[4] LEVENTHAL, Circuit Judge, dissenting in part:

In the principal case before us, the government seeks enforcement against General Motors of a defect notification order, as well as fines. The district court denied summary judgment to the government. After trial, it held for General Motors.

The majority concludes that the Government should have been given a summary judgment, and remands for determination of appropriate relief.

I concur in the view that the district court judgment in favor of General Motors cannot stand. In my view, however, the case is one that is not appropriate for summary judgment and requires a retrial in accordance with what I consider to be sound principles. These principles are to some extent set forth in our prior opinion in the Wheels case. United States v. General Motors Corp., 171 U.S.App.D.C. 27, 518 F.2d 420 (1975) [ Wheels]. I think it would be most convenient if I proceed at this point as if I were writing an opinion for the court — presenting what I would consider the correct disposition.

This case concerns the standard for proving that a defect in an automobile model "relates to motor vehicle safety" within the meaning of the National Traffic and Motor Vehicle Safety Act of 1966, 15 U.S.C. §§ 1381 et seq. (the Act). The National Highway Traffic Safety Administration (the Administration) ordered General Motors (GM) to issue defect notifications concerning the pitman arms of 1959 and 1960 Cadillacs, which break as a result of steering stress, causing sudden loss of steering control. An action seeking enforcement of this order was tried de novo in the district court with the trial judge as the finder of fact.

The existence of a defect was conceded. GM offered proof that the pitman arm failures occur only in high stress situations, which involve low speed and parking maneuvers. The government introduced evidence of at least one incident in which pitman arm failure at lesser steering stress produced a dangerous situation as well as expert testimony on normal human reaction to loss of steering at low speed. GM presented a "risk analysis" which predicts the likely number of future injuries or deaths to be expected in the remaining service life of the affected models.

The district court found that GM had successfully rebutted the government's "slim prima facie case" on the basis of the risk analysis. In so deciding, the district court applied an incorrect legal standard as to the burden of presenting data of past harm caused by the defect. The correct standard leads to the conclusion that it was "clearly erroneous" for the district court to find that GM met its burden of rebutting the government's prima facie case.

I. BACKGROUND

A. Administrative Action

In 1972, acting on consumer complaints brought to its attention by the Center for Auto Safety, the Administration began an investigation of pitman arms failures in 1959-60 Cadillacs. The pitman arm is a critical component of the steering system. It transfers the angular motion of the steering wheel and shaft to lateral movement of the drag link and tie rods which turn the front wheels. When the pitman arm fails, steering control is suddenly lost. In September, 1972, the Administration requested information from Cadillac's manufacturer, GM, about the pitman arm. GM's summary of its investigation stated that, as of September 1972, it had sold approximately six times as many replacement pitman arms for the 1959-60 models as for the adjacent years' models. Furthermore, the GM presentation showed that 1959-60 pitman arm design was quite different from that of those models and that on June 10, 1960, GM changed the hardness specification for the 1959-60 pitman arm "after end of regular production on service replacement parts," "to improve performance" under extreme loads.

During 1973, the Administration reviewed the material presented by GM and customer complaints, contracted for testing of pitman arms, and conducted hearings in which GM participated. On January 10, 1974, the Administrator notified GM that he had "determined that a defect which relates to motor vehicle safety exists with respect to the steering pitman arm on 1959-60 model year Cadillac automobiles, in that these pitman arms are subject to sudden, and catastrophic failure, causing loss of steering control, and resulting in an unreasonable risk of accidents, deaths, and injuries to persons using the highways". The Administration directed GM to notify owners of the affected Cadillacs of the defects and urged GM to recall them for replacement at GM's expense.

B. Enforcement Action 1. Preliminary Matters

On January 11, 1974, GM filed suit in the District Court for the Eastern District of Michigan to set aside the Administration order. A temporary restraining order (TRO) against the effectuation of the January 10 order was granted on the same day, but after a hearing the TRO was vacated and a preliminary injunction denied. That same day, Feb. 13, 1974, the government commenced an enforcement action in the District Court for the District of Columbia. In addition to enforcement of its notification order, the government sought imposition of a $400,000 civil penalty, pursuant to § 109(a) of the Act.

