HAR2001 Rel

Collision Between a Sport Utility Vehicle Operating With
Partial Driving Automation and a Crash Attenuator

Mountain View, California
March 23, 2018
Accident Report
NTSB/HAR-20/01
PB2020-100112
National
Transportation
Safety Board
NTSB/HAR-20/01
PB2020-100112
Notation 59775
Adopted February 25, 2020
Highway Accident Report

Collision Between a Sport Utility Vehicle Operating With
Partial Driving Automation and a Crash Attenuator
Mountain View, California
March 23, 2018
National
Transportation
Safety Board
490 L’Enfant Plaza SW

Washington, DC 20594
National Transportation Safety Board. 2020. Collision Between a Sport Utility Vehicle Operating With Partial Driving
Automation and a Crash Attenuator, Mountain View, California, March 23, 2018. Highway Accident Report
NTSB/HAR-20/01. Washington, DC.
Abstract: On Friday, March 23, 2018, at 9:27 a.m., a 2017 Tesla Model X P100D electric-powered sport utility vehicle
(SUV), occupied by a 38-year-old male driver, was traveling south on US Highway 101 (US-101) in Mountain View, Santa
Clara County, California. As the Tesla approached a paved gore area dividing the main travel lanes of US-101 from the left
exit ramp to State Route 85 (SR-85), the vehicle moved to the left and entered the gore. It continued traveling through the
gore and struck a previously damaged and nonoperational crash attenuator at a speed of about 71 mph. The impact rotated the
SUV counterclockwise and caused the front body structure to separate from the rear of the vehicle. The Tesla was involved
in subsequent collisions with two other vehicles, a 2010 Mazda 3 and a 2017 Audi A4. The Tesla’s high-voltage battery was
breached in the collision and a postcrash fire ensued. The driver was transported to a local hospital, where he died from
blunt-force trauma injuries. The driver of the Mazda sustained minor injuries, and the driver of the Audi was uninjured.
From its investigation of this crash, the National Transportation Safety Board (NTSB) identified the following safety issues:
• Driver distraction
• Risk mitigation pertaining to monitoring driver engagement
• Risk assessment pertaining to operational design domain
• Limitations of collision avoidance systems
• Insufficient federal oversight of partial driving automation systems
• Need for event data recording requirements for driving automation systems, and
• Highway infrastructure issues
On the basis of its findings, the NTSB makes safety recommendations to the US Department of Transportation, the National
Highway Traffic Safety Administration, the Occupational Safety and Health Administration, SAE International, Tesla,
Apple, and manufacturers of portable electronic devices.
The National Transportation Safety Board (NTSB) is an independent federal agency dedicated to promoting aviation, railroad,
highway, marine, and pipeline safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board
Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations,
study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The NTSB
makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations,
and statistical reviews.
The NTSB does not assign fault or blame for an accident or incident; rather, as specified by NTSB regulation, “accident/incident
investigations are fact-finding proceedings with no formal issues and no adverse parties . . . and are not conducted for the purpose of
determining the rights or liabilities of any person.” Title 49 Code of Federal Regulations, section 831.4. Assignment of fault or legal
liability is not relevant to the NTSB’s statutory mission to improve transportation safety by investigating accidents and incidents and
issuing safety recommendations. In addition, statutory language prohibits the admission into evidence or use of any part of an NTSB
report related to an accident in a civil action for damages resulting from a matter mentioned in the report. Title 49 United States Code,
section 1154(b).
For more detailed background information on this report, visit www.ntsb.gov and search for NTSB accident ID HWY18FH011.
Recent publications are also available in their entirety on this website. Other information about available publications also may be
obtained from the website or by contacting:
National Transportation Safety Board
Records Management Division, CIO-40
490 L’Enfant Plaza, SW
Washington, DC 20594
(800) 877-6799 or (202) 314-6551
Copies of NTSB publications may be downloaded at no cost from the National Technical Information Service’s National Technical
Reports Library at https://ntrl.ntis.gov/NTRL/. This product may be accessed using product number PB2020-100112. For additional
assistance, contact:
National Technical Information Service (www.ntis.gov)
5301 Shawnee Rd.,
Alexandria, VA 22312
(800) 553-6847 or (703) 605-6000
NOTE: This report was reissued on March 20, 2020, with a correction to page 65, clarifying that Member Jennifer Homendy was joined in her concurring
statement by all Board Members (Chairman Robert L. Sumwalt, III; Vice Chairman Bruce Landsberg; and Members Thomas B. Chapman and Michael E. Graham).
NTSB Highway Accident Report
Contents
Figures ......................................................................................................................................... iii
Acronyms and Abbreviations .................................................................................................... iv
Terminology Related to Driving Automation Systems .......................................................... vii
Executive Summary.................................................................................................................... ix
1 Factual Information ................................................................................................................. 1

1.1 Crash Summary ....................................................................................................................... 1
1.2 Operational Performance Data ................................................................................................ 4
1.3 Emergency Response............................................................................................................... 6
1.4 Occupant Restraints ................................................................................................................. 7
1.5 Vehicle Factors ........................................................................................................................ 9
1.5.1 Tesla SUV ..................................................................................................................... 9
1.5.2 Mazda 3 Car ................................................................................................................ 11
1.5.3 Audi A4 Car ................................................................................................................ 12
1.6 Tesla Autopilot ...................................................................................................................... 12
1.6.1 Autopilot Description .................................................................................................. 12
1.6.2 Autopilot Limitations .................................................................................................. 14
1.6.3 Autopilot Constraints .................................................................................................. 14
1.6.4 Postcrash Changes to Autopilot .................................................................................. 16
1.7 Tesla Collision Avoidance Systems ...................................................................................... 16
1.8 Tesla Driver Factors .............................................................................................................. 17
1.8.1 Background ................................................................................................................. 17
1.8.2 Cell Phone Usage ........................................................................................................ 18
1.8.3 Warnings for Hands Off Wheel .................................................................................. 20
1.8.4 Vehicle Familiarity and Handling ............................................................................... 20
1.9 Highway Factors .................................................................................................................... 21
1.9.1 Description and General Characteristics ..................................................................... 21
1.9.2 Gore Area .................................................................................................................... 21
1.9.3 Crash Attenuator ......................................................................................................... 23
1.10 Weather and Illumination .................................................................................................... 26
1.11 Other NTSB Investigations of Tesla Crashes with Autopilot Activated ............................. 26
1.11.1 Williston, Florida (May 7, 2016) .............................................................................. 26
1.11.2 Culver City, California (January 22, 2018) ............................................................... 27
1.11.3 Delray Beach, Florida (March 1, 2019) .................................................................... 28
i
2 Analysis.................................................................................................................................... 30
2.1 Introduction ........................................................................................................................... 30
2.2 Mountain View Crash Discussion ......................................................................................... 31
2.2.1 Crash Sequence ........................................................................................................... 31
2.2.2 Autopilot Performance ................................................................................................ 31
2.2.3 Collision Avoidance System Performance .................................................................. 32
2.2.4 Driver Distraction ........................................................................................................ 33
2.2.5 Highway Infrastructure Issues ..................................................................................... 41
2.3 Safety Issues Found in Partial Driving Automation Crashes ................................................ 43
2.3.1 Risk Mitigation Pertaining to Monitoring Driver Engagement .................................. 43
2.3.2 Risk Assessment Pertaining to Operational Design Domain ...................................... 46
2.3.3 Limitations of Collision Avoidance Systems .............................................................. 49
2.3.4 Insufficient Federal Oversight of Partial Driving Automation Systems ..................... 50
2.4 Need for Event Data Recorders for Driving Automation Systems ....................................... 52
3 Conclusions ............................................................................................................................. 55
3.1 Findings ................................................................................................................................. 55
3.2 Probable Cause ...................................................................................................................... 58
4 Recommendations................................................................................................................... 59
4.1 New Recommendations ......................................................................................................... 59
4.2 Previously Issued Recommendations Reiterated in This Report .......................................... 60
4.3 Previously Issued Recommendations Reiterated and Reclassified in This Report ............... 60
4.4 Previously Issued Recommendations Reclassified in This Report ....................................... 61
Board Member Statement ........................................................................................................ 64
Appendixes ................................................................................................................................. 66
References .................................................................................................................................. 74
ii
Figures
Figure 1. Map showing crash location and Tesla driver’s route of travel .................................... 1
Figure 2. Depiction of travel lanes and gore area ......................................................................... 2
Figure 3. Crash vehicles at final rest ............................................................................................ 3
Figure 4. Tesla postcrash fire ....................................................................................................... 4
Figure 5. Tesla movement leading up to the crash ....................................................................... 5
Figure 6. Positions of Tesla airbags.............................................................................................. 8
Figure 7. Tesla before being engulfed in flames .......................................................................... 9
Figure 8. Tesla interior rear section, with exposed battery cells ................................................ 10
Figure 9. Damage to Mazda 3 .................................................................................................... 11
Figure 10. Damage to Audi A4 .................................................................................................. 12
Figure 11. Tesla Autopilot components ....................................................................................... 13
Figure 12. Last Autopilot segment before crash, including warnings ........................................ 20
Figure 13. Postcrash drive-through, showing faded lane marking ............................................. 22
Figure 14. Added postcrash gore cross-hatching/chevrons ........................................................ 23
Figure 15. Precrash damaged condition of the crash attentuator ................................................ 24
Figure 16. 2015 Tesla after striking semitrailer, Williston, Florida ........................................... 27
Figure 17. 2014 Tesla and fire truck postcrash, Culver City, California ................................... 28
Figure 18. 2018 Tesla after striking semitrailer, Delray Beach, Florida .................................... 29
Figure 19. UNECE escalating timing of alerts for hands off wheel ........................................... 45
Figure D-1. Autosteer hands-on alert timing .............................................................................. 72
iii
Acronyms and Abbreviations

