August 23, 2026 · 15 min read

ISO 26262-9 §6 / -6 Annex DFMVSS 101 / 108 / 114 / 20826V511 / 26V341

When the Turn Signals Lived Inside the Screen: The Toyota 26V511 Combination Meter Recall Through an ISO 26262-9 Freedom-from-Interference and Initialization Lens

You press the start button on a Camry. Somewhere inside a 7-inch instrument cluster, two boot processes that were never supposed to overlap overlap. The screen comes up black. So far that is an annoyance. Then you reach for the turn signal stalk on your way out of the driveway and nothing happens, because on this vehicle the turn signals live inside the screen.

I wrote about a display failure nine days ago and said the industry has never decided who owns the pixel. This one is worse, and it is worse in an instructive way. Ford's problem was a menu drawn on top of a legally mandated image. Toyota's problem is that a legally mandated lamp function is downstream of a graphics module's boot sequence. The pixel was never the point. The point is what else got hung on the same processor.

1. The public record

NHTSA campaign 26V511, Part 573 report submitted August 6, 2026, Toyota references 26TB16 / 26TA16. Population: 508,354 model-year 2025–2026 Toyota Camry Hybrid, built at Georgetown, Kentucky between August 15, 2024 and June 9, 2026. Estimated percentage with the condition: 100%. Component supplier: Visteon Corporation (Mexico), part numbers 83800-AQ020 and 83800-AQ021. (NHTSA Part 573 Safety Recall Report 26V511)

Only the cars with the small cluster are in scope. The LE and SE trims get the 7-inch combination meter; XLE and XSE get a 12.3-inch unit running different software and are not affected. (CarBuzz, August 11, 2026)

Toyota's own defect description is short enough to quote whole, and I want it whole because the second sentence is the entire post:

"The subject vehicles are equipped with a 7-inch display combination meter, which controls certain vehicle functions and displays various information in the instrument panel. At vehicle startup, an error may occur in the startup sequence for this combination meter that can cause the combination meter to become blank. In addition, the turn signal lamps, the hazard lamp function, and certain warning buzzers (including the key left in ignition and the driver/passenger seat belt reminders) do not function."

"Controls certain vehicle functions." That is the architecture, stated plainly in a regulatory filing.

On July 31, 2026, Toyota determined the vehicles may not meet FMVSS No. 101 paragraphs S5.1 through S5.5 (controls and displays), FMVSS No. 108 paragraphs S6.1.5.1, S7.1.1.5 and S7.1.2.5 (turn signal and hazard warning signal operation), FMVSS No. 114 paragraph S5.1.3 (key-left audible warning), and FMVSS No. 208 paragraph S7.3(a) (seat belt warning). Four standards. One boot sequence.

The chronology is the part engineers should read twice:

| Date | Event | | --- | --- | | July 2024 | Field reports begin: 7-inch meter remains blank at startup | | July 2024 – Oct 2025 | Recovered field parts sent to supplier; issue cannot be replicated | | From Oct 2025 | Toyota and supplier build special instrumentation to pull detailed data off affected vehicles; suspect a "software initialization concern" | | Oct 2025 – Mar 2026 | Bench testing induces the suspected initialization concern; blank meter recreated on the bench | | From Apr 2026 | Supplier runs power-cycle bench testing to reproduce it naturally — no occurrences | | June 2026 | Testing moves to a complete vehicle | | Late July 2026 | Phenomenon replicated on a whole vehicle. This is when the lamp and buzzer cascade is discovered. | | July 31, 2026 | Noncompliance determination | | Aug 6, 2026 | Part 573 filed; dealer notification same day | | By Oct 5, 2026 | Owner notification letters |

Two years from first field report to determination, and the mechanism only fell out at vehicle level. Bench power cycling — the obvious test — ran for months and produced nothing. Toyota did not issue a do-not-drive advisory, and the remedy is a dealer-installed software update; there is no over-the-air path for this cluster, so half a million cars have to physically show up. (autoevolution, August 11, 2026; CarBuzz)