Both parties sought a change of venue of the other's case to their chosen forum. The parties and judges recognized that the interests of justice and convenience of all called for consolidation of the cases raising identical issues. In a joint order of July 8, 1974, the district courts ordered the cases consolidated in the District of Columbia.

2. Denial of summary judgment

Both parties moved for summary judgment under Fed.R.Civ.P. 56(c). An action for enforcement of a notification order, under § 110(a), 15 U.S.C. § 1399(a), is tried de novo in the district court. The government has the burden of proof on the two elements required by the Act: 1) that a "defect" exists and 2) that the defect is "related to motor vehicle safety," i. e., involves an "unreasonable risk of accidents occurring as a result of the design, construction, or performance of motor vehicles . . . ."

The district court effectively granted summary judgment in favor of the government on the issue of existence of a defect. It based that judgment on 1) the disproportionately high replacement pitman arm sales, in the absence of any serious contention that this was due to causes other than a disproportionately high rate of pitman arm failures, and 2) tests performed by both parties showing that "the pitman arm can fail from metal fatigue after a large number of high stress maneuvers such as occur in parking and turning." On appeal, GM does not challenge this determination.

On the issue of safety-relatedness, the district court denied summary judgment to both sides. It acknowledge that:

[t]here is a certain appeal to the government's argument that a defect which may result in a loss of steering control is, ipso facto, a safety-related defect under the Act. One need only ask whether he would consider loss of steering control even at a very slow speed, a reasonable or unreasonable risk.

However, GM contended that the pitman arm failures could only occur in low-speed, high-stress maneuvers and that the absence of reported instances of death or injury resulting from pitman arm failure in the long history of the affected cars showed an absence of "unreasonable risk." The district court stressed the standard of an unreasonable risk and the "commonsense" approach to safety questions under the Act. It concluded:

This is an issue of fact which cannot be resolved by logic alone. And it is an issue of material fact under the law of summary judgment.

3. The trial

A non-jury trial of the issue of the safety-relatedness of the pitman arm defect was held from February 3 through February 11, 1975. Both sides presented metallurgical expert testimony on the process of fatigue-induced failure in pitman arms and the circumstances in which pitman arm separation could occur. The government presented the testimony of a driver, Karen Arbuckle, who had recently experienced a loss of steering during a 90° turn at 10-15 mph due to pitman arm failure in her 1969 Cadillac. In the incident, no one was injured. The government also presented the testimony of a professional driver and two experts in human reactions on the danger of sudden loss of steering, even in low speed maneuvers. One of the latter experts, Duncan Miller, testified that the median time between pitman arm failure in 5 mph U-turn and commencement of braking "would be in excess of 1.6 second." Raymond Caldwell, the professional driver, testified from tests with an artificially separable pitman arm that the car entered the opposing lane of traffic 1 1/8 seconds after separation in a 5 mph 90° turn, and 2/3 of a second in a 10 mph U-turn.

In rebuttal, GM offered further evidence, a "risk analysis" by one of its experts in fracture mechanics, Dr. Alan Tetelman. From this analysis, based on data in GM's files on pitman arm failures and general accident data, Dr. Tetelman predicted that for all the approximately 40,000 affected Cadillacs still on the road, during their remaining service life, there would be a very small chance (less than 1%) of a fatality. His analysis projected only one incapacitating and one non-incapacitating injury. The government objected to the data used by Dr. Tetelman and called a statistical expert to criticize his methodology and the significance of his result.

On April 25, 1975, the district court filed its findings of fact and conclusions of law in these cases. The court found that the government had:

made out a slim prima facie case on the testimony of Mrs. Karen Arbuckle concerning a recent pitman arm failure in her 1960 Cadillac and the metallurgical and metal fatigue tests and testimony of Dr. Volker Weiss. GM countered with the risk analysis and fracture mechanics tests and testimony of Dr. Alan Tetelman. Since the government as plaintiff did not bear its burden of proof, the Court finds that the pitman arm defect in model year 1959-60 Cadillacs does not create an unreasonable risk of accidents, injuries or death, and concludes that General Motors need not issue a defect notification to owners of those automobiles.

