Step 4: Full View

Entities, provisions, decisions, and narrative

Back to Case
Public Health, Safety, and Welfare—Driverless/Autonomous Vehicle
Step 4 of 5

125

Entities

5

Provisions

1

Precedents

14

Questions

9

Conclusions

Stalemate

Transformation
Stalemate Competing obligations remain in tension without clear resolution
Engineer A, the risk assessment team, and the manufacturer remain bound by simultaneously valid but incompletely reconciled obligations: (1) passenger-protection loyalty vs. aggregate public-safety minimization, (2) individual professional accountability vs. collective/corporate responsibility for the encoded algorithm, and (3) design-phase safety obligations vs. an unaddressed disclosure/informed-consent obligation to purchasers. None of these tensions is definitively closed off by the Board; each stakeholder continues operating under the same unresolved rule-set rather than a rule-set shifting to a new configuration.
Full Entity Graph
Loading...
Context: 0 Normative: 0 Temporal: 0 Synthesis: 0
Filter:
Building graph...
Entity Types
Synthesis Reasoning Flow
Shows how NSPE provisions inform questions and conclusions - the board's reasoning chain

The board's deliberative chain: which code provisions informed which ethical questions, and how those questions were resolved. Toggle "Show Entities" to see which entities each provision applies to.

Nodes:
■ Provision (e.g., I.1.) ◆ Question: Board = board-explicit, Impl = implicit, Tens = principle tension, Theo = theoretical, CF = counterfactual ▬ Conclusion: Board = board-explicit, Resp = question response, Ext = analytical extension, Synth = principle synthesis ▬ Entity (hidden by default)
Edges:
→ informs → answered by → applies to
Provisions (5)
View Extraction

All provisions in play for this case: the union of board-stated references and analysis-found citations (see each provision's provenance badge). The OntServe case page's Cited NSPE Provisions panel shows the subset actually cited by the committed conclusions, so its count can be lower.

