The Engineer’s Lament

To the public, a car either is or isn’t faulty. To an engineer, imperfections and compromises are inescapable.

In the early nineteen-seventies, Denny Gioia worked in the recall office of the Ford Motor Company. His job was to read field reports from the engineers Ford had posted around the country. If a safety problem was spotted, the Ford representative in that district would write up the case on a standardized form—single sheet, two sides, sometimes with a photograph stapled to the page—and send it on to Detroit.

Gioia looked for patterns. “You have to be able to identify something that’s cracking,” he said not long ago. “Otherwise, I’ve got an imaginary event. I attempt not to engage in magical thinking. I’ve also got to have a pattern of failures. Idiosyncrasies won’t do. Question is, do you have enough here indicating that these failures are not just one-off events?” He was looking for what he called “traceable cause.”

From the case reports that came in, Gioia built files, hundreds of them. He posted updates on a large bulletin board listing all the recalls that Ford had open at the time. Once a week, he would drive to the “chamber of horrors”—a yam-sized depot a few miles from Ford’s headquarters, where all the problematic parts and vehicles were sent. His responsibility was to put cases on the “docket,” the slate of potential recalls. There were five people in the office. They would go through every case on the docket and vote on whether to send it to the executive committee.

“I was youthful, I was relatively low pay grade, but it was an extraordinarily powerful position, in the sense of being able to influence people to do things,” Gioia said. “If I picked up the phone and said, ‘This is Gioia from recall office,’ people hopped. I’m a twenty-six-year-old stud having people drop everything to react to my requests.”

Gioia is a car fellow. His everyday drive is a two thousand thirteen Porsche nine hundred eleven S, and his weekend rail is a crimson one thousand nine hundred seventy nine Ferrari three hundred eight GTS—the kind with an engine that can rattle windows. His very first job was with Boeing’s aerospace division at Cape Kennedy, where he was part of the team that made sure the arms on the scaffolding that held the Apollo eleven and the Apollo twelve in place before liftoff retracted at precisely the right moment—because terrible things would happen if they didn’t. Gioia is capable and direct and intelligent, with the effortless self-confidence of someone who has mastered mechanical things. The walls of his office are covered with pictures of Ferraris and memorabilia from NASA and the slide rule he used on the Apollo projects. He grew up in rural Pennsylvania and Florida: working-class parents, state schools all the way for engineering, and then business school. He was beloved at Ford. When he was recruited, someone in H.R. wrote “Crown Prince” across his file.

“One of the cases I inherited when I got the job had to do with speed-control devices,” Gioia recalled. At the time, they were regulated by a vacuum valve, which was failing in two of Ford’s most expensive cars, the Lincoln Mark IV and the Thunderbird. “The Thunderbird is a behemoth,” Gioia said. “It’s got a four-hundred-and-sixty-cubic-inch engine suspending out at the front. I mean, the fetish mask is almost as long as the rest of the car. And nothing you could do from inwards the car could slow it down. You’re supposed to be able to hit the brake and shut it off. Nope, won’t do it. Hit the switch. No, it won’t shut off. This thing is in the accel mode. It weighs forty-five hundred pounds—it’s almost a light truck. It’s driven by little old ladies from Pasadena and it’s on its way to a hundred miles an hour.

“The advice we got from the engineers was ‘Just tell the drivers to turn the ignition off.’ Well, then there’s no vacuum assist on the power brakes. Steering turns strenuous. Ain’t nothing going on. So what would you rather have—somebody who can’t steer the car or stop the car or somebody who’s on his way to a hundred miles an hour? That’s a problem that’s going to kill someone.”

The T-bird case was straightforward: clear traceable cause, visible pattern of failure. Often, however, the troubles were more difficult to locate. Gioia could get twenty to twenty-five reports a day. The rhythm was unrelenting. Everything was a crisis. When he began, he was told, “We only have time to put out the big fires and piss on the little ones.” He said, “I had to become aware that you can’t attend to everything. You have to prioritize the most dangerous problems. Then you have to figure out when to pull the trigger. When do I actually have enough information that says it goes on the docket? Then how do I have enough information to make a compelling case to persuade an executive panel that they indeed should spend thirty million dollars on a recall?”

Several times, Gioia used the present tense in describing his time at Ford, even however it had been decades since he’d worked there. Eventually, he caught himself: “You hear how I’ m talking now? I get pitched back in time. I haven’t been there for forty years. But I still speak in the ‘we’ when I’m talking about these events.”