On April 28, 1975, the district court entered an order that set aside the Administrator's order to GM to issue defective notices and dismissed the cases.

II. THE STATUTE

A. Safety Related Standard

This case presents issues of the Act's defect notification provisions not resolved in Wheels, 171 U.S.App.D.C. 27, 518 F.2d 420 (1975).

Wheels involved the standard of proof of a "defect" in a type of pickup truck wheel; the defect, if established, undisputedly related to safety. Here, a defect in the pitman arm is conceded. The issue is safety-relatedness, the standard for determining whether the defect is "related to motor vehicle safety." Wheels came to us on summary judgment, whereas the case at bar was tried to the court, after summary judgment was properly denied, and the issue is whether the district court applied the correct standard on the burden of proof. In spite of these differences, both cases require examination of a provision employed by Congress to enhance safety in connection with automobiles. Wheels provides guidance in elucidating the standard of proof for requiring a defect notification.

The key concept in the statutory scheme is that of "unreasonable risk of accidents." As we concluded by examination of the legislative history in Wheels, this concept is to be applied in a "commonsense" manner, balancing safety benefits against economic costs.

Section 1 of the Act states its overall purpose:

Congress hereby declares that the purpose of this chapter is to reduce traffic accidents and deaths and injuries resulting from traffic accidents.

This broad purpose is reflected in the central provision relating to this case which contains this definition in § 102(1):

(1) "Motor vehicle safety" means the performance of motor vehicles or motor vehicle equipment in such a manner that the public is protected against unreasonable risk of accidents occurring as a result of the design, construction or performance of motor vehicles and is also protected against unreasonable risk of death or injury to persons in the event accidents do occur, and includes nonoperational safety of such vehicles.

It may be noted that the statutory language relates to protection against an unreasonable risk of "accidents," and separately to protection against "unreasonable risk of death or injury" in the event an accident occurs.

Senator Mondale, the author of the defect notification amendment in the Senate bill, stated in debate:

I do not consider it necessary to speculate whether a wheel falling off without warning is a safety hazard. Obviously, it is . . . . It is my view that the fair-warning provision is essential to make sure that the automobile consumer is warned of hazards such as this.

It is only fair, in view of the vast organizations established for the sale and service of these automobiles to notify the owner in clear and unmistakable terms, once a safety defect is known that a safety hazard is involved, what it is, and what corrective steps can be taken.

The House Report on the defect notification section states:

This section was included to afford a means for uniform and prompt notification to vehicle owners of the discovery of any defects related to safety. "Defect" is a defined term which includes any defect in performance, construction, components, or materials in motor vehicles or motor vehicle equipment. The provisions of this section do not alter other courses available to the Secretary, with respect to the deficiencies which necessitate notification, such as the imposition of a civil penalty or the seeking of injunctive relief. It is the committee's intention that the Secretary will exercise his authority under this section to publish notices and information concerning defects in those situations where so doing will bring about a higher level of safety. In this connection, the committee is confident that the manufacturers will be active in notifying purchasers and users so that defects will be corrected as quickly as possible.

Out of any manufacturing process, some products are bound to be "lemons." These failures may be due to flaws in the design, construction (including occasional human error on the production line) or inspection process. When the defects are occasional or isolated, the risk associated with them is part of the ordinary danger of operating an automobile; minimizing them is one aspect of the quality of a manufacturer's product which consumers choose to pay for. Total elimination of this risk would require a standard of design, construction, and testing that would produce a purchase price so prohibitive that it cannot be taken as the contemplation of Congress. And that obtains even though such a defect may be in a vital component and result in a safety risk.

However, the matter stands quite differently where it appears that the defect is systematic and is prevalent in a particular class of cars. Such a defect may be identified by an unusually high rate of failures in actual operation or by tests showing that failure is likely under normally encountered circumstances.