I.1 board + analysis Hold paramount the safety, health, and welfare of the public.
How this applies in the case (showing 3 of 22)
Obligation
Engineer A Public Safety Duty
This obligation directly restates the fundamental duty to hold paramount public safety health and welfare
Action
Risk Team Participation
Participating in risk assessment directly supports holding public safety paramount
State
Crash Outcome Objective Conflict
Programming crash outcome priorities directly implicates public safety and welfare
Obligation (2)
  • Engineer A Public Safety Duty
    This obligation directly restates the fundamental duty to hold paramount public safety health and welfare
  • Engineer A Paramount Safety Duty
    This obligation explicitly requires holding paramount public safety in the risk assessment work
Action (3)
  • Risk Team Participation
    Participating in risk assessment directly supports holding public safety paramount
  • Safety Concern Expression
    Raising safety concerns is a direct expression of holding public welfare paramount
  • Further Study Proposal
    Proposing further study serves to protect public safety before deployment
State (3)
  • Crash Outcome Objective Conflict
    Programming crash outcome priorities directly implicates public safety and welfare
  • Unavoidable Crash Harm Exposure
    Exposure to unavoidable harm requires holding public safety paramount
  • Autonomous Vehicle Technology Uncertainty
    Uncertainty in technology safety must be resolved with public welfare as priority
Constraint (1)
  • Engineer A Do No Harm Boundary
    This provision establishes the paramount safety duty that directly creates the do no harm constraint on Engineer A.
Principle (3)
  • Public Safety in Autonomous Vehicle Risk Assessment
    This provision establishes the paramount safety duty directly reflected in the Board's public safety principle
  • Safety in Crash Algorithm Recommendation
    The crash algorithm recommendation must prioritize public safety as required by this provision
  • Do No Harm in Autonomous Vehicle Case
    Holding safety paramount underlies the do-no-harm recommendation for further study
Role (1)
  • Engineer A Consultant Engineer
    As a professional engineer Engineer A must hold public safety paramount in the risk assessment
Event (4)
  • Pedestrian Fatality
    Engineers must prioritize public safety to prevent fatalities
  • Unavoidable Crash
    Public safety must be paramount when designing for unavoidable crash scenarios
  • Passenger Injury
    Passenger welfare falls under the duty to hold safety paramount
  • System Outcome Selection
    Programming crash outcome decisions must reflect paramount concern for public safety
Capability (5)
  • Engineer A Risk Assessment
    Engineer A must prioritize public safety while assessing risks of the autonomous vehicle system
  • Engineer A Team Risk Assessment
    Participation in the risk management team is directly tied to holding public safety paramount
  • Engineer A Ethical Reasoning
    Deciding between passenger and pedestrian safety directly invokes the paramount duty to public welfare
  • Engineer A Safety Concern Communication
    Communicating safety concerns is a direct expression of holding public safety paramount
  • Engineer A Risk Mitigation Exploration
    Exploring mitigation options serves the fundamental duty to protect public safety
II.1 board + analysis Engineers shall hold paramount the safety, health, and welfare of the public.
How this applies in the case (showing 3 of 22)
Obligation
Engineer A Public Safety Duty
This provision is the direct source of the paramount public safety obligation for engineers
Action
Risk Team Participation
Engaging in risk evaluation upholds the duty to prioritize public safety
State
Crash Outcome Objective Conflict
Engineers must prioritize public safety when resolving crash outcome objectives
Obligation (2)
  • Engineer A Public Safety Duty
    This provision is the direct source of the paramount public safety obligation for engineers
  • Engineer A Paramount Safety Duty
    This provision mandates engineers hold paramount public safety matching this specific obligation
Action (3)
  • Risk Team Participation
    Engaging in risk evaluation upholds the duty to prioritize public safety
  • Safety Concern Expression
    Voicing safety concerns fulfills the engineer's paramount duty to the public
  • Further Study Proposal
    Recommending additional study reflects commitment to public safety and welfare
State (3)
  • Crash Outcome Objective Conflict
    Engineers must prioritize public safety when resolving crash outcome objectives
  • Unavoidable Crash Harm Exposure
    Public safety must remain paramount even when harm is unavoidable
  • Autonomous Vehicle Technology Uncertainty
    Technology uncertainty must be addressed with public safety as the foremost concern
Constraint (1)
  • Engineer A Do No Harm Boundary
    This provision reinforces the safety and welfare obligation that bounds Engineer A actions during the risk assessment.
Principle (3)
  • Public Safety in Autonomous Vehicle Risk Assessment
    This provision restates the paramount obligation to protect public safety used by the Board
  • Safety in Crash Algorithm Recommendation
    The engineer's recommendation on crash outcomes must be guided by this paramount safety duty
  • Do No Harm in Autonomous Vehicle Case
    The do-no-harm approach is grounded in the fundamental duty to hold safety paramount
Role (1)
  • Engineer A Consultant Engineer
    Engineer A must hold paramount the safety health and welfare of the public in the autonomous vehicle assessment
Event (4)
  • Pedestrian Fatality
    Engineers must hold paramount public safety to avoid pedestrian deaths
  • Unavoidable Crash
    Safety must remain paramount in unavoidable crash design decisions
  • Passenger Injury
    Passenger safety is part of the public welfare engineers must protect
  • System Outcome Selection
    Selecting system outcomes requires prioritizing safety of all involved
Capability (5)
  • Engineer A Risk Assessment
    Engineer A's risk assessment work must be grounded in holding public safety paramount
  • Engineer A Team Risk Assessment
    Team evaluation of the vehicle system is governed by the duty to hold public safety paramount
  • Engineer A Ethical Reasoning
    The ethical tradeoff between passenger and pedestrian safety is a direct application of this duty
  • Engineer A Safety Concern Communication
    Raising safety concerns fulfills the engineer's obligation to hold public safety paramount
  • Engineer A Risk Mitigation Exploration
    Seeking additional mitigations supports the paramount duty to public safety
II.1.b board + analysis Engineers shall approve only those engineering documents that are in conformity with applicable standards.
How this applies in the case (showing 3 of 11)
Obligation
Engineer A Risk Mitigation Exploration Duty
Approving only conforming documents relates to ensuring technical mitigations meet standards before approval
Action
Technical Options Exploration
Exploring technical options relates to ensuring documents and designs meet applicable standards
State
Team Recommendation Pending
Engineers must ensure the pending recommendation conforms to applicable safety standards
Obligation (2)
  • Engineer A Risk Mitigation Exploration Duty
    Approving only conforming documents relates to ensuring technical mitigations meet standards before approval
  • Engineer A Further Study Proposal Duty
    Proposing further study aligns with only approving documents that conform to applicable standards
Action (1)
  • Technical Options Exploration
    Exploring technical options relates to ensuring documents and designs meet applicable standards
State (2)
  • Team Recommendation Pending
    Engineers must ensure the pending recommendation conforms to applicable safety standards
  • Autonomous Vehicle Technology Uncertainty
    Approval of designs requires conformity to standards despite technological uncertainty
Principle (1)
  • Safety in Crash Algorithm Recommendation
    Approving crash algorithm documents requires conformity with applicable safety standards
Role (1)
  • Engineer A Consultant Engineer
    Engineer A must only approve engineering documents that conform to applicable safety standards
Event (1)
  • System Outcome Selection
    Engineers must ensure outcome selection algorithms conform to applicable safety standards
Resource (1)
  • BER Case 96-4
    Both address engineers approving work against applicable safety testing standards.
Capability (2)
  • Engineer A Risk Assessment
    Engineer A should only approve risk assessment conclusions that conform to applicable safety standards
  • Engineer A Team Risk Assessment
    Team approval of the vehicle design must conform to applicable engineering standards
II.3.b board + analysis Engineers may express publicly technical opinions that are founded upon knowledge of the facts and competence in the subject matter.
How this applies in the case (showing 3 of 8)
Obligation
Engineer A Safety Concern Expression Duty
Expressing safety concerns is a technical opinion founded on knowledge and competence in the subject matter
Action
Safety Concern Expression
Expressing safety concerns publicly must be grounded in factual and competent technical judgment
State
Autonomous Vehicle Technology Uncertainty
Engineers may share technical opinions grounded in fact about uncertain autonomous vehicle technology
Obligation (1)
  • Engineer A Safety Concern Expression Duty
    Expressing safety concerns is a technical opinion founded on knowledge and competence in the subject matter
Action (1)
  • Safety Concern Expression
    Expressing safety concerns publicly must be grounded in factual and competent technical judgment
State (1)
  • Autonomous Vehicle Technology Uncertainty
    Engineers may share technical opinions grounded in fact about uncertain autonomous vehicle technology
Principle (1)
  • Safety in Crash Algorithm Recommendation
    Engineer A's technical opinion on crash outcomes must be based on competent knowledge of facts
Role (1)
  • Engineer A Consultant Engineer
    Engineer A may publicly express technical opinions based on knowledge and competence regarding the vehicle safety
Event (1)
  • New Technology Uncertainty
    Engineers may share informed opinions about uncertainties in new autonomous vehicle technology
Capability (2)
  • Engineer A Ethical Reasoning
    Engineer A's technical opinion on safety tradeoffs must be founded on facts and competence
  • Engineer A Safety Concern Communication
    Expressing safety concerns publicly or internally requires grounding in factual competence
III.1.b board + analysis Engineers shall advise their clients or employers when they believe a project will not be successful.
How this applies in the case (showing 3 of 12)
Obligation
Engineer A Safety Concern Expression Duty
Advising the employer of concerns aligns with the duty to advise when a project may not be successful
Action
Safety Concern Expression
Advising the employer of safety issues aligns with warning about potential project failure
State
Team Recommendation Pending
Engineers should advise if the pending project recommendation may not succeed
Obligation (2)
  • Engineer A Safety Concern Expression Duty
    Advising the employer of concerns aligns with the duty to advise when a project may not be successful
  • Engineer A Further Study Proposal Duty
    Proposing further study is a direct way to advise the employer that the project may not be ready or successful
Action (2)
  • Safety Concern Expression
    Advising the employer of safety issues aligns with warning about potential project failure
  • Further Study Proposal
    Proposing further study is a way of advising the employer that the project needs more validation
State (2)
  • Team Recommendation Pending
    Engineers should advise if the pending project recommendation may not succeed
  • Pre-Utilization Study Window
    Engineers must advise clients during the study phase if the project may fail
Principle (1)
  • Do No Harm in Autonomous Vehicle Case
    This provision supports advising the employer that further study is needed before proceeding
Role (1)
  • Engineer A Consultant Engineer
    Engineer A must advise the manufacturer client if the autonomous vehicle project poses safety concerns
Event (1)
  • New Technology Uncertainty
    Engineers should advise employers if uncertain technology poses risks to project success
Resource (1)
  • BER Case 96-4
    Both involve advising on business versus safety tradeoffs when a project may face standards issues.
Capability (2)
  • Engineer A Safety Concern Communication
    Engineer A must advise the employer if the project's safety approach may not be successful
  • Engineer A Risk Mitigation Exploration
    Advising on unresolved risks relates to informing the employer of potential project failure
Cross-Case Connections
View Extraction
Explicit Board-Cited Precedents 1

Cases explicitly cited by the Board in this opinion. These represent direct expert judgment about intertextual relevance.

Principle Established:

Engineers have an obligation to disclose safety-related technical concerns and recommend further testing/study based on technical findings alone, separate from business or financial considerations, so that employers can make informed decisions in furtherance of public health, safety, and welfare; engineers should strive to do no harm in the performance of their professional services.

Citation Context:

The Board cited this prior case involving software design testing to illustrate the principle that engineers must balance business pressures against technical findings and make recommendations based solely on technical concerns to protect public health, safety, and welfare, applying similar reasoning to the autonomous vehicle scenario.

Relevant Excerpts
discussion: "One example of this was BER Case 96-4, which involved software design testing."
discussion: "Although the facts in the present case are somewhat different than those in Case 96-4, the Board of Ethical Review believes that several points discussed in the previous case are pertinent to the case at hand."
discussion: "In BER Case 96-4, Engineer A's ethical concerns in the case were not related directly to the safety of the software, but instead to the availability of a new draft safety testing standard that might require additional scrutiny of the software."
discussion: "Implicit in Case 96-4 is the notion that in seeking to fulfill one's ethical obligations, engineers should strive to do no harm in the performance of their professional services."
Implicit Similar Cases 10 Similarity Network

Cases sharing ontology classes or structural similarity. These connections arise from constrained extraction against a shared vocabulary.

Component Similarity 59% Facts Similarity 42% Discussion Similarity 64% Outcome Alignment 100% Tag Overlap 25% Principle Overlap 68%
Same outcome unclear View Synthesis
Component Similarity 51% Facts Similarity 38% Discussion Similarity 52% Outcome Alignment 100% Tag Overlap 60% Principle Overlap 59%
Same outcome unclear View Synthesis
Component Similarity 53% Facts Similarity 45% Discussion Similarity 53% Outcome Alignment 100% Tag Overlap 33% Principle Overlap 76%
Same outcome unclear View Synthesis
Component Similarity 60% Facts Similarity 44% Discussion Similarity 37% Outcome Alignment 100% Principle Overlap 73%
Same outcome unclear View Synthesis
Component Similarity 53% Facts Similarity 37% Discussion Similarity 53% Outcome Alignment 100% Tag Overlap 25% Principle Overlap 72%
Same outcome unclear View Synthesis
Component Similarity 58% Facts Similarity 52% Discussion Similarity 53% Outcome Alignment 100% Tag Overlap 20% Principle Overlap 55%
Same outcome unclear View Synthesis
Component Similarity 48% Facts Similarity 32% Discussion Similarity 52% Outcome Alignment 50% Tag Overlap 100% Principle Overlap 71%
View Synthesis
Component Similarity 47% Facts Similarity 34% Discussion Similarity 47% Outcome Alignment 100% Tag Overlap 27% Principle Overlap 66%
Same outcome unclear View Synthesis
Component Similarity 43% Facts Similarity 22% Discussion Similarity 61% Outcome Alignment 100% Tag Overlap 40% Principle Overlap 69%
Same outcome unclear View Synthesis
Component Similarity 46% Facts Similarity 21% Discussion Similarity 55% Outcome Alignment 100% Tag Overlap 17% Principle Overlap 64%
Same outcome unclear View Synthesis
Questions & Conclusions (1 board)
View Extraction
Board Board question 1

What are Engineer A’s ethical obligations?

Board conclusion Engineer A has a responsibility to fully and actively participate as a member of the engineering risk management team, clearly and unambiguously express any and all concerns he has regarding the safety of the proposed autonomous vehicle operation system, and explore additional potential technical options that could mitigate the risks identified in the proposed system. In light of the fact that engineers should strive to do no harm in the performance of their professional services, if necessary, Engineer A should propose that further study be undertaken by the company before the autonomous vehicle operating system is utilized. That being said, to address the specific question posed in the case, Engineer A has an obligation to state that the prime ethical obligation of the vehicle operation is to minimize harm to affect the least number of persons.
Resolved by: The board subordinates any personal preference for passenger-favoring outcomes to the paramount public safety duty, resolving the tension by requiring full participation, clear expression of concerns, and a proposal for further study rather than silent deference or unilateral withdrawal. (confidence 0.85)
I.1. II.1. III.1.b. 3 principles 3 facts Conditions Narrative
Implicit (3)

Who should bear ultimate responsibility for the ethical trade-offs encoded in the autonomous vehicle's crash-decision algorithm—the individual engineer, the risk assessment team, or the manufacturer as a corporate entity?

AnalyticalThe Board's conclusion that Engineer A must actively participate and voice concerns presumes that individual advocacy within the team is sufficient to discharge his ethical duty. However, this leaves unresolved the question of ultimate accountability: because the final crash-algorithm decision will be implemented by the manufacturer as a corporate entity, Engineer A's personal obligation to hold paramount public safety may not translate into control over the outcome. The Board's framework should be extended to recognize a layered responsibility structure in which the individual engineer's duty is to ensure his professional judgment is fully and transparently placed into the corporate decision-making record, while ultimate accountability for the adopted algorithm rests with the manufacturer and the collective risk assessment team, not with Engineer A alone.
Resolved by: Individual advocacy duty is weighed against corporate implementation authority by splitting responsibility into layers, so Engineer A's non-delegable duty to voice judgment is satisfied without requiring him to control or guarantee the final corporate outcome. (confidence 0.75)
I.1. II.1. 3 principles 3 facts Conditions Narrative
AnalyticalRegarding Q101, responsibility for the ethical trade-offs encoded in the crash-decision algorithm is not solely Engineer A's individual burden, but he cannot delegate away his personal professional duty. As a licensed professional serving on the risk assessment team, Engineer A retains an individual, non-transferable obligation under his paramount duty to the public to ensure his own professional judgment is clearly voiced within the team process. The team and the manufacturer as a corporate entity bear collective and organizational responsibility for the final decision, but this does not relieve Engineer A of his individual duty to actively shape that decision through full participation and clear expression of concerns.
Resolved by: Individual non-transferable professional duty is balanced against collective and organizational responsibility by holding both simultaneously, so Engineer A's obligation to voice judgment does not depend on, nor is it discharged by, the team's or manufacturer's ultimate decision. (confidence 0.75)
I.1. II.1. 2 principles 3 facts Conditions Narrative

Given the significant uncertainty surrounding autonomous vehicle technology, does the risk assessment team have an obligation to recommend delaying deployment entirely rather than merely proposing further study?

Also discussed in: C1

What obligations does Engineer A have if the manufacturer rejects the team's safety concerns and proceeds with a crash algorithm the engineer believes is unsafe?

AnalyticalRegarding Q104, if the manufacturer rejects the team's safety concerns and proceeds with a crash algorithm Engineer A believes is unsafe, his obligations do not end with internal advocacy. Consistent with the duty to advise employers when a project will not be successful or may pose undue risk, Engineer A must formally document his objections and, if the safety concerns are serious enough to threaten the safety, health, or welfare of the public, he may need to escalate the matter within the organization or ultimately decline further participation in a manner that does not violate confidentiality obligations, since his paramount duty to the public survives any rejection of his recommendation by the client.
Resolved by: The paramount duty to public safety is weighed against loyalty and confidentiality obligations to the employer, with public safety prevailing once the risk is serious enough, but confidentiality still bounding how escalation may occur. (confidence 0.80)
I.1. II.1. III.1.b. 3 principles 3 facts Conditions Narrative
Principle tension (2)

How should the principle of prioritizing vehicle passenger safety in the crash algorithm be balanced against the broader principle of minimizing total harm to all persons involved, including pedestrians and cyclists?

