Autonomous Vehicles and the Trolley Problem: A Machine Ethics Explainer

Ask ten people what a self-driving car should do when a crash cannot be avoided and you will get ten confident answers. Then ask how the car knew the crash was unavoidable, how certain it was, and what it did four seconds earlier to end up in that position. The room goes quiet. That silence is where machine ethics actually lives. The famous thought experiment gets the headlines; the hard work happens in unglamorous places: perception thresholds, speed policy, following distance, and logs nobody reads until something goes wrong.

The Trolley Problem, Stripped of Its Props

Philosophers have argued about the runaway trolley since the 1960s. A brakeless trolley heads toward five workers. You can throw a switch and divert it onto a track where one worker stands. Most people pull the switch. Then comes the variant: push a large stranger off a footbridge to stop the trolley and save the five. Most people refuse. Same arithmetic, different intuition.

The point is not that people are inconsistent. Moral judgment tracks more than body counts. It tracks whether you acted or merely allowed something, whether the harmed person was used as an instrument, and how close your hand was to the lever. Now move the scenario to a two-lane road: brake failure, a cyclist ahead, oncoming traffic to the left, a wall to the right. Someone has to decide how the software behaves before the car ever leaves the factory. That decision is a moral one, whether or not anyone calls it that.

Why a Car Is Not a Trolley

Four differences matter more than the shape of the dilemma itself.

• Time. A trolley driver has seconds and a binary lever. An automated system has a few hundred milliseconds and a continuous range of braking, steering, and horn inputs.
• Uncertainty. The thought experiment hands you certainties: five people, one person, death either way. Sensors hand you probabilities: an object that is probably a pedestrian, classified with moderate confidence, moving left at an estimated speed.
• History. The trolley appears from nowhere. A crash is usually the end of a chain the vehicle itself partly wrote, through its speed, following distance, lane choice, and reaction to an earlier cut-in.
• Scale. One trolley, one decision. A fleet makes millions of small decisions a day, and each one sets a precedent for every car running the same software.

The Dilemma Nobody Codes

Because of those differences, serious engineering programs treat the trolley case as a design failure rather than a feature to optimize. The question shifts from "whom do we hit?" to "how do we make it very unlikely that we are ever in that position?" That means limiting where and when the vehicle is allowed to operate, slowing down in dense pedestrian areas, keeping redundant braking and steering, and refusing to run on roads the system was not validated for. A car that drives at 20 km/h past a school at dismissal time has already answered most of the ethical question.

The Hierarchy That Does Get Coded

What does get written down is a priority order. Something like: protect people over property; avoid the collision if there is any path that does so; if a collision is truly imminent, reduce severity; and do not create new victims to spare existing ones. That last clause is why "swerve into oncoming traffic" tends to be rejected outright, even when the arithmetic of a crash simulation looks favorable. The software is not choosing who dies. It is choosing which harms it is willing to cause.

Three Moral Frameworks, One Codebase

Most real systems mix three philosophical traditions without labeling them.

• Rule-based thinking. Hard constraints that never bend: never intentionally steer into a person, always yield to a pedestrian in a crosswalk, never exceed the posted limit by design. Predictable, auditable, occasionally rigid.
• Consequence-based thinking. Compare predicted outcomes and pick the least harmful. Useful for grading severity, dangerous when it becomes a permission slip to harm one person to save several.
• Risk-distribution thinking. Ask who bears the risk a maneuver creates, not just how much harm it produces. This is what stops a vehicle from routinely shifting danger onto cyclists and pedestrians to keep its own occupants comfortable.

Good design keeps the rule layer thin and absolute, and uses the other two only inside the space the rules leave open.

Whose Values Get Installed?

There is no neutral answer. A well-known online experiment run by researchers at MIT collected moral preferences from millions of participants around the world and found that choices vary by country and culture: who people protect first, how much they weight age, how much they trust jaywalkers to share the blame. A vehicle sold globally meets locally specific norms.

Some jurisdictions have tried to settle the matter in writing. Germany's ethics commission on automated driving published guidelines holding that the protection of human life has the highest priority, that animals and property rank below people, and that distinguishing between victims on the basis of personal characteristics such as age or disability is prohibited. Whatever one thinks of the specifics, the move is worth noting: a legislature, not an engineering team, stated the value hierarchy.

Protection of human life outranks every other consideration, and no one gets a lower weight because of something they cannot change.

Regulation, Accountability, and the Paper Trail

Regulators shape behavior less through trolley rules than through approval conditions. European rules, for example, have permitted a limited automated lane-keeping function for motorway driving at low speeds, with strict operating conditions and a driver who must remain ready to take over. That is a value judgment expressed as a speed limit and a handover requirement.

Accountability is the harder problem. When a crash involves an automated function, investigators want to know what the system sensed, what it predicted, what it commanded, and when. Event data recording, version control, and plain-language documentation of decision thresholds are what turn a philosophical claim into something a court or a safety board can examine. Liability questions, product law, and criminal responsibility vary widely between countries, and this is general background rather than legal advice; for a specific incident or product, consult a qualified lawyer in the relevant jurisdiction.

Design Habits That Beat Dilemma-Solving

1. Define the operating domain tightly, and treat leaving it as a safety event, not a graceful degradation.
2. Write the priority hierarchy down in plain language, then trace each line of it to code that implements it.
3. Represent uncertainty honestly. A system that is 55 percent sure an object is a pedestrian should behave differently from one that is 99 percent sure.
4. Test the mitigations, not the dilemma. Measure how often the vehicle gets close to a hard choice at all.
5. Log enough to reconstruct a decision long after the fact, and keep those logs readable by people who are not engineers.

Questions Worth Asking

When the next unavoidable-crash story appears, skip the hypothetical and ask these instead:

• What operating conditions was the system approved for, and was it inside them?
• What did the vehicle do in the preceding thirty seconds that shaped the situation?
• Who wrote the priority hierarchy, and can the public read it?
• What were the recall and over-the-air update timelines after earlier incidents?

The trolley problem endures because it is compact and dramatic. Machine ethics is neither. It is a long series of small, documented choices about speed, distance, restraint, and honesty about what the system can and cannot see. Get those right, and the lever rarely appears in the first place.

Photo: Chandra Phuyal / Pexels