In the event of a systematic defect, which leads to failures in a vital component, such as is the case with the pitman arms causing sudden loss of steering, this is prima facie an "unreasonable risk" for which Congress prescribed the additional protection (over and above a manufacturer's customary quality control) of notification, and now, recall. Proof of the pitman arm defect, which leads to its failure and loss of steering under foreseeable driving conditions, creates a strong presumption that the defect "relates to motor vehicle safety." The presumption is rebuttable. The reasons for rejecting the government's contention that such a defect is per se related to safety are set out below. Certainly, however, if this case had arisen near the beginning of the cars' service life, when there was little real-life experience with the cars, such proof would suffice to obtain enforcement of a notification order without waiting to see how many people would be hurt or killed.

With respect to 1959-60 Cadillacs, there was no prompt action in response to the pitman arm defect to notify owners or recall the car for repairs, nor has there been to date. Rather, during the period that has already elapsed — the bulk of the cars' service life — there have undoubtedly been many pitman arm failures; the safety consequences of those failures are unknown, unknown to the parties and to the courts.

During that period, GM, which knew early on of an unusual number of pitman arm failures, had the opportunity to develop data concerning experiences with pitman arms, the universe of failures and consequences thereof. This it had the power to acquire, as a manufacturer, by suitable notice to and inquiry of its dealers and, ultimately, its customers.

Instead, GM relies, in effect, on the lack of notifications sent to it on the initiative of consumers, i. e. on the dearth of complaints.

B. Burden of Rebuttal

The government's prima facie case is not a conclusive demonstration of a safety-related defect. GM should have the opportunity to show that the failures occur in circumstances in which loss of steering is not dangerous. In this case, GM maintains that the pitman arms fail only where the steering mechanism is subject to high stress, typically at low speeds and parking. GM further claims that loss of steering in such maneuvers is not dangerous. These contentions were supported by an offer of proof in affidavit form, and so the district court properly denied the government's motion for summary judgment.

GM offered two types of evidence in support of its two part contention which constitutes its rebuttal case. These two strands are discussed in Parts III IV of this opinion in some detail, because they serve as models of types of evidence available to a manufacturer coping with the burden of rebuttal.

The first type of evidence was offered by GM in support of its contention that pitman arm failures occur essentially only under high stress. This evidence relates to the mechanism responsible for pitman arm failures. The evidence stems from tests on Cadillacs with the defective pitman arms and metallurgical interpretation of failed pitman arms. One point illustrated by this type of evidence is the possibility for a manufacturer to meet its burden of rebuttal, on at least a portion of the overall safety-related issue, entirely by experimental proof, i. e. testing and metallurgical analysis, without the necessity of offering experimental proof based on a survey of significant amounts of road experience.

Both parties offered experimental evidence of this first type. Both put on witnesses with expertise in metallurgy. The government also offered experts in drivers' reactions; the manufacturer's supplement to the metallurgical evidence was the risk analysis previously noted. Both sides interlard their experts with projections on the ultimate issue of the magnitude of risk based on common sense.

As to driving expertise, central to Dr. Tetelman's risk analysis, the government relied on the Arbuckle incident to verify that the risk of danger from pitman arm failure is not merely theoretical. There are situations, after all, in which even one instance verifies a general proposition.

A manufacturer undertaking to rebut the government's prima facie case by an empirical showing based on experience accumulated during a substantial period of automobile operation must be able to make a valid prediction of negligible future risk from operation of the cars based on a significant data base. GM attempted to make this prediction for the 1959-1960 Cadillacs still in service through Dr. Tetelman's "risk analysis." The question is whether this analysis, essentially a statistical inference and prediction, rests on a data base adequate to carry the manufacturer's burden of rebuttal.

There is no legal requirement at present on either the government or manufacturers to keep comprehensive data on automobile accidents, such as the Federal Aviation Administration maintains on commercial aviation. The store of recorded experience must nevertheless be significant if it is to serve as the foundation for empirical rebuttal by a manufacturer. This requirement is a simple matter of the reliability of the rebuttal proof. And there is justice in this allocation to the manufacturer of the burden of compiling significant data on the causes and consequences of mishaps in its cars. Manufacturers have the channels, through their dealers, and the business motivation of good will and customer satisfaction, to acquire and maintain significant data on performance.