AAA American Automobile Association
ADAS advanced driver assistance systems
ADS automated driving systems
AEB automatic emergency braking
CalSTA California State Transportation Agency
Caltrans California Department of Transportation
CEA Consumer Electronics Association (renamed Consumer Technology Association

[CTA] in November 2015)
CFR Code of Federal Regulations
CHP California Highway Patrol
CTA Consumer Technology Association (formerly Consumer Electronics Association

[CEA])
CTIA Cellular Telecommunications Industry Association
DDT dynamic driving task
DOT US Department of Transportation
EDR event data recorder
FCW forward collision warning
FHWA Federal Highway Administration
GPS global positioning system
HAZMAT hazardous materials
HOV high-occupancy vehicle
I-405 Interstate 405
KB kilobyte
MAIT Multidisciplinary Accident Investigation Team
iv
MASH Manual for Assessing Safety Hardware
MB megabyte
MCU media control unit
mph miles per hour
MVFD Mountain View Fire Department
NCAP New Car Assessment Program
NCHRP National Cooperative Highway Research Program
NETS Network of Employers for Traffic Safety
NHTSA National Highway Traffic Safety Administration
NSC National Safety Council
NTSB National Transportation Safety Board
ODD operational design domain
ODI Office of Defects Investigation (NHTSA)
OEDR object and event detection and response
OTA over-the-air
OTS California Office of Traffic Safety
PED portable electronic device
RCM restraint control module
SAE SAE International (formerly Society of Automobile Engineers)
SD secure digital (card)
SMFD San Mateo Fire Department
SR-85 State Route 85
SUV sport utility vehicle
TACC Traffic-Aware Cruise Control
UNECE United Nations Economic Commission for Europe
US-27A US Highway 27A
v
US-101 US Highway 101
US-441 US Highway 441
vi
Terminology Related to Driving Automation Systems

In June 2018, SAE International (SAE) issued an updated Taxonomy and Definitions for
Terms Related to Driving Automation Systems for On-Road Motor Vehicles (SAE 2018).1 The
taxonomy includes functional definitions for levels of driving automation. As shown in Table 1
on the next page, SAE lists six levels of automation ranging from Level 0 (no driving
automation) to Level 5 (full driving automation). The generic term “driving automation
system” refers to any 1–5 level system. Individually, Tesla Autopilot subsystems―such as
Traffic-Aware Cruise Control (TACC), which provides longitudinal vehicle motion control; and
Autosteer, which provides lateral vehicle directional control―are considered Level 1 systems.
When Autopilot is active and multiple subsystems like TACC and Autosteer are combined to
provide both lateral and longitudinal vehicle motion control, the system is considered Level 2
driving automation.
SAE classifies a Level 2 system like Autopilot as “partial driving automation.” In a

Level 2 system, it is the driver’s responsibility to monitor the automation, maintain situational
awareness of traffic conditions, understand the limitations of the automation, and be available to
intervene and take full control of the vehicle at all times. Throughout this report, the terms
advanced driver assistance systems (ADAS), driving automation systems, and partial driving
automation will be used to describe the capabilities of Tesla Autopilot. In the SAE taxonomy table
(next page), the operational design domain (ODD) means the operating conditions under which
the driving automation system is designed to function. Object and event detection and response
(OEDR) includes detecting, recognizing, and classifying events and preparing to respond as
needed. The dynamic driving task (DDT) involves all real-time operational and tactical functions
required to operate a vehicle. Automated driving systems (ADS) apply to the higher, more fully
automated Levels 3–5.
1
SAE International, initially established as the Society of Automotive Engineers, is a professional association
and standards-developing organization. Refer to www.sae.org for additional information about technical standards
developed by the association.
vii
Table 1. Summary of SAE taxonomy and definitions of terms related to driving automation
systems for on-road motor vehicles. (Source: SAE International J3016, June 2018)
viii
Executive Summary
Crash Summary
On March 23, 2018, at 9:27 a.m., a 2017 Tesla Model X P100D electric-powered sport
utility vehicle (SUV), occupied by a 38-year-old male driver, was traveling south on
US Highway 101 (US-101) in Mountain View, Santa Clara County, California. At this location,
US-101 has six southbound traffic lanes, including a high-occupancy vehicle (HOV) exit lane to
State Route 85 (SR-85) southbound on the far left. As the SUV approached the US-101−SR-85
interchange, it was traveling in the lane second from the left, which was an HOV lane for
continued travel on US-101.2
While approaching a paved gore area dividing the main travel lanes of US-101 from the
SR-85 left-exit ramp, the SUV moved to the left and entered the gore. The vehicle continued
traveling through the gore and struck a damaged and nonoperational crash attenuator at a speed
of about 71 mph. The crash attenuator was positioned at the end of a concrete median barrier. As
a result of the collision, the SUV rotated counterclockwise and the front body structure separated
from the rear of the vehicle. The Tesla was involved in subsequent collisions with two other
vehicles, a 2010 Mazda 3 and a 2017 Audi A4.
The Tesla’s high-voltage battery was breached in the collision and a postcrash fire ensued.
On-scene witnesses found the Tesla driver in his seat with his lap/shoulder belt buckled. They
removed him from the vehicle before it was engulfed in flames. The driver was transported to a
local hospital, where he died from blunt-force trauma injuries. The driver of the Mazda sustained
minor injuries, and the driver of the Audi was uninjured.
System performance data downloaded from the Tesla indicated that the driver was
operating the SUV using the Traffic-Aware Cruise Control (an adaptive cruise control system)
and Autosteer system (a lane-keeping assist system), which are advanced driver assistance
systems in Tesla’s “Autopilot” suite. As part of this investigation, the National Transportation
Safety Board (NTSB) reviewed previous NTSB investigations involving the Tesla Autopilot
system in Williston, Florida; Culver City, California; and Delray Beach, Florida, to examine
common issues regarding the safety of advanced driver assistance systems that provide partial
driving automation (both lateral and longitudinal control).
Probable Cause
The National Transportation Safety Board determines that the probable cause of the
Mountain View, California, crash was the Tesla Autopilot system steering the sport utility vehicle
into a highway gore area due to system limitations, and the driver’s lack of response due to
distraction likely from a cell phone game application and overreliance on the Autopilot partial
driving automation system. Contributing to the crash was the Tesla vehicle’s ineffective
monitoring of driver engagement, which facilitated the driver’s complacency and inattentiveness.
Contributing to the severity of the driver’s injuries was the vehicle’s impact with a crash
2
Additional information about this investigation can be found in the public docket for this crash (NTSB case
number HWY18FH011) by accessing the Docket Management System at www.ntsb.gov.
ix
attenuator barrier that was damaged and nonoperational at the time of the collision due to the
California Highway Patrol’s failure to report the damage following a previous crash, and systemic
problems with the California Department of Transportation’s maintenance division in repairing
traffic safety hardware in a timely manner.
Safety Issues
The safety issues identified in this crash and in previous crashes involving partial driving
automation include the following:
• Driver Distraction. The Tesla driver was likely distracted by a gaming application on
his cell phone before the crash, which prevented him from recognizing that Autopilot
had steered the SUV into a gore area of the highway not intended for vehicle travel.
The driver was using a company-supplied phone, but his employer, Apple Inc., did not
have a policy preventing cell phone use while driving. Strong company policy, with
strict consequences for using portable electronic devices while driving, is an effective
strategy in helping to prevent the deadly consequences of distracted driving.
Additionally, an engineering solution to the distracted driving problem is needed.
Electronic device manufacturers have the capability to lock out highly distracting
functions of portable electronic devices when being used by an operator while driving,
and such a feature should be installed as a default setting on all devices.
• Risk Mitigation Pertaining to Monitoring Driver Engagement. The Tesla

