Key Out” or “Key In” reading.
Over the spring, and stretching into the fall the OVSC and Ford jointly reviewed the vehicle. NHTSA asked for more information; Ford provided it. In September, Ford made the decision to recall, even though, “it was not determined that a non-compliance to FMVSS 114 Section 5.1.3 existed in these vehicles,” Ford noted in its Part 573 Notice of Defect and Noncompliance. And just in case the agency was wondering what Ford really thought of FMVSS 114, it added:
“While the applicability of this section of FMVSS 114 to keyless ignition systems is ambiguous, in the interest of Ford’s consistent cooperation with the agency, Ford will conduct a notification and remedy campaign to add a ‘key in ignition’ door chime to address the agency’s question with respect to the requirements of FMVSS 114 Section 5.1.3 (Theft Prevention).”
The Agency Widens its Focus
In this compliance probe, the agency asked for a host of details related to manufacturers’ keyless ignition systems, ranging from the electronic architecture of the system, when the electronic code that now constitutes NHTSA’s two-part key schema is purged from the system and the audio and visual telltales used to alert the driver that he or she has exited the vehicle. NHTSA also asked for complaint data and the safety information manufacturers provide to their customers about keyless systems.
Keyless ignitions, introduced in the late 1990s, were intended to offer drivers convenience. Instead, they have disrupted a well-established set of driver behaviors and expectations, and introduced rollaway and carbon monoxide poisoning hazards that have resulted in injuries and deaths. There have been at least eight publicly acknowledged deaths and two serious injuries from carbon monoxide poisonings linked to keyless ignitions since 2010.
The most recently reported fatalities occurred in Greenville South Carolina. Bill and Woo Thomaston died of carbon monoxide poisoning after apparently leaving their 2006 Toyota Avalon running in a basement garage. On June 9, police found the couple unconscious in the bedroom of their home. The battery of the Avalon was dead and the fuel tank empty. The key fob was apparently still inside the vehicle.
“It made it easy to forget,” said David McCuen, Mrs. Thomason’s brother in a published news report.
In many vehicles, key slots and metal keys with indents have been replaced with plastic key fobs, containing an electronic code unique to a particular vehicle, and push-button ignitions.
As these systems evolved, automakers in concert with NHTSA, changed the definition of the key from a physical object to an invisible code. Consumers, meanwhile, continue to regard the plastic fob as the key – in part, because they are used to a physical key, and in part, because automakers branded their fobs as “smart” or “intelligent” keys, or called them key fobs. Indeed, one cannot start a vehicle without the fob. The fob, however, plays no role in turning the vehicle off, and shutting off the engine does not automatically lock a vehicle transmission into “Park,” as is required by FMVSS 114. Drivers must execute a sequence of events such as move the transmission into park, push the ignition button and open and shut the driver’s door.
A vehicle may or may not remind a driver that he or she has forgotten one of these critical steps. While you can’t remove a traditional key from the ignition without moving the automatic transmission into “Park,” and turning off the engine, you can leave a keyless ignition vehicle, key fob in hand, with the engine off and the transmission in neutral or drive, or with the transmission in “Park,” but with today’s quiet engines still purring away.
NHTSA is purporting to address these problems with a Notice of Proposed Rulemaking, published in December 2011, with a new reliance on audible warnings, based on those already required in FMVSS 403 (Wheelchair lifts). The agency offered no human factors research to demonstrate that these warnings would be effective.
SRS, which has been researching the problems created by keyless ignitions since 2009, met with NHTSA officials in 2010 to present these concerns. In addition, we filed comments to the agency 2011 Smart Key docket re-iterating the results of our research to the agency.
Complaints Are Growing
In the December 2011 NPRM, the agency cited only a handful of complaints: nine rollaway complaints reported to the agency – either actual incidents, or owners noting that it was possible to turn off the vehicle when the transmission was not in “Park.” It also noted four Vehicle Owner Questionnaires (VOQs) linking carbon monoxide incidents to keyless ignitions, and one reported death.
A more recent search found more than 70 complaints in NHTSA’s VOQ database related to rollaway or carbon monoxide poisoning.
Twenty consumers complained that they had actually left a car running – on multiple occasions; six mentioned carbon monoxide poisoning as a possible danger. In addition, two deaths and two injury incidents were reported to the agency. There are nine known fatalities and four serious injuries related to keyless ignition carbon monoxide poisonings. The chief complaint was rollaway: 43 drivers reported rollaway incidents, resulting in four injuries; five other owners mentioned that carbon monoxide poisoning was a danger.
More consumers complained about the possibility of rollaways. Consumers reported four injuries, and 33 rollaway incidents. Another five consumers mentioned that that it was possible to shut off the vehicle without the transmission automatically locking into park.
These complaints covered a wide range of vehicle models, including Toyota RAV4, Camry, Prius and Lexus ES, Hyundai Sonata, Volkswagen Passat, Routan and Tiguan, Nissan Altima and Murano, Buick Verano, and Pontiac Sunfire.
How Smart Keys Work in the Real World
As part of its investigation, the agency dispatched technicians to various Washington D.C.-area car dealerships, where they ran 2012 and 2013 model-year vehicles through a series of sequences. What the technicians found were a wildly divergent set of vehicle responses to the absence of the fob and to shutting off the vehicle while it was still in drive. Manufacturers employed different types of warnings, of different duration, of different decibel levels, emanating from different locations within the vehicle – some audible warnings could only be heard inside the vehicle. Some manufacturers added exterior audible warnings. There were no standard responses even within manufacturers.
Fob and Driver Gone; Engine Running
At least eight people are known to have died from carbon monoxide poisoning linked to a keyless ignition and a vehicle inadvertently left running. This is likely an undercount. Toyota vehicles have figured prominently in the death toll of known victims – Lexus models and Toyota Avalon were implicated in five deaths and two injuries. Mercedes and Chrysler vehicles were tied to three deaths. The agency has contracted three Special Crash Investigations into four of the fatalities involving Chastity Glisson a 2006 Lexus, Ray Harrington a 2011 Chrysler 300 and Mort Victor, Adele Ridless in a 2008 Mercedes Benz S Class.
NHTSA also tested this scenario. Technicians tried it two ways – they left the vehicle running, while in park, and exited with and without the key fob in their possession. The documents released as part of SRS’s FOIA request do not contain complete testing sheets for every vehicle – so it is unknown whether NHTSA ran this test on all models, or neglected to release some pages to SRS. There were no documents pertaining to the Nissan or Kia models.
The worst of the lot were the 2013 Hyundai Tuscon and the 2014 Buick Regal – no warnings whatsoever – take the fob, leave the fob, these vehicles don’t give a hoot. You get a visual “No Key”- type warning – but the thing about leaving the vehicle running, you the need the warning after exiting the vehicle. A message on the dashboard that the key is no longer there is like no warning at all.
Some vehicles did not have any exterior warning if the driver left it running with the fob in his possession: the 2013 Ford Explorer and 2014 Ford Flex, for example. More gave no warning at all if the driver exited the vehicle, but left it running with the fob inside, among them: none of the Toyota models tested, the 2013 Subaru BRZ; the 2013 Hyundai Sonata, Genesis and Elantra; and the 2013 Buick LaCrosse.
Drivers have also complained to the agency about this occurring, as well, for example (ODI VOQ 10394590):
My wife and I are retired in Florida. We parked our 2011 Toyota Camry XLE with keyless ignition in our garage and brought the key fob with us into our home. My wife either did not push the engine off button hard enough or forgot to push the engine off button to turn off the engine. We did not hear the 3 short beeps telling us the engine was running and the key fob was removed from the vehicle. The garage is attached to our home. The vehicle was left running in our closed garage. Carbon monoxide fumes entered our home causing headaches, nausea, and lethargy. Our home carbon monoxide detector sounded an alarm. We investigated and found that we left the vehicle running in the garage for 90 minutes. The garage temperature was over 100(f) degrees. There was a large pool of water under the car from condensation from the car air conditioning compressor. We were sickened by the carbon monoxide fumes and came close to losing our lives. The keyless ignition option is too dangerous. There needs to be a change in design that turns off the engine when the key fob leaves the vehicle and the engine off button is not depressed.
Ready to Roll
The hands-down, biggest sin almost all of the tested vehicles committed was their failure to automatically shift the transmission into “Park” at shutdown. In this test protocols, technicians started the vehicle, shifted the transmission out of park, turned off the vehicle, and waited 30 seconds before exiting the vehicle. Then, the technicians pushed it to determine if the vehicle had automatically locked in “Park.”
