Pillar to Post: Peter Welander's Blog
News and comment from Control Engineering process industries editor, Peter Welander
March 10, 2010
I have been following some of the discussions related to Toyotas lately. (In the interests of full disclosure, my wife drives a 2008 Prius and my daughter drives a 2008 Matrix. My wife is out of town at the moment, so I drove the Prius to work this morning. I did give a quick inspection to the floor mat and all seemed fine. I’ve driven it enough to think the concept of “rapid acceleration” is not in its vocabulary. The Matrix has a manual transmission, and I believe my daughter is a skilled enough driver to push in the clutch if necessary.)
Yesterday there was an article in the Chicago Tribune suggesting that Toyota is launching a counter offensive trying to discredit the efforts of David Gilbert (Southern Illinois University) who testified to congress that there are circumstances under which Toyota’s electronic throttle control can put the car into runaway mode. In response, Toyota’s contention is that Gilbert had to go to great lengths to make the controller fail. Its engineers demonstrated that if you go that far, any car’s controller will also freak out. They proved the point by using the same techniques on controllers from seven other vehicles, including Ford, Chevrolet, and Honda. All flunked the test.
“This is very interesting and timely,” you say, “but what does it have to do with process industries?” A fair question. The situation makes me wonder how such devices are designed and tested. Might it not be interesting to subject such a throttle controller to the same rigorous testing as a field device or PLC that is intended for a safety system? What would happen if Toyota or any automotive manufacturer submitted such critical system components to TÜV or a similar lab in order to get a SIL rating? (If you aren’t familiar with SIL ratings and what they mean, read this article.) Should a car’s throttle assembly have to pass a SIL 3 rating? SIL 2?
Needless to say, a safety PLC that helps keep a refinery from blowing up needs such rigorous testing. Maybe a few other things do as well.