III. ISSUE OF WHEN PITMAN ARM FAILURES OCCUR

A. Evidence

GM contends that pitman arm failures occur essentially only in high stress maneuvers. At trial, GM presented expert metallurgical evidence on the mechanism by which pitman arm failures occur. Dr. Kenneth Packer and Dr. Alan Tetelman testified that the fatigue-induced failure begins with a crack in the "necked down" portion of the arm, where the cross-section is smallest. The crack propagates as stress is applied in various steering maneuvers; the propagation rate increases with greater stress and size of existing crack(s). When a stress is applied which the intact area cannot sustain, the pitman arm fails. This process is called brittle fracture.

GM conducted tests to determine the stress felt by the pitman arm in various driving situations. Both sides used these measurements in their analysis. The crucial point is that the load is highest in quasi-stationary (parking) and slow maneuvers, such as a 5 mph U-turn. The stress in these maneuvers is over 2000 pounds, while in maneuvers over 10 mph, even jolting ones, the stress is close to 1000 pounds or less.

GM's experts presented a theory of "proof testing" which indicates that pitman arm failures will occur only in the high stress, low speed maneuvers. In normal operation, the steering mechanism is involved in a series of high and low stress events. The high stress events "proof test" the pitman arm. If a crack is developing, the pitman arm will fail when a high stress is applied exceeding the strength of the remaining cross section. Dr. Tetelman testified that a Cadillac would have to encounter at least 4000 potholes or many turning maneuvers at moderate or high speed without ever parking to permit the crack to extend to the point where it could fail above low speed. This theory was supported by GM's experts' inspection and interpretation of the fractured surface of several pitman arms which had been made to fail in tests. They testified that the intact area before the final failure was about half of the original cross-sectional area. This is consistent with their view that the pitman arms would tend to fail with a relatively large intact area, under the influence of a large stress.

The government's metallurgical expert, Dr. Volker Weiss, disagreed with GM's experts in both their view of the failure mechanism and interpretation of the failed pitman arm surfaces. Dr. Weiss disputed the applicability of "proof testing," based as it is on a brittle fracture process. He testified that pitman arms can deform plastically at high stress; this means, apparently, that with a certain application of high stress, a pitman arm can be seriously weakened, but not fail until application of the final blow at moderately low stress. He interpreted GM's test-failed pitman arm as having an intact cross section just prior to separation only a fraction (less than one-fifth) of the 50% figure testified to by Dr. Packer. Dr. Weiss gauged this previously intact area to have been roughly circular with a diameter of about 1/4 of an inch, which agreed with his previous examination of pitman arms that failed in actual use, including the Arbuckle pitman arm. He used this figure in preparing pitman arms for experiments in which separation occurred at final applied loads of less than 300 pounds. GM argued that Dr. Weiss's technique of machine notching the test pitman arms made them unrepresentative of pitman arms with real cracks, while Dr. Weiss maintained that this difference was not significant in that a given size crack would weaken the arm more than a notch of the same size.

B. Findings and Role of the Trial Court

The district court found, on the issue of unreasonable risk of failure above low speed that the government had not met its burden of proof. It reasoned:

The allegation that Dr. Weiss' experiments were not "true to life" was never rebutted by the government. Thus the "battle of the experts" was a standoff. The government did not show by a proponderance [ sic] of the evidence that a fatigue crack would normally propagate so far that the remaining cross-section could break under normal or high speed maneuvers.

Since the issue of when pitman arm failures occur is part of GM's rebuttal case, this conclusion reflects an incorrect allocation of the burden of proof. In general, under Fed.R.Civ.P. 52(a), the appellate court is bound by the district court's findings of fact unless they are "clearly erroneous." The scope of review is narrower, and particular caution is indicated, where credibility of witnesses is involved. However, "insofar as that conclusion derived from the court's application of an improper standard to the facts, it may be corrected as a matter of law."

