Safety Engineering

Cars are hard to engineer.  First of all, unless you are building the latest super car, you are going to be building a lot of them.  and they will last a long time.  Current cars will probably still be running for decades in some cases. Yet you are constantly fighting to keep costs as low as possible to retain competitive market share. So an engineer is constantly fighting serious compromises.

Cars are also complicated.  Probably the most complicated thing that is by and large mass produced and readily available to the consuming public.  Who, just from the sample size will have a significant number who will do things that you, as an engineer, cannot even imagine the most Darwin worthy person doing. Yet the stuff happens.  This is can make it almost impossible to decide if a problem is a one off caused by operator error or a real issue that needs to be addressed.

In the early nineteen-seventies, Denny Gioia worked in the recall office of the Ford Motor Company. His job was to read field reports from the engineers Ford had posted around the country. If a safety problem was spotted, the Ford representative in that district would write up the case on a standardized form—single sheet, two sides, sometimes with a photograph stapled to the page—and send it on to Detroit.

Gioia looked for patterns. “You have to be able to identify something that’s breaking,” he said not long ago. “Otherwise, I’ve got an imaginary event. I try not to engage in magical thinking. I’ve also got to have a pattern of failures. Idiosyncrasies won’t do. Question is, do you have enough here indicating that these failures are not just one-off events?” He was looking for what he called “traceable cause.”

From the case reports that came in, Gioia built files, hundreds of them. He posted updates on a large bulletin board listing all the recalls that Ford had open at the time. Once a week, he would drive to the “chamber of horrors”—a huge depot a few miles from Ford’s headquarters, where all the problematic parts and vehicles were sent. His responsibility was to put cases on the “docket,” the slate of potential recalls. There were five people in the office. They would go through every case on the docket and vote on whether to send it to the executive committee.

“I was young, I was relatively low pay grade, but it was an extraordinarily powerful position, in the sense of being able to influence people to do things,” Gioia said. “If I picked up the phone and said, ‘This is Gioia from recall office,’ people jumped. I’m a twenty-six-year-old guy having people drop everything to respond to my requests.”

Gioia is a car guy. His everyday drive is a 2013 Porsche 911 S, and his weekend ride is a red 1979 Ferrari 308 GTS—the kind with an engine that can rattle windows. His first job was with Boeing’s aerospace division at Cape Kennedy, where he was part of the team that made sure the arms on the scaffolding that held the Apollo 11 and the Apollo 12 in place before liftoff retracted at precisely the right moment—because terrible things would happen if they didn’t. Gioia is capable and direct and intelligent, with the easy self-confidence of someone who has mastered mechanical things. The walls of his office are covered with pictures of Ferraris and memorabilia from NASA and the slide rule he used on the Apollo projects. He grew up in rural Pennsylvania and Florida: working-class parents, state schools all the way for engineering, and then business school. He was beloved at Ford. When he was recruited, someone in H.R. wrote “Crown Prince” across his file.

“One of the cases I inherited when I got the job had to do with speed-control devices,” Gioia recalled. At the time, they were regulated by a vacuum valve, which was failing in two of Ford’s most expensive cars, the Lincoln Mark IV and the Thunderbird. “The Thunderbird is a behemoth,” Gioia said. “It’s got a four-hundred-and-sixty-cubic-inch engine hanging out at the front. I mean, the hood is almost as long as the rest of the car. And nothing you could do from inside the car could slow it down. You’re supposed to be able to hit the brake and shut it off. Nope, won’t do it. Hit the switch. No, it won’t shut off. This thing is in the accel mode. It weighs forty-five hundred pounds—it’s almost a light truck. It’s driven by little old ladies from Pasadena and it’s on its way to a hundred miles an hour.

“The advice we got from the engineers was ‘Just tell the drivers to turn the ignition off.’ Well, then there’s no vacuum assist on the power brakes. Steering turns heavy. Ain’t nothing going on. So what would you rather have—somebody who can’t steer the car or stop the car or somebody who’s on his way to a hundred miles an hour? That’s a problem that’s going to kill someone.”

The T-bird case was straightforward: clear traceable cause, obvious pattern of failure. Often, though, the troubles were more difficult to locate. Gioia could get twenty to twenty-five reports a day. The pace was unrelenting. Everything was a crisis. When he started, he was told, “We only have time to put out the big fires and piss on the little ones.” He said, “I had to become aware that you can’t attend to everything. You have to prioritize the most dangerous problems. Then you have to figure out when to pull the trigger. When do I actually have enough information that says it goes on the docket? Then how do I have enough information to make a compelling case to convince an executive panel that they really should spend thirty million dollars on a recall?”

Several times, Gioia used the present tense in describing his time at Ford, even though it had been decades since he’d worked there. Finally, he caught himself: “You hear how I’m talking now? I get pitched back in time. I haven’t been there for forty years. But I still speak in the ‘we’ when I’m talking about these events.”


