Safety Recall J0V - Where is the Remedy?

It's attached to #18 and dated December 20th, but I haven't heard of anyone getting it in the mail yet. Hopopotamus found out about it during a conversation with the dealer.

 

thing is 3% 4% of a huge # of cars, that can still represent 10's of thousands of potential crashes/fatalities due to brake failures.

 

What's post #22 about? This is a thread about recall J0V, which isn't about brake failures.

Also, in any thread about obscure unhandled edge cases in embedded real-time software, an assumption like 3% or 4% incidence is kind of untethered from the practicalities of what "obscure edge case" can mean in that kind of software.

If there's a bug in the software, it's present in 100% of the cars that haven't been updated.

However, even though present, it may be triggered only in combinations of circumstances that occur with truly tiny probabilities (numbers that would make 3% or 4% look enormous).

The right thing for Toyota to do is just recall all the cars in which the bug is present, and update them.

Which is what they've undertaken to do....

 

The big unknown in this is what “unintended consequences” does the latest fix have. There are times where it’s good to be the guinea pig, but I don’t think this is one of those times.

 

If you haven't had recall E0E done already, or if you were one of the ~ 36,000 who went in for E0E but it wasn't done completely, then going in for J0V will mean that you get a complete application of E0E into the bargain. That includes reflashing the MG ECU, changing the parameters used to drive the transistors in the power module. That has led some people with butt-dynos to complain that their cars now drive differently. (Mine had already had E0E done when I bought it, so my butt-dyno has always thought it feels pretty much like a Prius, but then maybe I never felt those surges of exhilarating power from before.)

If you've already had E0E done and it was done correctly, as in most cases, J0V will only involve a reflash of the hybrid control ECU so it doesn't slip into OFF instead of limp-home in a particular rare set of circumstances.

Here's a post on how you can check your own firmware versions and know in advance which of those things J0V will entail for you.

 

This recently occurred to me:

Looking through the technician instructions for this, there's no way to miss how hard Toyota is trying to avoid any possible power dip during reflashing that could lead to a bricked ECU.

They require a 12 volt power supply (not just a charger) to be hooked to the car's battery. They require the laptop running Techstream to be fully charged or plugged in, or both. They make sure the brake system is at full pressure before starting so the hydraulic pump shouldn't come on and draw power during the test, and they remove three high-amp fuses to prevent things on those circuits from happening.

That made me think: if you have any aftermarket, high-amp things you've added to the car that the dealer isn't going to know about, you probably want to make sure those are disabled before taking the car in for the reflash. I will definitely pull the fuse for my onboard air, for example.



Also, I see they aren't pulling the fuse for the brake pump. but just using the brakes until it runs, so they know the accumulator has been freshly pumped up.

Which would mean, if you've been noticing any increase in pump frequency lately, or it doesn't seem able to hold for an hour between runs if nobody's using the brakes, you might want to let them know that.

 

I finally got my v back from getting the JOV recall done earlier this month. I was told one thing and then something else by the dealership. I was not impressed at all to say in the very least.

I have started wondering howI could easily tell whether or not it was actually done or just a certification receipt was given to get their loaner car back and save them money.

When I was switching from my v (2013)to the loaner v (2017 v), I forgot where I had temporarily stored my wheel locks. The dealership told me that’s okay - not needed. But don’t they need the wheel lock to do anything with the brakes such as what you are describing above, which would mean they couldn’t have performed the recall fully or correctly?!?

 

pay your taxes late and you get a $$$$ fine. Car goes South due to unfixed recall, it could kill you. Hardly the same thing.
.

 

Read the calibration IDs with a Toyota Techstream diagnostic system or equivalent.

Toyota makes a Wheel Lock Master Key Set (09999-00110) available to dealers as a special service tool. [Edited to add:] The only brake-related steps in the “Technical Instructions for Safety Recall J0V” document are to set the parking brake and to press the brake pedal, so the booster pump won’t have to run later, as @ChapmanF notes. There is no need to remove the wheels at all.

