A closer examination of risk-benefit analyses reveals

some conceptual difficulties.14 Both risks and benefits lie

in the future. As there is some uncertainty associated with
them, we should address their expected values (provided
such a model fits the situation); in other words, we should
multiply the magnitude of the potential loss by the
probability of its occurrence, and similarly with the gain.
But who establishes these values, and how? If the benefits
are about to be realized in the near future but the risks are
far off, how is the future to be discounted in terms of, say,
an interest rate so we can compare present values? What if
the benefits accrue to one party, and the risks are incurred
by another party?
 Given sufficient information, an individual can decide
whether to participate in (or consent to exposure to) a risky
activity (an experiment). Individuals are more ready to
assume voluntary risks than they are involuntary risks, or
activities over which they have no control, sometimes even
when the voluntary risks are 1,000 times more likely to
produce a fatality than the involuntary ones.
 Some would advocate that the marketplace should
decide, assuming market values can come into play. But
today there is no over-the-counter trade in lives. Nor are
even more mundane gains and losses easily priced. If the
market is being manipulated, or if there is a wide difference
between “product” cost and sales price, it matters under
what conditions the buying or selling takes place. For
example, if one buys a loaf of bread, it can matter whether it
is just one additional daily loaf among others; it is different
when it is the first loaf available in weeks. Or, if you are
compensated for a risk by an amount based on the exposure
tolerance of the average person, yet your tolerance of a
condition or your propensity to be harmed is much greater
than average, the compensation is apt to be inadequate.
 The result of these difficulties in assessing personal risk is that
analysts employ whatever quantitative measures are ready at hand. In
regard to voluntary activities, one could possibly make judgments on the
basis of the amount of life insurance a person buys. Is that individual
going to offer the same amount to a kidnapper to be freed? Or is there
likely to be a difference between future events (requiring insurance) and
present events (demand for ransom)? In assessing a hazardous job, one
might look at the increased wages a worker demands to carry out the
task.
Faced with the wide range of variables possible in such
assessments, one can only suggest that an open procedure, overseen by
trained arbiters, be employed in each case as it arises. Conversely, for
people taken in a population-at-large context, it is much easier to use
statistical averages without giving offense to anyone in particular.
 Risks and benefits to the public at large are more
easily determined because individual differences tend to
even out as larger numbers of people are considered. Also,
assessment studies relating to technological safety can be
conducted more readily in the detached manner of a
macroscopic view as statistical parameters take on greater
significance. This occurs, for example, in studies by the
National Highway Traffic Safety Administration (NHTSA),
which proposes a value for human life based on loss of
future income and other costs associated with an accident.
Yet, studies repeatedly show that “policy analysts do not
evaluate the risk of their subjects’ lives as highly as people
evaluate risks to heir own (and others’) lives. Consequently,
too many risks are taken.
 It is almost impossible to build a completely safe
product or one that will never fail. The best one can do is to
assure that when a product fails, (1) it will fail safely, (2) the
product can be abandoned safely, or—at least—(3) the user
can safely escape the product. Let us refer to these three
conditions as safe exit. It is not obvious who should take the
responsibility for providing safe exit. But apart from
questions of who will build, install, maintain, and pay for a
safe exit system there remains the crucial question of who
will recognize the need for a safe exit.
 Providing for a safe exit is an integral part of the
social experimental procedure—in other words, of sound
engineering. The experiment is to be carried out without
causing bodily or financial harm. If safety is threatened, the
experiment must be terminated. The full responsibility
cannot fall on the shoulders of a lone engineer, but one can
expect the engineer to issue warnings when a safe exit does
not exist or the experiment must be terminated. The only
way one can justify the continuation of an experiment
without safe exit is for all participants (including the
subjects of the experiment) to have given valid consent for
its continuation.
 Here are some examples of what this might involve. Ships
need lifeboats with enough spaces for all passengers and crew
members. Buildings need usable fire escapes. The operation of
nuclear power plants calls for realistic ways to evacuate nearby
communities. The foregoing are examples of safe exits for people.
Provisions are also needed for safe disposal of dangerous products
and materials: Altogether too many truck accidents and train
derailments have exposed communities to toxic gases, and too many
dumps have let toxic wastes get to the groundwater table or into the
hands of children. Finally, avoiding system failure might require
redundant or alternative means of continuing a process when the
original process fails. Examples would be backup systems for
computer-based data banks, air traffic control systems, automated
medical treatment systems, or sources of water for fire fighting.