By “these events,” he was referring to one case in particular. It very first came to his notice in 1973, when he got a field report on one of Ford’s top-selling cars, a compact called the Pinto. The Pinto went on to spawn a series of devastating lawsuits, a federal investigation, a “60 Minutes” exposé, and a recall of 1.Five million vehicles, culminating in the indictment of the Ford Motor Company—the entire company—for reckless homicide in the deaths of three teen-age ladies. (Total disclosure: In 2011, I gave a talk at a marketing conference sponsored by Ford.) Honda’s current crisis over defective air bags, General Motors’ multibillion-dollar ignition-switch recall last year, and Toyota’s sudden-acceleration problems in two thousand nine and two thousand ten all go after the template created by the Pinto case forty years ago. A car company knows about a problem, and doesn’t fix it—why not? Denny Gioia has spent the better part of a lifetime thinking about this question. Sometimes there was a picture on the field reports that came across Gioia’s desk. The Pinto case had numerous photographs, stapled front and back. Gioia remembers everything about that very first moment. “Oh, God,” he says, “like it was yesterday.”

There is an old joke about an engineer, a priest, and a doctor loving a round of golf. Ahead of them is a group playing so leisurely and inexpertly that in frustration the three ask the greenkeeper for an explanation. “That’s a group of blind firefighters,” they are told. “They lost their look saving our clubhouse last year, so we let them play for free.”

The priest says, “I will say a prayer for them tonight.”

The doctor says, “Let me ask my ophthalmologist colleagues if anything can be done for them.”

And the engineer says, “Why can’t they play at night?”

The greenkeeper explains the behavior of the firefighters. The priest empathizes; the doctor offers care. All three address the social context of the situation: the fact that the firefighters’ disability has inadvertently created conflict on the golf course. Only the engineer attempts to solve the problem.

Almost all engineering jokes—and there are many—are versions of this belief: that the habits of mind formed by the profession enable engineers to see things differently from the rest of us. “A pessimist sees the glass as half empty. An optimist sees the glass as half total. The engineer sees the glass as twice the size it needs to be.” To the others, the glass is a metaphor. Nonsense, the engineer says. The specifications are off. He doesn’t give free rein to temperament; he assesses the object. These jokes, like many of the jokes people tell about themselves, are grievances. The engineer doesn’t understand why the rest of us can’t make sense of the world the way he does.

Toyota’s safety crisis was, in a sense, a version of the golf-course conundrum. One of the problems facing the company was “sticky” accelerator pedals: drivers would take their foot off the accelerator, and in a petite number of cases the pedal wouldn’t spring back up instantaneously. After four cases in Europe were brought to Toyota’s attention, the company determined that under conditions of high warmth or humidity the synthetic material used in part of the pedal mechanism was degrading slightly.

Toyota’s engineers approached the problem armed with the two concepts that define the engineer’s world: tolerances and specifications. A system’s tolerance is its capability to cope with switches and unplanned variation; systems need to be tolerant because you can never flawlessly predict what stresses and unexpected behaviors they will encounter. Specifications are constraints. No one tells you to build a ideal car. People tell you to build a car in eighteen months that will sell for twenty-five thousand dollars. The fact that a car is exposed to be imperfect, in other words, is not sufficient reason to recall it: imperfections and compromises are unpreventable. The issue is how tolerant the car is of those imperfections and compromises.

The University of Michigan engineering professor Jeffrey Liker (writing with Timothy N. Ogden) describes what happened next in the book “Toyota Under Fire” (2011):

The primary concern was determining if the gooey pedals affected the capability of drivers to stop their vehicles. This question is the hidden factor around which much of the subsequent controversy revolved: if the goopy pedals kept drivers from stopping or materially enhanced the amount of time required to bring a car to a halt, then the goopy pedals were clearly a safety defect and required instant corrective act. If, on the other mitt, braking spectacle was unaffected by the gooey pedals, then, the engineers felt, the pedals were not a safety defect but a customer-satisfaction and component-reliability issue.

What did Toyota’s engineers find? When the pedal stuck, it made no difference in how quickly the car could be brought to a stop: the brakes were powerful enough to override the problem if applied with sufficient force. Then they looked at the federal accident database, and learned that no crash had been credited to a gooey accelerator pedal. The system was, to their mind, adequately tolerant of imperfection. They determined against an instant recall, choosing instead to redesign the part and introduce it in fresh model lines. Their solution was not empathy or care. It was play at night.

