Uber Autonomous Vehicle Pedestrian Fatality (2018)

Incident Summary

On the night of March 18, 2018, an Uber autonomous test vehicle operating in self-driving mode struck and killed 49-year-old pedestrian Elaine Herzberg as she walked a bicycle across a road in Tempe, Arizona.^[1] The vehicle, a modified Volvo XC90 equipped with Uber’s developmental automated driving system, was traveling at approximately 39 miles per hour in a 35 mph zone. A human safety operator was seated in the driver’s seat at the time of the collision.

The National Transportation Safety Board (NTSB) investigation revealed that the vehicle’s perception system detected the pedestrian approximately 5.6 seconds before impact but repeatedly misclassified her, cycling between identifying her as a vehicle, a bicycle, and an unknown object.^[1] The system was not designed to alert the safety operator to potential hazards, and Uber had disabled the Volvo’s factory-installed automatic emergency braking system to prevent interference with the developmental software. The safety operator was found to have been looking at a mobile phone in the seconds preceding the collision.

The NTSB’s final report identified multiple systemic safety failures, including inadequate safety risk assessment procedures, the absence of a mechanism to alert the safety operator, an insufficient safety culture within Uber’s Advanced Technologies Group, and the lack of effective federal oversight of autonomous vehicle testing. Uber suspended its autonomous vehicle testing program following the incident and reached a private settlement with Herzberg’s family.

Key Facts

• Fatality: Elaine Herzberg, 49, first known pedestrian death involving an autonomous vehicle
• Vehicle: Modified Volvo XC90 operating under Uber’s developmental automated driving system
• Detection: Vehicle sensors detected the pedestrian 5.6 seconds before impact but failed to classify her correctly
• Safety systems disabled: Volvo’s factory automatic emergency braking had been deactivated by Uber
• Human operator: Safety driver was looking at a mobile phone and did not intervene
• Speed: Approximately 39 mph in a 35 mph zone

Threat Patterns Involved

Primary: Unsafe Human-in-the-Loop Failures — The system was designed to rely on a human safety operator as a critical backup, but the operational environment did not adequately support the operator’s ability to monitor the system and intervene effectively.

Secondary: Tool Misuse and Privilege Escalation — The developmental automated driving system was granted operational authority over safety-critical vehicle functions (including the disabling of factory safety systems) without commensurate safety assurance measures.

Significance

1. First autonomous vehicle pedestrian fatality. The incident was the first documented case of a self-driving vehicle killing a pedestrian, establishing it as a defining event in autonomous vehicle safety history.
2. Failure of the human-in-the-loop model. The NTSB findings demonstrated that relying on a human safety operator as the sole backup for an automated system is insufficient when the system does not provide adequate alerts and the operator is not actively engaged.
3. Systemic safety culture failures. The NTSB identified that the root causes extended beyond technical failures to include organizational deficiencies in Uber’s safety culture, risk assessment processes, and testing protocols.
4. Regulatory gaps in autonomous vehicle testing. The incident exposed the absence of federal safety standards for autonomous vehicle testing and prompted calls for more rigorous regulatory oversight of companies testing self-driving technology on public roads.