testing and analysis of toyota event data...

Failure Analysis Associates

Testing and Analysis of Toyota Event Data Recorders

Doc. no. 0907698.000 A0T0 0211 RPTD

Testing and Analysis of Toyota Event Data Recorders Prepared for Steve St. Angelo, Chief Quality Officer North American Quality Task Force Toyota Motor Manufacturing 1001 Cherry Blossom Way Georgetown, KY 40324 Prepared by Exponent Failure Analysis Associates 149 Commonwealth Drive Menlo Park, CA 94025 October 2011 Exponent, Inc.

0907698.000 A0T0 0211 RPTD ii

Contents

Page

List of Figures iv

List of Tables vii

Summary viii

1 Introduction 1

2 EDR Accuracy Test Methodology 3

2.1 Overview 3

2.2 Test Vehicle Description 4

3 Non-Deployment Testing 10

3.1 Overview 10

3.2 EDR Precision 10

3.3 Non-Deployment Testing Results 11

3.3.1 Seat Belt Status 11

3.3.2 Driver Seat Position Status 11

3.3.3 Passenger Occupancy Status 11

3.3.4 Transmission Position Status 11

3.3.5 Vehicle Speed 12

3.3.6 Engine Speed 12

3.3.7 Brake Position Status 12

3.3.8 Accelerator Pedal Position 13

4 Crash Testing 14

4.1 2007 Toyota RAV4 16

4.2 2007 Toyota Tundra 18

4.3 2007 Toyota Corolla 21

4.4 2005 Toyota Camry 24

4.5 2007 Lexus ES 350 25


0907698.000 A0T0 0211 RPTD iii


5 EDR Memory Toughness Testing 33

5.1 Data Retrieval Methodology 34

5.2 Oven Test 37

5.3 Direct Flame Impingement Tests 39

5.4 Mechanical Impact Test 42

6 Concept for a New Method of EDR Readout 50

6.1 Existing EDR Readout Systems 50

6.2 Proposed EDR Data Management System 51

6.3 Benefits of New EDR Data Management Method 54

6.3.1 Simple Data Collection Tool 54

6.3.2 Enhanced Data Security Control 55

6.3.3 Enhanced Software Updates 55

6.3.4 Centralized Crash Safety Database 55 Appendix A EDR Implementation in North American Vehicles Appendix B Non-deployment Events Created During Exponent’s Testing Appendix C Barrier Crash Test, 2007 Toyota Corolla, December 10, 2010 Appendix D Barrier Crash Test, 2005 Toyota Camry, December 10, 2010 Appendix E Barrier Crash Test, 2007 Toyota RAV4, December 13, 2010 Appendix F Barrier Crash Test, 2007 Toyota Tundra, December 14, 2010 Appendix G Barrier Crash Test, 2007 Lexus ES 350, February 15, 2011 Appendix H Barrier Crash Test, 2002 Toyota Camry, September 19, 2011 Appendix I Barrier Crash Test, 2003 Toyota Camry, September 19, 2011

0907698.000 A0T0 0211 RPTD iv

List of Figures

Page

Figure 1. Method for triggering non-deployment events. 4

Figure 2. Vehicles used for testing. 6

Figure 2. Vehicles used for testing (cont’d). 7



Figure 3. Brake data recorded using precision laboratory instrumentation overlaid with data from the EDR. 13

Figure 4. Accelerator voltage data recorded using precision laboratory instrumentation overlaid with data from the EDR. 13

Figure 5. Location and arrangement of the accelerometers attached to the RAV4 ACM. 15

Figure 6. 2007 Toyota RAV4 at impact with rigid barrier. 16

Figure 7. Pre-crash data from Toyota RAV4 EDR. 17

Figure 8. Comparison of velocity change calculated from laboratory accelerometers and velocity change reported by the EDR for 2007 Toyota RAV4 crash test. 18

Figure 9. 2007 Toyota Tundra at impact with rigid barrier. 18

Figure 10. Pre-crash data from Toyota Tundra EDR. 20

Figure 11. Comparison of velocity change calculated from laboratory accelerometers and velocity change reported by the EDR for the 2007 Toyota Tundra crash test. 21

Figure 12. 2007 Toyota Corolla at impact with rigid barrier. 22

Figure 13. Fractured mounting flange on the Corolla ACM. 23

Figure 14. Comparison of velocity change calculated from laboratory accelerometers and velocity change reported by the EDR for the 2007 Toyota Corolla crash test. 23

Figure 15. 2005 Toyota Camry at impact with rigid barrier. 24

Figure 16. Comparison of velocity change calculated from laboratory accelerometers and velocity change reported by the EDR for the 2005 Toyota Camry crash test. 25

0907698.000 A0T0 0211 RPTD v

Figure 17. 2007 Lexus ES 350 at impact with rigid barrier. 25

Figure 18. Pre-crash data from Lexus ES 350 EDR. 26

Figure 19. Comparison of velocity change calculated from laboratory accelerometers and velocity change reported by the EDR for the 2007 Lexus ES 350 crash test. 28




Figure 23. Fractured mounting flange on the 2003 Toyota Camry. 31


Figure 25. Opened ACM module. 33

Figure 26. Front and back of the ACM module; the EEPROM IC is located on the corner, on the back of the PCB. 34

Figure 27. Pin layout and assignment of the EEPROM IC used in this test. 34

Figure 28. Commercially available EEPROM reader with SOIC8 EEPROM adapter clamp. 35

Figure 29. Data acquisition by clamping onto the EEPROM IC pins. 35

Figure 30. Non-deployment event data read directly from the EEPROM chip. 36

Figure 31. Non-deployment event data read using Toyota’s EDR readout tool. 37

Figure 32. ACM unit exterior after the oven test. 37

Figure 33. ACM PCB after the oven test; components have fallen from the board. 38

Figure 34. PCB with EEPROM IC exposed. 38

Figure 35. Photos of the PCB after repeated applications of a propane flame. 40

Figure 36. Damaged EEPROM IC after approximately 13 seconds of propane flame impingement to the PCB and chip; correct data could still be read. 41

Figure 37. Cracked EEPROM IC at the end of the propane torch flame test; data could no longer be read. 42

Figure 38. 2007 Tundra and its ACM. 43

0907698.000 A0T0 0211 RPTD vi

Figure 39. ACM positioned on the shuttle for the impact test. 44

Figure 40. ACM unit after the impact test. 44

Figure 41. EDR imaging through the ACM connector (left); communication error message (right). 45

Figure 42. ACM unit after disassembly; loose plastic pieces, capacitors, inductors and ICs were observed. 46

Figure 43. Bent pins and cracks observed on the ACM plastic connector. 46

Figure 44. PCB in the ACM with EEPROM IC circled. 47

Figure 45. Pin layout and assignment of the AT250xx EEPROM IC used in this test. 47

Figure 46. EEPROM IC de-soldered from the PCB (left); commercially available EEPROM reader clamping onto the memory IC (right). 48

Figure 47. EEPROM data read using the commercial reader from an impact-tested 2007 Tundra ACM. 48

Figure 48. 2007 Tundra data read using Toyota’s EDR readout tool. 49

Figure 49. Schematic of existing Bosch CDR system. 50

Figure 50. Photograph of the components of the Bosch CDR system. 51

Figure 51. Schematic of proposed EDR readout method. 52

Figure 52. Screenshot of proposed EDR data interpretation service. 54

0907698.000 A0T0 0211 RPTD vii

List of Tables

Page

Table 1. EDR Data Records 2

Table 2. Vehicle Test Matrix 5

Table 3. Crash Test Matrix 15

0907698.000 A0T0 0211 RPTD viii

Summary

The airbag control modules (ACMs) installed in late-model Toyota Motor Corporation (Toyota)

vehicles incorporate an event data recorder (EDR) function. Following an impact sufficient to

trigger the recording of an event, the EDR digitally records information on collision-related

parameters such as vehicle acceleration and seat belt usage. Such triggering can occur even if

the event does not produce an air bag deployment. Some of the EDRs also record pre-crash

information such as vehicle speed, brake, and throttle application. This information can later be

downloaded (or imaged) for interpretation using appropriate readout equipment. This report

presents the results of a study by Exponent of EDR performance, as well as the robustness of the

memory chips in which the data are stored. Exponent created and evaluated 231 EDR records in

24 Toyota and Lexus vehicles under rigorous and controlled conditions.1 Seven of these EDR

records were generated by full-scale frontal crash tests using vehicles also equipped with

calibrated2 laboratory instrumentation that measured and recorded vehicle accelerations,

allowing for the evaluation of the data recorded during impact. Three of these crashes were

severe enough to damage the mechanical attachments of the ACMs to the vehicle, though they

remained electronically connected and recorded data.