The public witnessed things very differently. They didn’t think about the necessary compromises inherent in the design process. They didn’t understand that a car was engineered to be tolerant of things like gooey pedals. They looked at the part in isolation, spotted that it did not work as they expected it to work—and foresaw the worst. What if an inexperienced driver found his car behaving unexpectedly and panicked? To the engineer, a car sits somewhere on the gradient of acceptability. To the public, a car’s status is binary: it is either violated or working, flawed or functional.

In the wake of the sticky-pedal problem, customers embarked complaining that Toyotas were prone to unexpected, unintended acceleration. “Whenever someone called in to say, ‘I’ve had an gig of unintended acceleration,’ Toyota would dispatch a team of engineers,” said Roger Martin, a former dean of the University of Toronto’s Rotman School of Management and a member of the advisory panel that Toyota put together during the crisis. “And they would do a thorough examination of the car and pronounce it fine—because it always was—and assure the holder that everything was going to be fine. They were most likely just pressing the accelerator when they thought they were pressing the brake. There wasn’t a problem. Just be more careful next time. And they got more and more complaints.”

The engineers were right. A series of exhaustive investigations by federal regulators, with help from NASA engineers, established that the perception of an electronic failure was almost certainly illusory. The problem was caused either by the fact that some people put in poorly fitted, nonstandard floor mats or by the fact that drivers were pressing the accelerator thinking that it was the brake. (Pedal error, as it is known, is a well-documented source of vehicle malfunction, affecting drivers of many makes and models.) Cars are engineered to be tolerant of pedal error: the driver who depresses the accelerator, thinking it’s the brake, still has the option of simply putting the car in neutral or turning it off. (That’s one of the reasons that cars have gearshifts and ignition switches.) But in the public mind a car that accelerated unexpectedly was violated . The teams of engineers that Toyota sent out didn’t make the problem better. They made it worse.

“The Toyota boy explained this to the panel,” Martin went on. “He said, ‘Here’s our process.’ So I said to him, ‘What do you imagine the people are thinking? They’re wiggling like a leaf at the side of the road and after that entire practice they are told, “The car’s fine. Chill out. Don’t make mistakes anymore.” Of course they are not going to be blessed. These people are funked. What if instead you sent people out who could be genuinely empathetic? What if you said, “We’re sorry this happened. What we’re worried about is your convenience and your confidence and your safety. We’re going to check your car. If you’re just startled of this car, we’ll take it back and give you another, because your feeling of confidence matters more than anything else.” ’ It was a sort of revelation. He wasn’t a dumb stud. He was an engineer. He only thought about doing things from an engineer’s standpoint. They switched what those teams did, and they commenced getting love letters from people.”

It is hard to find an auto-safety controversy that does not divide along these lines. Last year, Tim Murphy, the chairman of the House Subcommittee on Oversight and Investigations, opened the very first of two congressional hearings on the Chevrolet Cobalt ignition-switch recall by telling, “Today we will ask G.M. and N.H.T.S.A. what they are doing, not just to fix the car but to fix a culture within a business and a government regulator that led to these problems.” Murphy was taking the public view. Since the Cobalt was violated, the fact that the National Highway Traffic Safety Administration did not order it recalled in a timely style represented a moral failure. “This is about restoring public trust,” he went on, “and providing the families and crash victims the truth about whether this tragedy could have been prevented and if future ones will be prevented.”

Then the acting head of the N.H.T.S.A., David Friedman (whose Ph.D. thesis involves ways of mathematically modelling fuel-cell stacks), gave his testimony, and he spoke another language. In the dry, empirical vernacular of the engineer, he explained exactly why the agency had done what it did. The Cobalt in the model years 2005-2010 was tooled with an ignition switch that, under certain conditions, shut off in mid-operation, disabling the air bags and the power assistance on the steering and the brakes. Accidents involving nonfunctioning air bags are monitored as a matter of course by the N.H.T.S.A.’s Special Crash Investigation (S. C.I.) division. In 2005, when the S.C.I. very first received field reports on the Cobalt, it passed the cases on to the Early Warning Division (E.W.D.), which collected all the data it could on air-bag non-deployment (A.B.N.D.) and referred the information to the Data Analysis Division (D.A.D.), which came up with a statistical comparison of air-bag non-deployment in the Cobalt and its peers.

“The data available to N.H.T.S.A. at the time was not sufficient to warrant a formal investigation,” Friedman explained, at which point you can imagine the members of the investigative committee either rolling their eyes or falling asleep. But Friedman soldiered on. A.B.N.D. rates as calculated by the D.A.D., with an assist from the E.W.D. and the S.C.I., can be obtained for every compact car sold in the United States in the early two-thousands, and then ranked in order of how frequently a model’s air bags failed to deploy in an accident. The average for the group is 1.22 non-deployments per hundred thousand kilometres driven. The worst offenders were the two thousand five Toyota Echo (Three.9 A.B.N.D.), the two thousand three Kia Optima (Trio.79), and the two thousand four Hyundai Accent (Trio.15). The two thousand six Cobalt is right in the middle of the pack, and the two thousand five Cobalt is just slightly worse than the average.

The underlying data set that Friedman’s charts drew from is a blizzard of numbers that would take up half a column on this page. But, if you take the time to sift through them, it is clear that Friedman gave a rigorous reaction to the question of why it took so long for G.M. and federal regulators to see that the Cobalt had a problem. It took so long because for the longest time there was little evidence to suggest that Cobalts had a problem. They were just somewhere in the middle of the gradient inbetween unacceptable and high-performing. “All the brilliant engineers and workers in the world won’t matter if the people don’t indeed care,” Murphy told the assembled witnesses, in his opening statement. “As the old telling goes, ‘People don’t care that you know until they know that you care.’ ” He meant: If all you do is give me numbers, I can’t understand you. Friedman, in providing him numbers, had effectively responded: If I don’t give you numbers, how do we know what to care about?

In this exchange, none of the categories that we typically use to account for belief and behavior are particularly helpful in making sense of their differences. Identity politics—the good explanatory growth engine of our time—focusses on gender and ethnicity. But the fact that these are two middle-aged white fellows tells us nothing. Murphy is a Republican and Friedman was appointed by a Democrat. But this doesn’t help, either. Their disagreement isn’t political. It’s professional. Murphy holds a Ph.D. in psychology (and proceeds to see patients); Friedman is pursuing one in engineering. Their perspectives turn on a category—profession—that we have shoved to the bottom of the pile. Surely this is why Jimmy Carter remains the most puzzling American President in latest times. We have too often insisted on attempting to understand him using the default modes of identity politics: as a white, Southern born-again Christian. But Carter was by profession and training an engineer—a disciple of the greatest and most influential engineer in the history of the U.S. Navy, Admiral Hyman Rickover. Rickover, Carter once said, had more influence on him than anyone except his parents. In his literalness, his relentless candor, his practicality, Carter was the Toyota engineer by the side of the road doggedly lecturing us on how to drive the car. Carter’s true nature is puzzling only if we remain rooted in the fantasy that the world we inherit somehow matters more than the world that we chose for ourselves—and that surrounds us, from nine to five, every working day of our adult lives.

“I’m a child of the sixties,” Gioia said, on this point. “I was an active member of the protest movement against the war in Vietnam and, curiously, the behavior of corporate America. I’m one of those guys who faced off with the bayonets as a result of the Kent State thing. During my M.B.A. program, in my classes, I was the voice for social activism. I got the reputation as the bleeding-heart liberal in the room, and that was the reputation I carried with me to Ford.”

Gioia says he went to Ford with the idea that he would “fight them from the inwards,” but sooner or later, inevitably, the world that surrounds us, all the working day, takes precedence. “Here’s the fellow that went in with a strong value system, with intent and purpose, and got flipped within the space of two years,” he went on. “If it could happen to me, it could happen to anybody.”

He joined Ford in 1972, and by 1974, when concerns about the Pinto began to emerge, he was thinking differently. He had become an automotive engineer. Reflecting on his own switches, he was put in mind of Ariel Sharon: “When he was asked later in his career why he was making all these concessions to the Palestinians now that he’s in the Israeli government, he simply said, ‘It looks different from here.’ I guess it looked different from there.”