Again, a traditional key cannot be removed from the ignition until the vehicle is in “Park.” FMVSS 114 is quite clear on this point: since 1992, the standard has required vehicles with automatic transmissions that have a Park position to have a key-locking system that prevented removal of the key unless the transmission was locked in Park or became locked in Park as the direct result of removing the key. In 2008, Chrysler recognized that when it recalled MY 2008-2009 Dodge Challenger vehicles equipped with automatic transmissions and “Keyless Go” option. In its Part 573 Defect and Noncompliance Notice in 2008, Chrysler noted that a driver could depress the stop/start button and turn off the engine when the vehicle was not in park, take the fob and exit the vehicle. Chrysler recognized this sequence of events as a clear violation of the standard. The recall reconfigured vehicle software to prevent the engine from shutting down when the driver depresses the On/Off button unless the vehicle shift lever is manually placed in Park. (In 2008, the agency accepted this remedy without comment. In the 2011 NPRM, NHTSA declared this scenario less-than-deal because drivers may want to use the On/Off button to shut the vehicle down in the event of an unintended acceleration emergency.)
In the magical world of invisible keys, this is now rarely the case. Of the 34 vehicles NHTSA tested 25 – 73 percent did not automatically lock the transmission in Park. Four of the GM models behaved as though the key was still inside the vehicle – even though the engine was no longer running and the transmission was in Drive. Two notable exceptions – compliant with the standard – were the Kia Optima and the Toyota Prius C. Both appeared to automatically lock the transmission in Park. Most vehicles with electronic shift levers lock the transmission in Park when the vehicle is not moving and engine is shut down. In contrast, shifters that operate via mechanical connection do not automatically lock in Park.
This happens in the real world, causing property damage, and so far, only injuries. Here’s Office of Defects Investigations (ODI) Vehicle Owner Questionnaire (VOQ) 10553008:
..I rented a car last week in San Diego, my first experience with keyless ignitions. I only had the car for one day and was not used to this system. Late at night I parked car, pushed the ignition to “off” started to get out of the car, when car started driving forward because I had forgotten to put it in park. I was knocked down in the middle of the street, it was pitch black outside, I had no idea what was happening, until I saw the car driving away. I managed to chase the car and jump back inside before it hit anything. However, my knee was torn up really bad, and i am still dealing with the injury more than a week later. Not having any warning/safety measure to let people know that the car is not in park, coupled with a whisper quiet engine, is a totally dangerous combination, and clearly deadly from many on line accounts I have read. Don’t know how this ridiculous idea ever made it to factory, much less approved without any warning system in place…
Fob Go Bye-Bye
In another testing scenario, a technician started the ignition and then removed the fob from within the vehicle range either by handing it off to a tester through the window to see if the vehicle noticed or warned the occupants that the fob was no longer in range of the vehicle.
This has happened in the real world to a 2013 Honda Acura owner in Ventura Calif.
Keyless start (push button) and problem occurred when no warning that key fob was not in vicinity of car after car was started and driven 2 hours away. My daughter handed me her keys to the Acura tl (incl key fob) through the driver’s side window after the car had been started so I could get some items out of our other car before she left to return to her home 5 hours away. I retrieved her items but forgot to give her the key fob back as the car was running and no warning indicators were given (audio or visual) that the key fob was not in the vicinity of the car. She headed off and stopped 2 hours later for gas only to find the car would not restart – due to the missing key fob. After experimentation and reading the owner’s manual I found that only when the door is opened and the fob is removed from the vehicle will a notice and alarm be given. If passed through an open window (as we did) no warning of any kind is given and the driver can drive off as if everything is fine. This is a significant flaw in the remote fob system and caused myself and my daughter significant amounts of stress and time to drive to her location to deliver the fob needed to restart the car. Acura claims no problems from their side but I believe this is a significant issue with the system that needs to be addressed. It may be more than just Acuras that have this problem. (ODI 10542876)
The testers found that most vehicles, the system makes some attempt to note that the fob was no longer in range of the vehicle. The notable exceptions were two Toyota models: the 2013 Highlander and RAV4 gave no warnings whatsoever that the fob had left the vicinity of the vehicle. The Subaru 2013 BRZ and Forrester were marginally better – no audio warnings, but a visual telltale – “No Key” or “Shift to Park” displayed very briefly. Even automakers that did install an audible telltale had no standardization among models. Ford was a perfect example. In this scenario, all seven models tested (including two Lincoln models) had different audio warnings. In the 2013 Ford Explorer, the warning that the fob had left the vehicle was at 65 decibels for 3 sec; but it was a continuous warning at about 50 decibels in the 2013 Ford Taurus; the Lincoln MXZ was at 48 decibels for less than 1 second.
