# stuck throttle, is your car safe?



## etischer (Jun 16, 2008)

With all that's going on with Toyota in the news, it seems appropriate to double check our cars for how well they deal with a stuck throttle. 

I made a program change to my controller today. If my throttle were to get stuck, pressing the brake pedal would command 0 speed and 0 torque, regardless of what the throttle pedal is commanding. 

I did have the gas pedal get stuck WOT under the floor mat once, and had to turn the ignition off. Having this simple program fix in an emergency situation will surely keep me safer (and less distracted trying to fiddle with the floor mat). Keep in mind, throwing an EV into neutral may not be the safest option for some people. Disconnecting the main contactor under full load current might not be the most desirable option either. 

Another mode of failure you might not think about is a broken wire on the throttle pot. If you are sending your pot a 0 - 10 volt reference, and the wire carrying the 0 breaks off, you will be stuck with a wide open throttle.


----------



## Dave Koller (Nov 15, 2008)

Nice thought - it bugged me before the "stuck throttle syndrome" hit the news.. I have built-in speed sensor, brake or clutch kills as does a red Dash button.. inertia cutoff and a clutch and key switch lol.. But it is a great thing to be thinking about.....


----------



## gdirwin (Apr 7, 2009)

I am cutting throttle if the brake is pressed or if the transmission is in neutral, but I am not using the clutch... 

I figured that most people (who drive standard transmissions) push in the clutch to start - then they let off the clutch and press the throttle at the same time... If they did this with the clutch switch killing the throttle, then they would not see any rpms and may press more gas (ie almost flooring it) as they release the clutch - when the clutch switch finally engages then they would get a massive jerk as the controller would see a step in the throttle input...

The down side is that without the clutch switch, then it is very easy to spin up the motor to very high rpms very quickly - the user would see this high rpm on the tach, and "should" adjust accordingly (and quickly)...

Eventually everyone would learn that you do not need to use the clutch at all - the clutch must be in for starting - as the START ignition sequence requires the clutch to be in for the OEM controls - a good habit/safety feature which I will keep.


----------



## Thaniel (May 25, 2008)

etischer said:


> I made a program change to my controller today. If my throttle were to get stuck, pressing the brake pedal would command 0 speed and 0 torque, regardless of what the throttle pedal is commanding.


Sounds like a good idea. How well does it work on hill starts?

For me having the clutch comforts me for run away situations. Stepping on the clutch is a reflex in those situations (My other cars are manuals as well). So stoping the action will be quick. If things are operating correctly the over rev control on the motor should keep it from throwing parts. If not.....Oh well. I'd rather have the motor throw parts through the hood (very unlikely) then hit somthing. 

Hey if all the runaway toyota's were Manuals I doubt there would have been crashes (likely not even any excitement). Maybe we should mandate Manual transmissions  J/k


----------



## etischer (Jun 16, 2008)

I am clutchless so hills are not an issue. Pressing the brake basically tells the inverter to assume the throttle input is 0 volts. 



Thaniel said:


> Sounds like a good idea. How well does it work on hill starts?


----------



## DavidDymaxion (Dec 1, 2008)

Pulling a boat out of the water is a case where you would legitimately want to have some power going despite also being on the brake. Another case is when I exit the car wash in winter (good idea if you don't want the road salt to rust your car) -- I need to ride the brakes for about 30 meters to dry things out or the car is very hard to stop. It is certainly preferable to ride the brakes at 5 mph than to speed up and slow down as separate actions. Even in warmer climates you might need to dry the brakes this way if you drive through a deep puddle. Another case is the drag racer that wants to take up the slack in the drive system, so as to not hammer the drive train upon launch.

Ideally, I think the algorithm should be something that allows both gas pedal and brake pedal below some low speed, but disables it above that low speed.

Also, I'd think that 0V and 12V should be error conditions, and your pot should work in the 3V to 8V (or something like that) range. Then a 0V (shorted to ground) or 12V (short to power) signal means an error. Don't some controllers work that way?

Final random thought: Have a rubber block for the last 5 mm of gas pedal travel. If someone pushes really really hard on the pedal (so it goes to maybe 9+ V) that indicates someone thinks they are pushing really hard on the brake, but are mistakenly pushing hard on the gas (studies have shown it happens more than you'd guess, and people swear the car kept accelerating even though they think they were on the brake). About the only emergency situation I can think of where you might be correctly and in a panic pushing really hard on the gas pedal is when a T-Rex is chasing you.


