Case file
- What happened: 1993–2004 Jeep Grand Cherokees carried a plastic fuel tank at the extreme rear of the vehicle, below the bumper. In low-speed rear impacts the tank could be punctured and ignite, killing occupants who had survived the collision itself.
- Scale: Dozens of fiery deaths across the vehicle's life – safety advocates counted more than 75 – and a 2013 recall of roughly 1.5 million US vehicles under NHTSA pressure.
- Root cause: The tank sat behind every energy-absorbing structure the vehicle had. Fuel-system integrity was managed as a compliance item, not as a crashworthiness requirement.
- The bill: A 1.5-million-vehicle campaign whose remedy was a bolt-on trailer hitch, plus two decades of litigation and regulatory conflict – the true cost of poor quality for one layout decision.
Here is an uncomfortable observation from two decades of gateway reviews: the fuel tank never wins a packaging argument. It has no advocate in the studio, no line on the option sheet, no seat at the layout table. It goes wherever the rear seats, the spare wheel and the cargo volume allow. On the 1993–2004 Grand Cherokee that meant the extreme rear, below the bumper line. Everything that followed was physics doing what physics does.
The situation
The Grand Cherokee arrived in the early 1990s into a market that wanted more interior on less footprint. The packaging answer was familiar: everything migrates forward, the tank migrates aft. It ended up behind the rear axle, at the very back of the vehicle, its aft face close to – and partly below – the bumper. In a rear impact, an intruding vehicle or a pole reached the tank before it reached any structure whose job was absorbing energy.
The vehicle was certified. It passed the federal fuel-system integrity standard of its day, FMVSS 301, as written and as tested. It was legal. It was not safe. NHTSA's later analysis of field data would put the Grand Cherokee's rear-impact fire fatality rate above comparable SUVs. The signal sat in the fleet long before anyone conceded it.
How it unfolded
The deaths accumulated through the 1990s and 2000s: low-speed rear impacts, survivable collisions, fatal fires. The Center for Auto Safety petitioned NHTSA. The agency investigated, and its analysis pointed one direction. In June 2013 Chrysler publicly declined a recall, insisting the vehicles contained no defect. Within days, under explicit regulatory pressure, it agreed to recall about 1.5 million US vehicles – the 1993–2004 Grand Cherokees, plus Libertys sharing the vulnerability.
The remedy tells its own story. The tank did not move. Chrysler installed trailer hitches – a bolt-on crush structure to take the first hit. An accessory-catalogue part promoted to safety device: that is what a decade of resistance bought. Recall logistics, hitch parts, dealer labour, litigation – the CoPQ ledger on a single layout decision, paid twenty years later. With interest.
Root-cause anatomy
Technically, this case is clean. A crashworthy vehicle is a managed energy budget: bumper, crush cans, rails – structures that convert impact energy into deformation before it reaches things that burn. The Grand Cherokee's tank sat behind all of it, shielded by millimetres of plastic and carpet. In DFMEA language: severity 10, occurrence arguable, detection effectively zero. No end-of-line test. No certification test at the speeds and geometries actually killing people. And once the layout froze, no revision short of a new vehicle.
The tank didn't fail its spec. The vehicle failed the tank.
Organisationally, the root cause is a boundary nobody drew. Packaging owned millimetres, crashworthiness owned structures, and fuel-system integrity fell into the gap – administered as compliance, a checklist rather than a discipline. Once "it passes FMVSS 301" became the answer, the question stopped being asked. When field data arrived, legal risk management outbid technical risk management for a decade. The 1999 redesign carried the placement forward. A second chance, spent on nothing.
Where the quality system failed
Run the public record – petitions, agency reports, recall filings – through the standard disciplines, and every one had a stop sign available.
Start with DFMEA. "Tank puncture in low-speed rear impact" is a textbook severity-10 line, and once the layout froze, detection should have scored near zero – which forces preventive action. My reading of the record is that certification passing got treated as the detection control. It isn't one. FMVSS 301 tests one geometry, one speed, one barrier; the field was killing people at others.
The APQP gateway is next. Layout freeze, and no sign in the record of a crash-energy sign-off covering fuel-system placement. The gate reviewed the feasibility of the package, not the survivability of the occupant. Feasibility asks whether the thing can be built. Survivability asks whether it ought to be.
Change control and the field loop closed the trap. The 1999 redesign re-inherited the placement, and nothing in the record suggests the decision was ever reopened. Fire incidents flowed into claims files and litigation instead of a living FMEA or a forced 8D while the fleet was young. Data that could have ended the argument by 2004 was still being argued in 2013.
Under VDA 6.3 logic, the process-audit question writes itself: show me where safety-critical subsystems sit inside your crash-energy management plan. If such an artefact existed on this programme, twenty years of field data says it never functioned. That silence is the finding.
What would have caught it
- A hard layout rule written into the design standards: nothing that carries fuel goes aft of the last energy-absorbing structure without dedicated attenuation of its own.
- An energy overlay on the packaging buck at the first layout study. Walk every exterior surface and ask what an impactor meets first, second, third – and at what speed the third item starts to burn.
- Severity-10 discipline. When severity is 10 and safety is involved, occurrence and detection arithmetic does not close the line. Engineering action or design change, full stop.
- Benchmark teardown. Comparable SUVs of the era packaged tanks ahead of the rear axle or behind real structure; one afternoon of teardown comparison exposes the outlier.
My take
Mine now, not the case's. In gateway reviews I chaired at Witte Automotive, the argument I lost least often was the one Chrysler defended for twenty years: it meets the spec. A spec tests one barrier at one speed. The customer meets the whole world. Building the quality organisation for a 900-person greenfield plant at SNOP, I made layout reviews ask the energy question before the millimetre question, because unfreezing a layout costs a hundred times what freezing it right does. I have also sat on the other side of stubbornness – de-escalating positions defended so long that changing them felt like defeat. That is Chrysler's June 2013 week, at industrial scale. In my aerospace work under AS9100, by contrast, fuel-system integrity lives inside structures engineering, not packaging – one conversation from the first sketch.
What this means on your floor
- Treat fuel and energy storage as a crashworthiness subsystem with a named owner from the first layout study – not as cargo-space residue.
- Nothing safety-critical behind the last line of energy absorption without designed attenuation. Write it into the design rules and audit against it.
- Severity-10 failure modes get engineering action, not occurrence arithmetic. Ban "it passes the regulation" as a detection control.
- Route field fire and incident data straight into the living FMEA. A fire is a signal, never a wear item.
The tank was not a bad component. It passed every test written for it. The failure was upstream – a layout study where millimetres of cargo space outranked joules of impact energy, and a quality system that let the decision escape review. Twenty years and 1.5 million vehicles later, the bill arrived in full: recalls, courtrooms, trust. Have the conversation at the first layout study, or physics will schedule it for you.