 

Supposedly the dealership has fixed the recall, but I wonder, especially after seeing something with brakes above. I’m wanting to be safe but also knowledgeable. After all, if not actually fixed (even though a certificate was given), then I have to contact another dealership (hopefully a good one) and get a lawsuit ready against the first dealership.


iPhone ?

 

This recall only involves updating the software in one of the car's ECUs. It is done by plugging a laptop in to the car's diagnostic port, and telling Techstream on the laptop to install the updated software version. In the bird's-eye view, that's all that's involved.

(Ok, I simplified: they will actually update more than one piece of software, if the car did not have the previous inverter-related software recall, or if it did but one of the updates was missed then, which happened to about 36,000 cars.)

Now. Why do they have a bunch of elaborate rituals around that simple update?

It turns out there is one thing you really do not want to happen while you are in the middle of updating software in a car's ECU (or your phone, or your internet router, or most things nowadays that have embedded software in them).

You don't want the power to go out in the middle of replacing the software.

If that happens, the device doesn't work. It doesn't have its complete software. It's overwritten up to some place in the middle. You generally don't get another try at uploading the update, because the ability to upload an update was part of the software, which the device now doesn't have. Such a device is usually referred to as "bricked" ... as in, now it's as useful as a ....

The dealership does not want to brick one of your car's ECUs when you brought the car in for a simple recall. When the update goes right, all they have to do is plug a laptop in to a plug below the dash, run the update, and unplug it. If the ECU gets bricked, now suddenly a tech has to come take the dash apart and remove the bricked ECU and replace it with a new one and put the car back together, all while you're wondering why the recall is taking so long. The dealer would much prefer not to eat that labor cost, not to mention the cost of the ECU.

So they really, really don't want the software update to get interrupted in the middle.

How do they avoid that? Well, it's all about eliminating as many possible causes of power dips as they can.

So the Techstream laptop has to have a full charge before they start. Or be plugged in. Better yet, plugged in and with a full charge, so it can keep going in case the dealership power goes out.

They won't start the update until they have connected a plugged-in 12 volt high-amp power supply and jumped it to the terminals of your car's own battery.

And they won't start the update until they have taken steps to prevent various things your car normally does that use heavy battery power. They pull three large fuses out of your car's fuse box so the things they control aren't going to maybe come to life in the middle of the update and suck the power down.

And one other thing that uses heavy 12 volt power is the pressurizing pump for the brake system. If they don't know how much pressure is in the system when they start, that pump might come on at any time during the procedure (it's the little whirring sound you're used to hearing under the hood, often right after using the brakes).

So how to make that less likely to happen? They just push the brake pedal a bunch, to use up pressure until the pump is triggered to come on. Then they wait for the pump to stop. That means the system is right now at full pressure, and the pump will probably not need to come on again, within the time they need to complete the update.

That's the only thing that "brakes" have to do with this recall at all. The recall is nothing but software updates, and they are just taking standard precautions to not have the software update get interrupted in the middle.

More or less the same precautions are in any of their recalls or service bulletins that involve updating software in any of the car's ECUs. It doesn't mean the procedures all have something to do with the brakes. These are just precautions against sudden electrical drains that could happen during a critical update.

The main reason I posted #26 was just to say, hey, if you have added any kind of aftermarket heavy electric load in your car (like the air compressor example in mine) and the dealer won't know about it or know how you disconnect it, probably you want to disconnect it yourself before going in for the recall. Because everybody's happier if the car's computers don't get bricked during what's supposed to be a quick in-and-out job.

Also, there are some people driving around with known brake system problems where they hear the pump running way more often than normal, but haven't had it fixed yet. If you're one of those people, let the dealership know before they start a software-update procedure! If they can't trust your pump to run once and stay off for an hour, they'll want to know that.

One other thing, they're probably happy if you show up for one of these updates without a whole lot of stuff packed in the hatch area, because they need to pull up the deck boards to get to your battery and attach the supplemental power supply.

See the link I put in #25 for how you can check the software versions in the car and make sure you have the right ones after the service.

