|
During pre-production planning, Pinto engineers considered using the same tank used in the Capri, which rode atop the rear axle and differential housing, and was separated by a shielding baffle. In more than 50 crash tests, it withstood rear-end impacts of 60 miles per hour. So why wasn't the Capri tank used in the Pinto? Or why wasn't the Capri's tank baffle placed between the Pinto's tank and its axle? When it was discovered that the gas tank was unsafe, did anyone go to Iacocca and tell him?5
Accident reports of rear-end collisions involving Pintos confirmed that if you ran into one, its rear end would fold, the filler pipe would tear away from the fuel tank and gasoline would pour out. In worst cases, if the speed and collision angle were just right, it was likely that the Pinto's doors would jam, trapping passengers inside.
Ford used a "cost-benefit" study to support its design decision against altering the fuel tanks. It estimated that the unmodified tanks would cause 180 burn deaths, 180 serious burn injuries and 2,100 burned vehicles each year, costing the company a total of $49.5 million. In contrast, the cost of modifying the design was higher: alterations would cost $11 per car, totaling $137 million per year.
What are the consequences of ostensibly decoupling risk-acceptance outcomes from the risk-acceptance decision-maker? It's not about death to systems' participants or individual systems' destruction; it's about fall-out from major risk assumption decisions that lead to unintended consequences that really do affect decision-makers. As a result of the company's choices, many Ford employees ended up unemployed, with their reputations tarnished, after the Pinto succumbed to the unintended consequences of the company's assumed risks. The demise of the Pinto followed directly from those decision-makers' choices. We doubt that personal consequences were ever identified or even considered during the process of Ford's assuming risks on behalf of its customers.
Example #2 of an Uncoupled Accountability Gap: The Concorde's Fuel Tanks6
Hazards arising from the Concorde's fuel tank design resulted in a predictable, disastrous accident at Gonesse, France, in July of 2000, and initiated the supersonic transports' unintended retirement. The Concorde had dodged catastrophe after six earlier foreign-object penetrations into its poorly protected fuel tanks over more than 20 years.7 The Bureau d'Enquêtes et d'Analyses pour la Sécurité de l'Aviation Civile (BEA)8 reported that, incredibly, 57 cases of burst tires had occurred between June 1979 and October 1993, almost four per year in both the Air France and British Airways fleets.9 In addition to tanks suffering structural damage, tire failures resulted in damage to critical aircraft components, such as wheels, brakes, hydraulic lines and control surfaces. Available BEA reports do not identify Air France's decision not to take action to mitigate the risks of foreign objects penetrating its planes' fuel tanks as contributory to the accident. We could find no evidence that Concorde program managers or risk-assessment decision-makers considered that their failure to take action to mitigate those obvious risks might lead to the demise of the entire Concorde program.10
|
)
)