The EDR records were imaged, interpreted, and compared with test conditions. The study

found:

1. Those EDRs that recorded pre-impact accelerator pedal position and brake use did so accurately.

2. Other parameters recorded by some EDRs, such as front passenger seat occupancy, driver seat position, seat belt status, transmission position, and vehicle and engine speed were accurately measured.

3. EDRs accurately recorded accelerations within the +/-50g limit of performance for which they were designed. In the three crashes where ACM mounts broke, the accelerations tracked well early in the post-crash period.

1 Research at Exponent is performed in accordance with its ISO 9001:2008 quality management system 2 Calibration is traceable to the National Institute of Standards and Technology

0907698.000 A0T0 0211 RPTD ix

Two ACMs were intentionally damaged by direct impact and by heat to assess the robustness of

the EDR. A test method was developed for reading data from damaged ACMs in which direct

clamping to the IC pins allowed data to be read directly from the EEPROM IC in the ACM.

Using this method, data could be retrieved even from ACMs that had suffered thermal or

mechanical damage.

At the conclusion of this report, Exponent proposes a new concept for obtaining and interpreting

the data stored in vehicle EDRs. This system has several advantages over the existing EDR

readout and data management systems. The proposed system has two components: 1) an EDR

module that includes a USB port where encrypted EDR data can be read using a computer or

handheld device; and 2) a secure online data management service where the EDR data can be

decrypted, interpreted, and a report generated. The advantages of this system include a

simplified method for direct-to-module data collection (not requiring separate hardware,

software and cables for each ACM design), improved security in data integrity, up-to-date

software for interpreting the EDR data, and a centralized location where such data can be stored.

In the interim, a secure on-line data interpretation can be implemented for vehicles on the road

using data imaged from the vehicle EDR via the current OBD-II or direct-to-module interfaces.

Scope

This report summarizes work performed to-date and presents the findings resulting from that

work. The findings presented herein are made to a reasonable degree of engineering and

scientific certainty. Exponent reserves the right to supplement this report and to expand or

modify opinions based on review of additional material as it becomes available.

0907698.000 A0T0 0211 RPTD 1

1 Introduction

Toyota started adding EDR functionality to its airbag control modules (ACMs) beginning with

model year 2001 vehicles. The primary role of the ACM is to determine whether airbags need to

be deployed, and then to deploy them at the appropriate time. The addition of EDR functionality

allows for storing data regarding the vehicle status and dynamics around the time period when a

deployment event or non-deployment event occurs. The EDR data are accessible through

various ports, though special equipment and software are needed to download and interpret this

information.

Data are recorded in the EDR for any event of sufficient magnitude, regardless of whether the

event resulted in an airbag deployment. The EDR-equipped Toyota vehicles investigated in this

study record post-crash frontal acceleration at 10 millisecond (ms) intervals. The post-crash

frontal accelerations recorded by the EDRs investigated in this study are mathematically

integrated during the data interpretation process, and are reported as post-crash velocity change

(delta-V). Depending on the ACM, some EDRs also record pre-crash data and additional status

information at the time of the event trigger. When available, pre-crash data are recorded at one-

second intervals up to five seconds before the trigger. Certain vehicle EDRs are also capable of

recording lateral accelerations and roll rates specific to side impacts and rollovers. Exponent’s

testing to date did not assess the accuracy of recorded data specific to these types of events. The

data recorded by Toyota’s EDR systems in Exponent’s testing are shown in Table 1. A more

extensive listing of EDR implementation as provided by Toyota is included as Appendix A.

0907698.000 A0T0 0211 RPTD 2

Table 1. EDR Data Records

Recorded on All Vehicles

Recorded on Some Vehicles

Pre-Crash Data Vehicle speed X Engine speed X Brake status X Accelerator pedal position X

Status Parameters at Time of Deployment Driver seat belt usage X Passenger seat belt usage X Driver seat position X Passenger occupant detection X Transmission shift position X Airbag diagnostic information X

Post-Crash Data Front collision: longitudinal velocity change X Side collision: lateral velocity change X Rollover: lateral acceleration, roll angle X

The data recorded by Toyota EDRs in this study are stored on EEPROM, and after being imaged,

the raw data is written as a hex file with file extension “rot”. Following a deployment event, the

EEPROM is frozen from further writing. The EDR readout tool interprets the .rot hexadecimal

data and creates a PDF file describing the stored data.

Historically, the interpretation software of Toyota and other manufacturers’ readout tools has

undergone periodic revisions. However, if the raw hexadecimal data is available, the file can be

reinterpreted using the latest software. The new approach described in Section 6 of this report

facilitates and ensures the use of the latest software and also allows users to be alerted if any of

their EDR files are subject to software revisions.

0907698.000 A0T0 0211 RPTD 3

2 EDR Accuracy Test Methodology

2.1 Overview

To evaluate the accuracy of stored EDR data, Exponent triggered EDRs to record information

under controlled conditions and then compared the recorded EDR data with the data recorded by

precision calibrated laboratory instrumentation. Seven full-scale crash tests were run at

Exponent’s Test and Engineering Center in Phoenix, AZ, all resulting in impacts of sufficient

magnitude to trigger airbag deployment. Three of these crash tests produced sufficient vehicle

chassis deformation to fracture the ACM mounts. One of these full-scale tests included

robotically applied pre-impact braking, resulting in decreasing speed prior to impact.

To produce a sufficient number of samples to allow an in-depth evaluation of EDR pre-crash

data accuracy, events that triggered EDR recording but not an airbag deployment were also

generated, allowing multiple events to be produced, recorded, and interpreted with the same

vehicle and ACM.

The ACMs in the vehicles investigated are either located on the floorpan beneath the radio and

climate control systems or between the front seats. They are typically bolted to the vehicle with

three bolts. To trigger the ACM and generate non-deployment events, the airbag control

modules were unbolted and then tapped from the rear, as shown in Figure 1. This allowed non-

deployment events to be generated while the vehicle was stationary or in motion.

The tested Toyota vehicles were equipped with EDRs that could record accelerations up to

approximately +/-50 g’s. This level of acceleration is greater than what is needed to trigger

deployment and to analyze safety equipment performance, but is less than the peak accelerations

that the ACM might experience in a severe crash. This is consistent with the intended purpose of

the ACM, namely to determine whether airbags need to be deployed, and then to deploy them at

the appropriate time. However, because the peak accelerations may be truncated to +/-50 g’s, the

calculated change in vehicle velocity (delta-V) by the EDR may underestimate the vehicle

velocity change. As will be discussed in Section 4, the acceleration (“g”) limit was occasionally

0907698.000 A0T0 0211 RPTD 4

surpassed during Exponent’s crash testing. The +/-50 g range is in compliance with the range of

accelerations specified in 49 CFR Part 563.3

Figure 1. Method for triggering non-deployment events.

2.2 Test Vehicle Description

Twenty-four Toyota and Lexus vehicles were evaluated. Seven of these vehicles were tested in

full-scale frontal crash tests. Twenty-two vehicles were evaluated with non-deployment events.

In total, 231 events were created during this study; 224 non-deployment events and seven crash

tests that resulted in airbag deployment.

Data from the EDRs were downloaded following each test using Toyota software version

2.0.1.1. The triggering method used in this portion of the study occasionally resulted in two or

more separate events being created. As the evaluated Toyota EDRs were capable of storing data

from at least two events, all double events were downloaded and analyzed.