On the afternoon of August Ten, 1978, just outside Elkhart, Indiana, three teen-age damsels stopped for gas on their way to a volleyball game. The driver was Judy Ulrich. Her cousin Donna and her junior sister Lyn were passengers. They were in a one thousand nine hundred seventy three Pinto. At the gas station, as Lee Patrick Strobel recounts in his book “Reckless Homicide?,” a history of the Ulrich trial, the women accidentally left the gas cap on the roof of the car, and after a mile or so it slipped off and flipped across the road. Judy slowed down. There was a high curb along the side of the highway, so pulling off the road was unlikely. She put on her emergency flashers. Coming down the road behind them was a van driven by a twenty-one-year-old man named Robert Duggar. He had two half-empty bottles of Budweiser next to him (albeit he wasn’t under the influence), and he took his eyes off the road for a moment as he reached for a cigarette. When he looked up, the Pinto was ten feet in front of him. He could not stop in time. The Pinto exploded in flames. Shards of glass scattered in every direction. The car spun around and around, stopping a hundred and fifty feet from the point of influence. The fire reached almost thirteen hundred degrees, melting the sunglasses around Lyn’s eyes. Lyn and Donna were killed instantly. Judy Ulrich lay in the grass with burns over ninety-five per cent of her bod, howling out, “Help me. Please, help me.” She died eight hours later.

The Ulrich crash is what led to Ford’s being charged with homicide. It is also very similar to the Pinto case that had come across Denny Gioia’s desk five years earlier: a rear collision, leading to a fire. In Gioia’s case, however, the kinds of detail that made the Ulrich case so emotionally compelling—the three ladies, the volleyball game, the melting sunglasses, Judy Ulrich’s sob for help—were absent. He had a typed double-sided sheet, with photographs. That’s what a recall officer sees. It would come in the morning mail with a pile of other case reports, not as the subject of a “60 Minutes” exposé or a sensational front-page story. He would see that people had died. But a death to him does not register the same way as a death does to us. The recall officer goes to the chamber of horrors every week. He looks at car crashes for a living. “People dying was a normal part of the job,” Gioia said. “It truly affected me when I very first embarked. I had a hell of a time getting used to what was required, because the very first thing that gets you going is always an awareness that someone has been grievously injured or killed in one of your products. And the only thing I’ll say to you is You’ve got to get over that. If you want to let emotion drive the recall coördinator’s job, you ain’t going to be a very good recall coördinator. You have to accept that, if you’re a manufacturer who’s building a product like a vehicle, people are going to get killed.”

So imagine the case in the recall officer’s stripped-down version. The relevant question is not who died. He’s not dwelling on the tragedy of three teen-age damsels. His question is: Why did they die? The prosecutor in the Ulrich trial, Michael Cosentino, said that Ford was to blame. Why didn’t blame reside with the municipality, which built a highway with a curb that made it unlikely for anyone to pull over securely? Or with Robert Duggar, who casually reached for a cigarette and took his eye off the road?

Cosentino’s response was that he had traceable cause. As Strobel recounts, Cosentino argued in his opening statement that there was something inherent in the Pinto’s design that “invited fire in the event of normal highway collisions.” This allegation was made repeatedly in the many lawsuits involving the Pinto. The Pinto’s gas tank sat behind its rear axle—instead of above it—and was separated from the back bumper by only a few inches of “crush space.” In a rear collision, the tank would be slammed against exposed studs on the axle, punching fuckholes in the tank, tearing out the fuel-filler neck, and spilling gas into the passenger cabin. If any part of the metal scraping on metal or metal scraping on pavement that is typical in a crash produced a spark, the car would explode into a fireball. A few months before the Ulrich crash, the N.H.T.S.A. released the results of an investigation into the Pinto’s safety record, detailing thirty-eight instances in which a Pinto had been struck from behind and burst into flames. Under pressure from the N.H.T.S.A., Ford eventually agreed to install a plastic protective “flak jacket” inbetween the gas tank and the axle. The Ulrich crash was in August of 1978. The recall was supposed to embark that fall. Hence the trial, and the pressing question: Why did Ford wait until one thousand nine hundred seventy eight to fix the gas tank of a car that very first came out in 1970?

But does a rear-positioned gas tank qualify as traceable cause? Traceable cause suggests a deviation from the norm. It turns out, however, that most compacts of that era had fuel tanks behind the rear axle. A former head of the N.H.T.S.A. testified on Ford’s behalf, stating that in his opinion the Pinto’s design was no more or less safe than that of any other car in its class, like the Chevrolet Vega or the A.M.C. Gremlin. Under cross-examination, one of the chief witnesses for the prosecution—an automobile-safety consultant named Byron Bloch—conceded the point. In “Reckless Homicide?,” Strobel writes:

Bloch agreed that the American Motors Gremlin, Chevrolet Vega, and Dodge Colt had their gas tanks behind the axle; that those cars had essentially the same bumpers (“I would say that they were all bad,” Bloch said); that the Vega had no figure rails at all; that all four cars had somewhat similar distances from the tank to the rear bumper; that all of them had at least some acute objects near the tank; and that the thickness of the gas tank metal on the Pinto was in the upper one-third of other one thousand nine hundred seventy three (era) cars.

