We're all aware of the two mega-recalls of Toyota vehicles. The quick and easy explanation is that "cars are too complicated" and "cars have too many processors and too much software."
Certainly, there is some truth to that (software-controlled cars creep me out), but the sticking-accelerator problem has nothing to do with electronics; it's a mechanical problem with a mechanical solution. But the real problem which designers of mass-market, high-volume products really face is the law of large numbers. When you have tens or hundreds of thousands of a product out in the market, some of their incredibly obscure and subtle problems will eventually surface.
These secondary and tertiary effects are the manifestations of data points and sequences which are severe outliers, residing on the edges of that Gaussian curve. From an engineering standpoint, unfortunately, it's almost impossible to test for these circumstances.
Even if a designer diligently does life tests on a reasonable number of units, they will not uncover problems which occur only in extremely low numbers. It's one thing to stress-test a few hundred cars for tens of thousands of miles, but the truly rare problems which arise from hundreds of thousands of units are very different.
This testing dilemma became very clear to me when I met with the team at Tufts University which developed one of the wet labs on the Mars Phoenix Lander (See EE Times' story here:"Mars lander's chem lab is NASA's MECA"). The instrumentation package had a small drawer which had to open once--but only once--after the long and cold journey through space. I asked them what their biggest design challenge was, and they told me it was guaranteeing that the drawer mechanism would work.
The problem was that it had to work once, and only once. Testing the mechanism over and over would not prove that it would work that critical first cycle, which is the only one that mattered.
The alternative test strategy would be to build hundreds, or even thousands, of these mechanisms and test them each once, which was obviously impractical. They did a lot of modeling, analysis, simulation, and tests, but in the end, could never prove with absolute certainty that the drawer would actually open that first time (which it did).
To those pundits in media who so quickly criticize the Toyota problem as a result of poor engineering and inadequate testing, I say "you have no idea what you are talking about." It's only because the basic design is so good and reliable, and the number of units on the road is so large, that these problems can even have a chance to appear. The law of large numbers is tough to work around, and does not yield easily to amendments.