3 49 CFR Part 563 “Event Data Recorders” was enacted as a Final Rule effective 10/27/06 with vehicles (already

equipped with EDR’s) to be in compliance starting 9/1/10. That Final Rule specified the data element format for recording of acceleration data as +/- 50 g. 49 CFR Part 563 was amended on 8/5/11 (effective 10/4/11). The amended Final Rule removed this specified data element format for acceleration data.

EDR TappedFrom Rear

0907698.000 A0T0 0211 RPTD 5

The vehicles used for testing are shown in Figure 2 and the test matrix and recorded data

elements are listed in Table 2.

Table 2. Vehicle Test Matrix

Vehicle Non-Deployment

Tests Crash Test

EDR Records Pre-Crash Data

2010 Toyota Avalon (VIN 4T1BK3DB2AU359937) X 2002 Toyota Camry (VIN 4T1BF32KX2U007715) X 2003 Toyota Camry (VIN 4T1BE32K03U759556) X 2004 Toyota Camry (VIN 4T1BE32K34U284924) X 2005 Toyota Camry (VIN 4T1BE32KX5U507087) X 2005 Toyota Camry (VIN 4T1BE32KX5U557830) X X 2007 Toyota Camry (VIN JTNBE46KX73061175) X X 2007 Toyota Camry (VIN 4T1BK46K57U033450) X X 2009 Toyota Camry (VIN 4T1BK46K79U592680) X X 2007 Toyota Corolla (VIN 1NXBR32EX7Z811764) X X 2010 Toyota Corolla (VIN 2T1BU4EE2AC299197) X X 2007 Toyota FJ Cruiser (VIN JTEZU11F570012218) X 2010 Toyota Prius (VIN JTDKN3DU3A0110275) X X 2010 Toyota Prius (VIN JTDKN3DU3A0073325) X X 2007 Toyota RAV4 (VIN JTMZD33V675073813) X X X 2008 Toyota Sienna (VIN 5TDZK23C38S211978) X X 2006 Toyota Tacoma (VIN 5TEKU72NX6Z190428) X 2007 Toyota Tundra (VIN 5TBBV54187S486597) X X 2007 Toyota Tundra (VIN 5TFRV54147X014817) X X X 2007 Toyota Tundra (VIN 5TFRV54137X020298) X X 2007 Lexus ES 350 (VIN JTHBJ46G772002519) X X 2007 Lexus ES 350 (VIN JTHBJ46G972080879) X X X 2006 Lexus IS 250 (VIN JTHBK262065014899) X X 2006 Lexus IS 350 (VIN JTHBE262062001692) X X

0907698.000 A0T0 0211 RPTD 6

2007 Toyota RAV4 (VIN JTMZD33V675073813) 2007 Toyota Tundra (VIN 5TFRV54147X014817)

2007 Toyota Corolla (VIN 1NXBR32EX7Z811764) 2005 Toyota Camry (VIN 4T1BE32KX5U557830)

2007 Lexus ES 350 (VIN JTHBJ46G972080879) 2008 Toyota Sienna (VIN 5TDZK23C38S211978)

Figure 2. Vehicles used for testing.

0907698.000 A0T0 0211 RPTD 7

2007 Lexus ES 350 (VIN JTHBJ46G772002519) 2007 Toyota Camry (VIN JTNBE46KX73061175)

2007 Toyota Tundra (VIN 5TFRV54137X020298) 2006 Toyota Tacoma (VIN 5TEKU72NX6Z190428)

2010 Toyota Prius (VIN JTDKN3DU3A0110275) 2010 Toyota Prius (VIN JTDKN3DU3A0073325)

Figure 2. Vehicles used for testing (cont’d).

0907698.000 A0T0 0211 RPTD 8

2010 Toyota Corolla (VIN 2T1BU4EE2AC299197) 2010 Toyota Avalon (VIN 4T1BK3DB2AU359937)

2007 Toyota Camry (VIN 4T1BK46K57U033450) 2005 Toyota Camry (VIN 4T1BE32KX5U507087)

2004 Toyota Camry (VIN 4T1BE32K34U284924) 2007 Toyota Tundra (VIN 5TBBV54187S486597)


0907698.000 A0T0 0211 RPTD 9

2009 Toyota Camry (VIN 4T1BK46K79U592680) 2006 Lexus IS 250 (VIN JTHBK262065014899)

2006 Lexus IS 350 (VIN JTHBE262062001692) 2007 Toyota FJ Cruiser (VIN JTEZU11F570012218)

2002 Toyota Camry (VIN 4T1BF32KX2U007715) 2003 Toyota Camry (VIN 4T1BE32K03U759556)


0907698.000 A0T0 0211 RPTD 10

3 Non-Deployment Testing

3.1 Overview

Non-deployment testing was conducted on 22 of the 24 vehicles listed in Table 2.4 The test

procedure was to image the contents of the EDR prior to any new events being generated.

During these initial downloads, the EDRs in most vehicles contained no stored events, and all

variables were set to their initial values. A few vehicles, however, already had recorded non-

deployment events. This prior non-deployment data was retained.

The goal of the non-deployment testing was to determine the accuracy with which various status

parameters were recorded by the EDR. These parameters provided information on seat belt

usage, driver seat position, passenger seat occupant detection, and the transmission shift position

(as available in a particular EDR). In addition, for those vehicles that record pre-crash data, non-

deployment testing was used to verify the EDR recording accuracy of vehicle speed, engine

speed, brake status, and accelerator pedal position information. Non-deployment testing was

performed with vehicles in park and while being driven. The status parameters and pre-crash

data recorded on the EDR were compared with the observed status of parameters, and with data

measured using vehicle or external sensors. A total of 224 non-deployment events were created,

read, and interpreted. Appendix B contains a listing of each test and outcome.

3.2 EDR Precision

In assessing the accuracy of the data recorded by the EDR, the resolution of the recorded

information must be considered. For status variables with discrete values (e.g. seat belt

condition), the recorded data is expected to exactly match the true value. For continuous

variables such as vehicle speed or engine RPM, the precision will be limited by the resolution of

the digitized value as stored. For example, the EDR stores vehicle speed with a resolution of 2

km/h (1.2 mph), and engine RPM with a resolution of 400 RPM. Thus, if vehicle speed is stored

as 46 km/h, the measured vehicle’s speed at that time could have been in the range of 46 km/h to 4 The EDRs of the 2002 and 2003 Toyota Camrys permanently record status parameters, such as seat belt usage,

only in a deployment event.

0907698.000 A0T0 0211 RPTD 11

just under 48 km/h. Similarly, if engine RPM were recorded as 1200, the measured engine RPM

at that time could have been in the range of 1200 to just under 1600 RPM.

3.3 Non-Deployment Testing Results

3.3.1 Seat Belt Status

The passenger and driver seat belt status are recorded as either “Belted” or “Unbelted.” All

vehicles that Exponent tested for this parameter recorded results that were consistent with the

seat belt condition during the test.

3.3.2 Driver Seat Position Status

The driver’s seat position is recorded by the EDR as “FW” or “RW,” corresponding to forward

and rearward adjustment of the driver’s seat on the seat track. During the testing, the driver seat

was adjusted to varying positions. The value recorded by the EDR correctly corresponded with

the observed location of the driver seat.

3.3.3 Passenger Occupancy Status

Passenger occupant detection can be recorded as: unoccupied, child, AF05 (adult female, 5th

percentile), AM50 (adult male, 50th percentile), or undetermined. Testing included loading the

passenger seat with ballast to simulate an occupant, and in all tests the recorded value

corresponded to the seat loading.

3.3.4 Transmission Position Status

When recorded by the EDR, transmission shift position is categorized as P (park), N (neutral), R

(reverse), or D (drive), where drive corresponds to any forward gear such as D, 1, 2, or 3. In all

tests, the recorded transmission shift position correctly corresponded to the shift position at the

time of the event.