Autopilot system did not provide an effective means of monitoring the driver’s level
of engagement with the driving task, and the timing of alerts and warnings was
insufficient to elicit the driver’s response to prevent the crash or mitigate its severity.
Requirements are needed for driver monitoring systems for advanced driver assistance
systems that provide partial driving automation (SAE Level 2 systems), and Tesla
needs to develop applications that more effectively sense the driver’s level of
engagement and that alert drivers who are not engaged.
• Risk Assessment Pertaining to Operational Design Domain. Crashes investigated

by the NTSB continue to show that the Tesla Autopilot system is being used by drivers
outside the vehicle’s operational design domain (the conditions in which the system is
intended to operate). Despite the system’s known limitations, Tesla does not restrict
where Autopilot can be used. Tesla should incorporate system safeguards that limit the
use of partial driving automation systems (Autopilot) to those conditions for which
they were designed. Additionally, the National Highway Traffic Safety Administration
(NHTSA) has failed to develop a method for verifying that manufacturers of partial
driving automation systems are incorporating system safeguards that are critical to
ensuring the safety of the motoring public.
• Limitations of Collision Avoidance Systems. The Tesla’s collision avoidance

systems were not designed to, and did not, detect the crash attenuator. Because this
object was not detected, (a) Autopilot accelerated the SUV to a higher speed, which
the driver had previously set by using adaptive cruise control, (b) the forward collision
warning did not provide an alert, and (c) the automatic emergency braking did not
activate. For partial driving automation systems to be safely deployed in a high-speed
x
operating environment, collision avoidance systems must be able to effectively detect

potential hazards and warn of potential hazards to drivers.
• Insufficient Federal Oversight of Partial Driving Automation Systems. The

US Department of Transportation and NHTSA have taken a nonregulatory approach
to automated vehicle safety. NHTSA plans to address the safety of partial driving
automation systems through enforcement and a surveillance program that identifies
safety-related defect trends in design or performance. This strategy must address the
risk of foreseeable misuse of automation and include a forward-looking risk analysis.
Additionally, NHTSA should complete a further evaluation of the Tesla Autopilot
system to ensure the deployed technology does not pose an unreasonable safety risk.
• Need for Event Data Recording Requirements for Driving Automation Systems.
Advanced driver assistance systems that provide partial automation collect significant
safety-relevant data that can be used for crash analysis and risk assessment. Currently,
manufacturers provide limited access to this data and there is no standardization of
retrievable data parameters. This report describes the NTSB’s previous safety
recommendations and the inaction of federal regulators to address this important issue
area that is needed to foster system safety improvements.
• Highway Infrastructure Issues. As part of this crash investigation, the NTSB issued
a safety recommendation report addressing systemic problems related to the timely
repair of traffic safety hardware in California. Investigators found that on the day of
the collision, the crash attenuator at the US-101–SR-85 interchange was in a
nonoperational damaged condition because of a previous crash, which had occurred
11 days earlier, on March 12, 2018. The Mountain View report briefly summarizes the
findings of the safety recommendation report and the actions taken by the state of
California to address this safety issue.
Findings
1. None of the following were factors in the Tesla driver’s actions in this crash: (1) driver
licensing or qualification; (2) familiarization with the vehicle and roadway; (3) medical
conditions, fatigue, or impairment by alcohol or other drugs; or (4) weather conditions.
2. The emergency response to the crash was timely and adequate.
3. The Tesla electric vehicle postcrash fire and related damage to the lithium-ion battery
presented unusual fire and electrical hazards to first responders.
4. The Tesla’s Autopilot lane-keeping assist system steered the sport utility vehicle to the
left into the neutral area of the gore, without providing an alert to the driver, due to
limitations of the Tesla Autopilot vision system’s processing software to accurately
maintain the appropriate lane of travel.
5. The Tesla’s collision avoidance systems were not designed to, and did not, detect the
crash attenuator at the end of the gore, nor did the National Highway Traffic Safety
xi
Administration require such capability; consequently, the forward collision warning

system did not provide an alert and the automatic emergency braking did not activate.
6. The driver did not take corrective action when the Tesla’s Autopilot lane-keeping assist
system steered the vehicle into the gore area, nor did he take evasive action to avoid
the collision with the crash attenuator, most likely due to distraction caused by a cell
phone game application.
7. Distracted driving due to portable electronic device use remains persistently high, and
additional countermeasures are needed.
8. A technological solution, such as a lock-out function or application that automatically

disables highly distracting features of a portable electronic device while driving, is an
effective countermeasure for eliminating portable electronic device distraction while
driving.
9. Strong company policy, with strict consequences for using portable electronic devices
while driving, is an effective strategy in helping to prevent distracted driving crashes,
injuries, and fatalities.
10. Although the Occupational Safety and Health Administration has guidelines for
companies to reduce motor vehicle crashes by prohibiting the use of portable electronic
devices while driving, the guidelines lack specificity, are not widely adopted by
companies, and are seldom enforced―limiting their impact in addressing the hazards
of distracted driving.
11. The Tesla Autopilot system did not provide an effective means of monitoring the
driver’s level of engagement with the driving task.
12. Although the lack of gore area roadway striping at the Mountain View crash location
likely did not contribute to the crash, ongoing research led by the Federal Highway
Administration can help identify what highway infrastructure changes may be needed
in the future to accommodate automated vehicles.
13. The crash attenuator was in a damaged and nonoperational condition at the time of the
collision due to the California Highway Patrol’s failure to report the damage following
a previous crash and systemic problems with the California Department of
Transportation’s maintenance division in repairing traffic safety hardware in a timely
manner.
14. If the crash attenuator at the US Highway 101−State Route 85 interchange had been
repaired in a timely manner and in a functional condition before the March 23, 2018,
crash, the Tesla driver most likely would have survived the collision.
15. Because monitoring of driver-applied steering wheel torque is an ineffective surrogate

