Jherrod ThomasThe Lion of Functional Safety™

July 4, 2026 · 14 min read

ISO 26262-3 HARAISO 26262-9 DFAFMVSS 114 / Part 573

When the Rollaway Monitor Was Asleep: The Ford 26V402 Park-Pawl Recall Through an ISO 26262 and FMVSS 114 Lens

A parking pawl is a beautifully dumb piece of steel: a spring-loaded finger that drops into a notched ring on the transmission output shaft and holds several thousand pounds of truck on a hill. It has exactly one enemy — being asked to engage while that ring is still spinning. Ford's 26V402 recall is about software that did precisely that, ground the finger down over months of driving, and then handed the resulting rollaway hazard to a monitoring function that, it turns out, sleeps when the truck does.

Regular readers will recognize the shape of this one. I have written about maintenance manuals that disable thrust-reverser monitors and flap-asymmetry detectors that wore off the shaft they were watching. This is the automotive edition of the same disease: a hazard was assessed, judged acceptable because a monitor would catch it, and nobody wrote the requirement that the monitor be awake when the hazard arrives.

The public record

On June 24, 2026, Ford Motor Company filed Part 573 Safety Recall Report 26V402 (Ford recall 26S48), covering 741,195 U.S. vehicles: 313,147 model-year 2020–2021 Ford Explorers, 246,202 MY 2018–2021 Expeditions, 82,570 MY 2021 F-150s, 59,079 MY 2018–2021 Lincoln Navigators, and 40,197 MY 2020–2021 Lincoln Aviators — every one equipped with park-by-wire and a 10R60, 10R80, or 10R80MHT ten-speed automatic (NHTSA Part 573 Safety Recall Report 26V402, June 24, 2026).

The defect description is two sentences of quiet horror. Affected vehicles "may experience temporary engagement of their transmission parking pawl while the vehicle is in motion when certain shifts are commanded by the transmission, potentially damaging park system components." The cause: "the vehicle's transmission valve body separator plate may limit flow to the park valve causing temporary park pawl engagement when certain shifts are commanded." In other words, a hydraulic restriction inside the valve body starves the park valve, the valve drifts, and the pawl kisses a spinning output ring it was never supposed to touch. Each kiss chips, bends, or shears the pawl and its ring. The driver feels little or nothing. The damage accumulates silently until, one day, Park is commanded, the pawl no longer holds — and if the parking brake is not applied, the vehicle rolls (NHTSA Part 573 26V402; The Drive, Ford Recalls 740,000 Trucks and SUVs That Could Roll Away in Park, June 2026).

The chronology is, as usual, where the engineering lesson lives. NHTSA's Office of Defects Investigation contacted Ford on April 6, 2026 with eleven Vehicle Owner Questionnaires on nine vehicles reporting movement after shifting to Park, inability to shift into Park, or movement with the brake applied. Ford's Critical Concern Review Group opened an investigation on April 14. But the Part 573 admits this was not the first look: the CCRG had already investigated park-system damage warranty claims on the 2020 Explorer in February–March 2022, and closed that investigation "as not an unreasonable risk to motor vehicle safety based on the determination that in the event of park pawl damage, electric parking brake apply strategies would prevent unintended vehicle movement and customers would be provided notification in the instrument panel cluster" (NHTSA Part 573 26V402, Chronology).

Four years later, the 2026 investigation found the flaw in that reasoning, and the report states it with remarkable candor: all affected vehicles have "roll away detection" that automatically applies the EPB if movement is detected in Park — but "the vehicle's Powertrain Control Module (PCM) may not be awake in some instances after the vehicle has been powered down after a period of time and unable to detect movement."

Read that sentence the way an assessor would. The risk acceptance rested on a safety mechanism. The safety mechanism runs on the PCM. The PCM sleeps. The hazard — a parked, unattended vehicle beginning to roll — lives almost entirely in the time window after the PCM has gone to sleep.

