January 13, 2021
BY EMAIL
Mr. Al Prescott
Vice President, Legal
Tesla, Inc.
3550 Deer Creek Rd.
Palo Alto, CA 94304
aprescott@tesla.com

NEF-104aa
EA20-003

Dear Mr. Prescott:
The Office of Defects Investigation (“ODI”) of the National Highway Traffic Safety
Administration (“NHTSA”) is investigating a potential safety-related defect concerning incidents
of media control unit (“MCU”) failures resulting in loss of rearview camera and other safetyrelated vehicle functions in certain model year (“MY”) 2012 through 2018 Tesla Model S andMY 2016 through 2018 Tesla Model X vehicles.
Certain of these Model S and X vehicles were equipped with an NVIDIA Tegra 3 processor withan integrated 8GB eMMC NAND flash memory device (the “subject vehicles”). Part of this 8GB
storage capacity is used each time the vehicle is started. The eMMC NAND cell hardware fails
when the storage capacity is reached, resulting in failure of the MCU. The MCU is the vehicle’s
display screen, which controls certain aspects of performance subject to Federal motor vehicle
safety standards (“FMVSS”) 1 and other safety-relevant functions. Specifically, failure of theMCU results in loss of the rearview/backup camera 2 and loss of HVAC (defogging anddefrosting setting controls (if the HVAC status was OFF status prior to failure). The failure also
has an adverse impact on the Autopilot advanced driver assistance system (“ADAS”), as well asturn signal functionality due to the possible loss of audible chimes, driver sensing, and alerts
associated with these vehicle functions.
As discussed more fully below, ODI has tentatively concluded that the failure of the media
control unit (MCU) constitutes a defect related to motor vehicle safety. Accordingly, ODI
requests that Tesla initiate a recall to notify all owners, purchasers, and dealers of the subjectvehicles of this safety defect and provide a remedy, in accordance with the requirements of theNational Traffic and Motor Vehicle Safety Act, 49 U.S.C. §§ 30118-30120.
While FMVSS apply to new motor vehicles and items of motor vehicle equipment, the fact that a system is subject
to FMVSS is indicative of the system’s relevance to safety.
2Backup cameras are required by FMVSS No. 111, which has a stated purpose of “reduc[ing] the number of deaths
and injuries that occur when the driver of a motor vehicle does not have a clear and reasonably unobstructed view tothe rear.” 49 C.F.R. § 571.111 S2.
1I.

ODI’s Investigation

ODI began its investigation of the subject vehicles when it opened Preliminary Evaluation(“PE”) PE20-010 on June 22, 2020. The investigation was upgraded to Engineering Analysis(“EA”) EA20-003 on November 12, 2020. The EA covers approximately 158,000 vehicles.
During its investigation, ODI collected, reviewed, and analyzed information from a number ofsources. The Office considered complaints and data provided by Tesla and consumers, surveyed
consumers, and reviewed repair invoices. Further, ODI compiled data, identified trends, andmade comparisons to peer vehicles and other similar safety recalls. ODI considered Tesla’s
technical briefing presentations and responses to ODI’s formal and informal requests forinformation, and evaluated Tesla’s assertions.
II.

The Safety Defect and its Frequency

ODI has tentatively concluded that a defect related to motor vehicle safety exists in the subjectvehicles because the eMMC NAND flash devices have a finite lifespan based upon the numberof program/erase (P/E) cycles, after which the MCU fails due to memory wear-out. ODI
tentatively concludes that this constitutes a premature failure of safety-critical part.
According to Tesla, for subject vehicles equipped with the NVIDIA Tegra 3 processor with an
integrated 8GB eMMC NAND flash memory device, the eMMC NAND cell hardware will failwhen reaching lifetime wear, for which the eMMC controller has no available memory blocks
necessary to recover. With this failure mode, the only recovery available is a replacement of theeMMC device, achieved by physical part replacement of either the MCU assembly or visual
control module subcomponent. Tesla provided information concerning the effects of MCU
failure on vehicle function, which include in loss of rearview/backup camera and loss of HVAC
(defogging and defrosting) setting controls (if the HVAC status was OFF status prior to failure.)
The failure also affects the Autopilot advanced driver assistance system (ADAS) and turn signal
functionality due to the possible loss of audible chimes, driver sensing, and alerts associated withthese vehicle functions.
During its investigation, ODI learned that the expected usage life rating for the 8GB eMMC
NAND flash memory device is approximately 3,000 “P/E” or Program-Erase cycles, after which
the eMMC NAND flash memory device would become fully consumed and no longer beoperational, leading to a failure of the media control unit (MCU). At a daily cycle usage rate of
1.4 per block, accumulation of 3,000 P/E cycles would take only 5-6 years. Historically, theexpected life of a vehicle generally far exceeds 5-6 years of service. 3 ODI believes that a 5- or 6year life expectancy for a component integral to providing the driver with safety functions isinsufficient. During our review of the data, Tesla provided confirmation that all units will
inevitably fail given the memory device’s finite storage capacity. Tesla provided its own
statistical model showing the number of projected weekly MCU repairs from 2020 to 2028,
estimating that replacement rates for MCU failures will peak in early 2022 and gradually decline
until (near) full part turnover has been accomplished in 2028
3The current average age of vehicles in the light duty fleet is approximately 12 years. [CITE]