AnalyticalThe Board resolves the apparent conflict between a passenger-favoring 'Safety in Crash Algorithm Recommendation' principle and the broader 'Public Safety in Autonomous Vehicle Risk Assessment' principle by subordinating passenger-specific safety to aggregate harm minimization. In effect, the Code's paramount public safety duty is interpreted expansively to include all road users—pedestrians, cyclists, and motorcyclists—not just the vehicle's own occupants, meaning the manufacturer's client-facing interest in passenger protection cannot override the engineer's broader obligation to the public at large.
Resolved by: The engineer's narrower duty to favor the client's passengers is subordinated to the broader, paramount duty to protect all road users, because the Code's public safety obligation is read to extend beyond the immediate client relationship. (confidence 0.80)
I.1. II.1. 3 principles 3 facts Conditions Narrative

Does the principle of public safety in autonomous vehicle risk assessment, which considers all road users, conflict with a crash algorithm principle that specifically favors protecting the vehicle's own passengers?

Also discussed in: C301
Theoretical (3)

From a deontological perspective, did Engineer A fulfill his duty to hold paramount the safety, health, and welfare of the public while serving on the autonomous vehicle risk assessment team?

Also discussed in: C301

From a consequentialist standpoint, does programming the vehicle to minimize harm to the greatest number of people (potentially sacrificing passenger safety) produce the best overall outcome compared to prioritizing passenger safety above all else?

Also discussed in: C302

Did Engineer A act with professional integrity, in the virtue-ethics sense, by committing to clearly and unambiguously voice his safety concerns and press for further study rather than deferring silently to the team's momentum toward a recommendation?

Also discussed in: C1
Counterfactual (3)

If Engineer A had not been formally assigned as a member of the engineering risk assessment team but instead only reviewed the recommendation after it was finalized, would the Board still conclude he had a duty to fully and actively participate in shaping the team's recommendation?

AnalyticalThe Board's resolution is procedural rather than fully substantive: it prioritizes minimizing harm as the answer to the narrow crash-algorithm question, but leaves unresolved how this principle interacts with other principles such as informed consent of vehicle purchasers, corporate accountability for encoded ethical trade-offs, and the reversibility of risk distribution (e.g., if passengers faced the lesser harm). This suggests the case establishes a priority ordering for principles only within the specific fact pattern presented, without generalizing a fixed hierarchy applicable to all autonomous vehicle risk scenarios.
Resolved by: The board resolves only the immediate harm-minimization question and does not weigh it against unaddressed obligations such as informed consent or corporate accountability, leaving their relative priority unsettled. (confidence 0.75)
I.1. II.1. 3 principles 3 facts Conditions Narrative
Also discussed in: C201

If the crash scenario under consideration were avoidable rather than unavoidable, would the Board's conclusion that the prime ethical obligation is to minimize harm to the least number of persons still apply in the same way?

Also discussed in: C303 C103

If the scenario instead posed a choice between a certain fatality for the vehicle's passengers versus a probable but non-life-threatening injury to a pedestrian or cyclist (reversing which party bears the greater risk), would the Board still hold that minimizing harm to the least number of persons is the prime ethical obligation?

AnalyticalThe Board's conclusion treats 'minimize harm to the least number of persons' as a stable ethical rule, but this formulation may not hold uniformly across all crash configurations. Where the relative severity of harm is reversed—for example, a certain fatality to passengers versus a probable but non-life-threatening injury to a third party—the same aggregate-minimization logic could yield a different, even opposite, recommendation. This suggests the Board's stated obligation should be understood as a general orientation toward harm minimization rather than a fixed hierarchy favoring third parties over passengers, and that Engineer A's duty to explore additional technical options must include stress-testing the algorithm's ethical logic against varied severity and probability combinations, not just the single scenario presented.
Resolved by: The general aggregate-harm-minimization principle is weighed against scenario-specific severity reversals by treating it as a flexible orientation rather than a fixed hierarchy, requiring re-testing of the logic against each new configuration. (confidence 0.75)
I.1. II.1. 2 principles 3 facts Conditions Narrative
Also discussed in: C303
Analytical questions (2)

Questions the analysis generates beyond the board’s explicit questions: implicit issues, principle tensions, theoretical framings, and counterfactuals. A question with an identified source board question appears nested under that question above.

Implicit (1)

Should vehicle purchasers or passengers be informed that the autonomous system may be designed to prioritize minimizing total harm rather than maximizing their personal safety?

AnalyticalThe Board's conclusion establishes a substantive ethical standard (minimize harm to the least number of persons) but does not address a procedural dimension: whether the adoption of a harm-minimizing algorithm that may expose vehicle passengers to greater risk than they might otherwise expect creates an independent obligation of disclosure to purchasers or users. Engineer A's duty to avoid doing harm arguably extends beyond the design phase into ensuring that the ethical trade-off embedded in the system is not concealed from those who will rely on it, since informed consent and transparency are foundational to the profession's broader public welfare obligations even though the Board's conclusion is silent on this communicative dimension.
Resolved by: The duty to avoid harm is weighed against silence on trade-offs by extending it into a communicative obligation, favoring disclosure and informed consent over allowing users to remain unaware of embedded risk allocation. (confidence 0.70)
II.1. II.3.b. III.1.b. 2 principles 3 facts Conditions Narrative
Principle tension (1)

If minimizing overall harm sometimes requires exposing vehicle passengers to greater risk than pedestrians, does this create tension with an engineer's duty to hold paramount the safety of the client's own product users?

AnalyticalThe 'Do No Harm in Autonomous Vehicle Case' principle functions as the tie-breaker that operationalizes the paramount safety duty into a concrete decision rule: when harm is unavoidable, the ethically preferred algorithmic outcome is the one causing harm to the fewest people, even if that harm falls disproportionately on the vehicle's own passengers. This shows that in situations of genuine trade-off between identifiable groups, the Board prioritizes a utilitarian minimization-of-harm calculus over a duty-based obligation to protect a specific class of persons (the client's passengers), effectively ranking aggregate welfare above particularized loyalty.
Resolved by: A utilitarian minimization-of-harm calculus is weighed against a duty-based obligation to protect the client's passengers specifically, with the former prevailing as the operative decision rule when harm is unavoidable. (confidence 0.75)
I.1. II.1. 3 principles 3 facts Conditions Narrative
Decisions & Arguments (6)
View Extraction

Should Engineer A fully and actively participate on the risk assessment team and clearly voice his safety concerns about the crash algorithm, or defer quietly to the team's emerging consensus?

Options considered:
O1 Fully engage as a team member and clearly and unambiguously state all safety concerns about the crash algorithm, pressing them into the team's deliberations. Board's choice
O2 Participate nominally but avoid pressing personal safety concerns once it appears the team is converging on a recommendation, to preserve team cohesion and timeline.
O3 Express reservations privately to individual colleagues or supervisors rather than placing them formally into the team's collective record.
Argument structure (Toulmin):
Grounds

Engineer A was assigned as a consultant to a risk assessment team evaluating a new autonomous vehicle operating system whose crash algorithm must choose between a pedestrian fatality and a passenger injury in an unavoidable crash, and the underlying technology is novel and uncertain.

Warrant

Engineers must hold paramount the safety, health and welfare of the public, and engineers serving on a review or assessment team must fully and actively participate and be objective and truthful in voicing their professional judgment; team membership duty and safety concern expression duty jointly outweigh a duty to avoid team friction.

Rebuttal

This duty to press concerns further would not apply if the team's recommendation already fully incorporated Engineer A's stated concerns, or if the underlying technology were so novel that no team member could meaningfully identify which risks required voicing.

Engineer A Team Participation Duty and Safety Concern Expression Duty

Should Engineer A explore additional technical options to mitigate identified risks and propose further study before deployment, or accept the team's current recommendation as sufficient, or instead recommend that deployment be delayed outright?

Options considered:
O1 Recommend that the company undertake additional study of unresolved risks before the system is utilized, while continuing to explore mitigation options. Board's choice
O2 Conclude that identified risks have been sufficiently addressed by the team's existing analysis and support proceeding without further study.
O3 Argue that the uncertainty surrounding the new technology is so significant that deployment should be postponed entirely rather than merely subjected to further study.
Argument structure (Toulmin):
Grounds

The autonomous vehicle operating system is new technology whose crash-decision behavior is uncertain, and the risk assessment team identified an unavoidable crash scenario producing a choice between pedestrian fatality and passenger injury.

Warrant

Engineers should strive to do no harm in their professional services, which requires that identified risks be mitigated or, if mitigation is inadequate, subjected to further study before a system is put into public use.

Rebuttal

The duty to propose further study would not require recommending outright delay if the further study process itself can adequately identify and mitigate the risks, or if delay would itself entrench other harms by withholding a net safety-improving technology.

Engineer A Risk Mitigation Exploration Duty and Further Study Proposal Duty Engineer A Do No Harm Boundary

Should Engineer A endorse an algorithm design that minimizes harm to the fewest number of persons overall, or one that prioritizes protecting the vehicle's own passengers even if this increases harm to pedestrians or cyclists?

Options considered:
O1 Endorse a design that selects the outcome causing harm to the smallest number of people, even where this disadvantages the vehicle's own passengers. Board's choice
O2 Endorse a design that specifically favors protecting the vehicle's own occupants as the manufacturer's direct customers, even if this increases risk to pedestrians or cyclists.
O3 Advocate for an algorithm that stress-tests and adjusts its harm-minimization logic across varied severity and probability combinations rather than applying a fixed rule favoring one class of persons.
Argument structure (Toulmin):
Grounds

In an unavoidable crash the system must select between a pedestrian fatality and a passenger injury; the vehicle's passengers are the manufacturer's direct customers while pedestrians and cyclists are third-party road users exposed to the same system.

Warrant

Engineers must hold paramount the safety, health and welfare of the public, understood to include all road users and not only the client's product users; where harm cannot be avoided, this paramount duty is operationalized as minimizing the number of persons harmed.

Rebuttal

The rule of minimizing harm to the fewest persons would not apply in the same way if the relative severity were reversed, such as a certain passenger fatality against a probable but non-life-threatening pedestrian injury, or if passengers' assumption of risk in using the vehicle created a morally relevant asymmetry with non-consenting third parties.

Engineer A Paramount Safety Duty Engineer A Do No Harm Boundary

Should Engineer A advocate that purchasers and passengers be informed that the autonomous system may be designed to minimize total harm rather than maximize their personal safety, or treat this design logic as proprietary information not requiring disclosure?

Options considered:
O1 Press the team and manufacturer to inform purchasers and passengers that the system may sacrifice their personal safety to minimize total harm across all road users. Board's choice
O2 Accept that the crash algorithm's ethical trade-off logic is proprietary design information not requiring disclosure to purchasers or passengers.
O3 Support including general language about harm-minimization logic in technical or legal documentation without direct, specific notification to purchasers.
Argument structure (Toulmin):
Grounds

The crash algorithm embeds a harm-minimization logic that may expose passengers to greater risk than they would otherwise expect, and this design choice is determined internally by the manufacturer and risk assessment team rather than communicated to end users.