The one seventy-one days earlier

On May 27, 2026, Toyota filed 26V341 — 81,893 vehicles: 2025 Lexus UX Hybrid (9,165), 2024 Lexus GX (32,215), 2024 Toyota Mirai (356), and 2024–2025 Land Cruiser Hybrid (40,157). Different meter (12.3-inch), different supplier (Yazaki Meter Co., Ltd., Japan), different vehicles. Same failure class: "The combination meter may experience a startup fault that can cause certain areas of the display to become blank," taking with it the engine oil pressure, coolant temperature and charge indicators — and, on the Mirai, the high-voltage loss-of-isolation warning, which is why that filing also cites FMVSS No. 305 S5.4.4. (NHTSA Part 573 Safety Recall Report 26V341)

And buried in the 26V341 chronology is the sentence that should make every meter architect uncomfortable:

"In June 2024, Toyota conducted a fault-tree analysis (FTA) and suspected that a malfunction could occur during meter boot due to the short time between boot processes and potential overlap."

The fault tree was right. In June 2024. It named a boot-sequence race, on a completely different meter program, one month before the Camry field reports started arriving. It took until November 2025–April 2026 — thousands of cycled startups on a purpose-built rig — to reproduce it, and until May 21, 2026 to become a recall.

This is not a story about somebody ignoring their own analysis on the same part. Visteon's 7-inch code and Yazaki's 12.3-inch code are unrelated. It is a story about a correct finding that stayed inside one program instead of becoming a design rule across every cluster in the portfolio.

2. The standards lens

The item boundary is drawn in the wrong place

ISO 26262-3 Clause 5 asks you to define the item: its functionality, its boundary, its interfaces, and the functions allocated to it. If the item is "instrument cluster," the natural functional list is speed, telltales, trip data, menus. Turn signal actuation is not on that list, because turn signal actuation is not an instrument cluster function. It is a lamp function that happens to have been implemented in the cluster MCU because the cluster MCU was already reading the stalk switch and already driving the telltale arrows, and merging the two saved a body-controller output and some harness.

That is a defensible cost decision and an indefensible safety-boundary decision, and the two are separable. The moment FMVSS 108 lamp actuation crosses into the cluster, the cluster inherits every requirement that used to belong to the body ECU, and the item definition has to say so out loud. Toyota's Part 573 says it in six words — "which controls certain vehicle functions" — two years after the field started complaining.

Freedom from interference, but only after the MPU is configured

ISO 26262-9 Clause 6 governs coexistence of elements of different ASILs in the same element. ISO 26262-6 Annex D enumerates the interference classes you have to argue against: timing and execution, memory, and exchange of information. Everyone knows this list. Almost every FFI argument I have reviewed makes it for the steady state: here is the MPU region table, here is the partition schedule, here is the E2E profile on the shared signal.

The initialization window is where those arguments do not hold, because during boot:

the MPU or MMU region table is not yet loaded, so memory partitioning does not exist;
the RTOS scheduler is not yet running, so timing partitioning does not exist;
the watchdog is often not yet serviced or not yet windowed, so the timing monitor does not exist;
and the diagnostic that would report the failure is itself one of the things still initializing.

A blank cluster at t=0 is the canonical case of a fault whose detection mechanism has not booted yet. If your FDTI clock starts when the diagnostic starts, and the diagnostic never starts, the fault detection time interval is not long. It is undefined.

So the honest reading of ISO 26262-9 §6 here is: the FFI argument for this cluster was written for a system that was already up. Nobody was asked to write one for the ninety-odd milliseconds in which the QM graphics stack and the safety-relevant lamp and chime logic are the same unprotected thread.

Error detection at the software architectural level

ISO 26262-6 §7.4.14 and the associated tables call for error detection mechanisms at the architectural level: control flow monitoring, program sequence monitoring, diverse software design, graceful degradation. Toyota's own FTA named an overlap between boot processes — that is precisely a program-sequence fault, and program sequence monitoring is the listed method for it, highly recommended at ASIL B and above.