0907698.000 A0T0 0211 RPTD 12

3.3.5 Vehicle Speed

During non-deployment testing, the EDR-recorded vehicle speed was compared with speeds

observed on the vehicle speedometer and independent, GPS-based instrumentation. These

sources of vehicle speed information were not synchronized with the EDR, so only general

comparisons were possible. Based on these observations, the vehicle speeds recorded by the

EDR were found to be in general agreement (within 10%) with the values reported by the

speedometer and GPS readings. More precise analysis of EDR speed measurement accuracy was

performed in conjunction with the vehicle crash tests (Section 4), where vehicle speed was

simultaneously measured by both the EDR and the added laboratory instrumentation.

3.3.6 Engine Speed

Engine speed was reported by the EDR with a 400-rpm resolution. Testing found that these

truncated engine RPM values were consistent with the values observed using the vehicle’s

instrument panel tachometer as well as with those transmitted via the vehicle’s communication

bus.

3.3.7 Brake Position Status

Brake status is recorded as “On” or “Off” in one second intervals up to five seconds leading up

to the EDR trigger. Our testing was conducted with three brake configurations: no brake

application, steady brake application, and cyclic brake application. During testing, the brake

application was noted by the test operator, and for some tests a precise time history of the brake

application was recorded using an external sensor and data acquisition system. In all tests, the

brake application was correctly recorded by the EDR for the recorded period (pre-trigger). Two

examples showing externally recorded brake application data overlaid on the corresponding EDR

output are provided in Figure 3. Note that pre-crash data is stored in one-second intervals, and

the point in time when an event is triggered may fall anywhere within a one second interval.

0907698.000 A0T0 0211 RPTD 13

Figure 3. Brake data recorded using precision laboratory instrumentation overlaid with data from the EDR.

3.3.8 Accelerator Pedal Position

The accelerator pedal position recorded by the EDR is generated by the accelerator pedal

position sensor 1 (VPA1). The accelerator pedal position was noted by the test operator, and for

some tests the time histories of the accelerator pedal position sensor voltages were monitored and

recorded using data from the vehicle communication bus or external data acquisition. In all tests,

the accelerator pedal position was correctly recorded by the EDR for all five seconds leading up

to EDR trigger. Samples of collected data are shown in Figure 4 for the same events shown in

Figure 3.

Figure 4. Accelerator voltage data recorded using precision laboratory instrumentation overlaid with data from the EDR.

0907698.000 A0T0 0211 RPTD 14

4 Crash Testing

Seven Toyota vehicles were subjected to full-scale frontal impact crash tests into a rigid barrier5

to evaluate the performance of the EDRs during impacts. Four of these vehicles were equipped

with EDRs capable of recording only post-crash data (2002 Camry, 2003 Camry, 2005 Camry,

and 2007 Corolla) and three vehicles had EDRs that could record both pre- and post-crash data

(2007 RAV4, 2007 Tundra, and 2007 Lexus ES 350).

The tests were performed with the engine running and the transmission in neutral. The vehicles

were towed up to the test speed along Exponent’s 1200-foot crash rail, then released prior to

impact. The vehicles were instrumented with three separate sets of precision laboratory

accelerometers, each set measuring accelerations in three orthogonal axes. These accelerometers

were positioned on the ACM, near the vehicle center of gravity, and in the trunk or cargo area

(for pre-crash vehicle acceleration measurements). The accelerometers mounted on the ACM

and near the vehicle center of gravity (CG) were capable of recording the high accelerations

during the crash pulse with great accuracy and were integrated to determine vehicle velocity

change (delta-V) during the crash pulse. The calculated delta-V values were compared with the

delta-V reported by the EDR. Figure 5 shows an example of the accelerometers placed on the

ACM housing. Each of the accelerometers attached to the ACM weighs approximately 3 grams,

and did not affect the integrity of the ACM.

Vehicle speeds were measured using pre-impact laboratory speed traps. Additionally, to

evaluate recorded data with varying pre-crash speeds and brake input, the RAV4 was equipped

with a remotely-operated pneumatic actuator that applied force to the brake pedal approximately

two seconds before impact. The trunk-mounted accelerometers were used to measure vehicle

deceleration and speed at impact. The accelerator was not applied in any of the tests. A test

matrix is shown in Table 3.

5 Exponent data collection and processing conformed with SAE J211 guidelines, as required by the Federal

government for the conduct and documentation of safety compliance crash tests.

0907698.000 A0T0 0211 RPTD 15

Figure 5. Location and arrangement of the accelerometers attached to the RAV4 ACM.

Table 3. Crash Test Matrix

Vehicle EDR Capability Impact

Speed

Braking

Input

Accelerator

Input

2007 Toyota RAV4 Pre- and post-crash data 27.5

km/h 2 seconds prior to impact None

2007 Toyota Tundra Pre- and post-crash data 48.6

km/h None None

2007 Toyota Corolla Post-crash data only 65.3

km/h None None

2005 Toyota Camry Post-crash data only 47.5

km/h None None

2007 Lexus ES 350

Pre- and post-crash data 81.0 km/h

None None

2002 Toyota Camry

Post-crash data only 47.8 km/h

None None

2003 Toyota Camry

Post-crash data only 64.5 km/h

None None

Lateral

Vertical

Longitudinal

0907698.000 A0T0 0211 RPTD 16

4.1 2007 Toyota RAV4

A 2007 Toyota RAV4 was crashed into a rigid barrier with pre-impact braking. The 2007

Toyota RAV4 was equipped with a pneumatic actuator that was remotely triggered to apply the

vehicle’s brake pedal approximately two seconds prior to impact. The vehicle was towed and

released at a speed of 49.1 km/h (30.5 mph) without accelerator input. At impact, the vehicle’s

speed had been reduced by the braking to 27.5 km/h (17.1 mph). A photograph of the vehicle at

impact is shown in Figure 6. The test report is provided in Appendix E.

Figure 6. 2007 Toyota RAV4 at impact with rigid barrier.

Figure 7 shows the pre-crash data recorded by the EDR for the Toyota RAV4 crash test. The

EDR correctly reported brake status as “Off” at points in time of 3, 4, and 5 seconds prior to

impact, followed by “On” status at points in time of 1 and 2 seconds prior to impact. The

accelerator voltage was reported by the EDR as 0.78 V for all five seconds leading up to the

impact, which is consistent with the accelerator not being depressed.

The EDR reported the vehicle speed at the last pre-crash data point recorded prior to impact as

32.0 km/h (19.9 mph). According to the EDR, this data point was recorded 300 ms (within a

100 ms resolution) prior to impact. The data from the laboratory instrumentation (see Appendix

E, pre-impact longitudinal velocity versus time) shows that the vehicle was traveling

approximately 31.5 km/h (19.6 mph) at 300 ms before impact.

0907698.000 A0T0 0211 RPTD 17

Figure 7. Pre-crash data from Toyota RAV4 EDR.

The post-crash velocity change (delta-V) reported by the EDR is plotted in Figure 8 along with

the velocity change calculated from the measurements using the laboratory accelerometers that

were affixed to the ACM and near the vehicle’s center of gravity (CG). The maximum delta-V

reported from the EDR data was 33.0 km/h (20.5 mph) as compared to 32.6 km/h (20.3 mph)

calculated from the laboratory accelerometer located near the CG. Delta-V is calculated by the

EDR from stored acceleration values. Delta-Vs calculated using the accelerometers positioned

near the CG and on the ACM were processed using SAE J211 specifications. For reference

purposes, the measured speed at impact is also shown.

The EDR correctly reported seat belt status and driver seat position.

0907698.000 A0T0 0211 RPTD 18

Figure 8. Comparison of velocity change calculated from laboratory accelerometers and velocity change reported by the EDR for 2007 Toyota RAV4 crash test.

4.2 2007 Toyota Tundra

A 2007 Toyota Tundra was towed up to speed and then released. Just prior to impact with a

rigid barrier, the truck speed was measured by the laboratory sensors to be 48.6 km/h (30.2 mph).

There was no braking or accelerator application prior to impact. A photograph of the impact is

shown in Figure 9. The crash test report is provided in Appendix F.

Figure 9. 2007 Toyota Tundra at impact with rigid barrier.

0

5

10

15

20

25

30

35

0 0.05 0.1 0.15 0.2

Delta‐V (km

/h)

Time (s)

07 RAV4 CG Accelerometer J211

07 RAV4 ACM Mounted Accelerometer J211

07 RAV4 EDR Readout

Impact Speed

0907698.000 A0T0 0211 RPTD 19

The 2007 Tundra was equipped with an EDR that records pre-crash data, and the resulting EDR

data is shown in Figure 10. The accelerator voltage was reported by the EDR as 0.78 V for all

five seconds leading up to the impact, which is consistent with the accelerator not being

depressed. The EDR also correctly recorded the absence of pre-crash brake application. The

pre-crash vehicle speed was recorded by the EDR as 48.0 km/h (29.8 mph) approximately 400

ms prior to impact. As previously discussed, vehicle speed is recorded in 2 km/h increments, so

the EDR accurately captured the actual impact speed of 48.6 km/h (30.2 mph) as measured by

the speed trap.

0907698.000 A0T0 0211 RPTD 20

Figure 10. Pre-crash data from Toyota Tundra EDR.

The velocity change reported by the EDR is plotted in Figure 11 along with the velocity change

calculated from the laboratory accelerometers mounted on the ACM and near the vehicle’s CG.

The maximum delta-V reported from the EDR data was 54.0 km/h (33.5 mph) as compared to

53.6 km/h (33.3 mph) calculated from the laboratory accelerometers located near the CG. Delta-

0907698.000 A0T0 0211 RPTD 21

Vs calculated using the accelerometers positioned near the CG and on the ACM were processed

using SAE J211 specifications. For reference purposes, the measured speed at impact is also

shown.


Figure 11. Comparison of velocity change calculated from laboratory accelerometers and velocity change reported by the EDR for the 2007 Toyota Tundra crash test.

4.3 2007 Toyota Corolla

A 2007 Toyota Corolla was crashed into a rigid barrier at an impact speed of 65.3 km/h (40.6

mph). The EDR for this vehicle does not record pre-crash data such as vehicle speed. A

photograph of the impact is shown in Figure 12. The crash test report is provided in

Appendix C.

0

10

20

30

40

50

60

0 0.02 0.04 0.06 0.08 0.1 0.12 0.14 0.16

Delta‐V (km

/h)

Time (s)

07 Tundra CG Accelerometer J211

07 Tundra ACM Mounted Accelerometer J211

07 Tundra EDR Readout

Impact Speed

0907698.000 A0T0 0211 RPTD 22

Figure 12. 2007 Toyota Corolla at impact with rigid barrier.

During the Corolla’s impact with the rigid barrier, two of the three flanges used to bolt the airbag

control module to the vehicle fractured (Figure 13). This was the result of deformation to the

vehicle floor pan underneath the ACM after the vehicle had experienced significant crush, and

after the airbags had deployed. The ACM cables remained connected throughout the crash test,

and the EDR finished recording all data from the event.

The post-crash velocity change reported by the EDR is plotted in Figure 14 along with the

velocity change calculated from the laboratory accelerometers that were mounted near the

vehicle’s CG. As a consequence of the fractured ACM flanges, the ACM and the accelerometers

mounted to it shifted during the latter portion of the crash sequence, affecting the velocity change

measured by the EDR and the instrumentation. Therefore, the delta-V from the laboratory

sensors mounted to the ACM housing was not plotted. The accelerometers mounted near the

vehicle CG also recorded accelerations in excess of 50 g’s for more than 10 ms, so it is probable

that the accelerations recorded by the ACM’s accelerometers were truncated (see Section 2.1 for

a discussion on this point). The delta-V calculated using the accelerometers positioned near the

CG was processed using SAE J211 specifications. For reference purposes, the measured speed

at impact is also shown. The maximum delta-V calculated from the laboratory accelerometers

positioned near the CG was 73.0 km/h (45.3 mph) as compared to 70.6 km/h (43.9 mph) reported

from the EDR data.


0907698.000 A0T0 0211 RPTD 23

Figure 13. Fractured mounting flange on the Corolla ACM.

Figure 14. Comparison of velocity change calculated from laboratory accelerometers and velocity change reported by the EDR for the 2007 Toyota Corolla crash test.

0

10

20

30

40

50

60

70

80

0 0.02 0.04 0.06 0.08 0.1 0.12 0.14 0.16

Delta‐V (km

/h)

Time (s)

07 Corolla CG Accelerometer J211

07 Corolla EDR Readout

Impact Speed

Longitudinal

acceleration likely exceeded50 g

ACM mounting flanges fractured

0907698.000 A0T0 0211 RPTD 24

4.4 2005 Toyota Camry

The 2005 Toyota Camry was crashed into a rigid barrier at an impact speed of 47.5 km/h (29.5


photograph of the impact is shown in Figure 15. The test report for this crash is provided in

Appendix D.

Figure 15. 2005 Toyota Camry at impact with rigid barrier.


calculated from the laboratory accelerometers that were positioned on the ACM and near the

vehicle’s CG. Delta-Vs calculated using the accelerometers positioned near the CG and on the

ACM were processed using SAE J211 specifications. For reference purposes, the measured

speed at impact is also shown. The maximum delta-V reported from the EDR data was 55.9

km/h (34.7 mph) compared with 53.1 km/h (33.0 mph) calculated from the laboratory

accelerometers located near the CG.


0907698.000 A0T0 0211 RPTD 25

Figure 16. Comparison of velocity change calculated from laboratory accelerometers and velocity change reported by the EDR for the 2005 Toyota Camry crash test.

4.5 2007 Lexus ES 350

The 2007 Lexus ES 350 was crashed into a rigid barrier at an impact speed of 81.0 km/h (50.3

mph). A photograph of the impact is shown in Figure 17. The 2007 Lexus ES 350 was equipped

with an EDR that records pre-crash data. The test report is provided in Appendix G.

Figure 17. 2007 Lexus ES 350 at impact with rigid barrier.

0

10

20

30

40

50

60

0 0.02 0.04 0.06 0.08 0.1 0.12 0.14 0.16

Delta‐V (km

/h)

Time (s)

05 Camry CG Accelerometer J211

05 Camry ACM Mounted Accelerometer J211

05 Camry EDR Readout

Impact Speed

0907698.000 A0T0 0211 RPTD 26

During the Lexus ES 350’s impact with the rigid barrier, all the flanges used to bolt the airbag

control module to the vehicle fractured, allowing the module to move relative to the vehicle. As

in the Toyota Corolla test, this was the result of deformation to the vehicle floor pan underneath

the ACM, and it occurred after the vehicle had experienced significant crush and after the airbags

had deployed. The ACM cables remained connected throughout the crash test, and the EDR

finished recording all data from the event.

Figure 18. Pre-crash data from Lexus ES 350 EDR.

Figure 18 shows the pre-crash data recorded by the EDR for the Lexus ES 350 crash test. The

pre-crash vehicle speed was recorded by the EDR as 78.0 km/h (48.5 mph) approximately 400

ms prior to impact. The EDR correctly reported brake status as “Off” for the five seconds

0907698.000 A0T0 0211 RPTD 27

leading up to impact. The accelerator voltage was reported by the EDR as 0.78 V for all five

seconds leading up to the impact, which is consistent with the accelerator not being depressed.


calculated from the laboratory accelerometers that were mounted near the vehicle’s CG. As a

consequence of the crash, the ACM detached from the vehicle and no longer accurately

measured vehicle accelerations. Therefore, the delta-V from the laboratory sensors mounted to

the ACM housing was not plotted. The accelerometers mounted near the vehicle CG also

recorded accelerations in excess of 50 g’s for more than 10 ms, so it is probable that the

accelerations recorded by the ACM’s accelerometers were truncated (see Section 2.1 for a

discussion on this point). Further, the analog-to-digital converter for the longitudinal

accelerometer mounted near the vehicle CG was saturated during the crash, so the delta-V

(which was calculated using SAE J211 specifications) would underestimate the true delta-V. For

reference purposes, the measured speed at impact is also shown. The maximum delta-V

calculated from the laboratory accelerometers positioned near the CG was 86.7 km/h (53.9 mph)

as compared to 54.5 km/h (33.9 mph) reported from the EDR data.