measure of driver engagement, performance standards should be developed pertaining
to an effective method of ensuring driver engagement in SAE Level 2 partial driving
automation systems.
xii
16. If Tesla Inc. does not incorporate system safeguards that limit the use of the Autopilot
system to those conditions for which it was designed, continued use of the system
beyond its operational design domain is foreseeable and the risk for future crashes will
remain.
17. The National Highway Traffic Safety Administration’s failure to ensure that vehicle
manufacturers of SAE Level 2 driving automation systems are incorporating
appropriate system safeguards to limit operation of these systems to the operational
design domain compromises safety.
18. In order for driving automation systems to be safely deployed in a high-speed operating
environment, collision avoidance systems must be able to effectively detect and
respond to potential hazards, including roadside traffic safety hardware, and be able to
execute forward collision avoidance at high speeds.
19. The National Highway Traffic Safety Administration’s approach to the oversight of
automated vehicles is misguided, because it essentially relies on waiting for problems
to occur rather than addressing safety issues proactively.
20. It is essential that the National Highway Traffic Safety Administration’s surveillance
and defect investigation program closely examine issues related to foreseeable misuse
of automation and perform a forward-looking risk analysis to identify partial driving
automation system defects that pose an unreasonable risk to safety.
21. The National Highway Traffic Safety Administration’s Office of Defects Investigation
has failed to thoroughly investigate the Tesla Autopilot design regarding the degree to
which drivers are currently misusing the system, the foreseeable consequences of
continued use by drivers beyond the system’s operational design domain, and the
effectiveness of the driver monitoring system in ensuring driver engagement.
22. Vehicle performance data associated with activation and engagement of partial driving
automation systems on vehicles involved in crashes are not required nor available on
most event data recorders.
23. A standardized set of retrievable data is needed to enable independent assessment of

automated vehicle safety and to foster automation safety improvements.
xiii
Recommendations
New Recommendations
As a result of its investigation, the National Transportation Safety Board makes the
following nine new safety recommendations:
To the National Highway Traffic Safety Administration:
Expand New Car Assessment Program testing of forward collision avoidance

system performance to include common obstacles, such as traffic safety hardware,
cross-traffic vehicle profiles, and other applicable vehicle shapes or objects found
in the highway operating environment. (H-20-1)
Evaluate Tesla Autopilot-equipped vehicles to determine if the system’s operating

limitations, the foreseeability of driver misuse, and the ability to operate the
vehicles outside the intended operational design domain pose an unreasonable risk
to safety; if safety defects are identified, use applicable enforcement authority to
ensure that Tesla Inc. takes corrective action. (H-20-2)
For vehicles equipped with Level 2 automation, work with SAE International to
develop performance standards for driver monitoring systems that will minimize
driver disengagement, prevent automation complacency, and account for
foreseeable misuse of the automation. (H-20-3)
After developing the performance standards for driver monitoring systems

recommended in Safety Recommendation H-20-3, require that all new passenger
vehicles with Level 2 automation be equipped with a driver monitoring system that
meets these standards. (H-20-4)
To the Occupational Safety and Health Administration:
Review and revise your distracted driving initiatives to increase employers’

awareness of the need to develop strong cell phone policy prohibiting the use of
portable electronic devices while driving. (H-20-5)
Modify your enforcement strategies to increase the use of the general duty clause
cited in 29 United States Code section 654 against those employers who fail to
address the hazards of distracted driving. (H-20-6)
To SAE International:
For vehicles equipped with Level 2 automation, work with the National Highway
Traffic Safety Administration to develop performance standards for driver
monitoring systems that will minimize driver disengagement, prevent automation
complacency, and account for foreseeable misuse of the automation. (H-20-7)
xiv
To Manufacturers of Portable Electronic Devices (Apple, Google, HTC, Lenovo, LG,

Motorola, Nokia, Samsung, and Sony):
Develop a distracted driving lock-out mechanism or application for portable

electronic devices that will automatically disable any driver-distracting functions
when a vehicle is in motion, but that allows the device to be used in an emergency;
install the mechanism as a default setting on all new devices and apply it to existing
commercially available devices during major software updates. (H-20-8)
To Apple Inc.:
Develop and implement a company policy that bans the nonemergency use of
portable electronic devices while driving by all employees and contractors driving
company vehicles, operating company-issued portable electronic devices, or using
a portable electronic device to engage in work-related communications. (H-20-9)
Previously Issued Recommendations Reiterated in This Report

As a result of its investigation, the National Transportation Safety Board reiterates the
following two safety recommendations (already classified “Open―Unacceptable Response”) in
sections 2.3.3 and 2.3.2, respectively, in this report:
Develop and apply testing protocols to assess the performance of forward collision
avoidance systems in passenger vehicles at various velocities, including high speed
and high velocity-differential. (H-15-4)
Develop a method to verify that manufacturers of vehicles equipped with Level 2

vehicle automation systems incorporate system safeguards that limit the use of
automated vehicle control systems to those conditions for which they were
designed. (H-17-38)
Previously Issued Recommendations Reiterated and Reclassified in

This Report
As a result of its investigation, the National Transportation Safety Board reiterates and
reclassifies the following five safety recommendations:
To the US Department of Transportation:
Define the data parameters needed to understand the automated vehicle control
systems involved in a crash. The parameters must reflect the vehicle’s control status
and the frequency and duration of control actions to adequately characterize driver
and vehicle performance before and during a crash. (H-17-37)
Safety Recommendation H-17-37 is reclassified from “Open―Await Response” to

“Open―Unacceptable Response” in section 2.4 of this report.
xv
Use the data parameters defined by the U.S. Department of Transportation in

response to Safety Recommendation H-17-37 as a benchmark for new vehicles
equipped with automated vehicle control systems so that they capture data that
reflect the vehicle’s control status and the frequency and duration of control actions
needed to adequately characterize driver and vehicle performance before and
during a crash; the captured data should be readily available to, at a minimum,
National Transportation Safety Board investigators and National Highway Traffic
Safety Administration regulators. (H-17-39)
Safety Recommendation H-17-39 is reclassified from “Open―Acceptable Response” to

Define a standard format for reporting automated vehicle control systems data and
require manufacturers of vehicles equipped with automated vehicle control systems
to report incidents, crashes, and vehicle miles operated with such systems enabled.
(H-17-40)

To Tesla Inc.:
Incorporate system safeguards that limit the use of automated vehicle control
systems to those conditions for which they were designed. (H-17-41)

“Open―Unacceptable Response” in section 2.3.2 of this report.
Develop applications to more effectively sense the driver’s level of engagement and
alert the driver when engagement is lacking while automated vehicle control
systems are in use. (H-17-42)

xvi
Previously Issued Recommendations Reclassified in This Report

As a result of its investigation, the National Transportation Safety Board reclassifies the
following two safety recommendations:
To the Consumer Electronics Association (now the Consumer Technology Association):
Encourage the development of technology features that disable the functions of

portable electronic devices within reach of the driver when a vehicle is in motion;
these technology features should include the ability to permit emergency use of the
device while the vehicle is in motion and have the capability of identifying occupant
seating position so as not to interfere with use of the device by passengers.
(H-11-47)

“Closed―No Longer Applicable” in section 2.2.4.3 of this report.
To the California State Transportation Agency:
Develop and implement a corrective action plan that guarantees timely repair of
traffic safety hardware and includes performance measures to track state agency
compliance with repair timelines. (H-19-13)
Safety Recommendation H-19-13 is reclassified from “Open―Initial Response

Received” to “Open―Acceptable Response” in section 2.2.5.2 of this report.
xvii
1 Factual Information
1.1 Crash Summary
On Friday, March 23, 2018, at 9:27 a.m., a 2017 Tesla Model X P100D electric-powered
sport utility vehicle (SUV), operated by a 38-year-old driver, was traveling south on
US Highway 101 (US-101) in Mountain View, Santa Clara County, California. The driver had
departed his home in Foster City, California, at 8:59 a.m. to drive to his work location in
Sunnyvale, California (see figure 1).
Figure 1. Map showing crash location and Tesla driver’s route of travel on southbound US-101.
Continuing south on US-101, the driver approached the interchange with State Route 85
(SR-85). As shown in figure 2, US-101 southbound at the SR-85 interchange consisted of:
• A single left-exit high-occupancy vehicle (HOV) lane for SR-85 (yellow arrow),
• A single US-101 HOV lane (green arrow; Tesla driver’s intended route),
• Three mainline US-101 lanes (red arrows), and
• Two right-exit conventional lanes for SR-85 (blue arrows).
1
A 630-foot-long paved gore with an unmarked neutral (inside) area separated the left-exit
HOV lane for SR-85 from the US-101 HOV lane.1 The gore widened to about 17.5 feet at the
point where a previously damaged and nonoperational crash attenuator was in place ahead of a
3-foot-high concrete barrier (see inset image in figure 2). The barrier separated the left-exit HOV
lane for SR-85 from the US-101 HOV lane. At this location, the speed limit was 65 mph.
Figure 2. Depiction of travel lanes and gore area at the US-101−SR-85 southbound interchange.
Inset photo depicts precrash damaged condition of the crash attenuator. (Source: Google Earth,
image date March 2018. Inset photo provided by California Department of Transportation
[Caltrans]; image date March 20, 2018).
As the SUV approached the US-101−SR-85 interchange, it was traveling in the second
lane from the left with the Tesla’s Autopilot system activated (for more detail on the operational
performance data, see section 1.2).2 When the SUV reached the gore dividing the main travel
lanes of US-101 from the left exit ramp to SR-85, the vehicle moved to the left. It entered the
gore, through which it continued traveling until the front left of the SUV struck the crash
1
A gore area is a triangular-shaped boundary created by white lines marking an area of pavement formed by the
convergence or divergence of a mainline travel lane and an exit/entrance lane. It is not intended for vehicle travel.
2
In accordance with California Vehicle Code section 21655.5, the California Air Resources Board designated
the Tesla Model X as an approved vehicle for single-occupant use in HOV lanes.
2
attenuator at a speed of 70.8 mph. The impact rotated the SUV counterclockwise and caused the
front body structure to separate from the rear of the vehicle. The SUV was subsequently struck
by two other vehicles, a 2010 Mazda 3 and a 2017 Audi A4, when it rotated into the lane to the
right of the gore (see figure 3).3
Figure 3. Southbound view of US-101, depicting the Tesla, Audi, and Mazda vehicles at final rest.
(Source: witness S. Engleman)
The Tesla’s high-voltage battery was breached in the collision and a postcrash fire ensued
(see figure 4). After the crash, on-scene witnesses found the driver in his seat with his lap/shoulder
belt buckled. They removed him from the vehicle before it was engulfed in flames, and he was
transported by ambulance to the hospital for treatment.
The 51-year-old female driver of the Audi was uninjured, and the 25-year-old male driver
of the Mazda sustained minor injuries. The Tesla driver died at Stanford Health Care Hospital at
1:02 p.m., 4 hours 35 minutes after the crash. The cause of death was multiple blunt-force injuries
that included a fractured pelvis and significant internal injuries.
3
This investigation focused on the primary collision between the SUV and the crash attenuator. More detailed
information related to the precrash motion of the Mazda and the Audi can be found in the public docket for this crash
(NTSB case number HWY18FH011).
3
Figure 4. Northbound view of US-101 depicting Tesla postcrash fire. (Source: witness S. Engleman)
1.2 Operational Performance Data

Autopilot is a combination of Tesla advanced driver assistance systems (ADAS) that
control vehicle speed and lane positioning by automating braking, steering, and torque to the drive
motors. The major subsystems associated with the operation of Autopilot are Traffic-Aware
Cruise Control (TACC) and Autosteer. TACC is an adaptive cruise control system that provides
longitudinal control (acceleration and deceleration) and Autosteer is a lane-keeping assist system
that provides lateral control (steering) of the vehicle inside the lane.
The SUV stored operational data in its event data recorder (EDR) and in non-volatile
memory in its media control unit (MCU).4 The MCU data were continually recorded onto a secure
digital (SD) card in the vehicle’s Carlog.5 After examining the Carlog data, National Transportation
Safety Board (NTSB) investigators developed a time-position diagram (figure 5) depicting the
4
The EDR captured the vehicle’s dynamic time-series data for the period just before and during the crash event.
The EDR was located in the restraint control module (RCM) designed to control the car’s airbag system and other
supplemental restraints.
5
Detailed information regarding the recovery of data from the SUV can be found in the Automation and Data
Summary factual report in the public docket for this crash (NTSB case number HWY18FH011). Tesla refers to the
data stored on the non-volatile memory SD card in the MCU as “Carlog” data. Parameters of data recorded included
vehicle speed, steering angle, lateral and longitudinal acceleration, accelerator position, driver-applied brake pedal
application, lead vehicle distance, and Autopilot technology features.
4
motion of the SUV during the 10 seconds leading up to the crash.6 The time-position diagram is
divided into two images. The left image shows the position of the SUV 9.9 to 4.9 seconds precrash
and the right image depicts the final 4.9 seconds leading to the crash with the attenuator.
Figure 5. Movement of the Tesla SUV (blue vehicle) during the 10 seconds leading up to the
crash with the attenuator. (The gore is highlighted yellow in this graphic for better clarity.)
The Carlog data also showed that during the last 10 seconds before impact:
• Autopilot was active and the TACC was set to a cruise speed of 75 mph.
• Between 10 and 6 seconds prior to the crash, the SUV was traveling between 64 and
66 mph and following another vehicle at a distance of about 83 feet. The Tesla driver
had set the TACC to position 1, which maintained the closest possible following
6
Appendix A gives details of the NTSB investigation. Appendix B contains the tabulated data extracted from
the Carlog used to create figure 5.
5
distance behind the lead vehicle immediately ahead (time-based following distance of
about 0.9 seconds).7
• When the Tesla was about 5.9 seconds and about 560 feet from the crash attenuator,
Autosteer initiated a left steering input (5.6 degrees at the steering wheel) toward the
neutral area of the gore. At the time of the steering movement, no driver-applied
steering wheel torque was detected by Autosteer.8 It is possible that hands can be
resting on the steering wheel and no torque is registered. However, a lack of steering
wheel torque indicates to the vehicle system that the driver’s hands are not on the
steering wheel. This hands-off steering indication continued up to the point of impact
with the crash attenuator.
• When the SUV was about 3.9 seconds and 375 feet from the crash attenuator and fully
inside the neutral area of the gore, the TACC no longer detected a lead vehicle ahead
and the SUV began accelerating from a speed of 61.9 mph to the preset cruise speed
of 75 mph.9
• The forward collision warning (FCW) system did not provide an alert and the
automatic emergency braking (AEB) did not activate as the Tesla approached the crash
attenuator.
• The data indicated that the SUV driver did not apply the brakes and did not initiate
any steering movement to avoid the crash.
1.3 Emergency Response

A multiagency response consisted of the California Highway Patrol (CHP) and the
Mountain View Fire Department (MVFD). The first emergency 911 call was received at 9:28 a.m.
and the MVFD was dispatched at 9:31 a.m., arriving at the crash location at 9:36 a.m. The MVFD
responded with three engine units, one rescue unit, and a truck for patient care, fire suppression,
and equipment/personnel recovery.
After emergency personnel extinguished the flames by using water and foam, they noted
intermittent popping noises accompanied by smoke, at which time they applied additional water.
Because of concerns regarding high voltage and energy issues associated with the Tesla’s
lithium-ion battery, the MVFD incident commander contacted Tesla Inc. regarding additional
actions needed to make the SUV safe. A Tesla battery engineer advised that the vehicle was not
safe because of the extent of the damage and that all personnel should stay away from the SUV
until Tesla representatives could evaluate it.
7
Drivers using TACC can adjust following distance by choosing a setting from 1 (the closest following distance)
to 7 (the longest following distance). Each setting corresponds to a time-based distance that represents how long it
takes for the Tesla, from its current location, to reach the location of the rear bumper of the vehicle ahead.
8
Torque is force applied to an object to make it rotate about an axis (in this case, the steering wheel to rotate
about the steering column).
9
A dashcam mounted in a vehicle traveling north on US-101 captured the Tesla before the crash. The video
showed a sedan in front of the Tesla―a lead vehicle―continuing south in the second lane from the left (the US-101
HOV lane) as the SUV traveled south in the gore area not intended for vehicle travel.
6
When the Tesla engineers arrived at the crash site, they immediately began removing
damaged cells from the battery. Shortly thereafter, they heard three consecutive popping sounds
and saw a shift in the vehicle’s floorboard. The Tesla engineers determined that further attempts
to remove damaged battery parts would be unsafe. Because the SUV could not be made
completely stable on scene, it was loaded onto a flatbed tow truck and escorted by the CHP and
the MVFD to an impound facility in San Mateo, California. About 20 minutes after the SUV
arrived, the San Mateo Fire Department (SMFD) was dispatched to the impound facility because
of venting sounds emanating from the Tesla wreckage.10 The SMFD crew monitored the vehicle
with thermal cameras but made no further attempts at fire suppression.
At 7:01 p.m. on March 28 (5 days after the crash), the SMFD was dispatched to the
impound facility because of a report of a fire. On arrival, the SMFD crew observed flames about
8–12 inches high emanating from the Tesla’s front passenger side. Approximately 300 gallons of
water were applied intermittently during a 40-minute period, but because the fire continued to
burn, Tesla engineers advised the SMFD to apply foam. At 8:50 p.m., after about 5 minutes of
foam application, the fire was extinguished. A hazardous materials (HAZMAT) unit of the SMFD
responded to test the run-off water and determined it to be toxic. The HAZMAT unit ordered
public works to vacuum water, foam, and vehicle fluids from the storm drain. About 9:50 p.m.,
the HAZMAT unit declared the scene safe.
Lessons learned from the emergency response to the Tesla fire will be incorporated into a
separate NTSB report on electric vehicle battery fires.
1.4 Occupant Restraints