Here are the deaths per million vehicles for one thousand nine hundred seventy five and one thousand nine hundred seventy six for the best-selling compact cars of that era, compiled by Gary T. Schwartz in his landmark law-review article “The Myth of the Ford Pinto Case”:>

Suppose we concentrate just on the subset of accidents involving a fire. That’s a infrequent event—it happens once in every hundred crashes. In 1975-76, 1.9 per cent of all cars on the road were Pintos, and Pintos were involved in 1.9 per cent of all fatal fires. Let’s attempt again. About fifteen per cent of fatal fires resulted from rear collisions. If we look just at that subset of the subset, Schwartz shows, we ultimately see a pattern. Pintos were involved in Four.1 per cent of all rear-collision fire fatalities—which is to say that they may have been as safe as or safer than other cars in most respects but less safe in this one.

Later, after Gioia’s initial brush with the Pinto, he recalled finding out about internal Ford tests demonstrating that the fuel tank of the Pinto would rupture in rear crashes involving speeds as low as twenty-five miles per hour. The corresponding figure for its competitors, like the Vega, was closer to twenty-seven or twenty-eight miles per hour, he said. The disparity was pointed out by Cosentino at the Ulrich trial. Ford knowingly sold a car that performed worse than its competitors in the most horrifying of scenarios—a fire from a rear collision. He was thinking speculatively and symbolically. What’s the worst that could happen? And what does that fact say about the company’s motivations?

Yet, from an engineer’s standpoint, the same information is much more ambiguous. Every car on the road is different—safer in some ways and less safe in others. So does the one area where the Pinto is worse—by two miles per hour in an infrequent subset of a uncommon kind of fatal crash—mean that the car is defective? A radically redesigned Pinto would not have saved the Ulrich damsels. In the trial, the defense successfully argued that Duggar was driving at close to fifty miles per hour, and nothing brief of a Sherman tank could have survived the influence of a four-thousand-pound van at total speed.

Around this time, the N.H.T.S.A. passed a revised version of what’s called the three hundred one rule, which stated that the fuel systems of passenger cars had to be safe from rupture in collisions of thirty miles per hour. The N.H.T.S.A. determined to fix the problem of the Pinto’s gas tank through regulation. But when the N.H.T.S.A. went back in one thousand nine hundred ninety and analyzed the effect of the fresh regulation, it concluded that “fatalities were not affected.” The difference inbetween twenty-five and thirty miles per hour, or inbetween 27.Five and thirty, was too petite to pick up, or maybe it didn’t exist at all, or maybe the problem all along was rear collisions at fifty or sixty miles per hour. Fatalities were not affected. We are back to where Friedman was with the air-bag non-deployment rates of the Cobalt. Was the car violated? Or was it just somewhere on the gradient inbetween unacceptable and high-performing?

In the nineteen-nineties, the sociologists Matthew Lee and M. David Ermann interviewed the key engineers who had worked on the Pinto, and even then—two decades after the controversy—they were resolute. “They didn’t see the fuel-tank issue as the central problem, and they didn’t see the fix that was implemented as the result of the recall as doing anything worthwhile,” Lee said recently. “In their view, the flak jacket was pretty much futile.” They had seen the data. They had looked at the record of events like the Ulrich crash, and the one thousand nine hundred ninety N.H.T.S.A. Three hundred one report. They concluded that we would be better off focussing on other things. Lee went on, “They would say things like ‘The gas tank was problematic, as it was for all the other petite cars and as it still is today for many petite cars.’ Then they would say, ‘But the real issue is this’—and they would go off on a sultry discussion of safety glass.”

You and I would feel safer in a car that met the three hundred one standard. But the engineer, whose aim is to maximize safety within a series of material constraints, cannot be dissipated by how you and I feel. If you are busy empathizing with blind firefighters—if your purpose is to treat them with the same consideration you would sighted golfers—how do you get them to consider that everyone might be better off if they played at night? The grievance at the heart of that joke is that we wrongly think of the engineers’ attitude as callous, when to their mind, in their concentrate on identifying the real problem, they are the opposite of callous.

At one point, Gioia began to tell the story of the time his team got word of a problem at Ford’s big-truck plant in Kentucky. A batch of wheel hubs was defective: clear traceable cause, evident pattern of failure. “They had identified twelve highway tractors, the big ones, where they knew the front hubs were going to break,” he said. “Not if, when . And so we dropped everything. We had to find those trucks. We’re talking about a big truck at highway speeds. The momentum on a mighty vehicle will literally knock down a house. We stayed up for several days until we found them all. One was in Alaska. Another was on a boat to Hawaii.”

He went on, “So many people, especially the people writing about G.M. right now, are telling, ‘It’s a collection of bad actors, and they have inured themselves to their responsibilities.’ But I think it’s significant to say that, at least in the recall office where I worked, it was not populated by a collection of ogres. They were people that cared.”

That is, these were people who cared about the problems they thought were problems . The entire time that Gioia was working on the Pinto case, he drove a Pinto. “Look, the facts of the matter are that in normal use this car is ideally fine,” he said, shrugging. Later, he sold his Pinto to his sister, for six hundred dollars. At the time, the Pinto was being attempted in court for the murder of three teen-age ladies. But it should be remembered that, in the end, Ford won the Ulrich case. The engineers got the chance to present their evidence, and their testimony carried the day.

Last August, the traffic-safety experienced Leonard Evans published a paper in the American Journal of Public Health . In the early nineteen-seventies, Evans wrote, the United States was often said to have the safest roads in the world, and since then traffic fatalities in the U.S. have declined by forty-one per cent. That sounds like an incredible number. But then Evans pointed out that, in the same period, traffic deaths in the Netherlands, for example, declined at twice that rate. The United States, once No. One in the world in safety, has fallen to nineteenth place. If American highway deaths had followed the European pattern, Evans concluded, twenty thousand lives would have been saved in two thousand eleven alone.

Evans is a physicist and a member of the National Academy of Engineering, who worked for years for General Motors, and you get a clear sense of what he would like to see: the causes of traffic fatalities ranked in order of significance, and a safety campaign organized accordingly. Excessive speed, for example, is implicated in an terrific number of fatal crashes. Traffic enforcement cameras—“speed cameras”—have been shown, conclusively, to reduce road fatalities. Western European countries have been aggressive in adopting speed cameras, which is one of the main reasons that their road deaths have fallen so dramatically. The United States has not. Even plain police enforcement of the speed limit, in some states, has been lacking. A few years ago, the economists Gregory DeAngelo and Benjamin Hansen wrote a paper looking at road deaths and injuries in the state of Oregon, which—in part because of a “tax revolt”—has cut the size of its highway patrol repeatedly since the end of the nineteen-seventies. “We find that Oregon would have experienced Two,302 fewer fatalities from 1979-2005 if the number of state police had been maintained at their one thousand nine hundred seventy nine levels,” the two concluded.

There is also a clear, demonstrated relationship inbetween the cost of alcohol and the number of drunk-driving deaths. Research has shown that raising social awareness around buzzed driving—as groups like Mothers Against Toasted Driving have done—is not enough. In most Western European countries, the sales tax on alcohol ranges inbetween sixteen and twenty-five per cent. In the United States, it is somewhere inbetween one-half and a third of the European rate—and because the federal excise is a plane amount (not a percentage of the sales price) it falls every year with inflation.

“There are enormously negative outcomes that are responsive to the price of alcohol, like highway fatalities,” the economist Philip J. Cook, who has written extensively on the subject, says. “I estimated that the tax increase associated with the one thousand nine hundred ninety one excise tax saved sixty-five hundred lives the very first year from trauma-related accidents of various kinds. It was an extraordinarily effective measure from the public-safety perspective. What is distressing to me is that it has been permitted to erode. And there is a large segment in Congress seeking to repeal the one thousand nine hundred ninety one increase entirely.”

In the United States, issues like taxes or speed cameras tend to be framed in political terms—as matters of individual liberty or economic freedom. But Evans’s point is that we have overlooked the fact that these issues are essentially about public safety. Would the people of Oregon have voted so overwhelmingly in favor of an anti-tax ballot measure if they had realized that they were condemning thousands of their fellow-citizens to death?

The number of deaths associated with drinking and speeding obviously dwarfs the number associated with the kind of auto-safety controversies that grab our attention. The N.H.T.S.A.’s conclusion was that, in the very first seven years that the Pinto and its later companion model the Bobcat were on the road, two dozen of their occupants were killed by fires from rear collisions. The number of deaths linked to the Toyota sudden-acceleration complaints was about the same. The deaths associated with G.M.’s ignition-switch malfunction have so far totalled around fifty. More people died in an average year in Oregon as a result of too few traffic police than died in all three of those controversies combined. And those are just the fatalities that resulted from a single variation in one factor in one puny state in one twenty-five-year period.

The other visible fact is that the variables that indeed matter have to do with the driver, not the car. The public treatment to auto safety is preoccupied with what might go wrong mechanically with the vehicles we drive. But the chief factor is not what we drive; it is how we drive. Richard Schmidt, who is perhaps the world’s leading accomplished on pedal error, says that the Toyota sudden-acceleration controversy ought to have triggered a national discussion about safer driving. He argues for overturning the deeply held—and, in his view, irrational—proscription against two-foot driving. If drivers used one foot for the accelerator and the other foot for the brake, he says, they would be far less likely to mistake one pedal for the other. Accidents could be prevented; lives could be saved. But in order to talk about solving the pedal-error problem you have to accept the fact that, when it comes to saving lives, things like the number of police on the road, and the price of alcohol, and the technics we use to drive our cars are vastly more significant than where a car’s gas tank is mounted.

“I would argue that our nation has a low tolerance for fatalities associated with airplanes,” the N.H.T.S.A.’s David Friedman told me, when we spoke late last year. “In part because of that, fatalities are very, very low from aircraft. Also in part because of that, the F.A.A. has close to fifty thousand employees—an order of magnitude more employees than we do. We have six hundred. To deal with ten thousand people who are dying from toasted driving or ten thousand dying because they didn’t wear a seat belt, or the three thousand dying from dispersed driving, or the four thousand dying because they are pedestrians or bicyclists and they are hit by a car. That’s why the Administration has been asking Congress for more resources for us. With more resources, we could save more lives. And each time the reaction from Congress has been no. Zero.”

When he said that, Friedman was fresh off another excruciating appearance before Congress, to reaction questions about the Honda air-bag recall. He didn’t belabor the point. He didn’t have to. Here he was, charged with reducing one of the greatest sources of preventable death and injury in the United States, and he was being instructed to direct the energies of his lil’, underfunded agency toward a problem so puny that it hardly showcased up in the traffic-fatality statistics. Engineers have a grievance. They think we should think more like them. They are not wrong.

The one thousand nine hundred seventy three file with the photos stapled front and back got Denny Gioia’s attention. He later went to the chamber of horrors, and he eyed the problem firsthand: a burned-out Pinto carcass. “You have to imagine what it’s like. Have you ever seen a burned-out—not a Pinto but anything ?” he said. “It’s awful. It’s just awful. Especially if you use your imagination and recall that people were in it when it turned into that state. Everything ’ s melted. All the plastic, and there’s a lot of plastic. All of the wiring. Steering wheel is warped. I mean, it starts to rust in days. It’s repulsive to see that kind of thing.”

Did he have traceable cause? He did later, when he learned about the internal test results. But all he had in the beginning was what the engineer assigned to the case said: “He told me, ‘I spent all day on this damn car. I went over it with a fine-tooth comb. Other than that, it’s a tin can.’ What does that mean? He meant that it was a two-thousand-pound car on the road with four-thousand-pound cars. It got hit. It lit up. What do you expect?” It didn’t look like a defect. It looked like ordinary physics.

Nor did Gioia see a pattern of failure. This was a uncommon subset of a uncommon subset of traffic accident. “Usually, just to put something on the docket, I’ve got to have twenty cases, pointing to a similar component that was failing,” Gioia said. “The entire time I managed the Pinto file, I never got above five.” He held out his arm, his finger and thumb separated by a sliver. “In that context of everything else that’s going on, it’s that big.”

In the meantime, he and his colleagues in the recall office were bouncing problems, attempting to figure out which ones would pass muster with the executives upstairs. “Sometimes we’d look at something and say, ‘It’s not worth putting forward, because there’s no way they’re going to recall this trivial problem,’ ” he said. “And we didn’t want to lose credibility. And, reminisce, on a private level, I’m the man who has a reputation as a bleeding-heart liberal. Gioia will vote to recall anything. So I had to rein myself in a little bit. And you can’t recall everything. You just can’t. You know? You want to recall everything that looks like it might be a problem? Guess what, you just put the company out of business.”

Related movie: