The Pinto Problem

December 16, 2006

In the seventies, Japanese car makers introduced a new style of car into the American market: the sub-compact. Initially regarded by American manufacturers as a non-competitive joke, the Japanese cars rapidly gained acceptance and mass appeal once the oil crisis kicked into high gear. Caught off guard by the changes in the marketplace, the Americans scrambled to design and release small, high-mileage automobiles. Ford’s entry into this genre, the Pinto, presents an excellent case study for those of us who study the use of probabilistic methods in risk assessment.

Fairly late in the design process, a flaw in the Pinto was revealed. Under certain types of rear-end collisions, there was a small chance that the entire gas tank would ignite, quite literally turning the car into a deathtrap. An engineering workaround was available, but at a cost, of course. Fitting the solution into the Pinto’s manufacturing would result in an additional cost of eleven dollars per car.

This problem left the management at Ford facing a decision: allow the Pinto to proceed as per the original design, or spend the fixed cost per car to mitigate the risk. So the good MBAs pulled out their risk management toolset: estimate the probability of the particular type of accident (quite low), estimate the monetary costs of settling with the families of accident victims, and multiply the two values to arrive at the expected value, per car, of using the original design. Now they had a number that they could compare with the fixed costs of risk mitigation. The estimated cost per car was in the neighborhood of five dollars, which made the decision simple: five is much less then eleven, so why make any changes?

Of course, if you are of a certain age, you probably remember the results. Exploding Pintos were big news, and when it made the news that Ford had been aware of the problem, but had not opted to fix it, Ford suffered a tremendous public relations blow. Pinto jokes were, for a long time, a staple of the popular culture, and even now, the Pinto is remembered explosively. Yet, statistically, the Pinto wasn’t really that different from any of the similar cars of the time, and only 27 people actually died in Pinto fireballs.

So, what are the lessons to be learned?

  1. People are very bad at understanding probabilities intuitively. When presented with an event that has a very low probability, they will tend to treat it as if it will never happen. Although the actual “Pinto Memo” very responsibly laid out the assessments of expected number of deaths, it was probably the case that managers given access to the raw data were willing to dismiss the problem, based on the probability assignments.
  2. People are also bad at assessing second-order costs. In this particular case, it was easy to gather statistical information about liability costs, but it was also easy to overlook the impact of negative publicity. Ford lost sales across the entire product line, and gained a reputation as the manufacturer of “four seat barbeques”. The actual cost of litigation was substantial, even beyond the settlement costs.
  3. Failure is more enduring than success. The Pinto was actually one of the most popular cars of the seventies, and the safety statistics were actually on par with its contemporaries. But still, it is remembered as a deathtrap, and remains the butt of many jokes.

These lessons combine to form what I call “The Pinto Problem”, and the question is, how can we apply them to the field of disaster recovery?

One approach is to just use a sledgehammer. When you haven’t accounted for the second-order impacts of a failure, inflate the cost estimates. When you see a low-probability event, inflate the probability of failure. Or, more formally, introduce noise into your estimates. When you have significant doubt about the actual costs, or want to be more risk-adverse, increase the noise factor in your calculations. This approach is straightforward, and is appropriate for situations where you both want to be very risk-adverse and where you have the money and time to commit to a solution.

A more sophisticated approach is risk mitigation: recognize the subtleties of the Pinto problem, and attempt to address them point-by-point. Devote a significant amount of time brainstorming and analyzing second-order costs, examining customer impact, and then recognizing that there are probably many other costs that you haven’t been able to identify. Wherever possible, avoid using probabilities in anything other than calculations, as they will probably confuse the issue when presented to people. And above all, always recognize that rare events will happen, and you must have a plan to deal with them.


2 Responses to “The Pinto Problem”

  1. jwbates said

    I actually have much more to say about the risk mitigation approach, but the Nyquil is kicking in, and I’m afraid that anything I write might wind up being just, “La la la la la”. More later.

  2. […] People discussing reliability often toss around the claim that their particular system meets the “five nines” criterion: most often interpreted as “this system will experience only five minutes of downtime per year”. The use of this metric is an excellent example of the Pinto problem, in that it preys upon people’s weakness when it comes to probability. […]

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: