We’ve got to talk about the Dodge Charger Unintended Acceleration story that we and a number of other car publications ran yesterday. Namely, we have to talk about the term “drive-by-brake,” which sounds made up, partly because I cannot find a single reference to this term on the vast internet, and partly because its function sounds truly absurd: It accelerates your car when the “gas” pedal is broken. But is this “drive-by-brake” thing as ridiculous as it sounds? Yes and no.
I’ve been running around trying to talk with safety regulators and accelerator pedal module suppliers to see what the rules are on accelerator pedal failsafes, and I’ll be honest: I haven’t gotten too far. But I have found a NHTSA study and chatted with a number of engineers, many of whom all concluded roughly the same thing: “I get what Dodge is trying to do, and if it’s like a creep mode that’s fine. But it shouldn’t go that fast.”
That’s where I landed on this whole thing, but let’s step back for a second to recap. Edmunds recently published this article and the below video showing a Charger Daytona EV test car accelerating without any pedal input:
The article describes what happened:
I was pulling out onto a thoroughfare street from a strip mall parking lot when warning lights appeared on the Charger’s instrument panel for the stability control, frontal collision warning system, regenerative braking and more. There was also a short-lived message — it might have been something about the forward collision warning system — and that the car would be in low power mode. This wasn’t good.
I could tell something was wrong because the car accelerated sluggishly. I got the Charger up to the speed of traffic OK, but then I noticed something was very wrong when I slightly lifted off the accelerator. First, the Charger wasn’t using any regenerative braking to slow itself down like it should. (In an EV, you typically lift off the accelerator and the car decelerates without using the regular friction brakes.) It wasn’t coasting, either. It was, in fact, accelerating.
I watched the speedometer and could tell the Charger was gaining speed at approximately 1 mph per second, even though I did not have a foot on the pedal.
This wasn’t the only complaint of unintended acceleration in a Dodge Charger EV, and that’s damning because there aren’t many Charger EVs on the road. Here’s a complaint on the NHTSA database:
And here are a few Dodge Charger Daytona Forum posts, with the latter claiming a 20% pedal input even with the driver’s foot completely off the accelerator:
I cannot corroborate all of these claims, and there’s always a potential that the drivers actually had their foot on the “gas” or that something got trapped under the pedal, but the Edmunds video speaks for itself, and then there’s this: Dodge itself admitted that this unintended acceleration was actually intended.
Intended by Stellantis, that is, and in fact branded as “drive-by-brake,” the term that sounds fake and has pretty much no trace on the internet. Here was Dodge’s statement:
In the rare event of an accelerator pedal fault, Stellantis has implemented a ‘drive-by-brake’ safety feature, which allows the driver to control speed through the brake pedal. In this instance, the feature worked as intended, and the driver was able to safely maneuver the vehicle off the road. This feature has been in Stellantis internal combustion engine vehicles for many years and has been carried over to battery electric vehicles.
Many People Are Skeptical
Edmunds’ brief discussion of the above quote was simply “It’s interesting to hear the company describe this acceleration override as a “feature” rather than a bug. Nevertheless, we’ll keep you posted about what happens when the Charger Daytona comes back from the dealer.”
Our friends at Carscoops car-scooped us with the exact headline we were planning on using — “Dodge Says Charger Daytona’s Unintended Acceleration Is A Feature Not A Bug” — and that story’s comments definitely include some skeptics; here’s one:
Wut. That response seems completely insane, and if it’s really been a “feature” for years in a range of stellantis products I think it needs a lot more coverage.
Here’s another:
And another:
‘Working as intended’ isn’t the answer I expected, that’s nuts.
For The Most Part, Folks Get The Concept But Think The Execution/Communication Is Terrible
Given all the screens and how everything is pointlessly now interconnected, it’s annoying that they can’t just pop up a message saying something like “Lost communication with throttle sensor, entering 20% limp home mode” to both make fixing the issue far easier and to calm down the driver as to why the car’s behaving unexpectedly.
Here’s another good one by Keith Tanner acknowledging that he understands the intent:
I was wondering if the 20% throttle signal was an intentional design choice when I read the article before the update. It would allow the vehicle to be moved to safety. This isn’t a terrible failure mode. I agree that maybe the driver should be alerted, it’s not like there’s a lack of screens.
I know that there’s a limp mode in GM PCMs that will allow the engine to idle but ignores pedal input when it thinks something is awry. I’ve triggered it a few times myself when running a rowdier cam that gulps excessive air on shifts, leading to a plausibility error in the MAF that make the car think the throttle was stuck open. I idled to a stop in the Laguna Seca runoff area a few times. I could reset it by power cycling the PCM with my kill switch, which also had the side effect of erasing the codes. The fun part was that the lower air density at my home in Colorado wasn’t enough to trigger it, so the failure only happened at sea level. That made it really fun to try to figure out.
