OPINION

TOBRINER, Acting C.J.

In August 1970, plaintiff Ray Barker was injured at a construction site at the University of California at Santa Cruz while operating a high-lift loader manufactured by defendant Lull Engineering Co. and leased to plaintiff's employer by defendant George M. Philpott Co., Inc. Claiming that his injuries were proximately caused, inter alia, by the alleged defective design of the loader, Barker instituted the present tort action seeking to recover damages for his injuries. The jury returned a verdict in favor of defendants, and plaintiff appeals from the judgment entered upon that verdict, contending primarily that in view of this court's decision in Cronin v. J.B.E. Olson Corp. (1972) 8 Cal.3d 121 [ 104 Cal.Rptr. 433, 501 P.2d 1153], the trial court erred in instructing the jury "that strict liability for a defect in design of a product is based on a finding that the product was unreasonably dangerous for its intended use. . . ."

As we explain, we agree with plaintiff's objection to the challenged instruction and conclude that the judgment must be reversed. In Cronin, we reviewed the development of the strict product liability doctrine in California at some length, and concluded that, for a variety of reasons, the "unreasonably dangerous" element which section 402A of the Restatement Second of Torts had introduced into the definition of a defective product should not be incorporated into a plaintiff's burden of proof in a product liability action in this state. Although defendants maintain that our Cronin decision should properly be interpreted as applying only to "manufacturing defects" and not to the alleged "design defects" at issue here, we shall point out that the Cronin decision itself refutes any such distinction. Consequently, we conclude that the instruction was erroneous and that the judgment in favor of defendants must be reversed.

In addition, we take this opportunity to attempt to alleviate some confusion that our Cronin decision has apparently engendered in the lower courts. Although in Cronin we rejected the Restatement's "unreasonably dangerous" gloss on the defectiveness concept as potentially confusing and unduly restrictive, we shall explain that our Cronin decision did not dictate that the term "defect" be left undefined in jury instructions given in all product liability cases.

As Cronin acknowledged, in the past decade and a half California courts have frequently recognized that the defectiveness concept defies a simple, uniform definition applicable to all sectors of the diverse product liability domain. Although in many instances — as when one machine in a million contains a cracked or broken part — the meaning of the term "defect" will require little or no elaboration, in other instances, as when a product is claimed to be defective because of an unsafe design or an inadequate warning, the contours of the defect concept may not be self-evident. In such a case a trial judge may find it necessary to explain more fully to the jury the legal meaning of "defect" or "defective." We shall explain that Cronin in no way precluded such elucidation of the defect concept, but rather contemplated that, in typical common law fashion, the accumulating body of product liability authorities would give guidance for the formulation of a definition.

As numerous recent judicial decisions and academic commentaries have recognized, the formulation of a satisfactory definition of "design defect" has proven a formidable task; trial judges have repeatedly confronted difficulties in attempting to devise accurate and helpful instructions in design defect cases. Aware of these problems, we have undertaken a review of the past California decisions which have grappled with the design defect issue, and have measured their conclusions against the fundamental policies which underlie the entire strict product liability doctrine.

As we explain in more detail below, we have concluded from this review that a product is defective in design either (1) if the product has failed to perform as safely as an ordinary consumer would expect when used in an intended or reasonably foreseeable manner, or (2) if, in light of the relevant factors discussed below, the benefits of the challenged design do not outweigh the risk of danger inherent in such design. In addition, we explain how the burden of proof with respect to the latter "risk-benefit" standard should be allocated.

This dual standard for design defect assures an injured plaintiff protection from products that either fall below ordinary consumer expectations as to safety, or that, on balance, are not as safely designed as they should be. At the same time, the standard permits a manufacturer who has marketed a product which satisfies ordinary consumer expectations to demonstrate the relative complexity of design decisions and the trade-offs that are frequently required in the adoption of alternative designs. Finally, this test reflects our continued adherence to the principle that, in a product liability action, the trier of fact must focus on the product, not on the manufacturer's conduct, and that the plaintiff need not prove that the manufacturer acted unreasonably or negligently in order to prevail in such an action.

1. The facts of the present case

Plaintiff Barker sustained serious injuries as a result of an accident which occurred while he was operating a Lull High-Lift Loader at a construction site. The loader, manufactured in 1967, is a piece of heavy construction equipment designed to lift loads of up to 5,000 pounds to a maximum height of 32 feet. The loader is 23 feet long, 8 feet wide and weighs 17,050 pounds; it sits on 4 large rubber tires which are about the height of a person's chest, and is equipped with 4-wheel drive, an automatic transmission with no park position and a hand brake. Loads are lifted by forks similar to the forks of a forklift.

The loader is designed so that the load can be kept level even when the loader is being operated on sloping terrain. The leveling of the load is controlled by a lever located near the steering column, and positioned between the operator's legs. The lever is equipped with a manual lock that can be engaged to prevent accidental slipping of the load level during lifting.

The loader was not equipped with seat belts or a roll bar. A wire and pipe cage over the driver's seat afforded the driver some protection from falling objects. The cab of the loader was located at least nine feet behind the lifting forks.

On the day of the accident the regular operator of the loader, Bill Dalton, did not report for work, and plaintiff, who had received only limited instruction on the operation of the loader from Dalton and who had operated the loader on only a few occasions, was assigned to run the loader in Dalton's place. The accident occurred while plaintiff was attempting to lift a load of lumber to a height of approximately 18 to 20 feet and to place the load on the second story of a building under construction. The lift was a particularly difficult one because the terrain on which the loader rested sloped sharply in several directions.

Witnesses testified that plaintiff approached the structure with the loader, leveled the forks to compensate for the sloping ground and lifted the load to a height variously estimated between 10 and 18 feet. During the course of the lift plaintiff felt some vibration, and, when it appeared to several coworkers that the load was beginning to tip, the workers shouted to plaintiff to jump from the loader. Plaintiff heeded these warnings and leaped from the loader, but while scrambling away he was struck by a piece of falling lumber and suffered serious injury.

Although the above facts were generally not in dispute, the parties differed markedly in identifying the responsible causes for the accident. Plaintiff contended, inter alia, that the accident was attributable to one or more design defects of the loader. Defendant, in turn, denied that the loader was defective in any respect, and claimed that the accident resulted either from plaintiff's lack of skill or from his misuse of its product. We briefly review the conflicting evidence.

Plaintiff's principal expert witness initially testified that by reason of its relatively narrow base the loader was unstable and had a tendency to roll over when lifting loads to considerable heights; the witness surmised that this instability caused the load to tip in the instant case. The expert declared that to compensate for its instability, the loader should have been equipped with "outriggers," mechanical arms extending out from the sides of the machine, two in front and two in back, each of which could be operated independently and placed on the ground to lend stability to the loader. Evidence at trial revealed that cranes and some high lift loader models are either regularly equipped with outriggers or offer outriggers as optional equipment. Plaintiff's expert testified that the availability of outriggers would probably have averted the present accident.

The expert additionally testified that the loader was defective in that it was not equipped with a roll bar or seat belts. He stated that such safety devices were essential to protect the operator in the event that the machine rolled over. Plaintiff theorized that the lack of such safety equipment was a proximate cause of his injuries because in the absence of such devices he had no reasonable choice but to leap from the loader as it began to tip. If a seat belt and roll bar had been provided, plaintiff argued, he could have remained in the loader and would not have been struck by the falling lumber.

In addition, plaintiff's witnesses suggested that the accident may have been caused by the defective design of the loader's leveling mechanism. Several witnesses testified that both the absence of an automatic locking device on the leveling lever, and the placement of the leveling lever in a position in which it was extremely vulnerable to inadvertent bumping by the operator of the loader in the course of a lift, were defects which may have produced the accident and injuries in question. Finally, plaintiff's experts testified that the absence of a "park" position on the loader's transmission, that could have been utilized to avoid the possibility of the loader's movement during a lift, constituted a further defect in design which may have caused the accident.

Defendants in response, presented evidence which attempted to refute plaintiff's claims that the loader was defective or that the loader's condition was the cause of the accident. Defendants' experts testified that the loader was not unstable when utilized on the terrain for which it was intended, and that if the accident did occur because of the tipping of the loader it was only because plaintiff had misused the equipment by operating it on steep terrain for which the loader was unsuited. In answer to the claim that the high lift loader was defective because of a lack of outriggers, defendants' expert testified that outriggers were not necessary when the loader was used for its intended purpose and that no competitive loaders with similar height lifting capacity were equipped with outriggers; the expert conceded, however, that a competitor did offer outriggers as optional equipment on a high-lift loader which was capable of lifting loads to 40, as compared to 32, feet. The expert also testified that the addition of outriggers would simply have given the loader the functignal capability of a crane, which was designed for use on all terrain, and that an experienced user of a high-lift loader should recognize that such a loader was not intended as a substitute for a crane.

The defense experts further testified that a roll bar was unnecessary because in view of the bulk of the loader it would not roll completely over. The witnesses also maintained that seat belts would have increased the danger of the loader by impairing the operator's ability to leave the vehicle quickly in case of an emergency. With respect to the claimed defects of the leveling device, the defense experts testified that the positioning of the lever was the safest and most convenient for the operator and that the manual lock on the leveling device provided completely adequate protection. Finally, defendants asserted that the absence of a "park" position on the transmission should not be considered a defect because none of the transmissions that were manufactured for this type of vehicle included a park position.

In addition to disputing plaintiff's contention as to the defectiveness of the loader, defendants' witnesses testified that the accident probably was caused by the plaintiff's own inexperience and consequent dangerous actions. Defendants maintained that if the lumber had begun to fall during the lift it did so only because plaintiff had failed to lock the leveling device prior to the lift. Defendants alternatively suggested that although the workers thought they saw the lumber begin to tip during the lift, this tipping was actually only the plaintiff's leveling of the load during the lift. Defendants hypothesized that the lumber actually fell off the loader only after plaintiff had leaped from the machine and that plaintiff was responsible for his own injuries because he had failed to set the hand brake, thereby permitting the loader to roll backwards.

After considering the sharply conflicting testimony reviewed above, the jury by a 10 to 2 vote returned a general verdict in favor of defendants. Plaintiff appeals from the judgment entered upon that verdict.

2. (1) The trial court erred in instructing the jurors that "strict liability for a defect in design . . . is based on a finding that the product was unreasonably dangerous for its intended use."

Plaintiff principally contends that the trial court committed prejudicial error in instructing the jury "that strict liability for a defect in design of a product is based on a finding that the product was unreasonably dangerous for its intended use. . . ." Plaintiff maintains that this instruction conflicts directly with this court's decision in Cronin, decided subsequently to the instant trial, and mandates a reversal of the judgment. Defendants argue, in response, that our Cronin decision should not be applied to product liability actions which involve "design defects" as distinguished from "manufacturing defects."

The plaintiff in Cronin, a driver of a bread delivery truck, was seriously injured when, during an accident, a metal hasp which held the truck's bread trays in place broke, permitting the trays to slide forward and propel plaintiff through the truck's windshield. Plaintiff brought a strict liability action against the seller, contending that his injuries were proximately caused by the defective condition of the truck. Evidence at trial established that the metal hasp broke during the accident "because it was extremely porous and had a significantly lower tolerance to force than a nonflawed aluminum hasp would have had" (8 Cal.3d at p. 124), and, on the basis of this evidence, the jury returned a verdict in favor of plaintiff.

On appeal, defendant in Cronin argued that the trial court had erred "by submitting a definition of strict liability which failed to include, as defendant requested, the element that the defect found in the product be "unreasonably dangerous.'" ( 8 Cal. 3d at pp. 127-128 (fns. omitted).) Relying upon section 402A of the Restatement Second of Torts and a number of California decisions which had utilized the "unreasonably dangerous" terminology in the product liability context, the defendant in Cronin maintained that a product's "unreasonable dangerousness" was an essential element that a plaintiff must establish in any product liability action.

After undertaking a thorough review of the origins and development of both California product liability doctrine and the Restatement's "unreasonably dangerous" criterion, we rejected the defendant's contention, concluding "that to require an injured plaintiff to prove not only that the product contained a defect but also that such defect made the product unreasonably dangerous to the user or consumer would place a considerably greater burden upon him than that articulated in Greenman [v. Yuba Power Products, Inc. (1963) 59 Cal.2d 57 ( 27 Cal.Rptr. 697, 377 P.2d 897, 13 A.L.R.3d 1049), California's seminal product liability decision]. . . . We are not persuaded to the contrary by the formulation of section 402A which inserts the factor of an 'unreasonably dangerous' condition into the equation of products liability." (8 Cal.3d at pp. 134-135.)

Plaintiff contends that the clear import of this language in Cronin is that the "unreasonably dangerous" terminology of the Restatement should not be utilized in defining defect in product liability actions, and that the trial court consequently erred in submitting an instruction which defined a design defect by reference to the "unreasonably dangerous" standard.

In attempting to escape the apparent force of Cronin's explicit language, defendants observe that the flawed hasp which rendered the truck defective in Cronin represented a manufacturing defect rather than a design defect, and they argue that Cronin's disapproval of the Restatement's "unreasonably dangerous" standard should be limited to the manufacturing defect context. Defendants point out that one of the bases for our rejection of the "unreasonably dangerous" criterion in Cronin was our concern that such language, when used in conjunction with the "defective product" terminology, was susceptible to an interpretation which would place a dual burden on an injured plaintiff to prove, first, that a product was defective and, second, that it was additionally unreasonably dangerous. ( 8 Cal. 3d at p. 133.) Defendants contend that the "dual burden" problem is present only in a manufacturing defect context and not in a design defect case.

In elaborating this contention, defendants explain that in a manufacturing defect case, a jury may find a product defective because it deviates from the manufacturer's intended result, but may still decline to impose liability under the Restatement test on the ground that such defect did not render the product unreasonably dangerous. In a design defect case, by contrast, defendants assert that a defect is defined by reference to the "unreasonably dangerous" standard and, since the two are equivalent, no danger of a dual burden exists. In essence, defendants argue that under the instruction which the trial court gave in the instant case, plaintiff was not required to prove both that the loader was defective and that such defect made the loader unreasonably dangerous, but only that the loader was defectively designed by virtue of its unreasonable dangerousness.

Although defendants may be correct, at least theoretically, in asserting that the so-called "dual burden" problem is averted when the "unreasonably dangerous" terminology is used in a design defect case simply as a definition of "defective condition" or "defect," defendants overlook the fact that our objection to the "unreasonably dangerous" terminology in Cronin went beyond the "dual burden" issue, and was based, more fundamentally, on a substantive determination that the Restatement's "unreasonably dangerous" formulation represented an undue restriction on the application of strict liability principles.

As we noted in Cronin, the Restatement draftsmen adopted the "unreasonably dangerous" language primarily as a means of confining the application of strict tort liability to an article which is "dangerous to an extent beyond that which would be contemplated by the ordinary consumer who purchases it, with the ordinary knowledge common to the community as to its characteristics." (Rest.2d Torts, § 402A, com. i.) In Cronin, however, we flatly rejected the suggestion that recovery in a products liability action should be permitted only if a product is more dangerous than contemplated by the average consumer, refusing to permit the low esteem in which the public might hold a dangerous product to diminish the manufacturer's responsibility for injuries caused by that product. As we pointedly noted in Cronin, even if the "ordinary consumer" may have contemplated that Shopsmith lathes posed a risk of loosening their grip and letting a piece of wood strike the operator, "another Greenman" should not be denied recovery. (8 Cal.3d at p. 133.) Indeed, our decision in Luque v. McLean (1972) 8 Cal.3d 136 [ 104 Cal.Rptr. 443, 501 P.2d 1163] — decided the same day as Cronin — aptly reflects our disagreement with the restrictive implications of the Restatement formulation, for in Luque we held that a power rotary lawn mower with an unguarded hole could properly be found defective, in spite of the fact that the defect in the product was patent and hence in all probability within the reasonable contemplation of the ordinary consumer.

Thus, our rejection of the use of the "unreasonably dangerous" terminology in Cronin rested in part on a concern that a jury might interpret such an instruction, as the Restatement draftsman had indeed intended, as shielding a defendant from liability so long as the product did not fall below the ordinary consumer's expectations as to the product's safety. As Luque demonstrates, the dangers posed by such a misconception by the jury extend to cases involving design defects as well as to actions involving manufacturing defects: indeed, the danger of confusion is perhaps more pronounced in design cases in which the manufacturer could frequently argue that its product satisfied ordinary consumer expectations since it was identical to other items of the same product line with which the consumer may well have been familiar.

Accordingly, contrary to defendants' contention, the reasoning of Cronin does not dictate that that decision be confined to the manufacturing defect context. Indeed, in Cronin itself we expressly stated that our holding applied to design defects as well as to manufacturing defects (8 Cal.3d at pp. 134-135), and in Henderson v. Harnischfeger Corp. (1974) 12 Cal.3d 663, 670 [ 117 Cal.Rptr. 1, 527 P.2d 353], we subsequently confirmed the impropriety of instructing a jury in the language of the "unreasonably dangerous" standard in a design defect case. (See also Foglio v. Western Auto Supply (1976) 56 Cal.App.3d 470, 475 [ 128 Cal.Rptr. 545].) Consequently, we conclude that the design defect instruction given in the instant case was erroneous.

3. (2a) A trial court may properly formulate instructions to elucidate the "defect" concept in varying circumstances. In particular, in design defect cases, a court may properly instruct a jury that a product is defective in design if (1) the plaintiff proves that the product failed to perform as safely as an ordinary consumer would expect when used in an intended or reasonably foreseeable manner, or (2) the plaintiff proves that the product's design proximately caused injury and the defendant fails to prove, in light of the relevant factors, that on balance the benefits of the challenged design outweigh the risk of danger inherent in such design.

Defendants contend, however, that if Cronin is interpreted as precluding the use of the "unreasonably dangerous" language in defining a design defect, the jury in all such cases will inevitably be left without any guidance whatsoever in determining whether a product is defective in design or not. (See Beron v. Kramer-Trenton Company (E.D.Pa. 1975) 402 F. Supp. 1268, 1275-1276, affd. (3d Cir. 1976) 538 F.2d 318.) Amicus California Trial Lawyers Association (CTLA) on behalf of the plaintiff responds by suggesting that the precise intent of our Cronin decision was to preclude a trial court from formulating any definition of "defect" in a product liability case, thus always leaving the definition of defect, as well as the application of such definition, to the jury. As we explain, neither of these contentions represents an accurate portrayal of the intent or effect of our Cronin decision.

In Cronin, we reaffirmed the basic formulation of strict tort liability doctrine set forth in Greenman: "'A manufacturer is strictly liable in tort when an article he places on the market, knowing that it is to be used without inspection for defects, proves to have a defect that causes injury to a human being. . . .'" (8 Cal.3d at p. 130 (quoting 59 Cal.2d at p. 62).) We held in Cronin that a plaintiff satisfies his burden of proof under Greenman, in both a "manufacturing defect" and "design defect" context, when he proves the existence of a "defect" and that such defect was a proximate cause of his injuries. (8 Cal.3d at pp. 133-134.) In reaching this conclusion, however, Cronin did not purport to hold that the term "defect" must remain undefined in all contexts (see Baker v. Chrysler Corp. (1976) 55 Cal.App.3d 710, 715 [ 127 Cal.Rptr. 745]), and did not preclude a trial court from framing a definition of defect, appropriate to the circumstances of a particular case, to guide the jury as to the standard to be applied in determining whether a product is defective or not.

As this court has recognized on numerous occasions, the term defect as utilized in the strict liability context is neither self-defining nor susceptible to a single definition applicable in all contexts. In Jiminez v. Sears, Roebuck Co., supra, 4 Cal.3d 379, 383, for example, we stated: "A defect may be variously defined, and as yet no definition has been formulated that would resolve all cases or that is universally agreed upon." Indeed, in Cronin itself, we expressly recognized "the difficulties inherent in giving content to the defectiveness standard" and suggested that the problem could best be resolved by resort to the "'cluster of useful precedents'" which have been developed in the product liability field in the past decade and a half. (8 Cal.3d at p. 134, fn. 16 (citing Traynor, The Ways and Meanings of Defective Products and Strict Liability (1965) 32 Tenn.L.Rev. 363, 373).)

Resort to the numerous product liability precedents in California demonstrates that the defect or defectiveness concept has embraced a great variety of injury-producing deficiencies, ranging from products that cause injury because they deviate from the manufacturer's intended result (e.g., the one soda bottle in ten thousand that explodes without explanation ( Escola v. Coca Cola Bottling Co. (1944) 24 Cal.2d 453 [ 150 P.2d 436])), to products which, though "perfectly" manufactured, are unsafe because of the absence of a safety device (e.g., a paydozer without rear view mirrors ( Pike v. Frank G. Hough Co., supra, 2 Cal.3d 465)), and including products that are dangerous because they lack adequate warnings or instructions (e.g., a telescope that contains inadequate instructions for assembling a "sun filter" attachment ( Midgley v. S.S. Kresge Co. (1976) 55 Cal.App.3d 67 [ 127 Cal.Rptr. 217])).

Commentators have pointed out that in view of the diversity of product deficiencies to which the defect rubric has been applied, an instruction which requires a plaintiff to prove the existence of a product defect, but which fails to elaborate on the meaning of defect in a particular context, may in some situations prove more misleading than helpful. As Professor Wade has written: "[The] natural application [of the term 'defective'] would be limited to the situation in which something went wrong in the manufacturing process, so that the article was defective in the sense that the manufacturer had not intended it to be in that condition. To apply [the term 'defective'] also to the case in which a warning is not attached to the chattel or the design turns out to be a bad one or the product is likely to be injurious in its normal condition . . . [and] [t]o use it without defining it to the jury is almost to ensure that they will be misled." (Wade, On the Nature of Strict Tort Liability for Products, supra, 44 Miss.L.J. 825, 831-832 (fns. omitted); see also Keeton, Product Liability and the Meaning of Defect (1973) 5 St. Mary's L.J. 30, 32; Hoenig, Product Designs and Strict Tort Liability: Is There a Better Approach? (1976) 8 Sw.U.L.Rev. 108, 118; Note (1973) 49 Wn.L.Rev. 231, 250.)

Our decision in Cronin did not mandate such confusion. Instead, by observing that the problem in defining defect might be alleviated by reference to the "cluster of useful precedents," we intended to suggest that in drafting and evaluating instructions on this issue in a particular case, trial and appellate courts would be well advised to consider prior authorities involving similar defective product claims.

Since the rendition of our decision in Cronin, a number of thoughtful Court of Appeal decisions have wrestled with the problem of devising a comprehensive definition of design defect in light of existing authorities. (See, e.g., Hyman v. Gordon (1973) 35 Cal.App.3d 769 [ 111 Cal.Rptr. 262]; Self v. General Motors Corp. (1974) 42 Cal.App.3d 1 [ 116 Cal.Rptr. 575]; Baker v. Chrysler Corp., supra, 55 Cal.App.3d 710; Buccery v. General Motors Corp. (1976) 60 Cal.App.3d 533 [ 132 Cal.Rptr. 605].) As these decisions demonstrate, the concept of defect raises considerably more difficulties in the design defect context than it does in the manufacturing or production defect context.

In general, a manufacturing or production defect is readily identifiable because a defective product is one that differs from the manufacturer's intended result or from other ostensibly identical units of the same product line. For example, when a product comes off the assembly line in a substandard condition it has incurred a manufacturing defect. (E.g., Lewis v. American Hoist Derrick Co. (1971) 20 Cal.App.3d 570, 580 [ 97 Cal.Rptr. 798].) A design defect, by contrast, cannot be identified simply by comparing the injury-producing product with the manufacturer's plans or with other units of the same product line, since by definition the plans and all such units will reflect the same design. Rather than applying any sort of deviation-from-the-norm test in determining whether a product is defective in design for strict liability purposes, our cases have employed two alternative criteria in ascertaining, in Justice Traynor's words, whether there is something "wrong, if not in the manufacturer's manner of production, at least in his product." (Traynor, The Ways and Meanings of Defective Products and Strict Liability, supra, 32 Tenn.L.Rev. 363, 366.)

First, our cases establish that a product may be found defective in design if the plaintiff demonstrates that the product failed to perform as safely as an ordinary consumer would expect when used in an intended or reasonably foreseeable manner. This initial standard, somewhat analogous to the Uniform Commercial Code's warranty of fitness and merchantability (Cal.U.Com. Code, § 2314), reflects the warranty heritage upon which California product liability doctrine in part rests. As we noted in Greenman, "implicit in [a product's] presence on the market . . . [is] a representation that it [will] safely do the jobs for which it was built." (59 Cal.2d at p. 64.) When a product fails to satisfy such ordinary consumer expectations as to safety in its intended or reasonably foreseeable operation, a manufacturer is strictly liable for resulting injuries. ( Greenman, supra; Pike v. Frank G. Hough Co., supra, 2 Cal.3d 465, 477; Hauter v. Zogarts (1975) 14 Cal.3d 104, 121 [ 120 Cal.Rptr. 681, 534 P.2d 377, 74 A.L.R.3d 1282]; Self v. General Motors Corp., supra, 42 Cal.App.3d 1, 6; Culpepper v. Volkswagen of America, Inc. (1973) 33 Cal.App.3d 510, 517-518 [ 109 Cal.Rptr. 110]; Van Zee v. Bayview Hardware Store (1968) 268 Cal.App.2d 351, 361 [ 74 Cal.Rptr. 21] .) Under this standard, an injured plaintiff will frequently be able to demonstrate the defectiveness of a product by resort to circumstantial evidence, even when the accident itself precludes identification of the specific defect at fault. ( Vandermark v. Ford Motor Co. (1964) 61 Cal.2d 256, 260 [ 37 Cal.Rptr. 896, 391 P.2d 168]; Culpepper v. Volkswagen of America, Inc., supra, 33 Cal.App.3d at p. 518; Elmore v. American Motors Corp. (1969) 70 Cal.2d 578, 580-584 [ 75 Cal.Rptr. 652, 451 P.2d 84].)

As Professor Wade has pointed out, however, the expectations of the ordinary consumer cannot be viewed as the exclusive yardstick for evaluating design defectiveness because "[i]n many situations . . . the consumer would not know what to expect, because he would have no idea how safe the product could be made." (Wade, On the Nature of Strict Tort Liability for Products, supra, 44 Miss.L.J. 825, 829.) Numerous California decisions have implicitly recognized this fact and have made clear, through varying linguistic formulations, that a product may be found defective in design, even if it satisfies ordinary consumer expectations, if through hindsight the jury determines that the product's design embodies "excessive preventable danger," or, in other words, if the jury finds that the risk of danger inherent in the challenged design outweighs the benefits of such design. (E.g., Self v. General Motors Corp., supra, 42 Cal.App.3d at p. 6; Hyman v. Gordon, supra, 35 Cal.App.3d at p. 773; Buccery v. General Motors Corp., supra, 60 Cal.App.3d at p. 547.) (3) A review of past cases indicates that in evaluating the adequacy of a product's design pursuant to this latter standard, a jury may consider, among other relevant factors, the gravity of the danger posed by the challenged design, the likelihood that such danger would occur, the mechanical feasibility of a safer alternative design, the financial cost of an improved design, and the adverse consequences to the product and to the consumer that would result from an alternative design. (See, e.g., Horn v. General Motors Corp. (1976) 17 Cal.3d 359, 367 [ 131 Cal.Rptr. 78, 551 P.2d 398]; Henderson v. Harnischfeger Corp., supra, 12 Cal.3d 663, 667-668; Luque v. McLean, supra, 8 Cal.3d 136, 140, 147-149; Heap v. General Motors Corp. (1977) 66 Cal.App.3d 824, 831 [ 136 Cal.Rptr. 304]; Buccery v. General Motors Corp., supra, 60 Cal.App.3d 533, 547; Baker v. Chrysler Corp., supra, 55 Cal.App.3d 710, 716; Self v. General Motors Corp., supra, 42 Cal.App.3d 1, 6-8; Garcia v. Halsett (1970) 3 Cal.App.3d 319, 323, 326 [ 82 Cal.Rptr. 420] .)

Although our cases have thus recognized a variety of considerations that may be relevant to the determination of the adequacy of a product's design, past authorities have generally not devoted much attention to the appropriate allocation of the burden of proof with respect to these matters. (Cf. Self v. General Motors Corp., supra, 42 Cal.App.3d at p. 8 with Baker v. Chrysler Corp., supra, 55 Cal.App.3d at p. 716.) The allocation of such burden is particularly significant in this context inasmuch as this court's product liability decisions, from Greenman to Cronin, have repeatedly emphasized that one of the principal purposes behind the strict product liability doctrine is to relieve an injured plaintiff of many of the onerous evidentiary burdens inherent in a negligence cause of action. (4) Because most of the evidentiary matters which may be relevant to the determination of the adequacy of a product's design under the "risk-benefit" standard — e.g., the feasibility and cost of alternative designs — are similar to issues typically presented in a negligent design case and involve technical matters peculiarly within the knowledge of the manufacturer, we conclude that once the plaintiff makes a prima facie showing that the injury was proximately caused by the product's design, the burden should appropriately shift to the defendant to prove, in light of the relevant factors, that the product is not defective. Moreover, inasmuch as this conclusion flows from our determination that the fundamental public policies embraced in Greenman dictate that a manufacturer who seeks to escape liability for an injury proximately caused by its product's design on a risk-benefit theory should bear the burden of persuading the trier of fact that its product should not be judged defective, the defendant's burden is one affecting the burden of proof, rather than simply the burden of producing evidence. (See Evid. Code, § 605; cf. Harris v. Irish Truck Lines (1974) 11 Cal.3d 373, 378 [ 113 Cal.Rptr. 489, 521 P.2d 481]; Estate of Gelonese (1974) 36 Cal.App.3d 854, 862 [ 111 Cal.Rptr. 833]; Perales v. Dept. of Human Resources Dev. (1973) 32 Cal.App.3d 332 [ 108 Cal.Rptr. 167]; Rebmann v. Major (1970) 5 Cal.App.3d 684, 688 [ 85 Cal.Rptr. 399] .)

(5) Thus, to reiterate, a product may be found defective in design, so as to subject a manufacturer to strict liability for resulting injuries, under either of two alternative tests. First, a product may be found defective in design if the plaintiff establishes that the product failed to perform as safely as an ordinary consumer would expect when used in an intended or reasonably foreseeable manner. Second, a product may alternatively be found defective in design if the plaintiff demonstrates that the product's design proximately caused his injury and the defendant fails to establish, in light of the relevant factors, that, on balance, the benefits of the challenged design outweigh the risk of danger inherent in such design.

Although past California decisions have not explicitly articulated the two-pronged definition of design defect which we have elaborated above, other jurisdictions have adopted a somewhat similar, though not identical, dual approach in attempting to devise instructions to guide the jury in design defect cases. (See, e.g., Henderson v. Ford Motor Co. (Tex. 1974) 519 S.W.2d 87, 92; Welch v. Outboard Marine Corporation (5th Cir. 1973) 481 F.2d 252, 254.) As we have indicated, we believe that the test for defective design set out above is appropriate in light of the rationale and limits of the strict liability doctrine, for it subjects a manufacturer to liability whenever there is something "wrong" with a product's design — either because the product fails to meet ordinary consumer expectations as to safety or because, on balance, the design is not as safe as it should be — while stopping short of making the manufacturer an insurer for all injuries which may result from the use of its product. This test, moreover, explicitly focuses the trier of fact's attention on the adequacy of the product itself, rather than on the manufacturer's conduct, and places the burden on the manufacturer, rather than the plaintiff, to establish that because of the complexity of, and trade-offs implicit in, the design process, an injury-producing product should nevertheless not be found defective.

Amicus CTLA on behalf of the plaintiff, anticipating to some extent the latter half of the design defect standard articulated above, contends that any instruction which directs the jury to "weigh" or "balance" a number of factors, or which sets forth a list of competing considerations for the jury to evaluate in determining the existence of a design defect, introduces an element which "rings of negligence" into the determination of defect, and consequently is inconsistent with our decision in Cronin. (Cf. 8 Cal.3d at p. 132.) As amicus interprets the decision, Cronin broadly precludes any consideration of "reasonableness" or "balancing" in a product liability action.

In the first place, however, in Cronin our principal concern was that the "unreasonably dangerous" language of the Restatement test had "burdened the injured plaintiff with proof of an element which rings of negligence" (italics added) (8 Cal.3d at p. 132) and had consequently placed "a considerably greater burden upon [the injured plaintiff] than that articulated in Greenman." (8 Cal.3d at pp. 134-135.) By shifting the burden of proof to the manufacturer to demonstrate that an injury producing product is not defective in design, the above standard should lighten the plaintiff's burden in conformity with our Greenman and Cronin decisions.

Secondly, past design defect decisions demonstrate that, as a practical matter, in many instances it is simply impossible to eliminate the balancing or weighing of competing considerations in determining whether a product is defectively designed or not. In Self v. General Motors Corp., supra, 42 Cal.App.3d 1, for example, an automobile passenger, injured when the car in which she was riding exploded during an accident, brought suit against the manufacturer claiming that the car was defective in that the fuel tank had been placed in a particularly vulnerable position in the left rear bumper. One issue in the case, of course, was whether it was technically feasible to locate the fuel tank in a different position which would have averted the explosion in question. But, as the Self court recognized, feasibility was not the sole issue, for another relevant consideration was whether an alternative design of the car, while averting the particular accident, would have created a greater risk of injury in other, more common situations. (See 42 Cal.App.3d at pp. 7-8.)

In similar fashion, weighing the extent of the risks and the advantages posed by alternative designs is inevitable in many design defect cases. As the Self court stated: "[W]e appreciate the need to balance one consideration against another in designing a complicated product so as to achieve reasonable and practical safety under a multitude of varying conditions." (42 Cal.App.3d at p. 7.) Inasmuch as the weighing of competing considerations is implicit in many design defect determinations, an instruction which appears to preclude such a weighing process under all circumstances may mislead the jury.

Finally, contrary to the suggestion of amicus CTLA, an instruction which advises the jury that it may evaluate the adequacy of a product's design by weighing the benefits of the challenged design against the risk of danger inherent in such design is not simply the equivalent of an instruction which requires the jury to determine whether the manufacturer was negligent in designing the product. (See, e.g., Wade, On the Nature of Strict Tort Liability for Products, supra, 44 Miss.L.J. 825, 835.) It is true, of course, that in many cases proof that a product is defective in design may also demonstrate that the manufacturer was negligent in choosing such a design. As we have indicated, however, in a strict liability case, as contrasted with a negligent design action, the jury's focus is properly directed to the condition of the product itself, and not to the reasonableness of the manufacturer's conduct. (See, e.g., Ault v. International Harvester Co. (1974) 13 Cal.3d 113, 121 [ 117 Cal.Rptr. 812, 528 P.2d 1148, 74 A.L.R.3d 986]; Escola v. Coca Cola Bottling Co., supra, 24 Cal.2d 453, 462 (Traynor, J. conc.).)

(6) Thus, the fact that the manufacturer took reasonable precautions in an attempt to design a safe product or otherwise acted as a reasonably prudent manufacturer would have under the circumstances, while perhaps absolving the manufacturer of liability under a negligence theory, will not preclude the imposition of liability under strict liability principles if, upon hindsight, the trier of fact concludes that the product's design is unsafe to consumers, users, or bystanders. ( See Foglio v. Western Auto Supply, supra, 56 Cal.App.3d 470, 477.)

4. Conclusion

The technological revolution has created a society that contains dangers to the individual never before contemplated. The individual must face the threat to life and limb not only from the car on the street or highway but from a massive array of hazardous mechanisms and products. The radical change from a comparatively safe, largely agricultural, society to this industrial unsafe one has been reflected in the decisions that formerly tied liability to the fault of a tortfeasor but now are more concerned with the safety of the individual who suffers the loss. As Dean Keeton has written, "The change in the substantive law as regards the liability of makers of products and other sellers in the marketing chain has been from fault to defect. The plaintiff is no longer required to impugn the maker, but he is required to impugn the product." (Keeton, Product Liability and the Meaning of Defect (1973) 5 St. Mary's L.J. 30, 33.)

If a jury in determining liability for a defect in design is instructed only that it should decide whether or not there is "a defective design," it may reach to the extreme conclusion that the plaintiff, having suffered injury, should without further showing, recover; on the other hand, it may go to the opposite extreme and conclude that because the product matches the intended design the plaintiff, under no conceivable circumstance, could recover. The submitted definition eschews both extremes and attempts a balanced approach.

(2b) We hold that a trial judge may properly instruct the jury that a product is defective in design (1) if the plaintiff demonstrates that the product failed to perform as safely as an ordinary consumer would expect when used in an intended or reasonably foreseeable manner, or (2) if the plaintiff proves that the product's design proximately caused his injury and the defendant fails to prove, in light of the relevant factors discussed above, that on balance the benefits of the challenged design outweigh the risk of danger inherent in such design.

Because the jury may have interpreted the erroneous instruction given in the instant case as requiring plaintiff to prove that the high-lift loader was ultrahazardous or more dangerous than the average consumer contemplated, and because the instruction additionally misinformed the jury that the defectiveness of the product must be evaluated in light of the product's "intended use" rather than its "reasonably foreseeable use" (see fn. 9, ante), we cannot find that the error was harmless on the facts of this case. In light of this conclusion, we need not address plaintiff's additional claims of error, for such issues may not arise on retrial.

The judgment in favor of defendants is reversed.

Mosk, J., Clark, J., Richardson, J., Wright, J., and Sullivan, J., concurred.