0907698.000 A0T0 0211 RPTD 28

Figure 19. Comparison of velocity change calculated from laboratory accelerometers and velocity change reported by the EDR for the 2007 Lexus ES 350 crash test.6




photograph of the impact is shown in Figure 20. The test report for this crash is provided in

Appendix H.


6 Note: The ACM shifted during the crash.

0

10

20

30

40

50

60

70

80

90

100

0 0.05 0.1 0.15 0.2

Delta‐V (km

/h)

Time (s)

07 ES350 CG Accelerometer J211

07 ES350 EDR Readout

Impact Speed

Longitudinal

acceleration likely

exceeded50 g

ACM mounting

flanges fractured

0907698.000 A0T0 0211 RPTD 29


calculated from the laboratory accelerometers that were mounted on the ACM and near the

vehicle’s CG. Delta-Vs calculated using the accelerometers positioned near the CG and on the

ACM were processed using SAE J211 specifications. For reference purposes, the measured

speed at impact is also shown. The maximum delta-V reported from the EDR data was 55.7

km/h (34.6 mph) compared to 52.2 km/h (32.4 mph) calculated from the laboratory

accelerometers mounted near the vehicle’s CG.


Figure 21. Comparison of velocity change calculated from laboratory accelerometers and

velocity change reported by the EDR for the 2002 Toyota Camry crash test.



mph). The EDR for this vehicle does not record pre-crash data. A photograph of the impact is

shown in Figure 22. The test report for this crash is provided in Appendix I.

0

10

20

30

40

50

60

0 0.02 0.04 0.06 0.08 0.1 0.12 0.14 0.16

Delta‐V (km

/h)

Time (s)


02 Camry ACM Mounted Accelerometer J211


Impact Speed

0907698.000 A0T0 0211 RPTD 30


During the 2003 Camry’s impact with the rigid barrier, the rearmost of the three flanges used to

bolt the airbag control module to the vehicle fractured. As in the Toyota Corolla and Lexus ES

350 tests, this was the result of deformation to the vehicle floor pan underneath the ACM, and

occurred after the vehicle had experienced significant crush and after the airbags had deployed.

The ACM cables remained connected throughout the crash test, and the EDR finished recording

all data from the event.

0907698.000 A0T0 0211 RPTD 31

Figure 23. Fractured mounting flange on the 2003 Toyota Camry.


calculated from the laboratory accelerometers that were mounted near the vehicle’s CG. The

delta-V calculated using the accelerometers positioned near the CG was processed using SAE

J211 specifications. For reference purposes, the measured speed at impact is also shown. The

accelerometers mounted near the vehicle CG also recorded accelerations in excess of 50 g’s for

more than 10 ms, so it is probable that the accelerations recorded by the ACM’s accelerometers

were truncated (see Section 2.1 for a discussion on this point). As a consequence of the fractured

ACM flange, the ACM housing and the accelerometers mounted to it were not fully fixed to the

vehicle chassis, affecting these measured accelerations. Therefore, the delta-V from the

laboratory sensors mounted to the ACM housing was not plotted. The maximum delta-V

reported from the EDR data was 56.2 km/h (34.9 mph) compared to 65.6 km/h (40.7 mph)

calculated from the laboratory accelerometers mounted near the vehicle’s CG.

0907698.000 A0T0 0211 RPTD 32


Figure 24. Comparison of velocity change calculated from laboratory accelerometers and velocity change reported by the EDR for the 2003 Toyota Camry crash test.

0

10

20

30

40

50

60

70

0 0.02 0.04 0.06 0.08 0.1 0.12 0.14 0.16

Delta‐V (km

/h)

Time (s)



Impact Speed

Longitudinal acceleration likely

exceeded50 g

Rear mounting

flange fractured

0907698.000 A0T0 0211 RPTD 33

5 EDR Memory Toughness Testing

EDR data is stored within the ACM on an EEPROM IC. Figure 25 and Figure 26 show the

location of this chip within the ACM from a 2007 Toyota Camry (ACM model #: 89170-33490).

In this case, the EEPROM is a BR93CXX family Microwire BUS Serial EEPROM manufactured

by Rohm Corporation. Other Toyota ACMs use different EEPROM ICs and have different

board layouts; another example is described in the section of this report on impact testing an

ACM. The EEPROM IC in this 2007 Camry’s ACM is in SOIC8 packaging. Its pins are

soldered onto the surface of the ACM’s Printed Circuit Board (PCB). The pin layout and

assignment for the BR93CXX family Microwire BUS Serial EEPROM is shown in Figure 27.

Figure 25. Opened ACM module.

0907698.000 A0T0 0211 RPTD 34

Figure 26. Front and back of the ACM module; the EEPROM IC is located on the corner, on the back of the PCB.

Figure 27. Pin layout and assignment of the EEPROM IC used in this test.

5.1 Data Retrieval Methodology

Our testing demonstrated that a commercially available EEPROM reader can be used to read the

data directly from the EEPROM IC, instead of using the conventional hardware and software for

accessing this information. The adapter clamp that comes with this standard EEPROM reader

has 8 contact pins that correspond to the 8 pins on the EEPROM IC (Figure 28 and Figure 29).

0907698.000 A0T0 0211 RPTD 35

Figure 28. Commercially available EEPROM reader with SOIC8 EEPROM adapter clamp.

Figure 29. Data acquisition by clamping onto the EEPROM IC pins.

0907698.000 A0T0 0211 RPTD 36

To demonstrate this method of reading the EDR data with a simple conventional EEPROM

reading tool, a non-deployment event was generated using the ACM tapping method described

previously. The data in the undamaged ACM was read directly from the EEPROM chip, and is

shown in Figure 30. For comparison, the data was also downloaded from the ACM using the

Toyota EDR readout tool. The data from the “rot” file produced by the readout tool is shown in

Figure 31, and the data is identical to that read directly from the chip.

Figure 30. Non-deployment event data read directly from the EEPROM chip.

0907698.000 A0T0 0211 RPTD 37

Figure 31. Non-deployment event data read using Toyota’s EDR readout tool.

5.2 Oven Test

To evaluate the mechanical and thermal toughness of the EEPROM memory in the ACM unit

and the data readability of the EDR, the same ACM from the 2007 Toyota Camry was subjected

to severe thermal stresses. It was first placed unpowered in an oven at 500˚C for approximately

five minutes. The post-test ACM unit is shown in Figure 32. The stickers on the metal casing of

the ACM unit were burned and the text was unreadable. The plastic connector socket also

melted. However, the overall structure of the metal casing remained intact.

Figure 32. ACM unit exterior after the oven test.

The ACM unit was opened and inspected after the oven test. Some of the soldered components

fell from the front of the PCB due to the elevated temperature (Figure 33). The PCB was

attached to the back metal plate by the melted plastic from the connector socket after the test. A

section of the back metal plate had to be subsequently removed in order to access the EEPROM

0907698.000 A0T0 0211 RPTD 38

IC (Figure 34). After gaining access to the IC, correct data was read by the EEPROM reader

through direct clamping.

Figure 33. ACM PCB after the oven test; components have fallen from the board.

Figure 34. PCB with EEPROM IC exposed.

0907698.000 A0T0 0211 RPTD 39

5.3 Direct Flame Impingement Tests

The exposed PCB area was then subjected to direct flame impingement by a propane torch to

evaluate the thermal toughness of the ACM unit and the data readability of the EDR when

exposed to intense heating. The flame was applied multiple times and data collection was

attempted and analyzed after flame application to ensure a valid fresh data read. Figure 35

illustrates the condition of the PCB after repeated applications by a propane torch.