The Tesla driver was restrained with a lap/shoulder belt equipped with a pretensioner that
worked in conjunction with airbag systems in a severe frontal collision (figure 6 shows the airbag
positions). The pretensioner automatically retracted both the seat belt anchor and the seat belt
webbing, reducing slack in both the lap and shoulder portions of the belt.
10
A damaged lithium-ion battery can cause battery cells to enter “thermal runaway,” which is a loss of electrical
isolation between the cathode and anode, making the cell overheat and combust. Thermal runaway events are often
accompanied by a combination of flames, venting of gases, and popping or other noises resulting from the venting.
This reaction may stop at one cell or propagate to adjacent cells.
7
Figure 6. Diagram showing the positions of the SUV’s airbags. (Source: Tesla Model X Owner’s
Manual)
Data downloaded from the RCM showed that the following restraint systems deployed
during the crash:
• Driver seat belt pretensioners,
• Driver front, knee, and side seat airbags,
• Inflatable curtain airbags on the left and right side,
• Passenger-side seat airbag, and
• Second row left and right curtain and side seat airbags.
8
The Mazda driver was wearing his lap/shoulder belt at the time of the crash and the
Mazda’s front airbag deployed. The Audi driver was also restrained with a lap/shoulder belt; the
Audi’s front airbag did not deploy.11
1.5 Vehicle Factors

1.5.1 Tesla SUV
1.5.1.1 Damage. The SUV was extensively damaged in the crash (see figure 7). The front section
(everything forward of the leading edges of the front doors) was destroyed and broken into
fragments that spread across several traffic lanes at the US-101−SR-85 interchange. Separated
components included the front drive motor, front suspension, fenders, and hood. The rear section,
including the passenger compartment, sustained thermal damage from the postcrash fire.
Figure 7. Northbound view of the crash scene before the Tesla was engulfed in flames. (Source:
witness S. Engleman)
1.5.1.2 Battery Damage. The Tesla electric vehicle was powered by a 400-volt lithium-ion
battery. The battery comprised about 8,500 vertically mounted and tightly packed battery cells,
divided into 16 modules contained within an aluminum battery pack assembly, extending along
the floor of the SUV. The battery pack was breached in the collision and a postcrash fire ensued.
Examination of the battery pack found the front edge crushed rearward with the top surface
twisted aft and upward, exposing individual battery cells (see figure 8).12
11
A near-deployment airbag event was recorded in the Audi’s EDR. The data showed the Audi driver braked
about 3 seconds before impacting the Tesla and slowed from a speed of about 63 mph to an impact speed of 16 mph.
The impact was not severe enough to trigger an airbag deployment. No data could be imaged from the Mazda because
the 2010 model was not supported by crash data retrieval tools.
12
A detailed discussion of the damaged battery and fire is available in the public docket for this investigation.
9
Figure 8. Interior view of the Tesla’s rear section, with exposed battery cells from the lithium-ion
battery (circled in red) in the floorboard. (Source: CHP)
1.5.1.3 Mechanical and Service History. A full examination of the Tesla’s mechanical
components was not possible due to the fire damage and the extensive damage of the detached
components. The condition prohibited an accurate evaluation of the functionality of the throttle,
steering, and brake system.13 Maintenance service records were examined and service personnel
at the Tesla Service Center in Sunnyvale were interviewed regarding repairs made to the Tesla
SUV between March 6 and March 12, 2018 (11 days before the crash). The March 6 service visit
was to diagnose and repair damage to a rear passenger door and to address a complaint about the
global positioning system (GPS)/navigation system that caused the cruise control not to function,
with an associated alert that read “maps not loaded.” The service personnel could not remember
the interaction with the driver about the cruise control complaint and wrote on the service records
“unable to duplicate concern at this time.” A review of the Tesla’s Carlog records from the time
of the crash showed that the cruise control was functioning, with no alerts about the maps not
loading.
13
A check of the National Highway Traffic Safety Administration (NHTSA) database revealed no relevant recalls
or ongoing defect investigations related to the circumstances of the Mountain View crash.
10
1.5.1.4 Tesla Software Updates. Tesla updates its software (firmware) wirelessly, providing
new features as they are developed.14 Firmware version 2018.10-4460-998269610au was
installed on the SUV on March 12, 2018, during the service visit. Two days later, Tesla released
a new firmware update to vehicle owners. Between March 14 and the crash on March 23, Tesla
made 13 attempts to send firmware version 2018.10.4 to the SUV via over-the-air (OTA) wireless
connection. Each attempt failed because of poor connectivity with the vehicle.15
Since the Mountain View crash, Tesla has enhanced the OTA updating process by adding
a firmware update window in the Tesla mobile phone application. The application provides push
notifications so that owners are informed and aware of the availability of updates even when not
in the vehicle.16
1.5.2 Mazda 3 Car
1.5.2.1 Damage. The 2010 Mazda 3 sustained damage concentrated in the area of the left fender,
left front tire and wheel assembly, and driver’s door (see figure 9).
Figure 9. Damage to left front, hood, and left side of the Mazda 3.
14
Firmware updates occur about every 6 to 8 weeks, but it is not uncommon for there to be 10 weeks between
updates. Firmware version numbers reflect the year and week of the release. Any number after the week number is
typically a sub-version number, which usually indicates minor fixes to the software.
15
Firmware 2018.10.4 did not provide additional cameras or sensor usage. The firmware change updated the
processing software for the vision system to improve overall performance.
16
Tesla advised the NTSB that OTA firmware installation is “extremely successful.” As of March 27, 2019,
firmware 2018.10.4 had been installed on 99.8 percent of the US Tesla fleet.
11
1.5.2.2 Mechanical Inspection. The CHP Multidisciplinary Accident Investigation Team

(MAIT) inspected the Mazda on March 29, 2018, and found no evidence of any mechanical
conditions that would have affected the vehicle’s safe operation.
1.5.3 Audi A4 Car
1.5.3.1 Damage. The 2017 Audi A4 sustained damage concentrated in the area of the right front
bumper, headlamp, and hood (see figure 10).
Figure 10. Damage to right front of the Audi A4.
1.5.3.2 Mechanical Inspection. The CHP MAIT inspected the Audi A4 on March 29, 2018, and
found no evidence of any mechanical conditions that would have affected the vehicle’s safe
operation.
1.6 Tesla Autopilot

