The launch slipped twice. The first fix never held.

Here is an uncomfortable observation about the twice-moved Highlander EV launch: almost nobody in the coverage is using the word that matters. Recurrence. Toyota slipped the date once, whatever lay behind it was declared fixed, and the failure has come back at programme scale – strongly enough that Toyota spent this week denying the uglier rumour of a slip into 2027. The press reaches for the usual shelf: strategy, battery supply, programme management. I have sat on the plant side of launch boards in automotive and aerospace for two decades, and a repeat failure after a declared fix has one name in my vocabulary: an unverified corrective action. Everything else is commentary.

The press reads strategy, a practitioner reads recurrence

Recurrence is a quality term, not a planning term. AS9100 clause 10.2 requires a review of the effectiveness of every corrective action before it is closed – the measured effect, not the intention behind it. IATF 16949 goes further for series production: a repeated nonconformity triggers mandatory escalation, documented problem-solving, an updated PFMEA and control plan. Both frameworks treat a returning failure as evidence that the original investigation stopped short.

A launch date that moves twice deserves the same reading. Instead, the re-baselined schedule gets filed under programme timing and an ineffective fix is laundered into a planning artefact. The failure did not change. The paperwork that absorbs it did. The aerospace side of my career drilled the habit in: you close a nonconformance on objective evidence, never on intent. Automotive taught me how rarely that happens under launch pressure.

A nonconformance that returns was never closed – it was only quiet.

How a countermeasure quietly dies

Countermeasures rarely fail loudly. Three failure modes cover most of them:

• The five whys stopped at the comfortable answer. The chain of causes ends where nobody has to redesign anything. The fifth why is where investigations go to be comfortable.
• The fix addressed detection, not occurrence. Added inspection, added containment, a new end-of-line gauge – all of it catches the failure more often while the mechanism that produces it sits untouched, waiting.
• The verification window was one green week. A countermeasure is pronounced effective after days of clean data, when the failure needed a cold Monday, a fresh supplier lot or a full seasonal cycle to reappear.

I lived all three at once at WITTE Automotive. A door-latch module threw a signal fault: a microswitch reporting closed when it was not. QRQC closed it in 72 hours – root cause declared as a contaminated reel of switches at the supplier, containment, 100% incoming checks, a supplier 8D, the Q-Wall back to green, closure, handshakes. Four weeks later the identical fault returned. Different production week, different reel, same customer. The second A3, written with engineering rather than against a deadline, found the real mechanism: a tolerance stack between the actuator lever and the switch plunger at the low end of the temperature spec. The switch was actuating late. Contamination had genuinely caused the first spike; it was a contributing factor, not the cause. The return cost us three days of full containment, roughly €30,000 in premium freight and re-inspection, and the same customer response written twice. The failure-cost reductions we later banked at that plant came largely from never again letting a first closure pass unchallenged.

What closure looks like at programme scale

At vehicle-programme scale, the same logic multiplied by tooling. Closure before a date is re-issued means three tests. Run-at-rate at true takt and true mix – not a demonstration line with hand-picked parts and hand-picked people, but production volume, sequence variability, real supplier lots, real shift patterns. Requalification of everything the fix touched: re-PPAP on process parameters, tooling, software states, supplier sub-lots, with the PFMEA and control plan updated to show why the failure mode is now owned. And a quality sign-off that precedes the schedule decision instead of trailing it in the appendices. If the date is re-issued before that evidence exists, you have not re-planned the launch. You have re-opened the nonconformance and called it a milestone.

When I built the QA/QC function for a 900-plus-employee greenfield plant at SNOP, the discipline that held the ramp was unglamorous: no nonconformance closed without a written effectiveness check, at defined volume, over a defined window. That plant recorded zero critical customer escalations in its first ramp quarter and took 70% out of defect cost – not through brilliance, but through a refusal to pay twice for the same lesson. Because you do pay twice: once in containment, sorting, premium freight and retest, and once in credibility, which appears on no cost sheet until the customer starts dual-sourcing you.

Toyota still deserves the credit that matters here: delaying a launch is cheaper than shipping junk into customers' driveways, and several competitors in this market have chosen otherwise. But do not let the Gantt chart do the talking. A date that moves twice is an ineffective corrective action wearing programme-management clothes, and the only question worth asking of the first slip is the one nobody asks: what evidence closed it.