Tesla used the same MCU with the Tegra 3 processor in approximately 158,000 MY 2012-2018
Model S and MY 2016-2018 Model X vehicles built by Tesla through early 2018. In response toODI’s Information Request (IR) for PE20-010 in August 2020, Tesla provided ODI over 52,000
complaints, field reports, warranty claims, and non-warranty claims. ODI reviewed the records
for duplicate Vehicle Identification Numbers (“VINs”) and identified 12,588 incidents at thetime, including complaints, field reports, warranty claims, and non-warranty claims related toMCU replacements. The IR response submitted by Tesla, which included data current as of July
2020, showed MCU failure rates between 14.2 – 17.3% for the range of MY 2012-2015 Model Svehicles, and MCU failures rates between 1.9 – 4.1% for the later MY 2016-2018 Model S andModel X vehicles. ODI believes failures rates will continue to accelerate, as shown in Tesla’s
projection models. We attribute the differences in failures rates between the model years to therespective time in service for the subject vehicles, in addition to some variances in memory
demand from driver to driver based on vehicle functions performed. As the vehicles continue toin use, more memory blocks are subsequently consumed, shortening the life of the 8GB eMMC
device leading to inevitable failure of the MCU. Given Tesla’s projects of MCU repairs, evenMY 2018 subject vehicles will experience 100% failure of the MCU within approximately 10years.
III.

The Safety Consequences and Precedent

A. The lack of an image on a backup camera display increases the risk of a crash
In subject vehicles, the MCU (media control unit) displays the rearview/backup camera image.
During an MCU failure, the screen becomes black, and a rearview/backup camera image is nolonger available to the driver. If this image is not available, the risk of crash increases potentiallycausing injury or death. FMVSS No. 111 was designed to address this safety risk by improving
driver visibility when a vehicle is in reverse. The standard commenced a phase in beginning on
May 1, 2016 requiring an increasing percentage of each manufacturer’s passenger car 4 fleet todisplay a rearview image while reversing. 100% fleet compliance was required for covered
vehicles manufactured on or after May 1, 2018.
NHTSA has overseen several vehicle safety recalls related to the loss of backup/rearview camera(see table 1.0 below). ODI believes past recalls support the tentative determination that the media
control unit (MCU) failures in the subject vehicles resulting in the loss of the rearview camera
image constitutes a defect related to motor vehicle safety. The following table lists some of thevarious recalls submitted to NHTSA regarding loss of backup/rearview camera image from thelast 5 years.

4GVWR of 4,536 kg or less.

Table 1.0 – Vehicle safety recalls related to loss of rearview camera (FMVSS 111)

RECALL MFR

MMYRECALL SAFETY DEFECTTYPEDESCRIPTION
CIn certain operating
conditions, the rearview
camera software may cause adelay in displaying therearview camera image
C
Back-up camera and display
settings can be adjusted suchthat the rear image is nolonger visible
C
Back-up camera and display
settings can be adjusted suchthat the rear image is nolonger visible
D
Back-up camera may fail todisplay rearview image withvehicle is in reverse

20V-046

MBUSA2019 Mercedes Benz
A220

19V-684

BMW

19V-654

Nissan19V-603

JLR

18V-632

Bentley

2018-20 5-Series, 6Series, 7-Series, X3,X4, X5, X6, Z4, RR
Phantom & Toy. Supra
2018-19 Nissan Altima,Armada, Frontier,Kicks, Leaf, Maxima,Murano, NV, NV200
2018 Range Rover &Range Rover Sport withContinental Surround
Camera systems
2018 Bentley Bentayga& Mulsanne

18V-629

Honda

2018 Honda Accord &2019 Honda InsightC

18V-398

FCA

2018 Ram
1500/2500/3500 &Dodge Journey

C17V-132

Subaru2017 Subaru Impreza

D16V-839

Maserati

2017 Maserati
Quattroporte, Ghibli,
and LevanteDC

Rearview camera may be
obstructed or may not be fullyvisible within two seconds
In certain scenarios, the backup camera center display maynot function properly
Rearview mirror backup
camera may experience a lossof image display whilebacking up
Due to a software problem,
the rearview camera display
may not work properly
In below freezing
temperatures, theentertainment telematics
module (ETM) may place
itself in a protection mode,
disabling the back-up camera

B. The lack of a functioning windshield defogging and defrosting system may decrease
the driver’s visibility, increasing the risk of crash.
In the subject vehicles, the media control unit (MCU) provides the driver with the touchscreen
display to control the base-level heating, ventilation and air conditioning (“HVAC”) system.

Upon the failure of the (MCU), the touchscreen display will appear as a black screen and thevehicles will not have a functioning windshield defogging and defrosting system. As a result, thelack of a functioning windshield defogging and defrosting system may decrease the driver’s
visibility in inclement weather, increasing the risk of crash.
NHTSA has overseen numerous vehicle safety recalls involving the loss of windshield defoggingand defrosting (see table 2.0 below) function. ODI believes past recalls support that the media
control unit (MCU) failures in the subject vehicles resulting in the loss of functioning windshielddefogging and defrosting system constitute a defect relating to motor vehicle safety. The
following table lists some of the recalls overseen by NHTSA regarding loss of windshielddefogging and defrosting systems over the last 20 years.
Table 2.0 – Vehicle safety recalls related to loss of windshield defogging and defrosting function (FMVSS 103)

RECALL MFR

MMYRECALL SAFETY DEFECTTYPEDESCRIPTIONCDo not have a functioning
windshield defrosting anddefogging system

19V-051

FCA

18V-139

JLR

15V-233

Mitsubishi

13V-567

GM11V-149

GM

2019 Ram 1500 with12" touchscreen
display and base
HVAC
2018 Land RoverRange Rover Velar
2009-11 Lancer,
Lancer Sportback,Lancer Evolution,
Outlander, OutlanderSport
2014 Chevrolet
Malibu2011 Buick LaCrosse
and Cadillac SRX

10V-514

Mitsubishi

2006-08 Endeavor
with manual airconditioning

D10V-096

GM

2009-10 Chevrolet
Express and GMC
SavanaC

09V-489

GM

2010 GMC Terrain
and Chevrolet
Equinox

C09V-158

FCA

2009 Dodge Ram

DDDCC

Air inlet door linkages may
detachBlower motor may fail

HVAC system may become
inoperative at startup
Electronic Climate Control
software may disable theability to adjust HVAC settings
The HVAC controller may
intermittently send incorrect
signals to the HVAC mode
door
HVAC control knobs may
fracture and spin on the control
shaft, resulting in loss ofHVAC control
Software in center instrument
panel may cause HVAC, radio
and panel illumination tobecome inoperative
HVAC module software may
cause windshield defrosting08V-634

GM2009 Chevrolet
Malibu HybridC07V-563

Volvo2007-08 Volvo XC90

D06V-494

FCA

D00V-355

Ford

2007 ChryslerSebringwith Automatic
Temperature Control
2000 Mustang GTCand defogging functions tobecome inoperative.
HVAC system may become
inoperative and mode selector
would remain in last setting
Climate Control Module(CCM) may get a shutdown
signal from the Engine Control
Module (ECM) on keyinsertion
HVAC module software defectmay cause defrosting anddefogging systems to become
inoperative
Coolant flow blockage inheater core, resulting in nowarm air from the heaterC. The impact on alert/sensing functions on ADAS and turn signal functionality
increases the risk of a crash.
In the subject vehicles, the loss of the media control unit (MCU) subsequently impacts theAutopilot ADAS System and turn signal functionality due to the possible loss of audible chimes,
driver sensing, and alerts associated with these vehicle functions. If the media control unit(MCU) were to fail during an active drive scenario, the driver would not have functioning turnsignal alert “blinker sounds.” Safety tell-tales such as audible chimes, driver sensing, and alerts
all play an important role in maintaining driver safety while operating the vehicle. The loss ofthese functions can increase the risk of crash.
NHTSA has overseen several vehicle safety recalls related to loss of turn signal function (seetable 3.0 below). ODI believes these recalls support tentative determination that the media
control unit (MCU) failures in the subject vehicles resulting in the loss of turn signal function asa vehicle safety defect. Additionally, NHTSA has overseen several vehicle safety recalls related
to the possible loss of audible chimes, driver sensing, and alerts associated with ADAS systems(see table 4.0 below). Loss of alerts associated with ADAS systems increases the risk of a crashoccurring because drivers may be unaware of system malfunctions.