1.6.1 Autopilot Description
Tesla refers to its suite of ADAS that controls vehicle movement as Autopilot. When
Autopilot is active, the system (1) monitors the travel path, (2) maintains the set cruise speed,
(3) maintains the vehicle’s position in the travel lane, (4) brakes when it detects slower-moving
vehicles ahead of the Tesla, and (5) decelerates and follows a slower-moving vehicle in front of
the Tesla at a preset following interval.
12
Autopilot consists of three main subsystems: (1) a sensor and imaging suite (cameras,
radar, and ultrasonic sensors) designed to assess the nearby environment (see figure 11), (2) a
data-processing suite designed to collect input data from the sensors and compute instructions,
and (3) a servo suite designed to send control inputs to the vehicle. Information travels between
subsystems using multiple controller area network busses. The performance data associated with
Autopilot control systems are stored in non-volatile memory and can be communicated through
an OTA network to the Tesla’s central computer network. Autopilot is considered an SAE
International (SAE) Level 2 partial driving automation system.17 In a Level 2 system, it is the
driver’s responsibility to monitor the automation, maintain situational awareness of traffic
conditions, understand the limitations of the automation, and be available to intervene and take
full control of the vehicle at all times.
Figure 11. Diagram showing the positions of Autopilot components (cameras, ultrasonic sensors,
and radar) for monitoring roadway environment. (Source: Tesla Model X Owner’s Manual)
The major Autopilot features that the driver used in the moments leading up to the crash
were TACC and Autosteer. TACC uses information from the forward-looking camera and radar
sensor to determine whether a vehicle is in front of the Tesla in the same lane. If no vehicle is
ahead of the Tesla, TACC maintains a set cruise speed selected by the driver. When a lead vehicle
travels slower than the Tesla’s set cruise speed, TACC will maintain a selected time interval
behind the lead vehicle.
The Autosteer lane-keeping assist system uses information from the forward-looking
camera, radar sensor, and ultrasonic sensors to detect lane markings and the presence of vehicles
and objects. This information provides automated lane-keeping steering control based on the lane
markings and the vehicle directly in front of the Tesla, if present. In most cases, Autosteer
attempts to center the Tesla in the travel lane. However, if the ultrasonic sensors detect the
presence of an adjacent object or large vehicle (for example, a guardrail or a truck), Autosteer
may steer the vehicle in a driving path offset from the center of the lane. If Autosteer does not
17
SAE International, initially established as the Society of Automotive Engineers, is a professional association
and standards-developing organization. Refer to www.sae.org for additional information about technical standards
developed by the association.
13
receive adequate data from the camera or sensors, a message displays on the instrument panel
indicating that Autosteer is temporarily unavailable.18
1.6.2 Autopilot Limitations
Autopilot features are described to Tesla customers as “Beta.”19 The Tesla Model X
Owner’s Manual (Tesla 2017) includes more than 50 warnings about the limitations of Autopilot
features.20 In addition, before driving with the Autopilot system, the driver must acknowledge
several factors. On the display screen inside a Tesla vehicle, the system prompts specifically about
Autosteer, although Autosteer requires activating TACC first. The Tesla-provided information
states (verbatim):
• Autosteer feature is currently in Beta.
• Autosteer is a driver assistance feature and does not make your vehicle
autonomous.
• Please use it only if you will pay attention to the road, keep your hands on the
steering wheel, and be prepared to take over at any time. Autosteer is designed
for use on highways that have a center divider, clear lane markings, and no
cross-traffic. It should not be used on highways that have very sharp turns or
lane markings that are absent, faded, or ambiguous.
• Autosteer is currently in Beta, which we say to encourage a higher level of

vigilance. If this were a computer or mobile phone, we would not refer to it as
Beta, but we believe the standards are considerably higher for vehicle control
and want to be clear about the proper use of Autosteer.
• Before using Autosteer, please read the Owner’s Manual for instructions and
more safety information.
• Do you want to enable Autosteer while it is in Beta?
Drivers also receive an alert every time Autopilot is activated to “Always Keep Your
Hands on the Wheel,” and “Be Prepared to Take Over at Any Time.”
1.6.3 Autopilot Constraints
1.6.3.1 Autopilot Activation. Autopilot (TACC and Autosteer) can be activated on any road on
which the system can detect lane markings. To activate Autopilot, a Tesla must be traveling at a
speed of at least 18 mph if no lead vehicle is detected. If a vehicle is detected ahead of the Tesla,
18
If the driver does not respond to visual and audible alerts regarding the unavailability of Autopilot, the vehicle
will decelerate in the current travel lane and activate the hazard flashers. (This situation would likely occur only in
the event of an incapacitated or completely unresponsive driver.)
19
In general, Beta means that an application or system is still in the development stages and is not the final
version.
20
Appendix C contains a list of warnings and limitations associated with the use of Autopilot features TACC and
Autosteer.
14
Autopilot can be activated at any speed under 90 mph, even when stationary (if at least 5 feet
away from the other vehicle).
1.6.3.2 Restricted Speeds. When Autopilot is active, the system limits the maximum speed at
which the vehicle travels. When used on roads without a center divider, Autopilot limits the
driving speed to a maximum of 5 mph above the detected speed limit (by reading the speed limit
signs). On a road with a center divider, Autopilot allows a maximum travel speed of 90 mph,
regardless of the roadway’s speed limit. In situations where the Autopilot vision system has not
detected a roadway speed limit, Autopilot limits the speed to 45 mph. A driver can manually
accelerate above the TACC-limited speed, but when the accelerator pedal is released, Autopilot
will slow the Tesla to the limited speed.
If a driver tries to activate Autopilot at a speed that is outside the system’s speed
restrictions, the instrument panel displays a message indicating that Autopilot is temporarily
unavailable.
1.6.3.3 Hands-On Steering Wheel Requirement. When active, Autosteer requires a driver to
intermittently hold the steering wheel. The system detects hands on the wheel by recognizing
torque on the steering wheel from the driver’s manually turning the wheel very lightly (that is,
without enough force to retake control).21 If Autosteer does not detect the driver’s hands on the
steering wheel for a period of time, a visual warning (flashing white light) appears along the top
of the instrument panel and the following message displays: “Apply light force to steering wheel.”
If Autosteer does not detect the driver’s hands on the steering wheel after the visual
warning, the system gives two auditory warnings, the first of which is sounded 15 seconds after
the visual warning. If the driver’s hands are still not detected on the steering wheel, Autosteer
gives a second auditory warning 10 seconds after the first one.
If a driver ignores the second auditory warning and does not apply steering-wheel torque
within the next 5 seconds, Autosteer sounds a continuous chime, turns on hazard warning flashers,
and slows the vehicle to a complete stop in the current lane of travel. Additionally, if a driver
receives any combination of three separate auditory alerts within an hour, Autosteer disengages
and remains unavailable until the vehicle has been turned off and then back on.
The time between the detection of hands-off operation and the visual warning depends on
(1) vehicle speed, (2) presence of a vehicle ahead, (3) lateral acceleration, (4) type of roadway,
(5) detection of system errors (which would prompt an immediate warning), (6) driver application
of pedals, and (7) miscellaneous factors, such as the presence of a construction zone. Because the
crash Tesla was traveling on a divided highway at a speed greater than 45 mph and following
another vehicle, Autosteer would give the first visual alert to the driver 3 minutes after not
detecting driver-applied torque on the steering wheel.
21
Activating a turn signal, using the cruise control lever to adjust the cruise speed or following distance, or using
any steering wheel button or scroll wheel is viewed by Autosteer as driver engagement with the system and resets
the counting of the hands-off-wheel timing.
15
1.6.4 Postcrash Changes to Autopilot
After the Mountain View crash, Tesla made design changes to the Autopilot software. The
changes included updates to the vision system, more immediate warnings in Autosteer’s
hands-off-wheel alert timing, and an Autopilot “Drivable Space” forward collision warning and
avoidance system. The changes are summarized in appendix D.
1.7 Tesla Collision Avoidance Systems

