IEEE Technology and Society Magazine - June 2017 - 69

case, largely through the lens of what an engineer
should be ethically permitted or even required to do in
response to a situation of that type [8]. More specifically,
what should an engineer do if the placement of the Pinto's rear fuel tank might cause harm to the public? While
we are not committed to the view espoused in the article, the article is important to examine for at least two
reasons. First, De George's article helps to bring to light
many of the key ethical responsibilities that engineers
have in complex, hierarchical organizations. Second, his
analysis is directly connected to one of the most notorious and influential automobile engineering ethics cases
(a case that is also often discussed in the context of
business ethics).
De George contends that engineers must uphold the
(safety) standards of the time; such standards are a minimum threshold that their designs must not fall below
[8]. Furthermore, he believes that customers are entitled
to know how much safety a car has. He offers a list of
criteria for when it is: 1) morally permissible to report an
issue to the public, and 2) when it would be morally
obligatory. Yet in general he suggests that engineers
should not be required to challenge managerial decisions (especially since doing so may put their career on
the line). He argues that the primary responsibility for
correcting such problems should fall on regulators and
not engineers (a view we do not embrace).
Human beings, engineers included, have a natural
(psychological) tendency to react to a "disaster" and then
implement changes afterward. It can be challenging to
garner the necessary will and resources towards solving
a problem before the problem manifests itself. Furthermore, "failure" is often seen as what instructs designers
in terms of creating a safer, "better" technology [24]. At
least some corporations adopt the mindset of waiting for
regulators and/or legal liability to push them towards the
implementation of a safer design (i.e., the same effect as
De George's approach). However, as should be made
abundantly clear by the deaths in the Pinto case, that
type of attitude can cause significant harm to the public.

Technical and Other Related
Complexities of Self-Driving Cars

∕

TABLE 1. Levels of Driving Automation
(adapted from SAE [28]).
Human Driver Monitors Driving Environment
Level 0 - No Automation

Full-time operation by
human driver

Level 1 - Driver Assistance

Single driver assistance
system (steering or
acceleration/deceleration)

Level 2 - Partial Automation

Driver assistance systems
for both steering and
acceleration/deceleration

Automated System Monitors Driving Environment

The self-driving car can reveal several potential weaknesses inherent to De George's view and to traditional
approaches to engineering challenges. The Pinto case
and many other examples of automobile safety have
focused on an individual component or on interrelated
set of components often with a known fault (e.g., the
GM ignition switch [25] or Takata airbags [26]). Much of
the coverage of self-driving cars in the popular media
has likewise been focused on components, particularly
sensors for navigation and guidance, and on algorithms
for safe driving [27].
june 2017

A self-driving car, however, is an entire system at
least part of which operates "autonomously." According
to the 2016 SAE International standard J3016, the levels
of automation of self-driving cars range from 0 to 5 as
indicated in Table 1 [28].
Level 2 automation is already being incorporated into
existing commercial vehicle brands including Mercedes,
BMW, and Cadillac. The Tesla (Model S) incorporates
Level 2 and some aspects of Level 3 automation which,
as discussed later, has led to some accidents including
at least one fatal incident. In this paper, we primarily
seek to examine ethical issues related to Levels 3, 4,
and 5. A key distinction among those levels is whether
the "safety-critical driving functions" are fully entrusted
to an automated system (Level 5) or whether a human
being is supposed to retain control over those functions
in at least some situations (Levels 3 and 4).
A myriad of technical complexities, some of which
are described below, could interfere with the safety and
reliability of self-driving cars. For example, a typical selfdriving car is estimated to contain 100 million lines of
code, which is approximately 10 times the amount of
code in a fighter jet [13]. Software testing has always
been difficult [29]; this kind of complexity makes it even
more challenging. We should also keep in mind that it is
not just the amount of code and its complexity that is

Level 3 - Conditional
Automation

Automated operation with
human driver expected
to respond to request for
intervention

Level 4 - High Automation

Automated operation even
if human driver fails to
appropriately respond to
request for intervention

Level 5 - Full Automation

Full-time automated driving
system

IEEE TEchnology and SocIETy MagazInE

Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - June 2017