ISO 26262-6 Table 4 also asks for restricted use of interrupts and no unbounded concurrency in the software architectural design. A race between initialization tasks is concurrency that was not bounded by design, and it survived because it is invisible in a deterministic bench rig and only opens when real inter-ECU wake jitter shifts one task a few milliseconds relative to another. That is exactly what the record shows: bench power cycling from April 2026 produced nothing; complete-vehicle testing in June and July reproduced it.

Dependent failure analysis

ISO 26262-9 Clause 7 wants coupling factors named. Here they are, and there are no compensating provisions on the list:

shared microcontroller and shared power-on reset
shared boot sequence and shared startup scheduler
single supplier software image across the whole population (100% of vehicles affected)
a single output path from stalk switch to lamp driver
the telltale that would annunciate the loss rendered by the very component that failed

The last one deserves its own line. There is no telltale for "your telltales are gone." A blank screen is the symptom and the silence. FMVSS 101 S5.5 is a display requirement; it does not require the vehicle to notice that its display stopped complying.

Field monitoring and read-across

ISO 26262-7 §6 covers field monitoring. IATF 16949 §10.2.3 and the AIAG-VDA lessons-learned loop cover read-across. Between them they own the gap that produced two recalls in seventy-one days: a June 2024 fault tree that correctly identified a boot-overlap mechanism on one meter program never became a screening question on any other meter program. Nobody walked into the Visteon 7-inch review and asked, "show me your initialization sequence diagram and your proof that these two tasks cannot interleave."

3. A worked snippet

Here is the HARA I would have wanted on the item definition that includes lamp actuation. Ratings are mine, argued from the standard; Toyota has published no ASIL and is under no obligation to.

| ID | Malfunctioning behaviour | Operational situation | Hazardous event | S | E | C | ASIL | | --- | --- | --- | --- | --- | --- | --- | --- | | MF-01 | Turn signal lamp actuation omitted after power-on | Lane change or merge, divided highway, 55–70 mph, dry, daytime | Following or adjacent traffic receives no intent signal; side-swipe or rear-end collision | S2 | E4 | C2 | B | | MF-02 | Hazard lamp actuation omitted | Vehicle disabled or stopped in a live traffic lane, limited sight distance | Approaching traffic does not perceive the stationary hazard; high-delta-v rear impact | S3 | E2 | C3 | B | | MF-03 | FMVSS-required telltale not rendered while the underlying condition is present | Extended drive, developing coolant or oil pressure fault | Driver does not withdraw from traffic; powertrain loss at speed | S2 | E3 | C2 | A | | MF-04 | Seat belt reminder chime and telltale omitted | Short trip, occupant habitually prompted by the reminder | Unbelted occupant in a crash | S3 | E2 | C2 | A |

MF-01 and MF-02 are the two that matter, and both land at ASIL B. That is not an exotic result. It is the result you get the first time you write down that the turn signals are a cluster function.

Fault tree for the top event

TOP  Vehicle reaches drive-ready state with turn signal and hazard
     actuation unavailable and no annunciation of the loss
                              |
                            [AND]
        +---------------------+---------------------+
        |                                           |
   G1  Meter application fails to reach          G2  No alternate path
       RENDER_READY / IO_READY                       to lamp driver and
        |                                            no loss annunciation
      [AND]                                          |
   +----+--------------------+                     [AND]
   |                         |                +------+------+
 B1  Boot task pair        B2  No program     |             |
     T_gfx / T_io             sequence      B3  Stalk     B4  No meter
     interleaves in           monitor           switch        heartbeat
     an unintended            armed before      polled by     consumed by
     order (race)             the race          meter MCU     body ECU
                              window            only
 Coupling factors (DFA): shared MCU, shared POR, shared boot scheduler,
 single software image across 100% of population, no diverse channel.

The AND under G1 is the whole design defect in two boxes. The race is B1. Every complex boot sequence has candidate B1s. What makes B1 a recall is B2 — nothing was watching the sequence at the moment the sequence went wrong.