The district court was affected by its apprehension that the government had failed to rebut the allegations that Dr. Weiss's experiments were not "true to life." By the same token, the court should have been troubled by the absence of GM's rebuttal to the Arbuckle incident. The court was presented with conflicting testimony of experts as to whether pitman arms fail virtually only in high stress situations. Mrs. Arbuckle gave testimony of a real life event which supported the government's theory. According to GM's own measurements, that pitman arm failure occurred at low stress. GM seeks to dismiss the Arbuckle evidence as "only one incident of alleged pitman arm failure." This misses the point. Where there is a choice between theories which say that something is possible or impossible, there is special significance in a real life incident, albeit a single instance, in which it has happened.

The district court referred to the Arbuckle incident in making its overall balance of the risk from pitman arm failures, but did not gauge the effect of the occurrence on the supposed "stand-off" in the "battle of the experts."

Apart from the application of an incorrect burden of proof, there is a problem in the district court's cursory treatment of the when-pitman-arms-fail issue as a standoff. The mere fact that experts disagree does not mean that the party with the burden of proof loses. The finder of fact has to make the effort to decide which side has the stronger case. This can be based on the demeanor of the witnesses (if so, the trial judge should say so) or the intellectual strength of the evidence and arguments based thereon.

While an appellate court is limited in its review of factual findings, it may rightfully consider whether the trial judge has weighed and appraised the case in the light of the "whole record." There may be cases of true equipoise of evidence, but this should not be used as the ground of decision unless there is a reasoned conclusion that the efforts of the trial judge at weighing evidence leave no alternative.

The obligation on the trial judge to make this effort and judgment is particularly pronounced in this type of case, involving a regulatory process to safeguard public safety prospectively. Although an agency is involved in bringing the case, there is no administrative decisionmaking. The district court must decide the issue of whether there is a safety-related defect de novo. Such a safety case calls for more than cursory application of traditional burden of proof concepts. Rather, it requires a searching inquiry by the trial judge of the totality of the evidence in the case. On the basis of this evidence, he must go through the intellectual process of resolving the issues, rather than throwing up his hands in the face of conflicting evidence.

In the course of this inquiry, the judge's role in eliciting evidence may go beyond asking questions of witnesses. The active role of the federal judge in criminal trials is well established. The similar considerations apply when a case involves the safety of the public. In a non-jury trial, there is merger of the functions of umpire, trier of fact, and decider of the law in the trial judge. In the interest of justice, and the public, the judge may rightly express his critical concerns and probe for responses.

C. Disposition of the Issue

If the case turned on this issue of when pitman arm failures occur, we would have to remand for further findings. This court cannot reach a conclusion since we have not had the trial court's opportunity of seeing and hearing the contending evidence. Neither could we be confident of the intent underlying the district court's "stand-off" reference. If this reflects a judgment that the evidence truly approximates equipoise, GM loses for failure to sustain its burden of rebuttal. But it may be, and this is intimated by the flavor of the opinion, that the district court found GM's evidence on the issue preponderant, and merely expressed this result in a soft or minimal way, consistent with its view of the burden of proof, but not adequate under our view.

Without resolving this uncertainty, this opinion will assume, arguendo, that the district court would have found that GM had met its burden on this issue and that we could not say that this finding was clearly erroneous. Even making this assumption, most favorable to GM, GM has not carried its overall burden of rebuttal. This opinion now turns to the remaining issue of danger from pitman arm failure even restricted to low speed situations.

IV. UNREASONABLE RISK AT LOW SPEEDS

A. Evidence

In rebuttal to the government's "commonsense" prima facie case, buttressed by expert testimony on human reactions and the testimony of Mrs. Arbuckle, GM offered the "risk analysis" testimony of Dr. Alan Tetelman. This involved a supposedly conservative estimate of the expected harm from pitman arm failures in the remaining service life of the 1959-60 Cadillacs based on data of previous experience with those cars and general accident statistics. GM manufactured 284,456 1959-60 Cadillacs, of which about 43,400 were still in use in 1974. GM estimated that these remaining cars would continue in use, on the average, a little over three years. On this basis, of the total miles driven in the cars, 96% of the model's service life had already occurred.