This mode absolutely should be speed limited, as The Mark notes:
What a very strange failsafe mode. As others have mentioned, it should be speed limited and there should be a message center warning (“Accelerator Error: Vehicle Speed Limited to 15 MPH”) or whatnot. Just enough to get your car safely off the road. I wonder what other OEMs have implemented in the event of this failure, which WILL happen, assuming they all share between a few pedal assembly suppliers.
Superflouis agrees:
Regarding the update – I’m kind of surprised the “drive by brake” emergency feature doesn’t have a speed limiter of 30 mph or so? I wonder if they put this in the owners manual…seems like an important detail idk
User Bob Boxbody asks a great question about the owner’s manual:
Is that drive-by-brake feature in the user manual? I’ve never heard of such a thing, but I’ve never owned a Dodge. I feel like Edmunds probably reads the manuals for their long-term tests (and if not, shame on them).
I looked at the owner’s manual (screenshot of two pages above; here it is in full) and found nothing, and neither did Charger EV owner named Hartley, who writes:
Owner here: It is NOT in the owner’s manual. I just checked a few minutes ago.
And to end on a funny note, we have this gem by Who Knows:
So are there any other secret drive modes that stellantis uses, say, if the steering fails you can control the steering rack with the window switches? Or if the parking brake fails, the power seat buttons can be used instead? If the vehicle won’t shift into drive, just toggle the door locks? Everything by wire could open up some interesting ways to control the vehicle.
The ‘Drive By Brake’ Concept Actually Appears To Be A Real Thing
There are a number of skeptics wondering whether “drive-by-brake” is real; I’m not sure if that term was recently made up, but I can tell you that my friend and Autopian contributor Steve Balistreri helped me find a 2020 NHTSA study that seems to confirm that such a feature is not unheard of. The title is “Functional Safety Assessment of a Generic Accelerator Control System With Electronic Throttle Control in Electric Vehicles,” and here’s its abstract:
This report describes the research effort to assess the functional safety of accelerator control systems with electronic faults, such as
errant electronic throttle control signals, following an industry process standard. This study focuses specifically on errant signals in
motor vehicles powered by gasoline internal combustion engines. This study follows the concept phase process in the ISO 26262
standard and applies a hazard and operability study, functional failure modes and effects analysis, and systems theoretic process
analysis methods. In total, this study identifies 5 vehicle-level safety goals and 179 ACS/ETC system safety requirements (an
output of the ISO 26262 and STPA processes). This study uses the results of the analysis to identify potential opportunities to
improve the risk assessment approach in ISO 26262.
The relevant part of the document is the one about “Safe States,” which are defined thusly: “The safe states for the [accelerator control system]/[electronic throttle control] are either full operation (full torque availability), degraded operation (0 < Torque < Full), or switched off mode (zero torque). The degraded operation may include different levels depending on the potential failure mode.”
The Safe State section of the report — and the one that relates most to the Charger situation — is here:
In case the [accelerator pedal position sensor] (APPS) signal is completely non- reliable, or if the [Engine Control Module] faults, but the vehicle can still be controlled by the brakes and the throttle actuator controller, the vehicle may be allowed a torque level higher than creep torque. In case of APPS and [Brake Pedal Position Sensor] malfunctions, no more than creep torque may be allowed. If the failure mode may result in uncontrolled torque production, then the system torque should be disabled.
- Safe states may include, but not limited to, the following states commonly used in the automotive industry:
- Safe State 1: Disable input from other vehicle systems, such as ACC and AEB.
- Safe State 2: Limit the maximum allowable propulsion torque to the propulsion torque level that was computed at the instant immediately prior to when the fault occurred.
- Safe State 3: Slow torque ramp rate in response to [accelerator pedal] input (e.g., single [accelerator pedal position sensor] fault)
- Safe State 4: Torque produced without AP input; speed limited to TBD (> creep) mph(e.g., two APPS faults; an ECM fault with throttle actuator controller still able to control throttle)
- Safe State 5: Torque produced at zero AP input value of the torque map (e.g., two APPS faults plus BPPS fault)
- Safe State 6: Zero torque output (e.g., vehicle disabled; system is unable to mitigate the hazards or ensure Safe States 1-5).
