Case file
- What happened: Tread separation on Firestone ATX, ATX II, and Wilderness AT tires — predominantly fitted to Ford Explorers — caused vehicles to lose control and roll over at highway speed.
- Scale: Linked to 271 US deaths and hundreds of injuries; roughly 6.5 million tires recalled in August 2000.
- Root cause: Manufacturing drift at Firestone's Decatur plant, a low recommended tire pressure (26 psi) that increased heat buildup, and an SUV platform sensitive to sudden tire failure. The pattern was visible in warranty and claims data for years before the recall.
- The bill: 271 lives, massive litigation, Congressional hearings, and the end of a supply relationship that had lasted nearly a century.
The situation
Ford launched the Explorer in 1990 as a Bronco II replacement. Heavier, higher-riding, designed for comfort as much as capability. Firestone supplied the tires — a partnership stretching back to the Model T. The ATX and Wilderness tires were specified at 26 psi, well below the 30–35 psi typical for that size and load rating. Lower pressure, softer ride. Also: more sidewall flex, more heat, less margin when a tire begins to delaminate.
The Explorer's high centre of gravity meant a sudden tread separation at speed could trigger a rollover. This was not news to automotive engineers. It was a known trade-off sitting inside the system, waiting for a manufacturing weakness to expose it.
How it unfolded
Claims accumulated through the early and mid-1990s. Tread separations, concentrated in hot climates — the southern US, Venezuela, Saudi Arabia, Thailand. Ford replaced Firestone tires on Explorers in several overseas markets in 1999, a full year before the US recall, without triggering a domestic escalation proportionate to the signal. State Farm Insurance reportedly flagged the pattern to NHTSA before the formal investigation opened. Both Ford and Firestone held warranty and claims data showing elevated failure rates for specific tire models. Much of it pointed to tires produced at the Decatur, Illinois plant.
NHTSA opened its formal investigation in May 2000. Firestone announced the recall in August. By then the deaths were counted and two brands were already broken.
Root-cause anatomy
Three factors converged. The Decatur plant exhibited manufacturing drift — variation in rubber compounds, adhesion problems between steel belts, inconsistent curing. These are the conditions that feed belt-edge separation. The 26 psi recommendation increased operating temperature and reduced tolerance for any belt-adhesion weakness. A tire that might survive at 32 psi could delaminate at 26. And the Explorer's rollover propensity amplified any sudden failure from a survivable incident into a fatal one.
Organisationally, the failure was simpler and worse. Claims data was a cost-tracking exercise, not a leading safety indicator. Nobody owned the trend. Ford and Firestone each held data the other needed, but the supplier governance structure created no joint escalation path for field-failure trending. The Decatur signal was buried in aggregate warranty reporting instead of segmented by production source.
Where the quality system failed
On the PFMEA side: specifying 26 psi instead of 30–35 was a design trade-off with a direct, predictable effect on tire temperature and belt durability. This needed a formal failure-mode analysis connecting recommended pressure to thermal load to belt-adhesion margin. A PFMEA that scores severity at 9 or 10 for tread separation at highway speed does not permit "softer ride" as mitigation.
Supplier quality governance failed next. The Decatur drift should have surfaced through process capability trending and audit depth. When warranty claims cluster around a single plant, that is a supplier escalation gate — not a curiosity for the next quarterly review.
And CAPA. Corrective action for early field failures was either absent or ineffective. Overseas markets saw the same tire fail the same way. An insurance carrier flagged the pattern. These are 8D triggers. None was run early enough to alter the trajectory.
Warranty data is free PFMEA input. If you are not feeding field failures back into your design risk register, you are paying for the data twice — once in the claim, and again in the next failure.
What would have caught it
Claims data segmented by tire model, vehicle application, manufacturing plant, and geographic region — trended monthly, owned by a named quality engineer with escalation authority. Not a department. A person. The Decatur signal needed trending warranty claims back to production source, not aggregation by tire line. Basic supplier scorecard discipline, and it was not done.
A formal PFMEA linking psi to thermal load to belt-adhesion margin, with severity scoring that reflects rollover risk. If severity is catastrophic, the trade-off passes through a different gate entirely. Contractual escalation thresholds: a defined field-failure rate triggering joint root-cause analysis within 30 days, not after years of claims pile up. And process audits at Decatur targeting the specific failure modes — belt adhesion, compound variation, cure consistency. Not generic compliance checklists.
My take
I have been the person who opens warranty data and finds the pattern nobody wanted to see. At SNOP, building the quality system for a 900-person greenfield plant, I insisted claims and field returns became a standing item on the Q-Wall. Not something finance tracked for reserve purposes. You trend it by customer, by part number, by production line. When something spikes, it goes to QRQC the same day. Not next quarter.
The Ford–Firestone case is the one I cite when someone in a leadership meeting treats warranty reserves as a routine cost line. They are not. Warranty data is your highest-fidelity signal for what your design and your supplier base are actually doing in the field. If you do not own it, route it, and act on it, you are flying blind — and you will not know how blind until the investigation opens.
In my current role at Airbus, the regulatory architecture does not tolerate learning from warranty claims after the fact. The underlying mechanism is the same. Field data flows back into design risk registers, supplier scorecards, and audit programmes. When that loop is tight, you prevent. When it is loose, you investigate — and you explain to someone why you did not see it coming.
What this means on your floor
- Make warranty and claims data a standing KPI on your quality wall, segmented by supplier, plant, and product. Name the owner — a person, not a department.
- Run a PFMEA on every design trade-off that touches safety margin. Pressure, load, temperature, speed. If you are trading margin for comfort or cost, the severity score decides whether you are allowed to.
- Set a contractual escalation threshold with your suppliers: field-failure rate above a defined level triggers joint 8D within 30 days. No exceptions, no waivers.
- Audit for the failure modes that actually harm people — not the paperwork that makes auditors comfortable.