----------



## Dave Koller (Nov 15, 2008)

DavidDymaxion said:


> *Pulling a boat out of the water is a case where you would legitimately want to have some power going despite also being on the brake.* Another case is when I exit the car wash in winter (good idea if you don't want the road salt to rust your car) -- I need to ride the brakes for about 30 meters to dry things out or the car is very hard to stop. It is certainly preferable to ride the brakes at 5 mph than to speed up and slow down as separate actions. Even in warmer climates you might need to dry the brakes this way if you drive through a deep puddle. Another case is the drag racer that wants to take up the slack in the drive system, so as to not hammer the drive train upon launch.
> 
> Ideally, I think the algorithm should be something that allows both gas pedal and brake pedal below some low speed, but disables it above that low speed.
> 
> Also, I'd think that 0V and 12V should be error conditions, and your pot should work in the 3V to 8V (or something like that) range. Then a 0V (shorted to ground) or 12V (short to power) signal means an error. Don't some controllers work that way?


I have a bypass switch for the boat pull scenario - I can use my backup relay to slap a limit across the pot but on VERSION 2 ( using Atmel and software) I will look into that algorithm. Right now I am all logic gates and audio LOL - but that will be so easy with an embedded processor - AND I can change so much! I should have gone that way first but I started to regress to my tried and true - quick for me to do (er, is done ). I have voltage sensors , speed sensors , and tachometer all there.. Relays just to look OLD.. and enough audio feedback to scare the crap out of anyone in the car!.....


----------



## EVfun (Mar 14, 2010)

I should point out that one of the failure modes for a DC motor controller is that the MOSFETs fail on (I'm not sure if IGBTs share that failure mode.) Any type of brake circuit that creates a zero throttle input will have no effect in this case. The controller current limit will have no effect in this case (Curtis "1221" will be a reference to the amps!)


----------



## JRoque (Mar 9, 2010)

Hi. My take on this, and with all the Toyota news flying around, is that the motor cut off if you press the brake pedal *and* your MPH reading is >10 or so. That way you can pull up a hill from a dead stop by pressing both brake and throttle but if you're actually driving, it would cut off. Of course, you want this to reset this quickly so returning the throttle to 0 value, resets it and allows the motor to speed up again. If the throttle pedal never hits 0, the car would stop. This would help protect from those evil floor mats. 

BTW, in lieu of something like above, Toyota should at least 1. bolt a couple mat hooks to the car's floor and 2. make the gas pedal pivot at it's center so a floor mat would simply swivel it and not depress it; only your foot pressing on both sides of the center swivel could do that.



> one of the failure modes for a DC motor controller is that the MOSFETs fail on


and not even logic that breaks a contactor is 100% safe in this scenario. A transistor welded 'on' would likely put all of the available current through and might weld the contactor as well. Another way to prevent runaway conditions like this is to current limit with a breaker. The breaker would be at a value you would never hit during normal operation but would trip upon maximum current draw.

JR


----------



## green caveman (Oct 2, 2009)

Fairly lengthy discussion of emergency disconnects here

Synopsis is Kilovac EV200 are good because you can break 2000amps (once).

Big red buttons are good, but not guaranteed to break the circuit in case of runaway.

Inertial switches are probably a good idea in a wreck.

Many other thoughts and comments including observations on the EV EZ Safe Disconnect, knife switches, etc.


----------



## rmay635703 (Oct 23, 2008)

I am surprized that so many here don't have a master disconnect contactor.

Thats EV 101 both my EVs have a master disconnect contactor and a contactor that clicks shut when I touch the throttle.

So if I have a controller failure (stuck on) I just let up on the gas and the contactor kills it.

If the throttle gets stuck down, I just turn off the key.


----------



## Dave Koller (Nov 15, 2008)

EVfun said:


> I should point out that one of the failure modes for a DC motor controller is that the MOSFETs fail on (I'm not sure if IGBTs share that failure mode.) Any type of brake circuit that creates a zero throttle input will have no effect in this case. The controller current limit will have no effect in this case (Curtis "1221" will be a reference to the amps!)


Mine kills the contactor, throttle and pot but if all else fails there is the magic manual over-ride.. There is an argument that doing things this way creates wear - or you can't give it gas with clutch in or brake on - but it seems to work well on DC anyway.. (mine latches TILL brake, clutch, or over-speed unlatch it...) EV's take a different kind of thinking and safety. Oh, and my big RED button (a cable) kills *both contactors* (of course I use two!) (switches placed apart on cable kills power to both) and if you pull real hard the cable pulls the Andersons apart.. IF I reach that point I think an ejection seat is in order ...