Warrant

Engineers must strive to do no harm and must hold paramount the safety, health and welfare of the public, which extends to ensuring that ethical trade-offs affecting user safety are not concealed from those who rely on the product, since informed reliance is part of the profession's broader public welfare obligation.

Rebuttal

This disclosure obligation would not apply if the manufacturer can show that revealing the algorithm's logic would predictably cause purchasers to behave in ways that increase overall harm, undermining the very safety purpose the disclosure was meant to serve.

Engineer A Safety Concern Expression Duty Engineer A Do No Harm Boundary

If the manufacturer rejects the team's safety concerns and proceeds with an algorithm Engineer A believes is unsafe, should Engineer A formally document and escalate his objections, or accept the manufacturer's decision and continue participating as before?

Options considered:
O1 Place objections formally into the corporate record and escalate the safety concern within the organization, potentially declining further participation if the risk remains unresolved. Board's choice
O2 Accept the manufacturer's final decision as within its corporate authority and continue serving on the team without further formal objection.
O3 Bypass internal escalation and report the unresolved safety concern directly to an external regulatory or licensing authority.
Argument structure (Toulmin):
Grounds

The manufacturer rejected the risk assessment team's safety concerns and proceeded with a crash algorithm that Engineer A continued to believe was unsafe for the public.

Warrant

Engineers must hold paramount the safety, health and welfare of the public even after a client or employer rejects their recommendation, and engineers must advise their employer when a project will not be successful or poses undue risk to the public.

Rebuttal

This escalation duty would not apply if the residual risk from the rejected algorithm falls within accepted engineering tolerances comparable to existing accepted risks in autonomous vehicle deployment, in which case Engineer A's paramount safety warrant may no longer be triggered.

Engineer A Public Safety Duty

Should Engineer A treat the ethical trade-offs encoded in the crash algorithm as his individual ultimate responsibility, or as a layered responsibility shared with the risk assessment team and the manufacturer?

Options considered:
O1 Fulfill the personal duty to voice concerns and explore mitigations fully, while recognizing that final accountability for the adopted algorithm rests with the team and manufacturer collectively. Board's choice
O2 Insist that Engineer A alone bears ultimate ethical responsibility for the crash algorithm's trade-offs, demanding personal veto power over the team's recommendation.
O3 Treat the outcome as solely the team's or manufacturer's decision, withdrawing any sense of personal accountability once a recommendation is made.
Argument structure (Toulmin):
Grounds

Engineer A was one member of a multi-person risk assessment team evaluating a system whose final crash algorithm would be adopted and implemented by the manufacturer as a corporate entity.

Warrant

Engineers must hold paramount the safety of the public through their own individual professional judgment, and must fully and actively participate as team members, but final implementation authority and accountability rest with the corporate entity that adopts the recommendation.

Rebuttal

This layered responsibility framework would not apply, shifting fuller individual responsibility back to Engineer A, if he failed to fully express his concerns or explore mitigations and was not in fact overruled by the team or company.

Engineer A Paramount Safety Duty and Team Participation Duty
Event Timeline (10)
10 sequenced 5 actions 5 events
Case timeline
The emergence of driverless/autonomous vehicle operating system technology introduces new uncertainties and potentially significant risk into the case, creating the conditions the risk assessment team must address.
State changes (1)
  • began: Autonomous Vehicle Technology Uncertainty
The automobile manufacturer assigns Engineer A, a consulting professional engineer, to an engineering risk assessment team tasked with making recommendations about crash scenarios for the proposed autonomous vehicle operating system.
Causal-normative reasoning(confidence 0.70)
Because New Technology Uncertainty drives the manufacturer to form the consultant team, this action carries no direct normative weight itself but sets in motion the causal chain that places Engineer A in a position where subsequent ethical obligations become active, so its neutrality is appropriate since responsibility only attaches once participation begins.
Engineer A fully and actively participates as a member of the engineering risk management team evaluating crash-scenario behavior of the proposed autonomous vehicle operating system. The discussion presents this as Engineer A's prescribed conduct.
Fulfills (1)
  • Responsibility to Fully and Actively Participate on the Risk Assessment Team
Causal-normative reasoning(confidence 0.85)
Because Risk Team Participation causally leads to Safety Concern Expression, Engineer A's active engagement fulfills the responsibility to fully participate and is guided by holding paramount public safety, which matters because without this participation the safety concerns that could mitigate Passenger Injury and Pedestrian Fatality downstream would never surface.
Engineer A clearly and unambiguously expresses any and all concerns he has regarding the safety of the proposed autonomous vehicle operating system to the risk assessment team. This is the discussion's prescribed conduct for Engineer A.
Fulfills (1)
  • Responsibility to Clearly Express Safety Concerns
Causal-normative reasoning(confidence 0.85)
Since Safety Concern Expression arises directly from Risk Team Participation and precedes the manufacturer's System Outcome Selection that causes both Passenger Injury and Pedestrian Fatality, fulfilling the responsibility to clearly express concerns under the guidance of do no harm and public safety is critical because it represents Engineer A's key opportunity to influence the harmful outcome before it is finalized.
Engineer A explores additional potential technical options that could mitigate the risks identified in the proposed autonomous vehicle operating system, as prescribed by the discussion.
Fulfills (1)
  • Responsibility to Explore Risk-Mitigating Technical Options
Causal-normative reasoning(confidence 0.80)
Technical Options Exploration fulfills the responsibility to explore risk-mitigating alternatives and, guided by do no harm and public safety, causally enables the Further Study Proposal, meaning this action matters because it is the constructive engineering response that could have altered the System Outcome Selection and thereby reduced the eventual passenger and pedestrian harms.
If necessary, Engineer A proposes that further study be undertaken by the company before the autonomous vehicle operating system is utilized. The discussion frames this as a conditional prospective action, to be taken if needed to fulfill the obligation to do no harm.
Fulfills (1)
  • Responsibility to Propose Further Study if Necessary
Causal-normative reasoning(confidence 0.80)
Further Study Proposal fulfills the responsibility to propose additional study when needed and, following causally from Technical Options Exploration, matters because it represents Engineer A's final documented attempt, guided by do no harm and public safety, to prevent the harmful System Outcome Selection from being adopted without further risk mitigation.
Hypothetical scenario under consideration by the risk assessment team in which a driverless/autonomous vehicle encounters a crash situation that cannot be avoided, triggering the software's programmed response.
Hypothetical automatic response in which the autonomous vehicle's software system selects a crash outcome, either the option maximizing passenger safety or the option minimizing overall harm to all parties involved.
Hypothetical harm outcome in which the vehicle crashes into a stationary object under the system's minimized-harm option, probably causing serious but non-life-threatening injuries to some passengers.
Hypothetical harm outcome in which the vehicle strikes a pedestrian, cyclist, or motorcycle rider under the passenger-priority option, potentially causing a fatal injury.
Narrative (1 main characters)
View Extraction
Opening Context

