An investigation means NHTSA has decided a pattern is worth examining. A
preliminary evaluation is often closed with no action; an engineering
analysis is the stage that usually precedes a recall.
Recall 23V838 Remedy Effectiveness
RQ24009
Still open recall query · opened April 25, 2024
the electrical system
The Office of Defects Investigation (ODI) is opening a Recall Query to assess the remedy adequacy of Recall 23V838. On December 12, 2023, Tesla filed a Defect Information Report (Recall 23V838) applicable to all Tesla models produced and equipped with any version of its Autopilot system, which Tesla described as an SAE Level 2 (L2) Advanced Driver Assistance System (ADAS). Autopilot is the simultaneous engagement of Tesla’s Traffic-Aware Cruise Control (TACC) and Autosteer. In describing the safety defect, Tesla’s Defect Information Report (DIR) explained that “the prominence and scope of the system’s controls may be insufficient to prevent driver misuse,” and Tesla committed to the deployment of a multipart remedy aimed at improving system and engagement controls and reducing mode confusion. EA22002 (upgraded from PE21020) was opened to investigate whether Tesla’s Autopilot contained a defect that created an unreasonable risk to motor vehicle safety and involved extensive crash analysis, human factors analysis, vehicle evaluations, and assessment of vehicle control authority and driver engagement technologies. The work conducted in these investigations aligns with Tesla’s conclusion in its 23V838 recall filing. During EA22002, ODI identified at least 13 crashes involving one or more fatalities and many more involving serious injuries in which foreseeable driver misuse of the system played an apparent role. Tesla filed Recall 23V838 to address concerns regarding the Autopilot system investigated in EA22002. Following deployment of the remedy in Recall 23V838, ODI identified concerns due to post-remedy crash events and results from preliminary NHTSA tests of remedied vehicles. Also, Tesla has stated that a portion of the remedy both requires the owner to opt in and allows a driver to readily reverse it. Tesla has also deployed non-remedy updates to address issues that appear related to ODI’s concerns under EA22002. This investigation will consider why these updates were not a part of the recall or otherwise determined to remedy a defect that poses an unreasonable safety risk. ODI is therefore opening this Recall Query investigation to further evaluate the adequacy of the remedy for recall 23V838.
Sudden Unintended Acceleration
DP23002
Still open defect petition · opened June 29, 2023
vehicle speed control
The Office of Defects Investigation (ODI) received a petition requesting that ODI reevaluate its decision to deny DP20-001 on the basis that intermittent high electrical current demands on the vehicles' 12VDC systems may have caused some or all of the incidents examined by ODI in DP20-001. The petitioner bases this information on a review of open-source research and the DP20-001 denial. The petition and related materials can be reviewed at NHTSA.gov under the following ODI number: 11528471.
Pedestrian alert sounds
DP22005
Closed defect petition · opened January 27, 2023 · closed August 7, 2023 · led to recall 22V063000
the electrical system
NHTSA received a petition on or about July 18, 2022, requesting that Federal Motor Vehicle Safety Standard (FMVSS) 141 be applied to all electric and hybrid vehicles operating in the United States. The petition can be reviewed at NHTSA.gov under ODI Number 11486072. FMVSS 141 establishes performance requirements for pedestrian alert sounds for motor vehicles. The standard applies to hybrid and electric vehicles that have a gross vehicle weight rating of 4,536 KG or less or are defined as low-speed vehicles. The standard became fully applicable to all such vehicles manufactured on or after March 1, 2021.On January 27, 2023, NHTSA opened Defect Petition (DP) 22-005 to evaluate the subject matter described in the petition. On June 24, 2023 and as supplemented on June 25, 2023, the petitioner notified NHTSA he was withdrawing his petition. The petitioner indicated that, based on his review of data, there is no justification for asserting potential benefits that could be derived from actions sought by my petition. Based on the petitioner's withdrawal, DP22-005 is closed. Closure of this DP does not represent a determination by NHTSA regarding the subject matter of the petition.