The propane flame was first applied to the exposed area for approximately five seconds. The

corner of the PCB had obvious scorching and charring. The top layer of the PCB had started to

peel and crack. The surface around the EEPROM chip had begun to bubble. Correct data was

able to be read by the EEPROM reader at this point via direct clamping onto the pins.

The propane flame was then applied for approximately another five seconds to the corner of the

PCB with the chip, including approximately two seconds of direct flame application to the top of

the chip. There was cracking and charring at the corner of the PCB with bubbling of the solder

flux and PCB conformal coating. A section of the PCB top layer had flaked off, exposing the

copper underneath. There was slight melting of the EEPROM chip. Correct data was again read

by the EEPROM reader via direct clamping onto the pins.

The propane flame was then applied directly to the top of the chip for approximately three more

seconds. Further damage to the corner of the PCB, the chip surroundings, and the chip itself

were observed. The status of the chip is shown in Figure 36. Correct data could still be read by

the EEPROM reader at this point through direct clamping onto the pins.

The propane flame was then applied directly to the top of the chip for another 15 seconds in three

intervals, each approximately five seconds in duration. Severe charring and melting in the

exposed PCB section was observed. Some of the black coating material on the chip faded away.

Cracks running more than half the width of the chip were observed. The result is shown in

Figure 37. The non-deployment data could no longer be read at this point; the chip was

unreadable by the reader.

0907698.000 A0T0 0211 RPTD 40

Figure 35. Photos of the PCB after repeated applications of a propane flame.

5 seconds

10 seconds

13 seconds ~28 seconds

0907698.000 A0T0 0211 RPTD 41

Figure 36. Damaged EEPROM IC after approximately 13 seconds of propane flame impingement to the PCB and chip; correct data could still be read.

0907698.000 A0T0 0211 RPTD 42

Figure 37. Cracked EEPROM IC at the end of the propane torch flame test; data could no longer be read.

5.4 Mechanical Impact Test

Having tested the thermal toughness of the EEPROM chip in the ACM, another ACM unit was

subjected to an impact test to evaluate the mechanical toughness of the EEPROM and the data

stored on it. The ACM unit (ACM model #: 89170-0C311) used for this test was from the 2007

Toyota Tundra (VIN 014817) that was previously subjected to a full vehicle crash test (Figure

38).

0907698.000 A0T0 0211 RPTD 43

Figure 38. 2007 Tundra and its ACM.

After being extracted from the crashed Toyota Tundra, the ACM was positioned on a shuttle

connected to the tow cable system of Exponent’s crash rail. The shuttle was accelerated to a

speed of 121.7 km/h (75.6 mph) and then decelerated suddenly, allowing the ACM to slide off

the shuttle (Figure 39). The ACM traveled approximately 6.7 meters in free flight and impacted

a steel plate secured to the face of a rigid barrier. The ACM left the shuttle facing forward, i.e.,

the front of the ACM pointed toward the barrier. The ACM rotated during flight and impacted

the barrier with its aft surface.

Following impact, the ACM was inspected. The rearmost flange used to bolt the module to the

vehicle was fractured and parts of the connector housing were broken off (Figure 40). The aft

side of the ACM cover was also bent and scuffed. Internal components had been damaged, as

was observed by the sound of loose parts when the ACM was turned upside down.

Attempts were made to image the information stored on the EDR through the ACM connector,

but a communication error was received (Figure 41).

0907698.000 A0T0 0211 RPTD 44

Figure 39. ACM positioned on the shuttle for the impact test.

Figure 40. ACM unit after the impact test.

0907698.000 A0T0 0211 RPTD 45

Figure 41. EDR imaging through the ACM connector (left); communication error message (right).

The ACM unit was then opened for inspection. Severe damage was observed inside the ACM

unit. Several components including inductors, capacitors and ICs had separated from the PCB

due to the impact (Figure 42). Bending of the connector pins and cracking of the plastic

connector socket were also observed (Figure 43).

The EEPROM IC found in this ACM unit (Figure 44) was an AT250XX family SPI Serial

EEPROM manufactured by Atmel Corporation. As in the ACM from the 2007 Camry, this

EEPROM is in an SOIC8 package, has pin spacing of 50 mil, and its pins are soldered onto the

surface of the ACM’s PCB. Figure 45 shows the pin layout and assignment of the AT250XX

family SPI Serial EEPROM.

The same commercially available EEPROM reader used in the EDR thermal testing was used to

read the data from the Atmel EEPROM IC. In this experiment, the EEPROM IC was desoldered

from the PCB and subsequently read by the reader (Figure 46).

Data was readable from the stand-alone EEPROM IC (Figure 47) and matched the data recorded

in the “rot” file generated by Toyota’s EDR readout tool (Figure 48). Note that for this particular

EDR, only the memory addresses that are used are reported in the “rot” file.

0907698.000 A0T0 0211 RPTD 46

Figure 42. ACM unit after disassembly; loose plastic pieces, capacitors, inductors and ICs were observed.

Figure 43. Bent pins and cracks observed on the ACM plastic connector.

0907698.000 A0T0 0211 RPTD 47

Figure 44. PCB in the ACM with EEPROM IC circled.

Figure 45. Pin layout and assignment of the AT250xx EEPROM IC used in this test.

0907698.000 A0T0 0211 RPTD 48

Figure 46. EEPROM IC de-soldered from the PCB (left); commercially available EEPROM reader clamping onto the memory IC (right).

Figure 47. EEPROM data read using the commercial reader from an impact-tested 2007 Tundra ACM.

0907698.000 A0T0 0211 RPTD 49

Figure 48. 2007 Tundra data read using Toyota’s EDR readout tool.

0907698.000 A0T0 0211 RPTD 50

6 Concept for a New Method of EDR Readout

Exponent proposes a new concept for obtaining and interpreting the data stored in vehicle EDRs.

The system has several advantages over the existing EDR readout and data management systems.

6.1 Existing EDR Readout Systems

The Toyota EDR Readout Tool and Bosch Crash Data Retrieval (CDR) System have a similar

approach to downloading and interpreting EDR data. As illustrated in Figure 49, these systems

both use dedicated interface modules and a laptop computer loaded with specialized software.

Using the dedicated interface module and cables, the computer downloads EDR data via the

vehicle’s OBD-II port or by connecting directly to the ACM. After being downloaded, the

hexadecimal data from the EDR is interpreted on the laptop using special software. To maintain

the ability to correctly interpret data from new and existing vehicles, both Toyota and Bosch

periodically release software updates. For the Bosch CDR system, access to software updates

requires a subscription to the software, at a cost of $749 per year. This is in addition to the initial

price of the Bosch CDR Interface Module, which together with a complete set of cables is

approximately $5000. A photograph of the Bosch CDR system is shown in Figure 50. Other

manufacturers’ vehicles equipped with EDRs typically employ similar methodologies.

Figure 49. Schematic of existing Bosch CDR system.

0907698.000 A0T0 0211 RPTD 51

Figure 50. Photograph of the components of the Bosch CDR system.

6.2 Proposed EDR Data Management System

The EDR readout method proposed by Exponent consists of two components:

1. An EDR module that would include a read-only USB port: The EDR could be plugged

into any computer that has a USB host, and encrypted EDR data from the EEPROM

inside the module can be downloaded through the USB port. In this mode, the EDR

functions as a read-only USB memory drive with hardware encrypted data.

2. An online data management service: The encrypted data downloaded from the EDR USB

port subsequently could be uploaded to a centralized secure online service for data

analysis. The data decryption and interpretation would be performed only at the

0907698.000 A0T0 0211 RPTD 52

centralized online service and a report would be generated to give the user the meaning of

the data.

A conceptual illustration of the proposed EDR readout method is shown in Figure 51.

Figure 51. Schematic of proposed EDR readout method.