Table 3.0 – Vehicle safety recalls related to loss of turn signal function (FMVSS 108)RECALL MFR

MMY

19V-403Mazda

2018 Mazda CX-9

14V-294

FCA2014 Ram Promaster

12V-454

GM

2013 Chevrolet
Sonic

06V-263GM

2004-05 Cadillac
XLR

04V-584

VW

2000-02 VW Golf,GTI, Jetta

04V-547

GM

2003-04 Saturn ION

04V-524

GM2003 Chevrolet
Cavalier & Pontiac
SunfireRECALL SAFETY DEFECTTYPE
DESCRIPTIOND
Weak retention force of wiring
harness connectors may disrupt
communications and disable
frontal airbag, turn signals andengine starting system.
Inoperable turn signals preventthe driver from signaling to otherdrivers, increasing the risk ofcrash.
D
Water intrusion around in-floor
battery cover may disable airbags, stop lamps, turn signals,
backup lights and/or door locks
CBody Control Module (BCM)
fails to warn when turn signal
lamp fails to illuminateD
Bulb used for DRL, turn signal &parking lamps may become
damaged by vibration and burnout prematurely
DHazard switch and flasher system
function may degrade over time
because of distortion andmaterial transfer resulting inintermittent or inoperative turnsignal and hazard flasher
function
D
Front turn signal lamp and DRL
may stop working on either side
due to loss of contact between
bulb and socket
D
Rear lamps that provide stop,
turn signals and tail lamp
functions stop working becauseof inadequate contact between
bulb and socketTable 4.0 – Vehicle safety recalls related to loss of (ADAS) warning notifications to the driver

RECALL MFR
19V-540

MercedesBenz

15V-366

SubaruIV.

MMY

RECALL SAFETY DEFECTTYPEDESCRIPTION
2019-20 platforms
DA software error in the radar
equipped with Driver
sensor control unit may impair
Assistance Package
the functionality of the Active
Brake Assist function with nowarning displayed to the driver
2015-16 Impreza,
D
Loss of driving assist system
Legacy, Outback,function with no warning
WRX, XV Crosstrek
displayed to the driver

Conclusion

ODI tentatively concludes that the subject MY 2012-2018 Tesla Model S and MY 2016-2018
Model X vehicles contain a defect related to motor vehicle safety. The failure rate in thisinvestigation is significantly greater than the failure rate for vehicles involved in prior recalls
involving similar behavior. ODI’s analysis of the data demonstrates that the number of failuresof the media control unit (MCU) will steadily increase over time until all parts in the subjectvehicles have failed. The tentatively-determined safety defect in the MY 2012-2018 Tesla Model
S and MY 2016-2018 Model X is a clear, identified failure mode that leads to an unrecoverable
status for the media control unit (MCU) and adversely affects vehicle safety functions. ODI
requests that Tesla recall each of the subject vehicles in accordance with 49 U.S.C. §§ 3011830120.
NHTSA notes that Tesla has implemented several over-the-air updates in an attempt to mitigate
some of the issues described in this letter, but tentatively believes these updates are procedurally
and substantively insufficient. As a matter of Federal law, vehicle manufacturers are required toconduct recalls to remedy safety-related defects.
ODI’s request that Tesla conduct a safety recall does not constitute a formal conclusion by
NHTSA with respect to the evidence in its investigative file. This recall request does notconstitute an initial or final agency decision that the subject vehicles contain a safety-related
defect pursuant to 49 U.S.C. § 30118, or an order to recall vehicles.
If Tesla decides not to conduct the requested recall, it must provide ODI with a full explanationof its decision, including any additional analysis of the problem beyond Tesla’s pastpresentations. If not satisfied after consideration of this information, the Agency may proceed to
publish in the Federal Register an Initial Decision that these vehicles contain a safety-related
defect, describing the alleged safety defects, the safety consequences of these defects, the ODI
investigation, and the scheduling of a public meeting pursuant to 49 U.S.C. § 30118, and may
take other appropriate action.
Tesla’s written response to this letter referencing the identification codes in the upper right handcorner on page 1 of this letter, must be submitted to this office no later than January 27, 2021, byemail to Jeff.Quandt@dot.gov. It is important that Tesla respond to this letter on time. This letteris being sent pursuant to 49 U.S.C. § 30166, which authorizes this agency to conduct
investigations and require the submission of reports that may be necessary to enforce Chapter
301 of Title 49. Failure to respond promptly and fully to this letter may be construed as aviolation of 49 U.S.C. § 30166, which could subject Tesla to civil penalties pursuant to 49
U.S.C. § 30165.
If you have any questions about this letter, please contact Mr. Jeffrey L. Quandt of my staff at(202) 366-5207. If you have any questions regarding the recall procedures, please contact Mr.
Joshua Neff of my staff at (202)-366-0698.

Sincerely,
STEPHENANTHONYRIDELLA

Digitally signed by STEPHENANTHONY RIDELLA
Date: 2021.01.13 14:12:33-05'00'

Stephen Ridella, Ph.D.
Director
Office of Defects Investigation