Dr. Tetelman used as his measure of risk an index called "total severity" which is the product of the mean severity per pitman arm failure times the expected number of pitman arm failures in the remaining model life. The concept of severity used was that used by the Consumer Product Safety Commission (CPSC). This scale, based on a unit of a day lost due to injury, gives numerical values to injuries ranging from mild ones to death.

The mean severity of a pitman arm failure was taken as the probability that a pitman arm failure would lead to an accident times the severity calculated for an average accident caused by loss of steering due to pitman arm failure. The probability of failure was simply taken from GM's service engineer's file on the pitman arm problem. This contained an "events summary," which recorded all of the problem occurrences (complaints) allegedly related to pitman arms which were known to GM. Of these 158 events, as Loren Papenguth, GM's assistant chief engineer, testified, those that GM could not confirm as involving the pitman arm were eliminated, which included some 19 accidents. Of the 64 or 65 "confirmed" pitman arm failures, Mr. Papenguth testified that two involved minor accidents. Thus, Dr. Tetelman took as the probability of accident from a pitman arm failure, the ratio 2/64.

The average severity of a pitman arm accident was computed using data from police accident reports in Texas during 1969-73 and from the National Safety Council on the distribution of accident severity depending on the speed preceding the accident. Dr. Tetelman took the Texas accidents resulting from steering defects (as reported in the police reports) for his data base on the frequency-severity distribution. The Texas police reports used the rough National Safety Council Classification: fatal; incapacitating injury; non-incapacitating injury; no injury. Dr. Tetelman recalculated these on his translation into the equivalent CPSC values. In view of his testimony that pitman arm separations would only occur at low speeds, Dr. Tetelman normalized the steering defect distribution to the distribution of all accidents in the low speed (0-9 mph) range. With these assumptions, he arrived at a figure for the mean severity of a pitman arm failure.

The expected future number of pitman failures was based on a survey of 613 1959-60 Cadillac owners (commissioned by the government), in which 17 stated that they had suffered pitman arm failures. The calculation assumed that, since there was no indication of an upturn in failure rate, the future failure rate would be the same as the historical one. Using GM's data on the number of remaining Cadillacs in use and their expected three year remaining life, Dr. Tetelman calculated that there would be about 250 pitman arm separations in the future (as of 1974).

Putting these two factors together, the mean severity and the future expected frequency, Dr. Tetelman predicted that the conservatively calculated future harm was: a very small chance (less than 1%) of a fatality and about one incapacitating and one non-incapacitating injury.

The government presented numerous objections and rebuttals to Dr. Tetelman's risk analysis. It objected to the use of the Texas accident data as hearsay for which there was no evidence presented of its accuracy and reliability. The government criticized Dr. Tetelman's analysis for disregarding, i. e., assigning no value whatever to: accidents involving mild injuries less than internal organ injuries, e. g. sprains, bruises and scalds; accidents involving "possible injury," i. e., injuries claimed subjectively, but not medically verifiable objectively, at the time of the accident (with no "reserve" for the possibility of later confirmation with symptoms and even death); and accidents involving property damage but no injuries.

The government further criticized Dr. Tetelman's reliance on GM's engineering files on pitman arm complaints for the ratio 2/64 on the basis of uncertainties in how the file was compiled and made to include other data available from GM and its dealers. The survey of Cadillac owners used to estimate the expected future number of pitman arm failures was never introduced in evidence and was considered unreliable by the government. The government pointed out that the fraction of past pitman arm failures implied by the survey was undercut by other, more solid evidence, being only one-fourth as great as the ratio implied by the excess (over adjacent models) of replacement pitman arms sold as compared to the total 1959-60 Cadillacs sold. Finally, the government presented an expert in statistics to rebut the methodology of Dr. Tetelman (who did not claim expertise in statistics) in inferring the risk of future harm, as well as criticizing the statistical significance of his input data.

