Stas Peterson: Under price pressure to gain the benefit of electronic throttles, and reduce costs, they decided the old mechanical throttle was no longer needed as a redundant system.

I do not understand how there could be a cost advantage to replacing a $10 throttle cable with a sensor, a servo, and all the wiring and software needed to make them work together.

CaptJackSparrow: Ever open an electronic gadget? Open a few of the same model and you’ll see these random jumper wires and some will not have them. All the minor revisions are items that nobody can predict and there’s no way to ever do so.

There is a way. In aerospace, we track parts by part number and serial number. We know which parts got what changes, so when something goes wrong, we know which parts are affected (and which airplanes they were installed on).

I’m not saying that it would be cost effective for automotive production, but it is possible.

Jean-Charles Jacquemin:
So if you are right Jeffhre, I advise all the current car engineers to revise this elementary exercise :A particular circuit in a security system of a plane , car, truck, … only operates correctly if both components C1 and C2 are not faulty. If only one of them is faulty the security system is out of order.C1 may be faulty with a probability (k), (0 < (k) < 1) and C2 with a probability (z) (0<(z) <1). The defects of C1 and C2 are assumed independent.a)The basic circuit links C1 and C2 in series.
Solution :The probability that the circuit is out of or order is (k)+(z)-(k).(z) = p, 0 <p<1b)Assume you double the circuit for a better security. So you have two similar circuits in parallel the a circuit and the b circuit, with 4 components : Ca1 is linked to Ca2 and Cb1 is linked to Cb2. Solution :The probability that the circuit is out of or order is p².c)You may dramatically increase the probability of non failure of the circuit by not using parallel redundancy but cross redundancy, using the samefour components but linking Ca1 to both Ca2 AND Cb2 and linking Cb1 to both Ca2 AND Cb2.
Solution :The probability that the circuit goesout of or order is p^4. (the fourth power of p).That is theory, in practice one usually say that the probabilty of failure is at least halved to take into account other non modelized factors.I hope that helps.JC NPNSQuelle est la probabilité que le circuit tombe en panne ?  

The components and their arrangement in the system are only part of the reliability story. The probability of a system failure is also time dependent. With redundant systems, you need to deal with the problem of the backup system failing passively (without indication) such that it is not available when you need it.

In aerospace, we typically reduce exposure time by ensuring that there is either a way to indicate failures of redundant systems, or by making the redundant systems frequently swap modes from active to passive (just to make sure that they still function). When that is not possible, the operator gets stuck with a scheduled maintenance requirement to exercise the redundant systems.

So if component C1 has a failure rate of 1E-6 per operating hour, but it can fail passively, then the exposure time is the desigh life of the product. Let’s assume 1E4 hours for an automobile (300,000 miles at 30 MPH average). Thus, the probability of C1 being failed is increased to 1E-2. That’s 1 chance in 100; not good at all if the consequence is severe!

However, if the failure of C1 is indicated (e.g., “Check Engine” light) and we assume that the operator gets it repaired within 100 operating hours, the probability of C1 being failed is only increased to 1E-4. Dramatically better!

RonR64: Just shows how naive some of us have been in wanting the Volt release schedule moved up.Sure we might be willing to take the risk but is GM and their lawyers?More importantly our heirs?It would seem that it might be a good idea to have some sort of redundancy in the throttle and brake controls.I would think that a drive by wire system is most likely to fail with a zero or full throttle signal.Zero throttle not such a big deal.Full throttle – you gots a problem!So put a secondary switch that engages at the top 5% of throttle.If the computer sees full throttle from the analog switch but not full throttle from the discrete switch – shut her down!  

But now you have introduced another failure mode. When that secondary switch fails, you lose throttle control, which could be fatal if you have just pulled out in front of a truck.

In a critical aerospace application, we will typically have 3 sensors. They “vote,” and when one fails, it disagrees with the other two, so the controller can tell which input to believe.

But that’s probably overkill in this case. I’d stick to the current single sensor design, make reliability a priority, and push on the brakes in the rare case when the throttle sticks.

http://www.hybridcars.com/safety/sorting-out-hybrid-brake-issue-safety-issue-or-different-feel-26604.html