Initialization timing budget, as it should have been written

| Interval | Definition | Value I would specify | Status in the field product | | --- | --- | --- | --- | | T_POR to monitor armed | Power-on reset to program sequence monitor active | 50 ms max | Not specified | | FDTI_init | Monitor armed to detection of non-completion of initialization | 1,200 ms max | Undefined — no detector | | FRTI_init | Detection to degraded telltale mode active and Meter Degraded asserted on the bus | 300 ms max | No degraded mode exists | | FTTI (MF-01) | Power-on to first driver demand for turn signal | 3,000 ms typical worst case (driveway pull-out) | Budget never allocated |

Three seconds is a generous FTTI, and the budget still closes with room to spare. This was affordable. It just was not requested.

4. Derived requirements (excerpt)

FSR-CM-001 (ASIL B). Turn signal and hazard warning lamp actuation shall remain available independently of the combination meter application processor. Loss, reset, or failure to initialize of the combination meter shall not change lamp actuation behaviour. Verification: fault injection at the meter power and reset pins across all lamp operating modes.

TSR-CM-011 (ASIL B). A program sequence monitor shall verify that each initialization stage of the combination meter completes in a declared order, and shall be armed no later than 50 ms after power-on reset, before any application-layer initialization task is dispatched. Verification: instrumented boot trace, 100% stage coverage.

TSR-CM-012 (ASIL B). If the combination meter has not asserted RENDER_READY within 1,200 ms of power-on reset, it shall enter Degraded Telltale Mode within a further 300 ms: render the FMVSS 101 red-group telltales from a statically linked fallback image independent of the graphics stack, and assert MeterDegraded = 1 on the vehicle bus. FDTI 1,200 ms, FRTI 300 ms, both inside the 3,000 ms FTTI of MF-01.

TSR-CM-013 (ASIL B). Turn signal stalk state and hazard switch state shall be routed to the lamp drivers over a path that does not traverse the combination meter's application RTOS scheduler. The meter's role in this function shall be restricted to telltale annunciation only.

TSR-CM-014 (ASIL A). Seat belt reminder and key-left audible warnings shall be generated by the body control module. Absence of a valid combination meter heartbeat for more than 500 ms shall cause the body control module to assume full reminder duty, including the audible path, without operator action.

VER-CM-021 (ASIL B). Initialization verification shall include not fewer than 100,000 power-on cycles at complete-vehicle level, across the specified supply-voltage and ambient-temperature envelope, with randomized inter-ECU wake offsets spanning 0 to 200 ms. Bench-level power cycling with deterministic wake timing shall not be accepted as evidence of freedom from initialization races.

That last one is written directly against the record. Bench power cycling ran from April 2026 and produced nothing; the vehicle produced it in weeks. If your test rig removes the jitter, your test rig removes the defect.

5. What the headline really tells us

The headline is "Toyota recalls half a million Camrys over a software glitch," and every word of that is true and none of it is useful. There was no glitch in the sense of a bug that a code review would have caught by reading harder. Two tasks that were each individually correct ran in an order the designer had not enumerated, on maybe a fraction of a percent of startups, in a window that a deterministic bench rig cannot reach.

What is missing is not better code. What is missing is a written expectation about a state the system passes through on every single trip and that nobody treated as a state at all. Between power-on reset and the first rendered frame, this vehicle has no telltales, no turn signals, no hazard flashers, and no way to tell you about it — and that is by design, for a few hundred milliseconds, every time. The design intent was that the window closes. The requirement that the window closes, the monitor that checks whether it closed, and the behaviour when it does not close were never written down.

Four Federal Motor Vehicle Safety Standards were breached by one unbounded interleaving. Not because the interleaving was catastrophic, but because so many legally mandated functions had been quietly hung off a graphics processor that when it stumbled, it took the lamps and the chimes with it. The cluster grew into a body controller without anyone updating the item definition, and an FFI argument written for steady state does not cover a component that is not yet in steady state.

The fault tree that names this mechanism already exists. Toyota drew it in June 2024, for a different meter, from a different supplier. It was correct then. The failure was not analytical. It was that a finding stayed a finding instead of becoming a requirement, and a requirement is the only artifact that travels.

Sources

— Jherrod Thomas, The Lion of Functional Safety™