By “these events,” he was referring to one case in particular. It first came to his notice in 1973, when he got a field report on one of Ford’s top-selling cars, a compact called the Pinto. The Pinto went on to spawn a series of devastating lawsuits, a federal investigation, a “60 Minutes” exposé, and a recall of 1.5 million vehicles, culminating in the indictment of the Ford Motor Company—the entire company—for reckless homicide in the deaths of three teen-age girls. (Full disclosure: In 2011, I gave a talk at a marketing conference sponsored by Ford.) Honda’s current crisis over defective air bags, General Motors’ multibillion-dollar ignition-switch recall last year, and Toyota’s sudden-acceleration problems in 2009 and 2010 all follow the template created by the Pinto case forty years ago. A car company knows about a problem, and doesn’t fix it—why not? Denny Gioia has spent the better part of a lifetime thinking about this question. Sometimes there was a picture on the field reports that came across Gioia’s desk. The Pinto case had multiple photographs, stapled front and back. Gioia remembers everything about that first moment. “Oh, God,” he says, “like it was yesterday.”…

“I’m a child of the sixties,” Gioia said, on this point. “I was an active member of the protest movement against the war in Vietnam and, curiously, the behavior of corporate America. I’m one of those guys who faced off with the bayonets as a result of the Kent State thing. During my M.B.A. program, in my classes, I was the voice for social activism. I got the reputation as the bleeding-heart liberal in the room, and that was the reputation I carried with me to Ford.”

Gioia says he went to Ford with the idea that he would “fight them from the inside,” but sooner or later, inevitably, the world that surrounds us, all the working day, takes precedence. “Here’s the guy that went in with a strong value system, with intent and purpose, and got flipped within the space of two years,” he went on. “If it could happen to me, it could happen to anybody.”

He joined Ford in 1972, and by 1974, when concerns about the Pinto began to emerge, he was thinking differently. He had become an automotive engineer. Reflecting on his own changes, he was put in mind of Ariel Sharon: “When he was asked later in his career why he was making all these concessions to the Palestinians now that he’s in the Israeli government, he simply said, ‘It looks different from here.’ I guess it looked different from there.”

On the afternoon of August 10, 1978, just outside Elkhart, Indiana, three teen-age girls stopped for gas on their way to a volleyball game. The driver was Judy Ulrich. Her cousin Donna and her younger sister Lyn were passengers. They were in a 1973 Pinto. At the gas station, as Lee Patrick Strobel recounts in his book “Reckless Homicide?,” a history of the Ulrich trial, the girls accidentally left the gas cap on the roof of the car, and after a mile or so it slipped off and rolled across the road. Judy slowed down. There was a high curb along the side of the highway, so pulling off the road was impossible. She put on her emergency flashers. Coming down the road behind them was a van driven by a twenty-one-year-old man named Robert Duggar. He had two half-empty bottles of Budweiser next to him (although he wasn’t under the influence), and he took his eyes off the road for a moment as he reached for a cigarette. When he looked up, the Pinto was ten feet in front of him. He could not stop in time. The Pinto exploded in flames. Shards of glass scattered in every direction. The car spun around and around, stopping a hundred and fifty feet from the point of impact. The fire reached almost thirteen hundred degrees, melting the sunglasses around Lyn’s eyes. Lyn and Donna were killed instantly. Judy Ulrich lay in the grass with burns over ninety-five per cent of her body, crying out, “Help me. Please, help me.” She died eight hours later.

The Ulrich crash is what led to Ford’s being charged with homicide. It is also very similar to the Pinto case that had come across Denny Gioia’s desk five years earlier: a rear collision, leading to a fire. In Gioia’s case, however, the kinds of detail that made the Ulrich case so emotionally compelling—the three girls, the volleyball game, the melting sunglasses, Judy Ulrich’s cry for help—were absent. He had a typed double-sided sheet, with photographs. That’s what a recall officer sees. It would come in the morning mail with a pile of other case reports, not as the subject of a “60 Minutes” exposé or a sensational front-page story. He would see that people had died. But a death to him does not register the same way as a death does to us. The recall officer goes to the chamber of horrors every week. He looks at car crashes for a living. “People dying was a normal part of the job,” Gioia said. “It really affected me when I first started. I had a hell of a time getting used to what was required, because the first thing that gets you going is always an awareness that someone has been grievously injured or killed in one of your products. And the only thing I’ll say to you is You’ve got to get over that. If you want to let emotion drive the recall coördinator’s job, you ain’t going to be a very good recall coördinator. You have to accept that, if you’re a manufacturer who’s building a product like a vehicle, people are going to get killed.”


