Dual Brake Pedal Monitoring: Safety Risk?

Hello everyone.

Even reliable components like the throttle position sensor can sometimes fail. Unfortunately, the simultaneous evaluation of the sensor signal and the idle contact by the engine computer does not guarantee the detection of defects, so a faulty sensor signal indicating "full throttle" can lead to dangerous situations.
For such situations, the brake pedal monitoring system is designed to activate a limp mode and significantly reduce power output when the EDC detects simultaneous braking and acceleration, preventing the startled driver from inadvertently overriding the braking force with the engine's power.

The brake pedal monitoring is performed by the pedal switch F 47, which connects pin 20 (of the 68-pin engine control unit connector) to ground when the brake pedal is not depressed. When the brake pedal is pressed, the switch opens, and an internal pull-up resistor raises pin 20 to 12 volts.

For redundant monitoring, the voltage at the brake lights is also reported to the engine control unit via pin 44. Therefore, pins 44 and 20 will always have either 0 or 12 volts simultaneously. This is the normal operating condition.

"But: 'A man with one watch knows what time it is. A man with two watches is never sure.'"
If the two brake switches F and F 47 do not close and open simultaneously (which can be detected using VAGCOM by slowly depressing the brake pedal), the EDC detects an implausibility in the brake pedal monitoring and may enter a limp-home mode, even though there is no emergency situation or engine problem, and each monitoring system functions perfectly on its own.

Similar issues can occur if, for example, the fuse for the brake lights has blown, or if the brake light switch F is defective, causing the voltage at pin 44 to not "increase" at all when braking.

On the other hand, a pull-up resistor at pin 44 also raises the voltage to 12 volts as soon as there is no more ground connection (via the brake lights). Again, the engine control unit detects an implausibility in the signal at pin 22 - but this time without the brakes being applied.

That means: For example, if a brake light bulb has just burned out and the socket of another bulb has an older, previously unnoticed loose connection, the EDC can unexpectedly switch to emergency mode .
If something like this happens while someone is overtaking, it's possible that several people will end up as mere footnotes in the statistics on improper overtaking, because there are no obvious indications of a technical malfunction.

So, what's the point of a double brake pedal monitoring system when, in everyday situations, human lives are literally hanging by a thread – by light bulbs – components that every normally thinking driver treats as disposable consumables, while the actual engine management is generally considered a sensitive high-tech area that you only entrust to specialists in case of problems (for safety's sake!)

I personally find a brake monitoring system with only one switch to be generally safer, and therefore I rewired the signal cable 44 from the brake light to the brake pedal switch, so that only the simpler system with F 47 tells the engine computer whether or not the brakes are being applied.

Because with a watch... see above.

'Shouldn't it be the case that when overtaking, you also simultaneously...'

a) a faulty brake light.
b) a second faulty bulb, or one with a loose connection (what about the third brake light? It also draws power, and it seems that both the two lower bulbs and the 5th bulb of the third brake light are failing simultaneously...).
c) the faulty accelerator pedal potentiometer.

'To think that all of this could happen at once and together, I find it almost impossible.'

Even if the third brake light is also considered, the driver would have to be extremely careless with their brake lights to create those conditions.

Does the question of the fuse remain? Is it really true that a blown fuse won't be detected and that, in the event of a problem, the motor will switch to emergency mode?

Stukov wrote:

Shouldn't it be the case that, when overtaking, you simultaneously: a) a faulty brake light. b) a second faulty bulb, or one with a loose connection (what about the third brake light? It also draws power, and it seems that both the two lower bulbs and the 5th bulb of the third brake light are failing simultaneously...). c) the faulty accelerator pedal potentiometer. Does it seem likely that all of this happened at once and together? I find that almost impossible.

Hi.

The power supply doesn't necessarily have to be broken.
Someone here (or in the old forum) once described similar problems, which were resolved by precisely synchronizing the switches (without replacing any sensors!).

Whether the brake light switch closes too early or the last bulb becomes high-resistance, the engine computer cannot distinguish.

Quote:

Even if the third brake light is also considered, the person must be very careless with their brake lights to create those conditions.

Yes, they are included in the count. But older models don't have that feature, so in those, the normal functionality actually depends on two bulbs.

