I was trying to explain this concept to our sales rep today. He seems to think that releasing a product means that it is 100% finished and there will never be any problems with it ever. Reality is that we are always one bizarre untested configuration away from having an issue on a new install.

The terms "Beta" and "Gold" have this magical aspect for some classes of people, which I just can't get my head around, seeing the trunk code change every day.

That's why ALARP is such a widely used methodology.

Unless you're in the bands "unacceptable risk" or "broadly acceptable risk", economical considerations are valid.

That's a cop out argument.

Gas pedals and ignition switches are things that have existed for decades. Why are they screwing around with materials that don't perform well for a part as universal as a gas or brake pedal? Why not leave the damn thing alone?

In part because throttle and ignition control are increasingly eschewing mechanical linkages in favor of electronics. IIRC, the Camry in question had an electronic throttle, and the pedal part that experienced accelerated wear was an acetal bearing surface that was supposed to mimic the feel of a traditional throttle control. I don't know the details of this case, but acetal isn't uncommon for bearing applications.

As to why move to electronic throttle, it's mostly due to regulatory compliance.

> In part because throttle and ignition control are increasingly eschewing mechanical linkages in favor of electronics.

I would go further than this. I would guess that at least 50% of the cars on the road today have electronic-only throttles and that fully 99% of cars sold in the last year have had electronic-only throttles.

Drive-by-wire is basically the standard these days, even on very inexpensive cars. Emissions standards have basically forced it.

So you have a safety critical component that was redesigned (with a floor mat recall) in the last decade, and modified after a series of incidents.

Sounds like an engineering failure to me.

Parts are changed all the time over the production run of a car. How does that constitutes an "engineering failure"?

The materials degrade and fail, and the design of the physical environment around the pedals makes it easy for OEM or aftermarket floor mats to create fatal conditions.

The physical properties of pedals are well-known. Material failure of a pedal in the 21st century is a complete fuckup. Floor mats are known quantities as well. Perhaps design elements beyond weakly anchored plastic hooks embedded in the rug would make it more difficult for a sliding piece of rug or rubber to kill the occupants of the car.

Well engineered products should work in the environment that they operate in. These cars didn't perform in a variety of typical conditions, putting human life at risk. The "obvious" workarounds presented by the engineers aren't things that drivers are trained to do and aren't obvious to drivers in emergency situations.

That pretty much defines failure in my mind.

> aftermarket floor mats

How is it reasonable to hold a car manufacturer responsible for what could happen with aftermarket parts, unless those parts are designed to be an exact duplicate of an OEM part?

> Well engineered products should work in the environment that they operate in.

Completely agree. Toyota has produced a lot of cars, and only a minuscule subset seems to have actually been affected.

> These cars didn't perform in a variety of typical conditions, putting human life at risk.

Human life is at risk whenever a person is driving in a car, regardless of manufacturer. I think the proper question is do the Toyota designed cars present an unacceptable risk?

> The "obvious" workarounds presented by the engineers aren't things that drivers are trained to do and aren't obvious to drivers in emergency situations.

Stomping on the brakes seems like a reasonable response to an unintended acceleration event for an untrained person, and was experimentally shown in Toyotas to be sufficient to stop the car with an open throttle in a reasonable distance. If Toyota has a proper risk management plan in place (and I don't know of any evidence that they lack one), it would incorporate risk mitigation for an unintended acceleration. How an untrained driver would react, or a driver who didn't read the instruction manual, would be considered in the risk management plan.

As to driver training, I personally was taught that applying full brakes, handbrake, placing the transmission into neutral, and killing the engine are all options, in addition to the downsides of all of these. I am certain that many drivers don't know this, but to say that all drivers aren't trained on remedies is not wholly accurate.

As I see it, a true engineering failure is if there isn't a corrective process in place to replace affected parts and if there isn't a process to incorporate design process changes to prevent these problems from occurring in the future; clearly, there is a quality system in place. If Toyota produced new cars that had floor mats or pedals that had the previous problems that would be a clear engineering failure. What actually happened was that the cars were produced under the constraints of a realistic budget and acceptable defect rate.