It’s worth noting that, the report admits that these “safe states” actually cause the vehicles to behave in a way that the report itself identified as the key hazards of a failed Accelerator Control System. Those hazards, which include the driver not commanding acceleration and the vehicle accelerating anyway, can be seen in this table:
The report makes a clear distinction about why these Safe States technically aren’t the same as the hazards defined above. From the report:
The safe states listed above describe propulsion reduction (Safe States 2, and 4-6) or deviations
from the specified speed decrease or increase profiles (Safe State 3). While these vehicle
responses may be similar to the identified hazards H2 through H4, there are key differences.• The propulsion reduction or modified speed decrease/increase profiles are controlled
when entering a safe state, while the hazards describe uncontrolled changes in propulsion
(e.g., changes are not smooth or consistent).• When entering a safe state, the driver is informed that the vehicle is in a degraded
operating state and can take appropriate action. The driver may not be notified of the
degraded operating state when hazards H2 through H4 manifest.
This second point is key, and leads the report into the section titled “Example Driver Warning Strategies.” From that section:
“• Amber Light: Potential violation of a safety goal is detected, but probability is moderate
(e.g., single APPS fault, BTO algorithm fault regardless of the need to execute the BTO
algorithm)
• Red Light: Potential violation of a safety goal is detected; probability is high (e.g., AP
Torque Map corruption, AP or BP communication/data transfer fault), or Potential violation of a safety goal is detectedChime: Audible notification of the driver is implemented whenever the conditions for the red-light driver warning are identified. The chime may continue until the fault is
removed.
• Messages: Messages are displayed to the driver at least with the red-light driver warning.
The messages include instructions to the driver in case exiting or staying away from the
vehicle is required.
• Haptic warning: Haptic warning may be an additional driver warning strategy. Dashboard
lights and audible chimes are commonly used in conjunction with haptic warning. It may
be beneficial to assess the drivers’ reactions to haptic warning when the system is at the
same time attempting to reach safe state and degraded operation
In short, the document mentions that not only is too much acceleration a bad thing, but too little is, as well. And I assume that’s what Stellantis is getting at with its strategy, which appears to employ Safe State 4, which is, again:
- Safe State 4: Torque produced without AP input; speed limited to TBD (> creep) mph(e.g., two APPS faults; an ECM fault with throttle actuator controller still able to control throttle)
Note that “Safe State 3: Slow torque ramp rate in response to [accelerator pedal] input (e.g., single [accelerator pedal position sensor] fault)” just slows the throttle ramp-up, but it is still responding to the pedal, whereas the Edmunds case involved no pedal input, hence why it appears to have been similar to Safe State 4.
The document says the safe state should be “speed limited,” to “TBD mph,” so it’s unclear what the rule is, if any, or what Dodge’s limit is. Plus, as far as “Driver Warning Strategies,” one could argue that the lights on the dash were just that, though I agree with most commenters who believe that a message would be prudent in this case.
If you’re Stellantis, “the feature worked as intended” in response to a video of a car accelerating past 40 mph is a bit odd; add to that the fact that the term “drive-by-brake” is a brand new one not seen in the owner’s manual, and the lack of a clear message on the vehicle’s screen, and I’d argue that Stellantis would have been smart to dive in a bit deeper into what “drive-by-brake” means — in fact, it could have been spun into a positive. But right now, many think it’s BS — not the fact that a feature exists, but the claim that everything was working “as intended.” It seems hard to believe that a car accelerating itself past 40 without the driver knowing what’s going on is “a feature.”
To be sure, the NHTSA study that Steve helped me dig up seems to imply that this strategy is not entirely unheard of, but again, the bigger issue in my view is the lack of communication with drivers about what is happening, and I think the speed should be limited to maybe a few MPH (it’s hard to believe that 40 MPH is the system working “as intended”). You don’t need to be driving a car on the freeway with no functioning accelerator pedal.
Also, these new cars shouldn’t have pedal failures in the first place.
I suspect this brand will not survive the next 4 years. It will be a brutal time for every manufacturer, but especially bad for the near dead, like Dodge.
It isn’t working at intended, the accelerator pedal is apparently broken on a brand new car.
If it is an intended failsafe, that means something failed.
This would be really easy to test in any stellantis vehicle, just get under the dash and unplug the accelerator pedal
As for “ if the steering fails you can control the steering rack with the window switches?”
My brother had this figured out decades ago! I was with him when we were on the highway in his ’67 VW squareback. He controlled his position within the lane and made lane changes by feathering the wing windows on either side as needed. A squareback is small enough that he could reach across to the passenger wing window to feather that one as well as the driver side.
Sounds like they took the wrong lessons from Boeing: adding a “safety feature” that’s not in the manual, doesn’t tell you when it’s kicked in, and has no limit to how much it’ll push the vehicle.
*cough*MCAS*cough*
Oh, this is a feature. They should name it Fail Safe anti-Deacceleration. They can charge like $8,000 for it.