----------



## etischer (Jun 16, 2008)

IGBT fails ON too. But in my case it wont' cause a runaway cause I have a 3 phase motor. A stuck on winding would act like a DC injection brake. 



EVfun said:


> I should point out that one of the failure modes for a DC motor controller is that the MOSFETs fail on (I'm not sure if IGBTs share that failure mode.) Any type of brake circuit that creates a zero throttle input will have no effect in this case. The controller current limit will have no effect in this case (Curtis "1221" will be a reference to the amps!)


----------



## Dave Koller (Nov 15, 2008)

etischer said:


> IGBT fails ON too. But in my case it wont' cause a runaway cause I have a 3 phase motor. A stuck on winding would act like a DC injection brake.


Yep gotta love the use of AC -...


----------



## Qer (May 7, 2008)

rmay635703 said:


> I am surprized that so many here don't have a master disconnect contactor.
> 
> Thats EV 101 both my EVs have a master disconnect contactor and a contactor that clicks shut when I touch the throttle.
> 
> ...


Weeeeeell. One problem you get with that scenario is that every time the contactor opens you get a precharge scenario when you let go of the throttle and if the voltage in the capacitor bank differs from the battery pack (which is likely to happen in this scenario) both the contactor and the capacitors will wear down.

A pitted contactor might no longer be able to break the current when you need it and a capacitor band that's damaged will not be able to keep the ripple down which, actually, might kill your transistors full on. So have you actually increased the security? I actually doubt it.



etischer said:


> IGBT fails ON too. But in my case it wont' cause a runaway cause I have a 3 phase motor. A stuck on winding would act like a DC injection brake.


Our experience from the dyno is that an IGBT fails on for several milliseconds (maybe even a few hundred ms), then the bond wires act as fuses and the current flow stops. The higher battery voltage is and the lower the internal battery resistance is (for example if the batteries are LiFePO4 instead of Pb) the faster the transistors will burn off.

If you have a low voltage Pb setup (like a golf car) failing on is quite likely, but it seems that most (all?) people in this forum with a failed controller ends up with smoke, debris and no (or very little) power to the motor.


----------



## Harold in CR (Sep 8, 2008)

I'm more asking rather than telling, but, JimDear rigged up a rev limiter, to keep from blowing his motor. 
Now, IF you disengage the clutch or shift into neutral (Automatic trans) would that not stop the high CURRENT and allow the (whatever) safety disconnect to function, without MORE welding ?? Rev limiter would save the motor, and stop that fear, as you panic to get things shut down, safely ??


----------



## Qer (May 7, 2008)

Harold in CR said:


> I'm more asking rather than telling, but, JimDear rigged up a rev limiter, to keep from blowing his motor.
> Now, IF you disengage the clutch or shift into neutral (Automatic trans) would that not stop the high CURRENT and allow the (whatever) safety disconnect to function, without MORE welding ?? Rev limiter would save the motor, and stop that fear, as you panic to get things shut down, safely ??


In theory, yes. In reality the time it takes for the contactor to disengage might be enough for the motor to overrev from the treshold value to where it destroys itself. When we did overrev tests on the Soliton it took some ms (don't have the actual numbers in my head, but I'd guess some tens of ms) for the controller to react and during that time the unloaded motor managed to gain about an extra 1000 rpm or so.

So using the clutch in a runaway situation will definitely mean you risk the motor. The best is probably to step on the brakes and turn off the ignition and hope that the fuse (or something else) gives if the contactor gets stuck. Odds are that the transistors will blow to Kingdom Come since the current will start to escalate when the rpm drops. If PWM isn't running at, or close to, 100% when the controller goes full on odds are that you won't even have time to notice the full on as more than possibly a jerk before power dies.


----------



## rmay635703 (Oct 23, 2008)

Qer said:


> Weeeeeell. One problem you get with that scenario is that every time the contactor opens you get a precharge scenario when you let go of the throttle and if the voltage in the capacitor bank differs from the battery pack (which is likely to happen in this scenario) both the contactor and the capacitors will wear down.


Um no, my one contactor is AFTER the controller and is a F/R that also goes to neutral when the pedal is not depressed.

My master contactor only shuts off if I turn the key.


----------



## EVfun (Mar 14, 2010)

How many here have actually had a controller go full on in an onroad situation? I have!