This suggests that automakers have done no human factors testing to determine the most effective approach to warnings, and letting the driver know that something is amiss is an ad-hoc affair.
The Open NPRM
In December 2011, the agency opened a Notice of Proposed Rulemaking to again amend FMVSS 114. The agency’s proposal recognizes that the current keyless ignition systems have led to driver confusion, resulting in vehicles left running and/or out of the “Park” position, and the consequent rollaways and carbon monoxide poisonings. The NPRM pointed out, as did SRS more than a year prior, that the lack of standardization in combination with the lack of visual and tactile cues about the status of the vehicle engine has set the stage for the real world incidents in which drivers mistaking the fob for the key, inadvertently leave a vehicle running and/or exit the vehicle without putting the transmission into “Park.”
Nonetheless, the agency’s sole strategy for addressing the rollaway and carbon monoxide safety issues are for internal and external audible alerts, based on the wheelchair platform lift standard. One set of warnings would be deployed if the driver exits the vehicle with the transmission not in park. The first audible alert alerts (of no less than 85 dBa between 500-3000 Hz) would sound if the driver tries to shut off the engine when the transmission is not in “park,” and the vehicle is moving at less than 15 km/h (9.3 miles per hour). This alert would continue until the driver put the vehicle in “park,” without requiring the driver to restart the vehicle.
The agency said that it was proposing a loud audible warning because FMVSS 114 already requires audio telltales, and because visual alerts are too easily ignored. A second alert must sound outside the vehicle if the driver doesn’t respond to the internal alarm and continues to exit the vehicle without placing the transmission in “park.” The agency was leaning toward requiring manufacturers to install a sensor which detects when the key fob is missing from the vehicle. This external alarm will also be set at no less than 85 dBa between 500-3000 Hz, and must sound when the door located closest to the driver’s designated seating position is opened while the gear selection control is not in “park,” the vehicle is moving at less than 15 km/h (9.3 mph), and the fob is not present in the vehicle. The alarm must sound for one minute or until the transmission is moved into “park,” whichever comes first. To address the CO poisoning hazard, the agency would require a one-second audio telltale would sound outside the vehicle if: the engine is on, the driver’s door is opened and the fob is not in the vehicle.
NHTSA rejected an automatic cutoff solution, because it couldn’t decide what would be the specific time after which the engine would shut down, and because there are scenarios in which people leave a car running in the Park position for a period of time, such as leaving pets in the car with the heater or air-conditioning running, or the drivers themselves sleeping in vehicles with the climate controls running. The agency further argued that in attached garage scenarios, many consumers may leave the fob in the vehicle. A system in which the engine shuts down once the fob has been removed the vehicle for a certain length of time would not address the CO hazard in a scenario where the driver leaves the vehicle running in an attached garage, with the fob in the vehicle. In this situation, the agency concluded that an alert would be more effective.
The agency also rejected requiring a countermeasure that would prevent the propulsion system from shutting down unless the gear selection control is in “Park.” The agency argued that although it would address the rollaway problem, it might also contribute to the CO risk, because a driver might walk away from a vehicle in this condition. This made no sense. Not allowing shutdown unless the transmission is in park lies at the heart FMVSS 114. The agency noted that some manufacturers already offer this feature, but that the agency considered warnings to be the best strategy, because “they alert the driver to the situation rather than masking it (i.e., not only may the driver not realize the gear selection control is not in “park,” s/he may not realize that the propulsion system has not shut down).
The Final Rule is anticipated in 2015, the agency said.
What the compliance investigation shows is that not one vehicle tested had audible warnings that conformed to this proposal. Most were too soft or too short. The complaints tell us that the better solution is to make the fob the key and give it a role in shutting down the vehicle.
Too bad that FMVSS 114 is so darned ambiguous.
More on Smart Keys: