Tesla recalled 2 million cars for letting drivers stop watching the road

The car drives, the driver watches

On the highway, Tesla's Autopilot does two jobs at once. Traffic-Aware Cruise Control matches the car's speed to the traffic ahead, and Autosteer keeps it centered between the lane lines.¹ Between them they handle steering, acceleration, and braking, without the driver's hands or feet. What Autopilot does not do is watch the road. That job never leaves the driver.

Engineers have a scale for this. SAE International, which writes the standards carmakers build to, defines six levels of driving automation, numbered 0 through 5.² Autopilot sits at Level 2, "partial driving automation": the system steers and controls the speed, but the human driver has to watch the road the whole time and be ready to take the car back at any second.² Cruise control on its own is Level 1; add Autosteer and the car becomes Level 2.¹ The line that matters runs between Level 2 and Level 3. At Level 2 and below, the driver is the one watching, not the car.²

Autopilot was built to need a supervisor who never looks away. These two crashes are what happened when the supervisor did.

The car that could not see a crossing truck

At 4:36 on the afternoon of Saturday, May 7, 2016, a 2015 Tesla Model S was driving east on US-27A near Williston, Florida, at 74 miles an hour where the limit was 65.³ The driver, Joshua Brown, had set the cruise to 74 and switched on Autopilot. Over the 41-minute trip from Cedar Key, Autopilot had been on for 37 minutes. In that time the system felt Brown's hands on the wheel seven times, for 25 seconds in all, and once went nearly six minutes without sensing them.³

Ahead, a tractor-semitrailer began a left turn across the highway. Neither Brown nor Autopilot braked. The forward-collision warning never sounded and the automatic emergency braking never engaged: both were built to catch a vehicle in the lane ahead, not one crossing the path, and the truck was crossing.³ The Model S hit the side of the trailer and passed underneath it. Brown was killed.

Seven weeks later, Tesla published a statement it titled "A Tragic Loss." It called Brown's death "the first known fatality in just over 130 million miles where Autopilot was activated," and set that beside a U.S. traffic death roughly every 94 million miles.⁴ Neither the driver nor the car, Tesla wrote, had picked out the white side of the trailer against a brightly lit sky, so the brake was never applied. Autopilot, the company added, still required the driver to keep his hands on the wheel and stay responsible for the car.⁴

The car that steered itself into a barrier

At 9:27 on the morning of Friday, March 23, 2018, a 2017 Tesla Model X was driving south on US-101 in Mountain View, California, with Autopilot on and the cruise set to 75.⁵ The driver, Walter Huang, was an engineer at Apple. A game was running as the front app on his phone.⁵

The car's own data recorder captured the final ten seconds. About 5.9 seconds and 560 feet before impact, Autosteer turned the sport utility vehicle 5.6 degrees to the left, into the gore, the wedge of pavement where the State Route 85 exit splits from the highway, with no hand pressure on the wheel.⁵ About 3.9 seconds out, having lost the car it had been following, it sped up from 61.9 miles an hour toward its 75-mile-an-hour setting.⁵ For the last six seconds it sensed no steering from Huang.⁵ The Model X struck a crash attenuator, the collapsible cushion at the end of the divider, at about 70.8 miles an hour. Huang was killed.⁵

The attenuator should have absorbed much of the blow. It could not: another car had crushed it eleven days earlier, and Caltrans had not yet repaired it.⁵

Tesla again explained itself in a post, "An Update on Last Week's Accident." The driver had been given several visual warnings and one audible one to hold the wheel earlier in the drive. His hands were not detected on the wheel for the six seconds before the crash. He had about five seconds of clear view of the divider ahead, and did nothing.⁶ The crushed attenuator, Tesla said, was why the crash was so severe.⁶

The dispute Tesla settled with a recall

The National Transportation Safety Board investigates major crashes and names a probable cause. In both of these it named the driver and the design in the same breath. At Williston it found that the truck driver had failed to yield and that Brown had been inattentive "due to overreliance on vehicle automation," and that contributing to that overreliance was Autopilot's "operational design, which permitted his prolonged disengagement from the driving task."³ At Mountain View it found Huang distracted by his phone game and overreliant on Autopilot, with the system steering into the gore "due to system limitations," and it faulted the car's "ineffective monitoring of driver engagement."⁵

The phrase to hold onto is automation complacency: when a machine does a job well nearly all the time, the person minding it stops paying close attention, because for a long stretch nothing has needed them. Autopilot's only guard against this was steering-wheel torque, a slight twist or tug on the wheel. The board called torque "a poor surrogate" for engagement, because a hand can rest on the wheel while the eyes are anywhere.³ The logs bear that out. Brown got the hands-on prompt seven times across 41 minutes, none of them in the final approach to the truck. Huang's last hands-off alert came more than a minute before impact; in the final six seconds the system asked him for nothing.⁵ Tesla could say truthfully that each driver had been warned, and it changed nothing: no warning fired in the seconds that led to either crash.

There was a second design point. A Level 2 system is built for a particular set of roads and conditions, its operational design domain. Autopilot was meant for limited-access highways with clear lane lines, yet it would switch on and steer wherever a driver engaged it, including over the painted gore that Huang's car drifted into. In 2017 the board asked Tesla to add safeguards that hold automated steering to the conditions it was designed for. Tesla did not.³ By 2020 the board reissued that recommendation, marked Tesla's response "unacceptable," and wrote that by assuming drivers would always stay attentive, Tesla had "created a system designed to fail because of the foreseeable misuse of the system."⁵

Tesla's broader defense was that Autopilot made its cars safer overall, and its headline evidence came from NHTSA's first Autopilot investigation, in 2017, which reported that the Tesla crash rate "dropped by almost 40 percent after Autosteer installation."¹ Tesla promoted the figure for years. It was hollow from the start. NHTSA's own footnote conceded that the rates counted all the miles a car drove, not its Autopilot miles, and that only about a third of the cars had any pre-Autosteer mileage to compare.¹ After a Freedom of Information lawsuit forced the underlying data into the open in 2018, an outside analysis found that most of the cars lacked the mileage records the calculation needed, and that on the ones that had them the crash rate had moved the other way. NHTSA later said its review had never measured Autopilot's safety at all.⁷ Tesla's own favorite comparison had the same hole. Its one death per 130 million Autopilot miles, against one per 94 million overall, weighed highway miles under a driver-assist system against all miles on every kind of road. The two counts do not measure the same thing.

Whether the fault lay in Autopilot's design or in its drivers was, in the end, answered by Tesla. A second NHTSA investigation studied 467 Autopilot crashes and found a "critical safety gap" between what drivers thought the system could do and what it actually could.⁸ In December 2023 Tesla recalled every car it had ever built with Autosteer, 2,031,220 vehicles, and stated the defect in its own filing.

The fix, sent over the air, added what the board had asked for in 2017: more insistent alerts, extra checks when Autosteer runs off the highway, and suspension from the feature for drivers who keep ignoring it.⁹ Tesla filed the recall "while not concurring with the agency's analysis," so the argument never formally ended.⁹ But the controls it recalled were the controls that had let Brown and Huang stop watching the road.

The same gap, in the cars on the road now

This is not history. Since 2021 a NHTSA order has required carmakers to report any crash in which a Level 2 system was running within 30 seconds, if it killed someone, injured a pedestrian, or sent anyone to the hospital. Tesla files the large majority of those reports.¹⁰

Tesla's newer system is called Full Self-Driving. It is still a Level 2 system, one the driver must supervise and be ready to take over, and in 2024 Tesla renamed it "Full Self-Driving (Supervised)," moving the catch into the product's name. That October NHTSA opened an investigation into about 2.4 million Teslas running the feature, after crashes in low-visibility conditions, one of which killed a pedestrian.¹¹