So imagine the case in the recall officer’s stripped-down version. The relevant question is not who died. He’s not dwelling on the tragedy of three teen-age girls. His question is: Why did they die? The prosecutor in the Ulrich trial, Michael Cosentino, said that Ford was to blame. Why didn’t blame reside with the municipality, which built a highway with a curb that made it impossible for anyone to pull over safely? Or with Robert Duggar, who casually reached for a cigarette and took his eye off the road?…

Cosentino’s answer was that he had traceable cause. As Strobel recounts, Cosentino argued in his opening statement that there was something inherent in the Pinto’s design that “invited fire in the event of normal highway collisions.” This allegation was made repeatedly in the many lawsuits involving the Pinto. The Pinto’s gas tank sat behind its rear axle—instead of above it—and was separated from the back bumper by only a few inches of “crush space.” In a rear collision, the tank would be slammed against exposed studs on the axle, punching holes in the tank, ripping out the fuel-filler neck, and spilling gas into the passenger cabin. If any part of the metal scraping on metal or metal scraping on pavement that is typical in a crash produced a spark, the car would erupt into a fireball. A few months before the Ulrich crash, the N.H.T.S.A. released the results of an investigation into the Pinto’s safety record, detailing thirty-eight instances in which a Pinto had been struck from behind and burst into flames. Under pressure from the N.H.T.S.A., Ford eventually agreed to install a plastic protective “flak jacket” between the gas tank and the axle. The Ulrich crash was in August of 1978. The recall was supposed to start that fall. Hence the trial, and the pressing question: Why did Ford wait until 1978 to fix the gas tank of a car that first came out in 1970?

But does a rear-positioned gas tank qualify as traceable cause? Traceable cause suggests a deviation from the norm. It turns out, however, that most compacts of that era had fuel tanks behind the rear axle. A former head of the N.H.T.S.A. testified on Ford’s behalf, stating that in his opinion the Pinto’s design was no more or less safe than that of any other car in its class, like the Chevrolet Vega or the A.M.C. Gremlin. Under cross-examination, one of the chief witnesses for the prosecution—an automobile-safety consultant named Byron Bloch—conceded the point. In “Reckless Homicide?,” Strobel writes:

Bloch agreed that the American Motors Gremlin, Chevrolet Vega, and Dodge Colt had their gas tanks behind the axle; that those cars had essentially the same bumpers (“I would say that they were all bad,” Bloch said); that the Vega had no body rails at all; that all four cars had somewhat similar distances from the tank to the rear bumper; that all of them had at least some sharp objects near the tank; and that the thickness of the gas tank metal on the Pinto was in the upper one-third of other 1973 (era) cars.

Here are the deaths per million vehicles for 1975 and 1976 for the best-selling compact cars of that era, compiled by Gary T. Schwartz in his landmark law-review article “The Myth of the Ford Pinto Case”:

Gremlin 274 315
Vega 288 310
Datsun 1200/210 392 418
Datsun 510 294 340
Pinto 298 322
Corolla 333 293
VW Beetle 378 370

Suppose we focus just on the subset of accidents involving a fire. That’s a rare event—it happens once in every hundred crashes. In 1975-76, 1.9 per cent of all cars on the road were Pintos, and Pintos were involved in 1.9 per cent of all fatal fires. Let’s try again. About fifteen per cent of fatal fires resulted from rear collisions. If we look just at that subset of the subset, Schwartz shows, we finally see a pattern. Pintos were involved in 4.1 per cent of all rear-collision fire fatalities—which is to say that they may have been as safe as or safer than other cars in most respects but less safe in this one.

Later, after Gioia’s initial brush with the Pinto, he recalled finding out about internal Ford tests showing that the fuel tank of the Pinto would rupture in rear crashes involving speeds as low as twenty-five miles per hour. The corresponding figure for its competitors, like the Vega, was closer to twenty-seven or twenty-eight miles per hour, he said. The disparity was pointed out by Cosentino at the Ulrich trial. Ford knowingly sold a car that performed worse than its competitors in the most horrifying of scenarios—a fire from a rear collision. He was thinking speculatively and symbolically. What’s the worst that could happen? And what does that fact say about the company’s motivations?

Yet, from an engineer’s standpoint, the same information is much more ambiguous. Every car on the road is different—safer in some ways and less safe in others. So does the one area where the Pinto is worse—by two miles per hour in an infrequent subset of a rare kind of fatal crash—mean that the car is defective? A radically redesigned Pinto would not have saved the Ulrich girls. In the trial, the defense successfully argued that Duggar was driving at close to fifty miles per hour, and nothing short of a Sherman tank could have survived the impact of a four-thousand-pound van at full speed.