Quote:

The question remains: what about the fuse? Is it really true that a blown fuse won't be detected and that, in such a case, the motor will go into emergency mode?

I haven't tried it, but it shouldn't matter which way the implausibility emerges.
However, if a fuse blows, the implausibility only occurs when braking. And if there's no power afterward, you're usually not driving next to a truck on a country road...

The brake pedal monitoring is performed by the pedal switch F 47, which connects pin 20 (of the 68-pin engine control unit connector) to ground when the brake pedal is not depressed. When the brake pedal is pressed, the switch opens, and an internal pull-up resistor raises pin 20 to 12 volts.



'This is definitely NOT the case in a Golf IV with an ALH engine. In that model, there is a 12V supply on the control unit (T121/65) via switch F47. When the switch is activated, the 12V supply is cut off.'

On terminal T121/32, applying 12V activates the circuit (brake light via F).


That means: For example, if a brake light bulb has just burned out and the socket of another bulb has an older, previously unnoticed loose connection, the EDC can unexpectedly switch to emergency mode .


That smells like a self-experiment. Although, based on my own experience, I attribute only limited intelligence to software glitches ( ), I expect the following:
If one of the two switches fails, the indicator light will blink with an error message (indicating an implausible signal), but there will be NO intervention in the engine control system. This is because the signal is considered implausible.


So, what's the point of a double brake pedal monitoring system when, in everyday situations, people's lives are literally hanging by a thread connected to light bulbs?

...

I personally find a brake monitoring system with only one switch to be generally safer, and therefore I rewired the signal cable 44 from the brake light to the brake pedal switch, so that only the simpler system with F 47 tells the engine computer whether or not the brakes are being applied.


And if that one switch fails, there will be no motor control in the event of an error. That's the whole point of having dual switches: to enable fault detection.
In addition, the EDC analyzes the brake pedal input to enable features such as vibration damping, preventing unwanted activation, and smooth deactivation. Furthermore, the cruise control is also deactivated in this way, which could become a problem if the switch is defective.

CU Gremlin.

Gremlin wrote:

In the Golf IV with the ALH engine, this is definitely NOT the case. There is 12V on the control unit (T121/65) via switch F47. When the switch is activated, the 12V is removed. When the switch is activated, 12V is switched on at T121/32 (brake light via F)

.

Hi.

It's possible, I only measured the AFN.
However, this difference doesn't change the fundamental problems related to switch synchronization and the issue of evaluating implausibilities.

Quote:

Although, based on my own experience, I attribute only limited intelligence to software agents ( ), I expect the following: If one of the two switches fails, -> a blinking indicator light will appear with an error message (implausible signal), but there will be NO intervention in the engine control. This is because the signal is implausible.

What is the purpose (in terms of a security gain, however defined), of redundancy, if, in the event of a pedal sensor defect that is not detectable by the EDC (= appears plausible internally) and a simultaneous implausibility of the brake monitoring system, the emergency brake is not consistently applied and ?

It could be that, from the perspective of the "blind" engine computer, there is an "overpower emergency," and the driver is really slamming on the brakes - and then the power shouldn't be reduced, because perhaps only one of the brake switches is malfunctioning?

Quote:

and if that particular switch fails, there will be no motor control in case of an error.

That's the whole point of having two switches: to enable fault detection.

. . . which, in my opinion, is less beneficial than the one-switch solution due to the multitude of "homemade" uncertainties

Quote:

.

In addition, the EDC also analyzes the brake pedal to enable anti-vibration, anti-surge, and smooth steering. Also, the cruise control is deactivated in this way, which could also become a problem if the switch is defective...}

Okay, but those aren't security issues yet. And as long as the switch works, everything will remain normal.

What is the purpose (in terms of a security gain, however defined), then, of redundancy if, in the event of a pedal sensor failure that is not detectable by the EDC (= appears plausible internally) and simultaneous implausibility of the brake monitoring system, the emergency brake is not consistently applied and ?

It could be that, from the perspective of the 'blind' engine computer, there is an 'overpower emergency,' and the driver is really slamming on the brakes - and then the power shouldn't be reduced, because perhaps only one of the brake switches is malfunctioning?


