I think there's only one throttle motor, feedback of throttle position is by a dual track potentiometer and both tracks have to return the appropriate relative voltage to keep the MCU from shutting things down so there's no actuator redundancy here.
If you look at the report on Air France Flight 447 the final failure was operator error but the aircraft got itself into a stall through a combination of failures which included turning off the stall warning when the airspeed dropped below an arbitrary setting. This meant that when the pilot did the right thing (stick forward) the airspeed increased and the stall warning was again activated.
Human error is almost always to blame - it was human error that failed to correct the programming to recognise the fact that an altitude of 30,000 feet and an airspeed of 20 knots was about as bad a stall as you could get - so maybe there's some 'human error' in the MCU software?

 

In the case of Toyota, their fix was to electrically disable the throttle when the brake was pressed, so if their was an error of the throttle electronics, it wouldn't be noticed while the brakes were engaged. The ECU would still report an error if there was one.

No holding the brakes and reving the engine to burn rubber anymore!!

 

Toyota were apparently clever about that. The ECU knows whether you pressed the brake first, in which case the throttle works normally. Only if the brake is applied after the gas pedal does the throttle close. The problem with this "solution" is that it presumes the error is applying force to two pedals simultaneously. That's not what happens as the phenomenon results fom applying force to the gas pedal in the firm conviction that one is applying the brake. As more force is applied the car runs away as if the brakes have failed and the engine has a mind of its own. This just doesn't happen, the driver has his or her foot firmly on the floor with the gas pedal underneath the shoe, convinced that the brakes are fully applied. This is why none of these events involve selection of neutral which is a mere flick of the wrist away and would completely solve the problem. The driver isn't thinking straight but remains convinced that he or she is.

And I correct myself, the redundancy protection of drive by wire is in the pedal sender, only one actual motor is needed to operate the throttle plate, as is pointed out. Ford even uses three redundant signals.

Finally, in bumper to bumper traffic today i decided to test my conviction that this driver error is the cause of this phenomenon. I dared myself to put my left foot on the brake and see how much gas I had to apply to overcome just a moderate pressure on the brake pedal. It takes a lot to even begin to overcome the brakes and simply applying a bit more force to the brake pedal is sufficient to prevent any forward lurch. No crunchy events for me.

Much independent testing of this odd phenomenon has been performed. There is no way the engine can overpower the brakes, even at full throttle.

 

Well got my car back today. Nothing found... guess it is like a toothache goes away when you go to the dentist. We shall wait and see. No it is NOT driver error.

 

Jagular, although I agree driver error is usually and most likely to blame I disagree on your conclusions regarding the redundant systems. The systems take their inputs from single sensors, and the arbitrating function can fail to an unsafe state depending on the design. The redundant parts of the system are identical and can as such have the same systematical bug. That is why emergency shut down systems in nuclear plants should be designed by two independent teams who are not allowed to communicate. That said, as I indicated at the start of the post: Total failures into an unsafe status is so rare that I have never come across it, and I used to work designing these things for the oil and gas industry. (Unless tampered with by humans but that is another issue.)

So in conclusion: Unlikely but not entirely impossible.

 

A microprocessor like the MCU can fail for many reasons both hardware and software.
There is a well known open source microprocessor much loved by roboticists that I will not use because it can randomly 'fail dangerous' (anomalously driving a digital output high) when executing an instruction.
If that output was driving the PWM to the throttle motor it would force WOT.
I know this can and does happen because one of these things made a determined effort to kill me.

 

Not impossible but ....draw your own conclusions.

By redundant controls I meant that unless the duplicate instructions agree the throttle closes. I recognize it is possible to design supposedly redundant controllers which do not fail safe. My understanding is there are no circumstances in which automobile electronic throttle controls can fail and cause the throttle to open.

The various idle control systems are just not powerful enough to cause any issues to a driver with her foot on the brake. I tested this in bumper to bumper traffic recently as reported above. Sounds crazy to do it then but I have complete confidence in modern automobile electronics. They have proved to be exceptionally reliable and useful. I clearly remember the days when cars routinely required servicing referred to as tune ups. I have also experienced a stuck throttle due to throttle plate icing, but of course that doesn't cause acceleration. I have accidentally engaged cruise control at very high speed and been unnerved until I realized what was happening and touched the brake pedal to disengage it. In the old days an accelerator cable might break or jam. Electronic throttles are much safer.

The issue here is the phenomenon reported of the engine/transmission both activating to accelerate the car without the knowledge of the driver. There are two possible explanations for this. By far the most alarming possibility is also the most likely.

I shall be fascinated by the next post claiming this fault......

 

Well, my car has been reprogrammed, so we shall see. I guess the main thing is that this has been fully documented. In the event my car lunges into an intersection again or like the gentleman earlier said, jumps a curb, hits a garage door. All things are possible. These are computer driven and computers are not 100%. Thank you to all that have responded.

 

Oddly, computers are 100% reliable. If they work at all they work correctly. Computers are unable to perform functions not programmed into them. Unable.

Humans on the other hand are 100% unreliable. When they make mistakes they almost never know they have made a mistake. Had they known they were about to make a mistake then they wouldn't make it. The ability of humans to rationalize away their mistakes is remarkably effective.

You are very complacent about a potentially serious driving error you must have made. You ought not to be. I am willing to bet this "malfunction" will never show up again but you may well experience it.

I am curious to know what shoes you were wearing when these incidents occurred.

 

OMG Jagular........ give it a rest! I know that the issue was not human error. It has happened to two different drivers driving my car. I have been driving for many many years. Many different vehilces and this is my fourth Jag. This is the first time anything like this has ever happened. (not sure why I am justifying this) Computers are not 100%. Has nothing to do with what shoes I wear. Enough said!

 

Please start a new thread on progress, BiancaM.
We'd be really interested in an update - whether or not anything bad happens.
I think this one has exhausted itself and is closed.