Uber's car detected Elaine Herzberg 5.6 seconds before it killed her

The test car that drove into Elaine Herzberg

The vehicle was a 2017 Volvo XC90 that Uber's Advanced Technologies Group had rebuilt into a robotaxi prototype. Uber ATG was the company's self-driving division, racing rivals to build a car that could carry passengers with no driver. Its test cars still carried a person in the driver's seat, a safety operator whose only job was to watch the road and grab the controls if the software erred.¹

A little before ten at night, the car was driving itself north on Mill Avenue at about 45 mph. Elaine Herzberg, 49, was walking a bicycle across the road, away from any crosswalk. The car's sensors picked her up 5.6 seconds before it reached her. It did not brake or slow. The safety operator looked up about a second before impact, turned the wheel two-hundredths of a second before it, and the car struck Herzberg at 39 mph. She was killed.¹ The first federal report, out two months later, already flagged the two facts that would define the case: the car's emergency braking was off while the software drove, and the system was never built to warn the operator of a crash.²

Almost nothing about that came down to a single broken part. Investigators found a row of safeguards, each removed or weakened on its own reasonable-sounding grounds, until the only protection left was a person who had stopped watching.

It could see her. It could not decide what she was.

A self-driving car builds a running picture of the world from its sensors, and two steps in it matter here. Classification is the software putting a label on a cluster of sensor returns: car, bicycle, or pedestrian. Tracking is tying the thing it sees now to the same thing it saw a moment ago, so it can measure where the object is going and predict where it will be next. Prediction is what lets the car tell whether a path is about to cross its own.

Uber's system detected Herzberg 5.6 seconds out and held a sensor lock on her the whole way in. What it could not do was decide what she was. It labeled her an unknown object, then a vehicle, then a bicycle, and kept switching. Two design choices turned that indecision deadly. The system had no category for a person crossing away from a crosswalk, so it never classified her as a pedestrian. And when an object's label changed, the software threw away its history and treated the new label as a brand-new object with no past.¹ Every time the classification flipped, one account of the findings noted, the car lost her earlier positions, so it could not work out she was moving into its lane.³

A thing whose identity resets several times a second has no trajectory the car can trust, so the prediction stayed broken for more than four seconds while Herzberg walked toward the car. Only 1.2 seconds before impact did the software place her in its own path and register an imminent collision.¹ By then the car was 80 feet away, and the time to stop had nearly run out.

The brakes that were switched off on purpose

At 1.2 seconds the software knew it was about to hit something. It still did not brake.

The Volvo came from the factory with a system called City Safety, which includes automatic emergency braking: sensors that watch for an imminent forward collision and brake by themselves, without waiting for the driver. This version could detect pedestrians, and had it been on it very likely would have braked for Herzberg. But Uber turned the Volvo system off whenever its own software drove, because two automated systems fighting over the same brake pedal made the ride jerky.¹

Uber's own software had a braking function too, and Uber had leashed it as well. Whenever it decided hard braking was needed, it waited a full second first, a delay Uber called action suppression: a beat to confirm the hazard was real rather than stab the brakes at every false alarm, and to let the human take over. During that pause the car gave the operator no warning at all, and Herzberg was struck inside it.¹ Worse, when a crash could no longer be avoided by gentle braking, the system was set not to brake hard even to reduce the impact.¹

The factory brake that would have caught her was off. The software's own brake was gagged for the second that mattered and told no one. Each choice had a defensible reason. Together they stripped the car of every automatic way to stop itself, leaving one safeguard: the person in the seat.

A safety driver set up to fail

The safety operator that night was Rafaela Vasquez. Video from inside the car showed she spent 34 percent of the moving trip looking down toward her phone in the center console, where she had been streaming a show, once for a continuous 26 and a half seconds. She raised her eyes about a second before the crash, too late to do more than begin turning the wheel.¹

It is tempting to stop there, and the first police account did: a distracted driver, an avoidable death. But the deeper finding is about the job itself. Ask a person to watch a system that drives almost perfectly for hours, then snap to attention in the rare second it fails, and they will fail too. Psychologists call this automation complacency: the better a machine performs, the less its human monitor can stay alert, because there is nothing to do. A safety operator watching a road the car handles flawlessly is not lazy so much as human in a role built to defeat humans. Uber had done little to counter this known effect, and had lately cut its cars from two operators to one.¹

The report spreads the cause, and this is where accounts of the crash diverge. One reading centers Vasquez: she was paid to watch and watched a show instead. A second centers the machine: the car discarded its own perception and both automatic brakes were disabled by Uber's choices. A third centers the culture: a company with no standalone safety office and no formal safety plan sent a single, under-supervised operator out in a car built without a backstop. The strongest reading holds all three, and one fact settles the weighting. An attentive operator probably avoids the crash, but so does an enabled factory brake on its own, with the same distracted driver. Each of two safeguards would likely have avoided the crash or blunted it, and Uber had removed both. A failure any single working layer would have caught is not a story about one person's attention.

The aftermath tracked that split. Uber grounded its fleet within days and settled with Herzberg's husband and daughter inside two weeks, on undisclosed terms.⁴ A year later Arizona prosecutors found "no basis for criminal liability for the Uber corporation."⁵ In December 2020 Uber paid to hand its self-driving division to a startup, Aurora, and left the business.⁶ Vasquez alone was charged; in 2023 she pleaded guilty to endangerment and got three years of probation.⁷ The one human in the chain answered in court. The design choices that removed her backup did not.

Driver-assist puts the same trap in ordinary cars

Uber's robotaxi was an experiment, and experiments end. The handoff problem did not. It moved into the mainstream market under a friendlier name: driver-assistance features like Tesla's Autopilot and Full Self-Driving, and the lane-centering systems most carmakers now sell. Engineers rank these as Level 2 automation: the car steers, brakes, and holds its lane, but the human must watch every second and take over instantly. That is the Tempe operator's job, handed to millions of untrained owners on their commute.

The predictable thing happened. In December 2023 federal regulators forced Tesla to recall about two million cars, nearly every one it had sold in the United States with Autopilot, after finding the controls that keep drivers engaged "may be insufficient to prevent driver misuse." Drivers had crashed with Autopilot on, grown inattentive, even when they met everything the car's monitoring asked.⁸ It is the Tempe finding almost word for word: a system good enough to lull its human, who is the last defense against its rare mistakes.

The fix Tesla shipped was more chimes and warnings to nag the driver back. That treats the symptom. The disease is the arrangement itself, the same one that killed Elaine Herzberg: hand the driving to a machine that almost never needs help, then stake a life on a person staying alert for the rare second it does.