Written in second person from the engineer's point of view, so you read the case as the professional experienced it. Underlined names link to the character's profile below.

You are Engineer A, a professional engineer retained as a consultant to an automobile manufacturer that is evaluating development of a driverless, autonomous vehicle operating system. You have been assigned to an engineering risk assessment team tasked with making recommendations on how the vehicle's control software should respond to unavoidable crash scenarios. One scenario under review involves a situation where the system must choose between an outcome that maximizes protection for the vehicle's own passengers and one that minimizes total harm across all parties, including pedestrians, cyclists, or motorcycle riders, even if that means directing the vehicle into a stationary object such as a telephone pole at the risk of serious but non-fatal injury to occupants. The team's recommendation will inform how the crash algorithm is coded before the system is considered for deployment. In the coming discussions, you will need to weigh how to engage with the team, what technical and ethical positions to take, and how to handle disagreement if it arises.

Main characters (1)

Each card shows the roles a person holds and the tensions those roles raise for them. A single person may carry several roles in the case, and a tension between obligations can implicate more than one person at once. Click Show all tensions for the full list.

Engineer A Roles in this case: Consultant Engineer

Guided by: Safety in Crash Algorithm Recommendation, Public Safety in Autonomous Vehicle Risk Assessment, Do No Harm in Autonomous Vehicle Case

Engineer A's duty to function as a cooperative member of the design team can pull against the duty to voice dissenting safety concerns, since raising objections repeatedly may be seen as undermining team cohesion or second-guessing colleagues who have already signed off on the design.

Tension between Engineer A Paramount Safety Duty and Engineer A Do No Harm Boundary

Tension between Engineer A Safety Concern Expression Duty and Engineer A Do No Harm Boundary

Tension between Engineer A Risk Mitigation Exploration Duty and Further Study Proposal Duty and Engineer A Do No Harm Boundary

The overriding duty to protect public safety may require Engineer A to escalate concerns beyond the team or override team consensus, which conflicts with the expectation of deferring to collective team decisions and maintaining normal working relationships.

Proposing additional study or delay to address safety uncertainty can be perceived as obstructing the team's progress or questioning the competence of other team members, creating friction between the duty to seek further analysis and the duty to work cooperatively within the team structure.

Other people involved in the case but not central to the opening narrative.

The Board’s deliberation

How the Board of Ethical Review resolved the case, verbatim from its published conclusions.

Engineer A has a responsibility to fully and actively participate as a member of the engineering risk management team, clearly and unambiguously express any and all concerns he has regarding the safety of the proposed autonomous vehicle operation system, and explore additional potential technical options that could mitigate the risks identified in the proposed system. In light of the fact that engineers should strive to do no harm in the performance of their professional services, if necessary, Engineer A should propose that further study be undertaken by the company before the autonomous vehicle operating system is utilized. That being said, to address the specific question posed in the case, Engineer A has an obligation to state that the prime ethical obligation of the vehicle operation is to minimize harm to affect the least number of persons.
Opening States (5)
Crash Outcome Objective Conflict Unavoidable Crash Harm Exposure Team Recommendation Pending Autonomous Vehicle Technology Uncertainty Pre-Utilization Study Window
Summary
  • Engineers serving on risk management teams are expected to actively raise safety concerns within the team process rather than acting unilaterally outside it.
  • The case frames a 'do no harm' boundary as a limit on how safety concerns are expressed, suggesting that overreach or unilateral escalation can itself be a form of harm.
  • When duties conflict without a clear hierarchy, the board tends to resolve the tension procedurally, by defining participation and communication obligations rather than settling which duty takes precedence.

© Licensed under the GNU GPL v3