Around this time, the N.H.T.S.A. passed a revised version of what’s called the 301 rule, which stated that the fuel systems of passenger cars had to be safe from rupture in collisions of thirty miles per hour. The N.H.T.S.A. decided to fix the problem of the Pinto’s gas tank through regulation. But when the N.H.T.S.A. went back in 1990 and analyzed the effect of the new regulation, it concluded that “fatalities were not affected.” The difference between twenty-five and thirty miles per hour, or between 27.5 and thirty, was too small to pick up, or maybe it didn’t exist at all, or maybe the problem all along was rear collisions at fifty or sixty miles per hour. Fatalities were not affected. We are back to where Friedman was with the air-bag non-deployment rates of the Cobalt. Was the car broken? Or was it just somewhere on the gradient between unacceptable and high-performing?

I remember the Ford Pinto.  Frankly it’s weak points were more of the kind that was common of cars from that era with the tendency to rust away and oil leaky engines and just bad designs.  The 1970’s were not a great era for cars, at least American cars.  The actual gas tank accidents were so low that they were inmeasurable by any statistical data collection methods. The social consequences for Ford were immeasurable. The Pinot became a national joke and a huge embarrasment for Ford.

Sometimes an entire type of car can get a bad rap.  Consider reas engine cars.  They can have quirky handling characteristics and that has led to accidents.  The Tatra 77 in the 1930’s was one of the first to experience the problems.

  Developed by Hans Ledwinka and Paul Jaray, the Tatra 77a was the successor to the popular Tatra 77. Launched in 1935, it boasted a 75 horsepower, rear-mounted 3.4-litre, air-cooled V8 engine. The Tatra 87 had a 95 horsepower engine and was described by Nazi armaments and munitions minister, Fritz Todt, as “the Autobahn car”.

The cover of the Tatra 87 brochure

“Following the invasion of Czechoslovakia in the Thirties, it became very popular with high-ranking Nazi officers,” said Cole, who last year released the Young Bond novel, Shoot to Kill. “They were all seen driving these things. The cars were designed to be very aerodynamic with the fin at the back and the wheel arches filled in order to stop the wind dragging.

“These high-ranking Nazi officers drove this car fast but unfortunately the handling was rubbish, so at a sharp turn they would lose control, spin out and wrap themselves round a tree killing the driver more often than not. The Allies referred to the Tatra cars as their secret weapon against the Nazis.

“More high-ranking Nazi officers were killed in car crashes in the Tatra 77 [and 87] than were killed in active combat. It goes to show that being too flash doesn’t get you anywhere and will leave you dead.”

In 1934, Porsche was commissioned by Hitler to design a mass-produced and economic car for Germany. The VW Beetle arrived in 1938. Such were the similarities to the Tatra 97 (launched in 1936), however, that Porsche was ordered to pay a settlement of three million Deutsche Marks to the Czechoslovakian manufacturers in 1961.


Tatra handled their issues after the war and their contribution to the Allied war effort with some improvements to their car and some rather funny promo movies.  Still the issues ith rear and mid engine cars would haunt car makers as   the likes of Ralph Nader pounced at the smallest chance that their might be a fault.

Nader’s attack on the Chevrolet Corvair was legendary.  What’s amazing to me was that the attack was taken seriously. because everything I’ve seen seems to indicate that Corvairs are pretty good cars.  The cars seemed to be around long after most of the vintage A bodies and other GM cars were long gone.  Indeed you still see them occasionally.  Not bad for a car that was supposedly unsafe at any speed.

Perhaps one of the most notorious cases was the Moseley truck case.  It’s a sad thing when somebody dies in an accident, especially when there is a fire. Back in the early 1990’s Court TV was just getting started and because I was out of work I had the opportunity to see the case with the actual evidence presented. Here’s an article from the time.

As I watch the case I had no doubt that the jury would find for the defendant. The truck was brought into the courtroom and it essentially bent into a “V” shape from the impact. Also, the fuel tanks did not look as if they were damaged by an internal explosion.  If I were asked to give an opinion I would have said that the fire was a result of the failed fuel lines and still running fuel pumps.  That, of course would not have been a case for negligence and I underestimated the powers of persuasion of a good attorney, the ability to convince a jury that the company is guilty before being proven innocent and the advantages of a good  publicist and friendly media, see below.

The fact is that no matter how well you engineer you can’t change the fact that the environment that cars operate in is a dangerous one by it’s very nature.  There are simply too many things that can go wrong in so many different situations to be predictable.

Safety engineering for cars has always been a difficult and almost thankless task. The fact is that most people don’t by a car for it’s safety features. They never have, except for advocates like Nader.  Also there is no practical way to make a car truly safe and still have a reasonable compromise on things like fuel economy, cost, passenger and cargo capacity, and style, the things that people DO look for in a car.  And safety engineering typically goes from accident to accident with the lessons learned from each one. Many of the advances can found on the test track. In the end, experience is the only true teacher, as this video shows.



Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s