As of May 20, 2026, Ford counted 220 North American reports plus 10 VOQs on Explorer/Aviator and 62 reports plus 3 VOQs on Expedition/Navigator, with 24 allegations of property damage and 9 alleged injuries (two of them emotional-injury claims). The Field Review Committee approved the field action on June 16, 2026. The remedy is a PCM software update that "will prevent the transmission from commanding those shifts which may result in temporary engagement of the transmission parking pawl while the vehicle is in motion," plus dealer inspection and replacement of any already-damaged park components. The consumer advisory carries both Do Not Drive and Park Outside flags. Interim owner letters go out August 3–7, 2026; remedy letters are phased into the second quarter of 2027 (NHTSA Part 573 26V402; Reuters, Ford to recall over 741,000 US vehicles due to park system issue, June 30, 2026; ConsumerAffairs, July 1, 2026).

The standards lens

Start where the item definition should have started: the Park-hold function does not end at key-off. ISO 26262-3 §5 requires the item definition to enumerate operating modes, and "parked, powered down, unattended, on a grade" is not an edge case for a park-by-wire system — it is the primary operating mode of the function. Every downstream claim about safe states and safety mechanisms inherits that mode list. If the item definition scopes the analysis to "vehicle operating," the one state where a park pawl earns its living falls out of every work product that follows.

The HARA (ISO 26262-3 §7) then owes us two rows, not one. The first is the commission event: unintended park-pawl engagement while the vehicle is in motion (guide word M02, unintended activation). On these ten-speeds the pawl mechanism ratchets above walking speed rather than locking the driveline solid, so the immediate vehicle-level effect is noise and a torque transient rather than instant wheel lockup — which is exactly why this row is dangerous to under-rate. Its worst credible outcome is not the transient; it is the latent structural damage to the pawl and ring. The second row is the omission event that damage produces: loss of the Park-hold function on a parked, unattended vehicle. Severity is driven by the person the vehicle rolls toward — a child behind a 5,700-pound Expedition in a sloped driveway is S3 without any argument. Exposure: parking on a grade is an everyday condition, E4. Controllability: the defining feature of this hazard is that no one is in the vehicle — C3, nothing to debate. S3 / E4 / C3 is ASIL D. Even a deliberately conservative S2 reading lands at ASIL C. This is why FMVSS 114 — the federal standard governing theft protection and rollaway prevention — exists at all, though 26V402 is filed as a defect, not an FMVSS noncompliance: no compliance test drives a truck for 40,000 miles with a starved park valve first.

Now the part that should be taped to the wall of every safety office. The 2022 closure was, in ISO 26262 vocabulary, a claim that the hazard was mitigated by a safety mechanism: EPB rollaway detection plus an IPC warning. Fine — that is a legitimate architecture. But the moment you claim credit for a safety mechanism, ISO 26262-4 §6 makes you specify it: its fault-handling time, its diagnostic coverage, and — the piece missed here — its availability across every operating mode in which it is claimed. A rollaway monitor that requires an awake PCM provides zero coverage in the powered-down state, and the powered-down state is where parked vehicles spend more than 90 percent of their lives. The 2026 chronology sentence about the sleeping PCM is not a new discovery about the vehicle. It is a discovery about the 2022 analysis.

There is also a clean ISO 26262-9 dependent-failure story here, and it has two layers. First, the pawl damage is a classic latent fault in Part 5 vocabulary: undetected by the driver, undetected by any diagnostic that annunciates before Park is next commanded, accumulating across ignition cycles. Pair a latent loss of the primary actuator (pawl) with an unavailable safety mechanism (sleeping EPB monitor) and you have a dual-point failure whose residual risk was carried by nothing but the driver's habit of setting the parking brake — a habit FMVSS 114 has never been willing to assume, and neither should a HARA. Second, look at where everything runs: the shift-scheduling logic that causes the pawl strikes and the rollaway-detection logic that is supposed to catch the consequence are hosted on the same PCM, fed by the same power-mode manager that decides when to sleep. A dependent-failure analysis that put "PCM power state" in its list of coupling factors would have found that one shared decision — go to sleep — simultaneously retires the monitor and freezes the warning path. That DFA row was never written, or it was written and never closed.

Finally, ISO 26262-7 (production and operation) has a word for what happened between 2022 and 2026: field observation. Warranty claims citing park-system damage were the field telling Ford the commission event was real and mechanical. A field-monitoring process wired to the safety case would have asked the question the CCRG didn't: does the mechanism we credited in the HARA actually cover the state where this damage bites? Instead the claims were dispositioned against the same unverified monitor, and the loop closed on itself for four years.