Currently, a commercially available EDR system does not have a USB port. Adding the

electronics for the additional USB port function is feasible and should not significantly add to the

cost and complexity of the EDR system:

- USB memory storage devices have been used for many years with millions of non-

volatile memory-based flash drives. Flash drives with far more memory than necessary

for this purpose can be purchased retail for under $5 and the price per GB is continuously

dropping. We anticipate there are non-recurring engineering (NRE) costs associated with

a customized memory controller chip to interface between the USB port and the

EEPROM chip. However, this effort is not overly complex, as EEPROM read access is

0907698.000 A0T0 0211 RPTD 53

relatively straightforward, at low speed, and much less data compared to the state-of-the-

art flash drives. The proposed USB port will be read-only, preventing the EEPROM data

from being altered through the USB port.

- When the EDR is unpowered from the vehicle, the EEPROM and the USB controller

chip can be powered by the Vbus pin (5V) from the USB port. Alternatively, the Vbus

pin can be powered through the USB cable.

The online service provides a centralized data management system. In addition to the data

decryption and data interpretation services, the data can be used for research purposes to improve

public safety. The online service can provide privacy options for users’ data. Such options

dictate how the data a user uploads can be shared, such as with the manufacturer or

governmental agencies, or included in a database for research purposes. A sample privacy option

table/prompt is shown in Figure 52.

The online site could also include educational material for how to interpret the EDR data from

different manufacturers.

The online site can be established before USB-enabled EDRs are available so that the advantages

of this system will be available to users downloading data from previous generations of EDRs.

0907698.000 A0T0 0211 RPTD 54

Figure 52. Screenshot of proposed EDR data interpretation service.

6.3 Benefits of New EDR Data Management Method

Compared to the existing EDR readout and management systems, the new EDR data

management system offers benefits similar to “cloud computing,” as opposed to the de-

centralized “on premises information technology.” This could help prevent archived data loss by

investigators, such as might occur from natural disasters, computer storage hardware failure, or

other causes.

6.3.1 Simple Data Collection Tool

The data collection hardware would be simple, such as a tablet PC, smart phone or other

handheld device, as it would contain no interpretation capability. It eliminates the need for

different cables, connectors, car manufacturer software packages and equipment for different

vehicle brands, EDR modules and connection sockets. The connection method is simply a

EDR Readout Interpretation Service

STEP 1. REGISTER

STEP 2. CHOOSE PRIVACY OPTIONS

Store all data

Store data without any personally identifiable information

Don’t store any data

Choose whether the data you upload will be retained for use by Toyota and government agencies

Crash data will be stored without the uploading user’s information or the VIN

No data will be retained after you download the data interpretation

STEP 3. UPLOAD HEXADECIMAL CRASH DATA

STEP 4. DOWNLOAD DATA INTERPRETATION

0907698.000 A0T0 0211 RPTD 55

standard USB port. Further, the ACM does not need to be powered or the cables disconnected to

access the EDR memory.

6.3.2 Enhanced Data Security Control

The downloaded data is encrypted to protect against tampering. Online interpretation could be

limited to registered users. In this way, the ability to download and interpret data could involve

separate restrictions. Before uploading data, the user could also be required to acknowledge that

they have a legal right to the data. By requiring registration in order to interpret data, the online

service could monitor for potential misuse, such as data spoofing or attempts to reverse-engineer

the interpretation method.

6.3.3 Enhanced Software Updates

Since the online service would have the latest interpretation software, users would not need to

maintain such information on their personal devices. The rollout of interpretation software

would be faster and greatly simplified since only one source would need updating. The service

could be continually updated, as opposed to having to wait to release updates a few times each

year.

The online service could notify registered users via email about changes in software that affect

data they had previously interpreted. In this way, the user could obtain updated reports without

having to periodically check for changes that might affect them.

6.3.4 Centralized Crash Safety Database

Because all data downloads will need to be interpreted by the online service, the online service

will be in a unique position to aggregate EDR downloads. For research purposes, the

government and/or manufacturers would have a centralized means for acquiring and studying

crash data that has been allowed by users. Such data could be used to study crashes and improve

vehicle safety. This data is not currently available on this scale, even within NHTSA’s National

Automotive Sampling System (NASS) database.

0907698.000 A0T0 0211 RPTD 56

The online service would be maintained by an independent (neutral) third party provider not

affiliated with a manufacturer or the government. The manufacturer would be responsible for

ensuring that the latest interpretation data is available to the online service. Thus, confidentiality

can be preserved at the level desired by the user.

0907698.000 A0T0 0211 RPTD

Appendix A EDR Implementation in North American Vehicles Data provided by Toyota

0907698.000 A0T0 0211 RPTD

Appendix B Non-deployment Events Created During Exponent’s Testing

0907698.000 A0T0 0211 RPTD

Belted Unbelted Belted Unbelted Forward Rearward Unoccupied Child AF05 M50 / Adu P R N Drive

2007 Toyota RAV4 (VIN 3813) x x x x x x



Summary (VIN 3813) 2 1 1 2 0 3 0 1 2 0 2 0 1 0 x

2007 Toyota Tundra (VIN 4817) x x x x x x



Summary (VIN 4817) 2 1 1 2 0 3 1 1 1 0 2 0 1 0 x

2007 Toyota Corrolla (VIN 1764) x x x x N/A N/A N/A N/A x



Summary (VIN 1764) 1 2 1 2 0 3 2 0 1 0 N/A N/A N/A N/A x

2005 Toyota Camry (VIN 7830) x x x x N/A N/A N/A N/A x





2007 Lexus ES350 (VIN 0879) x x x x x x




Summary (VIN 0879) 3 1 3 1 2 2 0 0 0 4 4 0 0 0 x

2008 Toyota Sienna (VIN 1978) x x x x x x

















Summary (VIN 1978) 10 7 3 14 1 16 9 6 2 0 11 2 0 4 x





















Summary (VIN 2519) 15 5 7 13 4 16 11 4 0 5 5 2 0 13 x

Passenger Occupant Transmission Position

VerifiedVehicle

Driver Belt Passenger Belt Driver Seat Position

0907698.000 A0T0 0211 RPTD


2007 Toyota Camry (VIN 1175) x x x x x x






















Summary (VIN 1175) 6 16 4 18 1 21 4 16 0 2 18 1 0 3 x











2007 Toyota Tundra (VIN 0298) x



2007 Toyota Tundra (VIN 0298) x



Summary (VIN 0298) 6 8 5 9 1 13 7 6 1 0 9 2 0 3 x

2006 Toyota Tacoma (VIN 0428) x x x x N/A N/A N/A N/A x











2010 Toyota Prius (VIN 0275) x x x x x x











Summary (VIN 0275) 6 5 5 6 1 10 3 4 1 3 6 0 1 4 x












2010 Toyota Prius (VIN 3325) x

Summary (VIN 3325) 6 5 4 7 2 9 4 5 1 1 7 1 2 1 x

Vehicle

Driver Belt Passenger Belt Driver Seat Position Passenger Occupant Transmission Position

Verified

0907698.000 A0T0 0211 RPTD


















Summary (VIN 2680) 10 6 6 10 3 13 6 5 2 3 11 1 2 2 x

2010 Toyota Corolla (VIN 9197) x x x x x x

























Summary (VIN 9197) 11 14 13 12 3 22 9 9 4 3 21 1 2 1 x

2010 Toyota Avalon (VIN 9937) x x x x N/A N/A N/A N/A x













Transmission Position

VerifiedVehicle

Driver Belt Passenger Belt Driver Seat Position Passenger Occupant

0907698.000 A0T0 0211 RPTD














Summary (VIN 3450) 8 4 4 8 4 8 4 3 3 2 8 1 1 2 x



















2006 Lexus IS 250 (VIN 4899) x x x N/A N/A N/A N/A x x










Summary (VIN 4899) 7 3 4 6 2 8 N/A N/A N/A N/A 6 1 2 1 x








Summary (VIN 1692) 4 3 3 4 3 4 N/A N/A N/A N/A 4 1 1 1 x

2007 Toyota FJ Cruiser (VIN 2218) x x x x N/A N/A N/A N/A x





Summary (VIN 6597) 1 0 0 1 1 0 0 0 0 1 1 0 0 0 x

Transmission Position

VerifiedVehicle

Driver Belt Passenger Belt Driver Seat Position Passenger Occupant

testing and analysis of toyota event data...

Documents