Case file. Uber ATG test vehicle, Mill Avenue, Tempe, Arizona – 18 March 2018, 21:58. A modified Volvo XC90 in autonomous mode struck and killed Elaine Herzberg, 49, as she walked a bicycle across the road at night, far from the nearest marked crossing. First pedestrian fatality involving an automated driving system on a public road. This analysis draws on the public record only, chiefly NTSB report HWY18MH010. I had no involvement in the case.
The situation
Uber's Advanced Technologies Group was testing on public roads in Arizona because Arizona asked the fewest questions. California's regulator had all but shown them the exit; Phoenix rolled out a welcome mat and required no reporting of disengagements or incidents. Each vehicle ran with a single operator behind the wheel. That was a decision made in October 2017 – until then, two people rode up front, one watching the road, one watching the machine. The second seat was cut as a step toward driverless operation. Then the braking architecture, which is where this story lives. The XC90 left Gothenburg with City Safety, Volvo's production automatic emergency braking. Uber deactivated it; a factory system that brakes on its own authority does not coexist peacefully with a test platform. Uber's own emergency-braking logic existed in the software but stayed disabled while the computer drove – emergencies were delegated to the human. Two engineered safety nets, removed by design. One operator, substituted.How it unfolded
Herzberg stepped into the lane. Radar and lidar registered her 5.6 seconds before impact – roughly a hundred metres of runway at closing speed. What followed was a classification failure. Vehicle. Bicycle. Other. Back again. Every time the label flipped, the tracker discarded her recent path history, so the system never held a stable prediction long enough to act on. At 1.2 seconds out it finally settled on bicycle, crossing the vehicle's path. Then action suppression kicked in – a one-second window in which the software inhibited emergency manoeuvres to guard against false positives. At 43 mph that window is about nineteen metres. The audible alert to the operator fired a fraction of a second before impact. The operator, Rafaela Vasquez, had been streaming a talent-show episode on her phone. The NTSB reconstructed her gaze: off the roadway for about a third of the trip. She looked up roughly half a second before contact and braked too late to matter.Root-cause anatomy
The easy filing is "distracted driver". The board declined the easy filing. Its probable-cause finding, condensed but not paraphrased:The probable cause was the failure of the vehicle operator to monitor the driving environment and the operation of the automated driving system because she was visually distracted throughout the trip by her personal cell phone. Contributing were Uber ATG's inadequate safety risk assessment procedures, its ineffective oversight of vehicle operators, and the lack of adequate mechanisms for addressing operators' automation complacency – all a consequence of its inadequate safety culture.Stack the layers. Perception that held a human for six seconds and could not decide what she was. An emergency function built, then left disabled in computer control. An OEM barrier deliberately removed. Crew halved. No countermeasure for the one failure mode every automation engineer can predict – complacency. A regulator that never asked for data. And a pedestrian, impaired by methamphetamine per the toxicology, crossing where no crossing existed. Any single functioning layer probably saves her life. None functioned.
Where the quality system failed
Run it through a PFMEA the way an automotive auditor would. Failure mode: pedestrian in path at speed. Severity: 10. Occurrence control: "operator will intervene". Detection: "operator will notice". I have sat in reviews where the prevention column said "operator" three times running; we rejected it, because a severity-10 mode with human-only detection is a stop condition, not a scoring debate. The deeper failure is change control. Two changes – deactivating City Safety, halving the crew – were each arguable in isolation and fatal in combination, and neither visibly triggered revalidation of the safety case. I once inherited a stamping line where maintenance had jumpered a light curtain because it nuisance-tripped on a Friday. The bypass survived three audits because the paperwork was clean. The mechanism is identical; only the scale differs. A VDA 6.3 process audit would have asked one short question: who owns operator attention and fatigue? The honest answer in that organisation was nobody.What would have caught it
Barrier logic, first. You do not switch off a production AEB until your replacement beats it in validated coverage – shadow mode across millions of replayed kilometres, jaywalking pedestrians at night included. Uber had the simulation infrastructure. Coverage was not a gating requirement. Change control, second. Any configuration change touching a safety function reopens the risk assessment; that is not bureaucracy, it is the point of having one. Who re-ran the hazard analysis when the second operator left the vehicle? Leading indicators, third. Disengagements per thousand miles describe the car. Nothing described the operator – no attention sampling, no intervention-quality reviews, no phones-stowed rule of the kind aviation had long standardised. Driver-monitoring cameras became industry practice after Tempe, which is to say the fix existed, was cheap, and was skipped. And until the statistics justify one seat, you staff two. Copilots exist for precisely this complacency curve.
5.6 s
detection to impact
1.0 s
emergency-braking suppression
43 mph
impact speed – 69 km/h
My take
Here is the uncomfortable part. The machine worked as specified. It detected a human six seconds out and, per its own specification, deferred to a person watching television. The design traded a rare hard stop against a common nuisance stop, and chose the nuisance. Vasquez was the only individual charged; she pleaded guilty to endangerment in 2023 and received probation. The company avoided charges, paused testing for nine months, and later sold the unit to Aurora. The specification that killed Elaine Herzberg was written, reviewed and approved by a management system that was never asked to answer for it. So treat this as a shop-floor mirror. Every interlock someone wants bypassed because it nuisance-trips is City Safety with worse public relations. Replace the barrier with a validated one in the same week, in writing, or refuse the change. I would rather explain a false stop to a plant manager than open an NTSB docket with my product in it.What this means on your floor.
- A disabled interlock, a bypassed sensor or a halved inspection crew is a design change. It reopens the risk assessment – or it gets refused.
- No severity-10 failure mode rests on a single pair of human eyes. If detection reads "operator will notice", you have no detection.
- Measure the monitor: attention sampling, intervention quality, fatigue tracking. Complacency is a predicted failure mode, not a surprise.
- Protection layers must stay independent. A barrier that can be switched off for convenience is decoration.
