Uber ATG (Tempe, 2018): self-driving car hits pedestrian

01 · CONTEXT

A test car and a crossing outside the crosswalk

On March 18, 2018, an automated test vehicle from Uber's Advanced Technologies Group (ATG) struck a pedestrian in Tempe, Arizona. The NTSB report is the main source for this case. What matters for those who design systems is how a chain of perception, prediction, and decision was assembled, and how the protection layers around it were organized.

The pedestrian was crossing the avenue pushing a bicycle, at a spot with no crosswalk.

02 · THE DECISION CHAIN

Detecting was not enough: classify, predict, and brake

The diagram below is a didactic abstraction of the decision chain described in the report, not an internal schematic of Uber's system.

1. The system detected the pedestrian 5.6 seconds before impact.

2. The pedestrian's classification changed several times, alternating between vehicle, bicycle, and other.

3. The design excluded the tracking history of objects whose classification changed, and the system could not correctly predict the pedestrian's trajectory.

4. The system only recognized the emergency 1.2 seconds before impact.

5. The ADS was designed to suppress braking for 1 second after detecting a dangerous situation in which avoiding the collision required hard braking, above 0.71 g.

6. Instead of braking, the system issued an audible alert to the operator and started a gradual deceleration plan.

The report also explains why the prediction failed: the system's design did not account for pedestrians crossing outside a crosswalk.

Reports at the time, based on the preliminary report, said the car spotted the woman about six seconds before impact and that emergency braking was not enabled under computer control, with the justification of reducing the potential for erratic vehicle behavior.

03 · SAFETY LAYERS

Emergency braking and the human as fallback

When the main component is a system under development, which can err, what protects people is the independent layers around it. The steps below show the layers described in the report. Availability patterns talk about redundancy to keep the service up; here the same idea serves to keep people safe.

The system's design prevented emergency braking solely to mitigate the collision and relied on the operator's intervention.

1. The diagram shows the layers that could trigger the brake: the automated system, the factory automatic brake, and the on-board operator.

2. The ATG disabled the factory collision warning and automatic braking while the ADS was operating, to avoid possible interference between radar signals.

3. Volvo simulations suggest that a standard XC90 with these systems could have avoided or at least mitigated the collision.

4. Months before the crash, the ATG began testing with only one operator per vehicle; by removing the second operator, it also removed a layer of safety redundancy.

5. The interior camera video shows the operator looking away from the road for a prolonged period while the vehicle approached the pedestrian.

04 · SAFETY CULTURE

What the NTSB pointed to beyond the software

The NTSB describes the ATG as having an inadequate safety culture, lacking risk assessment mechanisms and operator oversight. The organization also had no corporate safety division and no dedicated safety manager.

05 · WHAT CHANGED

After the crash

06 · LESSONS

What to take into your next design

When a system with expected failures depends on a human as the last layer, that human's attention becomes a system requirement and must be measured and protected like any other. A protection layer only counts as redundancy if it remains active and independent of the others.

Suppressing an action to avoid false alarms is a legitimate trade-off, but it must come with a safe alternative for when the alarm is real. Risk management, operator oversight, and safety accountability are also part of the system's design.