Autopilot System Driver Controls
EA22002
Closed engineering analysis · opened June 8, 2022 · closed April 25, 2024 · led to recall 23V085
the electrical system
The Office of Defects Investigation (ODI) upgraded PE21020 to EA22002 on June 8, 2022, to extend work and deepen the PE21020 crash analysis, to supplement that analysis with additional data, and to perform vehicle evaluations to understand how Tesla’s Autopilot system may exacerbate human factors or behavioral safety risks by undermining the effectiveness of the driver’s supervision. To support this work, ODI collected additional crash information and assessed vehicle control authority, driver engagement technologies, and related human factors considerations associated with partial automation via analysis of peer vehicle data and hands-on vehicle evaluation, assessments from NHTSA human factors subject matter experts, and reviews of related publications dedicated to partial driving automation. Autopilot is the simultaneous use of the features that Tesla calls Traffic-Aware Cruise Control (TACC) and Autosteer. TACC is a type of adaptive cruise control that, like traditional cruise control, maintains a set speed but also slows or accelerates as necessary to maintain the vehicle’s following distance from a vehicle in front. As designed, Autosteer detects lane markings and the presence of other nearby vehicles and objects to keep the vehicle in its driving lane. Autopilot is characterized by Tesla as an SAE Level 2 (“L2 system”) partial driving automation system that provides driver assistance through steering, propulsion, and braking within a specified driving environment under direct supervision of the driver. L2 systems should be designed to support the driver’s need to monitor the system in response to the constantly changing driving environment and, if necessary, take over the dynamic driving task. To ensure sufficient driver engagement, vehicles with L2 systems should employ driver engagement systems and usage controls that are appropriate and sufficient for the L2 system design and driver expectations. ODI completed an analysis of 956 crashes reported up to August 30, 2023. In approximately half (489) of those crashes, ODI found: 1.) that there was insufficient data to make an assessment; 2.) the other vehicle was at fault; 3.) Autopilot was found to not be in use; or 4.) the crash was otherwise unrelated to EA22002. Of the remaining 467 crashes, ODI identified trends resulting in three categories: collisions in which the frontal plane of the Tesla struck another vehicle or obstacle with adequate time for an attentive driver to respond to avoid or mitigate the crash (211), roadway departures where Autosteerwas inadvertently disengaged by the driver’s inputs (111), and roadway departures in low traction conditions such as wet roadways (145). ODI observed this pattern across all Tesla models and hardware versions. Crash and human factors assessment showed that Autopilot controls did not sufficiently ensure driver attention and appropriate use. At the same time, peer analysis and vehicle evaluations established that Autopilot invited greater driver confidence via its higher control authority and ease of engagement. This mismatch of weak usage controls and high control authority was evident in these crash categories, which included indications of driver disengagement from the driving task. This mismatch was also evident in roadway departures when the system was engaged in low traction conditions outside of Tesla’s recommendations.Additional information regarding NHTSA’s crash analysis is available in the EA22002 file. ODI reviewed these findings with Tesla during several conversations in Quarter 4 of 2023. On December 12, 2023, Tesla filed a Defect Information Report (DIR) (Recall 23V838) applicable to all Tesla models produced and equipped with any version of its Autopilot system. Tesla’s DIR described the functionality of this system, stated that the prominence and scope of the system’s controls may be insufficient to prevent driver misuse, and described a remedy to improve the effectiveness of driver warnings and to reduce mode confusion. ODI completed an extensive body of work via PE21020 and EA22002, which showed evidence that Tesla’s weak driver engagement system was not appropriate for Autopilot’s permissive operating capabilities. This mismatch resulted in a critical safety gap between drivers’ expectations of the L2 system’s operating capabilities and the system’s true capabilities. This gap led to foreseeable misuse and avoidable crashes. During EA220002, ODI identified at least 13 crashes involving one or more fatalities and many more involving serious injuries, in which foreseeable driver misuse of the system played an apparent role. ODI’s analysis conducted during this investigation, which aligns with Tesla’s conclusion in its Defect Information Report, indicated that in certain circumstances, Autopilot’s system controls and warnings were insufficient for a driver assistance system that requires constant supervision by a human driver. Given Tesla’s recall (23V838) of all vehicles equipped with Autopilot for insufficient controls to prevent misuse, ODI is closing EA22002. Concurrent with that closing, ODI has opened a Recall Query (RQ24009) to assess the effectiveness of the 23V838 remedy. To review the ODI reports cited in the Closing Resume ODI Report Identification Number document, go to NHTSA.gov.