Let me tell you some things that don't work to shut you down in a reasonable amount of time (even with a little old Curtis 1221b controller.)

1. The transistors will not clear quickly. They stay on real hard, way past 400 amps and they are dead -- dead short. 

2. The pack fuse will not clear quickly enough. At least a little 400 amp fuse won't clear quick enough even with a stiff pack of Optimas and almost no motor rpm. I doubt even a 250 amp fuse or DC rated circuit breaker would be quick enough.

3. The brakes are a joke. When you pull the rpm down on a series motor the torque goes through the roof. You will find 2 locked tires and 2 spinning tires.

Your full on failure is most likely to happen when you first touch the throttle after being completely off it. For example, when stopped at a stoplight and you first start to move (and WOW do you move.) Mine EV launched from a standstill most of the others I have heard about happened that way too.

What will work is opening a suitable main contactor. Pushing a clutch in and releasing the motor would work, but the motor will blow chunks of comm bar everywhere. A very large SCR used as a crowbar circuit should work by leaving about 1 volt available for the motor until the pack fuse blows (make sure the SCR can always survive longer than the fuse.)


----------



## Dave Koller (Nov 15, 2008)

EVfun said:


> Your full on failure is most likely to happen when you first touch the throttle after being completely off it. For example, when stopped at a stoplight and you first start to move (and WOW do you move.) Mine EV launched from a standstill most of the others I have heard about happened that way too.


Did you find out WHAT caused the failure for sure?


----------



## EVfun (Mar 14, 2010)

Not for sure Dave. The inside of the controller was toast. One corner of a circuit board was reduced to glass mat and copper traces (the board resin was vaporized.) 

The best estimate based on what was left is that I lost the freewheel diodes. They opened as they cooled. Without working freewheel diodes the FETs took a severe voltage spike when they tried to switch off, caught between +120 volt from the pack and -100+ volts from the motor. The MOSFETs forgot the meaning of off. The Albright SW200 contactor didn't, and saved the day.


----------



## Dave Koller (Nov 15, 2008)

EVfun said:


> Not for sure Dave. The inside of the controller was toast. One corner of a circuit board was reduced to glass mat and copper traces (the board resin was vaporized.)
> 
> The best estimate based on what was left is that I lost the freewheel diodes. They opened as they cooled. Without working freewheel diodes the FETs took a severe voltage spike when they tried to switch off, caught between +120 volt from the pack and -100+ volts from the motor. The MOSFETs forgot the meaning of off. The Albright SW200 contactor didn't, and saved the day.


Yep - I think what people forget is the SW200 magnetic blowouts help with that high amp arc under those conditions - I have two and , as I said earlier at least one mechanical way to " pull the plug" 

I thought I read where the 1221b had some problem with the freewheel diode design - well yours did - lucky you had the contactor do it's job !!!

Thought of a spring latch contact with a blasting cap to blow it apart - gave up that idea ... Even machined one that cocked like a piston and had a cable latch - I would slam so fast apart - It probably never would weld ( it slammed 6 inches apart inside - haha blasting cap would have worked there too - except it would not be pretty LOL - then I came back down to earth )


----------



## Thaniel (May 25, 2008)

Dave Koller said:


> IF I reach that point I think an ejection seat is in order ...


 I like it.


----------



## EVfun (Mar 14, 2010)

Dave Koller said:


> Yep - I think what people forget is the SW200 magnetic blowouts help with that high amp arc under those conditions - I have two and , as I said earlier at least one mechanical way to " pull the plug"
> 
> I thought I read where the 1221b had some problem with the freewheel diode design - well yours did - lucky you had the contactor do it's job !!!


There is not really anything wrong with this part of the Curtis 1221b design but there are 2 weaknesses.

The first one is shared by all controllers that use multiple freewheel diodes. Diodes don't parallel that well because the hotter they get the lower their voltage drop. That causes the hot ones to take more current... get hotter... more current... more hotter... bad things. Controller builders match their diode voltage drops to minimize the problem. Rumor has it this matching is done to tighter tolerances in the Curtis 1231 line.

The second issue is that Curtis doesn't monitor the diode temperature separately. You can overheat them by driving at low motor rpms to long. In the right power output window this can happen faster than the whole heatsink gets hot. As a result, the controller doesn't "know" it should be protecting itself. If the old Curtis 1221b "knows" it is hot the switching frequency is dropped to 1kHz and the current limit is lowered. 

I second your appreciation for using a main contactor with a proper DC voltage, and current, rating. Don't leave home without it!


----------