A worked snippet — two HARA rows and the fault tree

The two rows the HARA owes, written the way the 2022 review should have seen them:

| ID | Function | Operating scenario | Malfunction (guide word) | S | E | C | ASIL | Safety Goal | |---|---|---|---|---|---|---|---|---| | HZ-PRK-01 | Transmission park-pawl actuation (park-by-wire) | Vehicle in motion, transmission executing commanded shift | Unintended activation: pawl commanded/allowed to engage while output shaft rotating | S1 direct (torque transient), but propagates latent damage feeding HZ-PRK-02 | E3 (specific shift conditions with degraded valve-body flow) | C3 (driver unaware; no annunciation) | ASIL B (as rated standalone — under-rating trap: see HZ-PRK-02) | SG-PRK-01: The transmission shall not engage the parking pawl while output-shaft speed exceeds the pawl ratchet-safe threshold. | | HZ-PRK-02 | Park-hold of stationary vehicle | Vehicle parked on grade, powered down, unattended, parking brake not applied | Loss of function: pawl fails to hold due to accumulated mechanical damage | S3 (rollaway into pedestrian or occupied space) | E4 (parking on grade is everyday) | C3 (no one present to intervene) | ASIL D | SG-PRK-02: The vehicle shall remain stationary when Park is the commanded state, or unintended motion shall be arrested and annunciated, in all power modes. |

And the fault tree for the top event, with the branch that actually fired in the field marked:

Top: Unattended vehicle rolls away while Park commanded
        AND
        ├── A. Park-pawl mechanical hold lost
        │       AND
        │       ├── A1. Repeated pawl engagement at speed (valve-body
        │       │        separator plate restricts flow to park valve)   <- root cause
        │       └── A2. Damage latent: no per-event DTC annunciated,
        │                no cumulative-damage counter, no inspection task
        ├── B. EPB not holding
        │       OR
        │       ├── B1. Driver did not apply parking brake (uncredited
        │       │        human action; FMVSS 114 assumes it absent)
        │       └── B2. Automatic apply-on-exit strategy not triggered
        │                (TRS reported Park reached; wrench-light path
        │                requires TRS to miss the Park position)
        └── C. Rollaway detection fails to arrest motion
                OR
                ├── C1. PCM asleep after power-down interval;
                │        motion detection inoperative                    <- the 2026 finding
                ├── C2. Detection latency exceeds distance-to-harm on grade
                └── C3. Detection and shift logic share PCM power state
                         (coupling factor: one sleep decision retires both)

Every gate in that tree was knowable in 2022. A1 was in the warranty data. A2 is a design review question. B2 is the gap in the annunciation logic the Part 573 itself describes — the wrench light and auto-EPB fire when the transmission range sensor fails to reach Park, not when the pawl reaches Park and no longer holds. C1 is a power-moding spec that existed on paper somewhere in Dearborn. The tree did not need four more years of field data. It needed to be drawn.

Derived requirements (excerpt)

Five requirements that turn the missing artifacts into checkable statements:

FSR-PRK-003 is the one that stings. Nothing in it is exotic — wake-on-motion interrupts and always-on brake controllers are shelf technology, and the EPB actuator itself is already sitting on the axle. The function was simply never allocated, because the 2022 analysis never asked which box had to stay awake.

What the headline really tells us

The headline says a software glitch can make three-ton Fords roll away, and the internet will spend a week joking about trucks with a bedtime. The Part 573 says something more useful: a hazard was found in 2022, weighed, and accepted on the strength of a monitor nobody had specified across power modes. The missing artifact is not the pawl-speed interlock — that is one line of shift-scheduling code, and it is literally the recall remedy. The missing artifact is the safety-mechanism availability claim: the one-page analysis that says here is the mechanism we are crediting, here are the operating modes of the hazard, and here is the evidence the mechanism is alive in every one of them. That page costs an afternoon. Its absence cost 741,195 vehicles, a Do-Not-Drive advisory, a park-outside warning, 24 damaged driveways and garage doors, and a remedy schedule that stretches into the spring of 2027 — all for a monitor that was exactly where its truck was: parked, powered down, and asleep.

Sources

— Jherrod Thomas, The Lion of Functional Safety™