Desiccated Air Bag Inflator Rupture
EA21002
Still open engineering analysis · opened September 17, 2021
the air bags
From 2000 through 2017, Takata produced millions of air bag inflators using two types of phase-stabilized ammonium nitrate ("PSAN") propellant -- propellant 2004 and propellant 2004L. After prolonged exposure to high temperature cycles and humidity, inflators using propellant 2004 can degrade, causing the propellant to burn too quickly when ignited. The rapid burning can cause the inflator to rupture during deployment, potentially causing serious or even fatal injury to vehicle occupants. See 2016 Blomquist Report at www.nhtsa.gov/sites/nhtsa.gov/files/documents/expert_report-hrblomquist.pdf.Consequently, all frontal inflators using propellant 2004 that do not contain a "desiccant" (a substance that traps and holds moisture) in US vehicles are under recall. These "non-desiccated" inflators either have been or are required to be replaced.In some cases, the remedy part for these recalled inflators was, or will be, an inflator using either propellant 2004 or 2004L that does contain a desiccant. None of these "desiccated" remedy parts (which were installed in older model year vehicles) are currently under recall for a degradation concern. Certain subsets of desiccated PSAN inflators using propellant 2004 for use as original equipment, however, have been recalled for a degradation concern. All Takata inflators produced with propellant 2004L contain desiccant, and none of these desiccated inflators using propellant 2004L are under recall for a degradation concern. There have been no reported field ruptures in any non-recalled desiccated PSAN inflators.It is understood that desiccants fully saturate at some threshold, at which point any additional moisture will not be captured. This means the degradation process observed in non-desiccated inflators using propellant 2004 may also occur in non-recalled desiccated inflators using propellant 2004, assuming additional moisture enters the inflator and high temperature cycling occurs. Based on available information, desiccant saturation can occur within the first five years in the worst environments, and the time required for full saturation is affected by multiple factors. While no present safety risk has been identified, further work is needed to evaluate the future risk of non-recalled desiccated inflators using propellant 2004.Three entities -- Takata (now known as TK Global), the Independent Testing Coalition, and Exponent -- have been studying the long-term behavior of Takata desiccated PSAN inflators using propellant 2004L (as well as 2004) in the presence of moisture and temperature cycling. The research efforts, which include development of predictive modeling techniques and field sample analysis, are ongoing. To date, none of the researchers have identified field evidence showing that propellant 2004L is undergoing a degradation process that leads to aggressive deployment and potential rupture. However, the time in service of such inflators remains short compared to that of the inflators using propellant 2004. Further study is needed to assess the long-term safety of desiccated inflators using propellant 2004L.The Office of Defects Investigation is opening this investigation to examine whether a safety defect related to propellant degradation exists in non-recalled desiccated PSAN frontal inflators manufactured by Takata. This investigation will require extensive information on Takata production processes and surveys of inflators in the field. Lists of recall actions that may have used desiccated PSAN inflators as remedy parts, as well as the makes and models originally manufactured with them, is available with the downloadable version of this document (see nhtsa.gov/recalls?nhtsaId=EA21002 -- note this information is subject to change/revision as the investigation proceeds). This investigation does not supersede EA15-001, which remains open.