 

whew! the term "brevity" came to mind

With only a mediocre grasp of software, many a user has unbricked (hard brick being a more apropos term) devices - either using a reprogramming platform based on Linux/Android, apple or Microsoft. If a device is properly designed, it will run via a debugging bridge that can effectively rewrite basic functions so that it can then receive more program functions. Whether or not Toyota, Ford, Samsung, Asus, or whomever utilizes that capability.... that's a different matter. The ability to reprogram bricked automotive devices is exemplified modernly in vehicles that receive OTA programming. It's not just Tesla that utilizes OTA programming anymore - as others are following suit. Safeguarding OTA programmable equipment obviously has to be more re-writable than a vehicle plugged in - sitting at your local service garage - possibly racking up a fee for the upgrade privilege.

 

Who knows what Toyota does with bricked ECUs they replace after problems occur? I wouldn't be surprised if they do unbrick them, but just don't have resources at dealerships to do it in situ.

I also don't know how often it happens really. But it must be enough to justify these lists of precautions they take, which appear in all TSBs and recalls involving updates, but the lists seem to trend longer with the publication dates of the TSBs....

 

I’m not sure I’d agree that the lack of recovery capability is a design failure. Most automotive ECUs never need or receive updates, so automakers may have found that providing more than the bare essentials for field reprogramming wouldn’t be cost effective. I’d imagine the extra non-recurring engineering costs, plus the per-unit cost of more or larger memory devices, when required, would add up to a lot more than the parts and labor to replace the occasional ECU for which reprogramming fails despite the precautions @ChapmanF describes.

The situation is different for automakers that choose to allow remote updates, of course, and for other kinds of equipment that are more likely to be updated, or for which the cost of a failed update is higher.

I agree. The key factors would be the failure rate and unit cost: if there’s a steady stream of expensive, failed ECUs coming in—and thus presumably also demand for refurbished replacements—it could pay off to develop, validate, and run a process for depot repair, if the design allows.

It’s cheaper to just tell the dealers to be careful. Many of the precautions are also covered, by the way, in T-SB-0134-16 Rev1, “Techstream ECU Flash Reprogramming Procedure.”

 

Got the "go-ahead" second letter last Thursday or Friday, says:

January 2019
SOSH-R66-1a

This is from Toyota Canada, not sure if it's the same ID as the States? I'm thinking to stall a month or so, let a few early adopters report first. Plus I can sync with my spring visit, pick up oil and a filter, and I've noticed a couple of missing fasteners on the car I want to pick up.

 

true - it may very well be a cost-effective analysis. Basing the burden upon the owner who then has to make an appointment, bring the car back to the shop, get a rental, wait a day or so until the car is fixed, bring the rental car back, & such. That activity, times maybe tens of thousands, puts a burden on what the service techs might otherwise be doing. Presuming that still is a cost-effective process, there is the "unknown" element. Take for example, the 1970s Ford Pinto. When Ford realized people were burning to death (or equally bad, surviving) in Auto collision/fires due to poor bumper fastener designe proximity to the likelihood of gas tank intrusion. The actuaries will step in, crunch the numbers to determine financial 'costs' possibly millions of cars needing to be fixed - & those costs, versus the handful of payouts for the injuries/fatalities/loss if good will/image.
So, whether it's a ECU, or bumper Bolt, the financial burden of repairs (& timeliness), versus the downdide - likelihood of catastrophic results from delays. When there are millions of foreseeable variables the manufacturer rolls the dice & takes their chances, or they do the best job they can thinking CYA - above all else.
.

 

Last time I took mine in for a reflash, I sampled the free coffee and cookies and leafed through 4th-gen brochures for the 50 minutes or so that it took.

If you have one of the generations with the aux battery in the back, you can save them some time by showing up with the back cleaned out.

 

A boot loader could be capable to receive downloads if equipped. That design will avoid any bricking of firmware.

 

I just had the update and I noticed the following week the battery drained after a few days of being parked. This does not happen normally but this will be week2 of driving. Will have to keep driving and see.

 

Is that the factory battery, or replacement? If factory, it's getting pretty long-in-the-tooth.