This scenario is extremely unlikely. At the exact moment when your accelerator pedal gets stuck due to the metal screws for the aluminum panels in the floor mat, your brake light switch malfunctions.
Even if the engine isn't shut off, your brakes are certainly strong enough to stop the entire vehicle, including the engine. Besides, there's always the ignition key.

I've experienced something similar before. It was a stuck throttle cable that was jammed in a 3/4 position. Back then, there was absolutely no electronics in cars (things like 'dwell angle' were still a mystery ). Just pump the brakes and turn the key...

Furthermore: if the accelerator pedal sensor provides an implausible signal, the emergency mode (increased idle speed) will ALWAYS be activated. I expect that if one of the F-switches fails, the emergency mode should NOT be activated, but only a warning message should be displayed.

The accelerator pedal sensor also uses two independent sensors that must provide signals that are consistent with each other. If one fails, it triggers a fail-safe mode.

'Your concerns were also in the direction of whether the EDC system would shut down the engine's power if a switch (or something else) malfunctions during an overtaking maneuver?'

I say: NO, because the signal is implausible and deviating from the expected performance could cause a hazard. An error message will be set.

So... I was just in the vehicle and simulated the error 'fuse for brake light defective'.

There are no error messages and no entries in the control unit (ECU). It does not trigger a fault when both the brake and accelerator pedals are pressed simultaneously.

Furthermore, I have noticed that when I apply the brakes, the power is reduced. } If I release the accelerator and then press it again, I get full power again, even though I am still on the brakes. } Therefore, it is possible to continue driving, or to regain motor power, even in the event of a complete switch failure, by releasing the accelerator and then pressing it fully again. }

The failure of component F47 still needs to be tested, but that's difficult to do quickly in the dark.

CU Gremlin.

Gremlin wrote:

The accelerator pedal sensor also works with two independent sensors that must provide signals that are plausible to each other. If one fails, it triggers a fail-safe mode.

Hi.

hm?? Two sensors in the accelerator pedal? The wiring diagram for the VP37 TDIs shows 6 connections:

1 = Poti output.
2 = 5V Poti supply.
3 = Poti mass.
4 = Relay output, idle state.
5 = Switching output, full load.
6 = Switching contact to ground.

Even if two potentiometers are present in the sensor, their output signals will be "mixed" into a single voltage, and the motor computer will have no chance to reconstruct the original partial voltages or to check their plausibility.

Quote:

Your concerns were also in the direction of "does the EDC shut down the performance if a switch (or something else) is defective during an overtaking maneuver?" I say: NO, because an implausible signal and deviations from the expected performance in this case could cause a hazard. An error message will be set.

Simultaneously applying gas and brakes is also implausible, and in such a case, the system would need to be overridden (because the pedal sensor could be defective and still provide seemingly plausible signals) - what would be the point of having a brake monitoring system otherwise?

Can the engine control unit distinguish between x different implausible situations and react to each one individually (e.g., by reducing power or not)?

Quote:

So... I was just in the vehicle and simulated the error "brake light fuse defective". There is no error message and no entry in the control unit (ECU). It does NOT get deactivated even when both the brake pedal and the accelerator pedal are pressed simultaneously.

Interesting... while this contradicts my understanding of security logic, it will probably be correct .

Quote:

Furthermore, I noticed that when I apply the brakes, the power is reduced. When I release the accelerator and press it again, I get full power again, even though I am still on the brakes. So, even in the event of a complete switch failure, I could still drive or replicate the motor power by releasing the accelerator and pressing it fully again.

If, in that split second of "power loss next to the truck," you're cool enough to take your foot completely off the gas, even though you still want to pass before you crash into oncoming traffic... does everyone manage to do that?

Interesting... while this contradicts my understanding of security logic, it will probably be correct .


How is the Electronic Stability Control (ESC) supposed to know if I'm actually braking or not in this case? Only one of the two switches is being activated.
Okay, so it's probably best not to adjust it. I was expecting to see an error message, but oh well...


If, in that split second of 'sudden power loss next to the truck,' you're cool enough to take your foot completely off the gas, even though you still want to pass before you crash into oncoming traffic... does everyone manage to do that?


'Ulf, you're starting to get paranoid now...'

what's happening:

- if the EDC itself fails.
- if the driveshaft breaks.
- if the throttle cable breaks.
- if the ignition coil fails.
- if a connector fails.
- if the circuit breaker contact breaks.
- if a valve spring breaks.
- if the fuel pump fails.
- etcetera, etcetera, etcetera...

wie häufig sind solche ausfälle ? JUST NOW...

Don't exaggerate, otherwise you'll have to push your car .

btw: The information about the pedal position sensor is on page 32 of the EDC manual.

CU Gremlin.

Hi.

Here is an excerpt from the description of the Industrial TDI (AFD, as of 11/9.

Quote:

Brake pedal position for F and F47. The switches, for safety reasons, both provide the same signal, indicating "brake applied" (a redundant system). This is monitored by the control unit. In addition, the signals from both switches are used to monitor the pedal position sensor (for plausibility). This prevents, for example, simultaneous braking and full acceleration. Backup function: In the event of failure of one of the two switches or in the case of unequal settings, an emergency program is activated, which intervenes in the fuel quantity control. Note: The two switches must be adjusted so that their switching points are exactly identical. Therefore, precise adjustment is required according to the repair manual.

I probably should have included that in the original post.

It's possible that newer generations of EDC systems are programmed differently...

Regarding "Paranoia":
Yes, driving is already dangerous enough. But I don't think we should make it even more dangerous with complex surveillance systems that can produce their own errors...

I've also read that phrase in the Industriemotor PDF and was surprised by it. Otherwise, I can confirm everything Gremlin has said about my AMF.

Regards,

Olaf.

Hello,

The accelerator pedal sensor also works with two independent sensors that must provide signals that are plausible to each other. If one fails, it triggers a fail-safe mode.

'Gremlin' is likely referring to the potentiometer and the idle speed sensor. Both are located in the accelerator pedal sensor, and if they provide conflicting signals (e.g., the idle speed sensor is closed while the potentiometer provides a high voltage), the sensor is declared defective, which results in an idle problem. More details can be found in the installation instructions for the industrial motor.

Regarding Ulf's problem:
It would certainly be worth experimenting to see what happens if both brake lights are defective. If I didn't know, I certainly wouldn't have the nerve to release the accelerator and then press it again during an (attempted) overtaking maneuver. I would much more likely initiate a full stop or start inspecting the terrain beyond the roadside ditch. This should actually be included in the owner's manual!

Until proven otherwise, I'm going to assume that the VW engineers had a reason for doing things the way they did. Therefore, instead of modifying the wiring as Ulf did, wouldn't it be better to simply add a resistor in parallel with the brake lights that counteracts the pull-up resistor in the control unit? Of course, it would first be necessary to experiment to determine the optimal value. But then the problem would be solved, and all the 'safety functions' would still be active.

Or were the VW engineers simply trying to ensure that broken brake lights would be noticeable through a flashing indicator light?

Hello.
Wolfgang.

Wolfgang, syncro16 wrote:

Until proven otherwise, I'm going to assume that the VW engineers had a good reason for doing things the way they did. Therefore, instead of modifying the wiring as Ulf did, wouldn't it be better to simply add a resistor in parallel with the brake lights that counteracts the pull-up resistor in the control unit? Of course, it would first be necessary to experiment to determine the optimal value. But then the problem would be solved, and all the "safety functions" would still be active. Or were the VW engineers simply trying to ensure that broken brake lights become noticeable through a flashing indicator light?

Hi Wolfgang,

I also considered adding a resistor in parallel with the brake lights. However, ultimately, it would only be an improvement to a fundamentally poorly designed system, so I opted for a more straightforward solution and reduced the whole thing to a simple switch.

According to my assessment, this variant has only one real disadvantage (compared to several in the original configuration).
If valve F 74 were to fail in a way that prevents it from opening, the driver would generally not notice because the normal performance would still be available.
If a defect later occurs in the throttle position sensor, causing an unintended full-throttle command without any "internal inconsistencies," simultaneous braking will no longer trigger the EDC's emergency mode, because the EDC will not detect the braking due to the faulty F47 sensor.

In this situation, the faulty F47 would have been detected due to its redundancy with the F system during the first braking maneuver after the failure, and the driver would likely have received some kind of warning (e.g., emergency mode, error message).