Loss of rearview camera
EA20003
Closed engineering analysis · opened November 12, 2020 · closed May 2, 2024 · led to recall 21V035
back-over prevention, the electrical system, the exterior lighting, visibility
On November 20, 2020, the Office of Defects Investigation (ODI) opened Engineering Analysis (EA) 20-003 to investigate incidents of media control unit (MCU) failures resulting in loss of rearview camera in model year (MY) 2012-18 Tesla Model S and model year (MY) 2016-2018 Tesla Model X vehicles equipped with the NVIDIA Tegra 3 processor with an integrated 8GB eMMC NAND flash memory device. During its investigation, ODI learned that the expected usage life rating for the 8GB eMMC NAND flash memory device is approximately 3,000 “P/E” or Program-Erase cycles, after which the eMMC NAND flash memory device would become fully consumed and no longer be operational, leading to a failure of the media control unit (MCU). At a daily cycle usage rate of 1.4 per block, accumulation of 3,000 P/E cycles would take only 5-6 years. Historically, the expected life of a vehicle generally far exceeds 5-6 years of service. ODI believes that a 5- or 6-year life expectancy for a component integral to providing the driver with safety functions is insufficient. During our review of the data, Tesla provided confirmation that all units will inevitably fail given the memory device’s finite storage capacity. Tesla provided its own statistical model showing the number of projected weekly MCU repairs from 2020 to 2028, estimating that replacement rates for MCU failures will peak in early 2022 and gradually decline until (near) full part turnover has been accomplished in 2028. According to Tesla, for subject vehicles equipped with the NVIDIA Tegra 3 processor with an integrated 8GB eMMC NAND flash memory device, the eMMC NAND cell hardware will fail when reaching lifetime wear, for which the eMMC controller has no available memory blocks necessary to recover. With this failure mode, the only recovery available is a replacement of the eMMC device, achieved by physical part replacement of either the MCU assembly or visual control module subcomponent. Tesla provided information concerning the effects of MCU failure on vehicle function, which include in loss of rearview/backup camera and loss of HVAC (defogging and defrosting) setting controls (if the HVAC status was OFF status prior to failure). The failure also affects the Autopilot advanced driver assistance system (ADAS) and turn signal functionality due to the possible loss of audible chimes, driver sensing, and alerts associated with these vehicle functions. Based on this analysis, ODI issued a Recall Request Letter (RRL) on January 13, 2021. The RRL was based on ODI’s tentative conclusion that a defect related to motor vehicle safety exists in the subject vehicles because the eMMC NAND flash devices have a finite lifespan based upon the number of program/erase (P/E) cycles, after which the MCU fails due to memory wear-out, which constitutes a premature failure of safety-critical part. Tesla responded to the Recall Request Letter (RRL) on January 27, 2021, and disputed the tentative findings of the RRL. Nevertheless, on January 29, 2021, Tesla filed a safety recall (21V-035), recalling (MY) 2012-2018 Tesla Model S and (MY) 2016-2018 Model X vehicles with a center display equipped with a NVIDIA Tegra 3 processor and an 8GB eMMC NAND flash memory device. In this recall, Tesla is providing a free hardware remedy in addition to the over-the-air (“OTA”) firmware updates that the company had previously implemented. NHTSA will continue to monitor the issue as part of its ordinary processes for overseeing the effectiveness of recalls. However, based on available information, at this time, Tesla’s recall appears to address the unreasonable risk to motor safety presented by the premature failure of the component. Accordingly, the investigation is closed. To review the ODI reports cited in the Closing Resume ODI Report Identification Number document, go to NHTSA.gov.
Loss of rearview camera
PE20010
Closed preliminary evaluation · opened June 22, 2020 · closed November 22, 2020
back-over prevention, the electrical system
On June 22, 2020, the Office of Defects Investigations (ODI) opened Preliminary Evaluation PE20-010 to investigate incidents of media control unit (MCU) failures resulting in loss of rearview camera in model year (MY) 2012-2015 Tesla Model S vehicles equipped with the NVIDIA Tegra 3 processor with an integrated 8GB eMMC NAND flash memory device. EMMC NAND flash devices have a finite lifespan based upon the number of program/erase (P/E) cycles. The subject MCU allegedly fails prematurely due to memory wear-out of the eMMC NAND flash. Tesla used the same MCU with the Tegra 3 processor in approximately 159 thousand 2012-2018 Model S and 2016-2018 Model X vehicles built by Tesla through early-2018. In response to ODI's Information Request (IR) for PE20-010, Tesla provided ODI with 2,399 complaints and field reports, 7,777 warranty claims, and 4,746 non-warranty claims related to MCU replacements. The data show failure rates over 30 percent in certain build months and accelerating failure trends after 3 to 4 years-in-service.According to Tesla, for subject vehicles equipped with the NVIDIA Tegra 3 processor with an integrated 8GB eMMC NAND flash memory device, the eMMC NAND cell hardware can fail when reaching lifetime wear, for which the eMMC controller has no available blocks to recover. With this failure mode, the only recovery available is a replacement of the eMMC device, achieved by physical part replacement of either the MCU assembly or visual control module subcomponent. Tesla provided the effects of MCU failure on vehicle function which result in loss of rearview/backup camera, loss of HVAC (defogging) setting controls (if the HVAC status was OFF status prior to failure.) There is also an impact on the advanced driver assistance support (ADAS) Autopilot system, and turn signal functionality due to the possible loss of audible chimes, driver sensing, and alerts associated with these vehicle functions. There are precedents for addressing defects that result in loss of either backup camera, defogging, or turn signal functions under safety recalls.Tesla has implemented certain Over-The-Air or OTA updates to subject vehicles to mitigate the effects of MCU failure. These updates include firmware changes to reduce memory usage of the subject memory card, improve eMMC error correction and storage management strategies, changing the control logic for turn signal activation, and defaulting the HVAC system to Auto (71.6F) for drives after MCU failure to address windshield defogging. Tesla indicated that the MCU failures are likely to continue to occur in subject vehicles as vehicles continue to operate and use available memory in the 8GB eMMC NAND flash memory until 100% of units have failed. This investigation has been upgraded to an Engineering Analysis (EA20-003). The VOQs associated with the upgrade of this investigation are identified in the attachment to this resume.
