Uber test SUV killed a Tempe pedestrian after never classifying her as a person

On the night of 18 March 2018, a modified Volvo XC90 running Uber Advanced Technologies Group's developmental automated driving system struck and killed 49-year-old Elaine Herzberg as she pushed a bicycle across N. Mill Avenue in Tempe, Arizona. It was the first pedestrian death caused by a vehicle under fully automated control on a public road, and the National Transportation Safety Board's investigation found that the software detected her 5.6 seconds before impact yet never once classified her as a pedestrian, while the company's own design decisions had stripped away the layers of protection that might have stopped the car.

What the system did in the 5.6 seconds before impact

The SUV was on the second loop of an established test route, about 19 minutes into autonomous operation, travelling at 45 mph in the right lane when the pedestrian began crossing at a location with no crosswalk, according to the NTSB's final report (NTSB/HAR-19/03). Radar picked her up 5.6 seconds out and labelled her a vehicle; lidar then called her an unknown object, then a vehicle again, then a bicycle, cycling through classifications for the remainder of the approach. Investigators wrote that the system design did not account for pedestrians crossing away from a crosswalk, so it never applied the pedestrian label at all.

The consequence was worse than a single mislabelling. Because the software discarded tracking history whenever an object's classification changed, each flip effectively created a brand-new object with no trajectory behind it, leaving the system unable to work out that the thing ahead was on a collision course. IEEE Spectrum described this as a cascade of design choices that left the car unable to respond to a person plainly in its path.

Only 1.2 seconds before impact did the system register an emergency. Stopping in time would have required braking harder than the system was permitted to command, so it entered a state Uber engineers called action suppression: a one-second window in which planned braking was withheld while the system re-checked the hazard and the human operator was expected to take over. No warning was given to the operator when suppression began. When the second elapsed and the collision was still unavoidable, the system sounded an audible alert and began a gradual slowdown rather than braking hard to reduce the impact. The operator grabbed the wheel 0.02 seconds before the strike, at 39 mph, and braked only after impact. Herzberg was thrown roughly 75 feet and died at the scene. (An early NTSB docket document circulated in news coverage put the emergency determination at 1.3 seconds before impact; the adopted final report states 1.2 seconds, which is the figure used here.)

Safeguards that had been removed

The test vehicle was a 2017 Volvo XC90, which shipped with forward collision warning and automatic emergency braking capable of detecting crossing pedestrians and cyclists. Uber ATG disabled those factory systems during automated testing to avoid radar interference with its own sensor stack. Volvo simulations, plus closed-course testing in the United Kingdom that reproduced the Tempe conditions with a dummy pushing a bicycle, indicated a standard XC90 would have avoided the collision or cut its speed substantially. The NTSB concluded that deactivating the production systems without replacing their full capability removed a layer of redundancy and raised the risk of on-road testing.

A second safeguard had also been thinned. Uber ATG had originally staffed each test vehicle with two people, a driver-seat monitor and a passenger-seat event tagger, then consolidated the roles into a single operator during September and October 2017 after installing a tablet interface. The operator on the crash trip had begun her training as a tagger before switching to the single-operator role in late October 2017. Interior camera video showed her repeatedly looking down at her phone, and phone records showed a television show streaming continuously from 9:16 p.m. to 9:59 p.m., covering the whole trip. Uber ATG had the ability to review operator behaviour retroactively but, the report says, rarely did so.

The report also records that between September 2016 and March 2018, excluding the Tempe crash, ATG test vehicles in autonomous mode were involved in 37 crashes and incidents, the large majority of them other vehicles striking the test car.

Findings, probable cause and fallout

The NTSB adopted its report on 19 November 2019. It placed the probable cause on the operator's failure to monitor the road because she was visually distracted by her personal phone, with contributing factors including Uber ATG's inadequate safety risk assessment, ineffective oversight of operators, and absence of countermeasures for automation complacency, all traced to what the board called an inadequate safety culture. Further contributing factors were the pedestrian's impaired midblock crossing and the Arizona Department of Transportation's insufficient oversight of automated vehicle testing. The board recommended that the National Highway Traffic Safety Administration make safety self-assessment reports mandatory for developmental automated driving system testing and evaluate them, and issued recommendations to Arizona, the American Association of Motor Vehicle Administrators and Uber ATG.

Uber ATG suspended public-road testing after the crash and resumed in December 2018 with two mission specialists per vehicle, real-time attentiveness monitoring, a three-week training programme, the Volvo warning and braking systems re-enabled during automated operation, and action suppression eliminated. The company told investigators that a September 2018 software build, run in simulation against the crash scenario, would have classified the pedestrian correctly about 4.5 seconds out and braked in time to prevent the collision.

On the legal side, an Arizona prosecutor concluded in March 2019 that there was no basis for criminal charges against Uber as a company, as NPR reported, while referring further examination of the operator's conduct back to police. Herzberg's family settled with Uber within weeks of the crash. The vehicle operator was later charged with negligent homicide and, as the Associated Press reported, pleaded guilty in July 2023 to endangerment and was sentenced to three years of supervised probation.

How the board framed it

NTSB Vice Chairman Bruce Landsberg, in a concurring statement filed on 25 November 2019, rejected the idea that the death was a matter of chance:

The automated vehicle (AV) event that resulted in a fatally injured pedestrian was not an accident. Accidents are unpredictable and unforeseeable. Rather, this was a crash that was predictable and avoidable.

NTSB Highway Accident Report NTSB/HAR-19/03

His statement also quantified the monitoring failure: on the crash trip the operator spent 34 percent of the time looking at her phone, her longest single glance away lasted 26 seconds, and she had driven the same route successfully 73 times before.

Reporting at the time distilled the technical finding to its bluntest form, as NPR did in noting that the system had no provision for people crossing outside crosswalks.

Why it moves the needle

This is the case that defined how autonomous vehicle testing is judged. It showed a deployed AI driving system failing on the most basic recognition task in its domain, then failing safely-by-design in a way that made the outcome worse: the deliberate one-second suppression of braking, and the rule that emergency braking was reserved for crashes it could fully avoid rather than ones it could merely soften. It also showed the human fallback that justified those choices being simultaneously reduced from two people to one and left largely unsupervised.

The pattern generalises well beyond one company. Any developmental autonomous system that treats a human monitor as its safety layer inherits the automation-complacency problem the NTSB documented here, and any system that silently withholds action while waiting on that monitor removes the monitor's chance to act. The board's recommendations pushed federal and state regulators toward mandatory safety self-assessments and real permit review, and the Tempe crash remains the reference point against which later robotaxi failures are measured.