B. Findings

In finding that GM had rebutted the government's "slim prima facie case" with Dr. Tetelman's testimony, the district court stated:

In the case of these Cadillacs, there is no documented injury or death resulting from pitman arm failure, as NHTSA has admitted. Furthermore there are few documented accidents. The cars are now fifteen years old. 96% of their life had been completed by the end of 1973. At the start of 1975 there were approximately 33,000 still in service. And the vehicles have travelled, in the aggregate, approximately 24 billion miles. On the basis of this extensive past experience, Dr. Tetelman projected a negligible risk in the extremely limited future that remains for these automobiles.[15]

[15] Dr. Tetelman used other data as well, but the Court relies on that portion of his analysis which is based on the life history of these automobiles.

It is, candidly, puzzling to ponder the district court's statement that it relied only on the 96% life history "portion" of Dr. Tetelman's "risk analysis" testimony, presumably meaning that the court severed that part of the analysis involving data challenged by the government, such as the Texas accident data and the survey of Cadillac owners. Yet these were all essential elements of Dr. Tetelman's purportedly conservative estimate of the likely injuries to be expected from pitman arm failures. The "life history," i. e. that 96% of the model's service life has expired, does not indicate negligible risk in the remaining life of the cars in use unless coupled with proof of lack of accidents in the cars' use in the past. There is an unstated assumption to the effect that if there had been injuries and death from pitman arm failures in the past, it would be known by someone. This presumption surfaces in the first two sentences quoted above. If the government could not come up with "documented injur[ies] or death[s]," the district court would draw an inference based on this presumed safe "life history" of the model.

The district court's finding on GM's rebuttal thus reflects an incorrect allocation of the burden of proof, as developed in section II.B, supra, and therefore should be set aside. Application of the correct standard leads to the conclusion that the "risk analysis" evidence presented in this case is incapable of carrying GM's burden of rebuttal. It suffices to focus on the figures used: that of the 64 complaints in the GM files which were considered "confirmed" instances of pitman arm failures, only two involved "reportable accidents." The government's expert in statistics testified that this was a miniscule sample of the thousands of pitman arm failures indicated by the replacement part sales, which would suffice by itself as proof of the characteristics of pitman arm failures generally. Significantly, there was no attempt by GM to prove that this was a representative sample.

VI. CONCLUSION

Logically, this would indicate that we should reverse the judgment and order judgment entered for the government on remand. However, the case was not tried before us. This appellate court may not properly act as the finder of fact, since there may be some ramifications of the evidence or fact-finding functions we have not fully discerned. In any event, there must be a remand or determination of appropriate relief.

This opinion concludes that in the remand for further proceedings the district court may and should reconsider the safety-related issue in light of the standard of proof and rebuttal set forth herein.

In its enforcement action, the government sought a civil penalty of $400,000 for failure to furnish the defect notifications. In approving the statutory scheme whereby a manufacturer runs the risk of such a penalty by litigating the merits of a notification order after failing to obtain temporary relief, a three-judge district court approved the purpose of deterring frivolous litigation, while permitting substantial challenges to be raised. The Supreme Court affirmed, Ford Motor Co. v. Coleman, 425 U.S. 927, 96 S.Ct. 1656, 48 L.Ed.2d 170 (1976). The district court left open the standard and interplay of factors which determine the actual amount of the penalty set. The district court has latitude to take into account its view of the seriousness of the safety-related defect and the manufacturer's good faith.

* * * * * *

Since most of the affected cars are no longer in operation, the import of my disagreement with the majority has more to do with the doctrine we establish for governance of this type of case in the future than the result in the case of the 1959-1960 Cadillacs. The majority elevates facts which give rise to a strong suspicion of dangerousness into a conclusive presumption of the existence of a safety-related defect. I would allow the manufacturer the opportunity to dispel this justified apprehension by proof that failure due to the defect does not occur in a dangerous fashion and that the risk arising from the defect is therefore inconsequential.