Battery Management Software Updates
DP19005
Closed defect petition · opened October 1, 2019 · closed September 28, 2021
the electrical system
In a letter dated September 17, 2019, Mr. Edward Chen petitioned the NHTSA to initiate a defect investigation of certain Tesla Model S and Model X vehicles that received revised battery management software in one or more over-the-air (OTA) updates from Tesla, beginning in May 2019. The petitioner bases his request on vehicle fires that took place worldwide and OTA software updates Tesla made to the Battery Management System (BMS) of certain Tesla vehicles that resulted in loss of available vehicle mileage range and increased charging durations.On October 1, 2019, the Office of Defects Investigation (ODI) opened DP19-005 to evaluate the petitioner?s request. Information provided by Tesla in response to ODI's information request letter for DP19-005 indicated that a firmware update that may limit maximum voltage was installed in certain MY 2012 through 2016 Model S vehicles (subject vehicles). The voltage limiting firmware is a dynamic algorithm that is enabled in vehicles with high Supercharging use histories, which contributes to high usage stress to the high-voltage (HV) battery. Tesla sold approximately 61,781 subject vehicles in the United States and, through August 2021, the voltage limiting firmware had been enabled in approximately 2,062 vehicles. Through December 2020, ODI identified 59 complaints from consumers alleging reductions in battery capacity (52) or charging speed (7) in the subject vehicles. Log data from these vehicles showed that the voltage limiting firmware had been enabled in about 58 percent (30 of 52) of the complaints alleging range loss. Subsequent updates have restored some or all of the battery capacity to vehicles affected by the voltage limiting firmware coupled with updates enhancing BMS battery brick monitoring algorithms. None of the complaint vehicles have reported any thermal incidents or other safety hazards related to the HV battery.The five non-crash fires referenced in the petition include two fires that occurred in China in early 2019 involving vehicles that: 1) had recently completed Supercharging sessions; 2) were at a high state-of-charge (SOC) of the HV battery; 3) were parked with the battery cooling system shutoff; and 4) had histories of high-stress usage for the HV batteries. The three fires that occurred outside China did not involve the same fact patterns regarding vehicle state and charging history. The two fires that occurred in the United States include one involving a vehicle with no Supercharging history that was driving when the fire occurred and another in which the origin of the fire was external to the HV battery. The fifth fire, which also originated external to the HV battery, involved a vehicle in Germany that had been parked at a low SOC for an extended period. To date, incidents of fires involving parked vehicles with recent Supercharging and histories of high-stress use have only been observed in China, where high-stress use factors appear to be more common. NHTSA is authorized to issue an order requiring notification and remedy of a defect if the Agency?s investigation shows a defect in the design, construction, or performance of a motor vehicle that presents an unreasonable risk to safety. 49 U.S.C. ?? 30102(a)(9), 30118. Given the absence of any incidents in the United States related to fast charging, and the absence of any such incidents globally since May 2019, it is unlikely that an order concerning the notification and remedy of a safety-related defect would be issued due to any investigation opened as a result of granting this petition. Therefore, upon full consideration of the information presented in the petition, and the potential risks to safety, th