The SUV was also equipped with collision avoidance assistance features including those
for prevention and mitigation of forward collisions. The FCW system provides visual and audible
warnings in situations when the Tesla detects high risk of a frontal collision. The AEB is typically
engaged after FCW if a driver does not respond, and automatically applies braking to prevent a
frontal collision or reduce its impact. The FCW/AEB system is a radar/camera fusion system
designed to detect slow, stopped, and decelerating vehicles ahead of the Tesla in the same lane.22
During the 5 seconds leading up to the crash, the Tesla SUV accelerated from about
63 mph to nearly 71 mph at impact. During the approach to the crash attenuator, the FCW system
did not provide an alert and the AEB did not activate. FCW and AEB are designed and tested to
recognize particular types of objects (vehicles) and warn or brake within a particular speed range.
NHTSA has established test protocols and performance specifications for FCW and AEB
as part of the agency’s New Car Assessment Program (NCAP).23 Collision avoidance systems
that meet the minimum performance specifications are listed as “Recommended Safety
Technologies” on NHTSA’s NCAP website, but the agency does not rate the overall effectiveness
of these systems. Collision avoidance technologies are not currently part of NCAP’s 5-Star Safety
Ratings program; only vehicle crashworthiness and rollover safety are.
Testing of various collision avoidance systems is also conducted in other parts of the world.
Euro NCAP in Europe uses similar testing scenarios to those of NHTSA’s NCAP, but there are
critical differences. For example, in addition to vehicle crashworthiness and rollover safety, Euro
NCAP’s overall safety rating includes the effectiveness of the vehicle’s collision avoidance
technologies.24 Furthermore, Euro NCAP’s testing of FCW and AEB is conducted at speeds up to
50 mph and includes targets representing not only motor vehicles but also pedestrians and
bicyclists. On the other hand, NHTSA’s NCAP testing of FCW and AEB is conducted at speeds
up to 45 mph and uses only motor vehicle targets.
22
The FCW and the AEB remain available at all times and in all domains. Although these systems use some of
the same sensors as Autopilot, they are not part of the partial driving automation system, which consists of TACC
and Autosteer.
23
See NHTSA’s NCAP website (accessed February 4, 2020). The FCW and AEB systems on the 2017 Tesla
Model X met NHTSA’s performance criteria, and the vehicle model is listed as having these recommended safety
technologies.
24
See Euro NCAP website (accessed February 4, 2020).
16
1.8 Tesla Driver Factors

1.8.1 Background
This report focuses only on human performance issues related to the Tesla driver.
Interviews with the Mazda and Audi drivers, in addition to other background information, can be
found in the public docket.
1.8.1.1 Licensing and Experience. The Tesla driver held a California class C noncommercial
driver’s license with no restrictions. His record showed no traffic-related violations or prior
crashes, and his license had never been suspended, revoked, or denied. The driver resided in
Foster City and worked as a software engineer for Apple at a facility in Sunnyvale. He was very
familiar with this travel route on US-101 because he drove through the area where the crash
occurred several times a week on his way to work.
1.8.1.2 Health and Toxicology. The driver’s family, friends, and coworkers told investigators
that he was good physical condition. He did not smoke, did not take any prescription medications,
and did not have any known health issues. He did see a physician in the weeks before the crash
for a cough, but the symptoms had subsided by the time of the crash. The driver exercised
regularly and had no current major life stressors. He had had laser vision correction surgery about
3 years before the crash, and his vision was 20/20. His hearing was also reportedly good. A
postmortem toxicology test did not detect alcohol or other tested-for drugs in his system.25
1.8.1.3 Precrash Activities. The below table lists the Tesla driver’s activities from March 21 to
March 23. The information is based on interviews with family and coworkers, Apple building
entry/exit data, cell phone records, and the Tesla’s Carlog data. The driver had about 6.5 to
7.5 hours of sleep opportunity per night in the 3 days leading up to the crash. The driver’s wife
reported that her husband would usually fall asleep immediately and would not wake up during
the night. She said that he snored occasionally but that he had never been diagnosed with a sleep
disorder such as obstructive sleep apnea.
Table 2. Precrash activities of Tesla driver, March 21–23, 2018.
Time Activity Source
Wednesday, March 21
7:00 a.m.–7:15 a.m. Awakens Family interview
8:51 a.m. Departs home to transport son to preschool Carlog data
9:01 a.m. Arrives at preschool in Foster City Carlog data
9:07 a.m. Departs preschool to drive to work Carlog data
25
The tested-for drugs included amitriptyline, amobarbital, bupropion, bupropion metabolite, butabarbital,
carisoprodol, chlorpheniramine, cocaine, desipramine, dextromethorphan, diazepam, diphenhydramine, doxepin,
doxylamine, EDDP (metabolite of methadone), BMDP (benzylone), fluoxetine, glutethimide, ibuprofen, imipramine,
ketamine, lidocaine, meperidine, meprobamate, methadone, methaqualone, nordiazepam, norpropoxyphene,
nortriptyline, pentazocine, pentobarbital, phencyclidine, phenobarbital, phenytoin, propoxyphene, secobarbital,
sertraline, and venlafaxine.
17
Time Activity Source
9:44 a.m. Arrives at work in Sunnyvale (Apple facility) Carlog data

11:10 a.m. Departs work to drive home Carlog data
11:37 a.m. Arrives home in Foster City Carlog data
Hires ride-share vehicle for transport to San
2:30 p.m. Family interview
Francisco to attend game developer’s conference
Work colleague drives him home from conference;
11:00 p.m.–midnight Family interview
goes to bed
Thursday, March 22
10:07 a.m. Arrives at work in Sunnyvale Carlog data
10:12 a.m. Enters Apple facility Apple building entry data
5:43 p.m. Departs Apple facility Apple building exit data
5:45 p.m. Departs work to drive home Carlog data
6:12 p.m. Arrives home in Foster City Carlog data
7:07 p.m. Incoming cell phone call from work supervisor Cell phone records
7:22 p.m.–
Text message exchange with supervisor Cell phone records
10:35 p.m.
11:30 p.m.–
Goes to bed Family interview
12:30 a.m. (Friday)
Friday, March 23
9:27 a.m. Crash – Mountain View Carlog data
1.8.2 Cell Phone Usage
1.8.2.1 Cell Phone General Information. The CHP recovered two cell phones at the crash scene.
One of them, an Apple iPhone 8 Plus, was found among the debris on the highway and sustained
major structural damage. The second phone, an Apple iPhone 10, was undamaged and found
among the driver’s personal belongings. The CHP inspected the phones and returned them both
to the driver’s family, who in turn forwarded the phones to Apple Inc. Apple advised that the
18
iPhone 8 Plus was a development fused model used primarily for business purposes. The
iPhone 10 was provided to the driver for personal use.
1.8.2.2 Cell Phone Inspection and Data Recovery. The NTSB retrieved unencrypted
CrashReporter logs from the Tesla driver’s Apple iPhone 8 Plus.26 Each of the three recovered
logs showed that a game application was active during the driver’s trip to work and was the
frontmost application on his phone when the crash occurred. Although the game (a world-building
strategy game with multiplayer capability) appears to require manual manipulation, the log data
are not specific enough to ascertain whether the Tesla driver was holding the phone at the time of
the crash.
Historical CrashReporter logs recovered from the driver’s device show a pattern of active
game play every day from Monday, March 19, 2018, to Friday, March 23, 2018, between
9:00 a.m. and 10:00 a.m. when the driver was en route to work.27 NTSB investigators asked his
wife (through the family attorney) whether she was aware that her husband played games on his
phone. She responded that her husband loved to do so but that he never did while driving.
1.8.2.3 Cell Phone Records. Cell phone records also showed that the Tesla driver was using the
Apple-owned iPhone 8 Plus on the morning of the crash. Although the records showed no
incoming or outgoing calls or text messages during his trip to work, they did show evidence of
data transmissions while the vehicle was in motion. In the 12 hours preceding the crash, the
highest data usage (204 kilobytes [KB] per minute average) was recorded in the 11.5 minutes
immediately preceding the crash.28 This level of data usage is consistent with online game activity.
When the phone was not in use during the overnight hours when the Tesla driver was asleep, the
average data usage was less than 1 KB/minute.
1.8.2.4 Cell Phone Laws and Policy. California state laws prohibit the holding and operating of
a cell phone while driving. California Vehicle Code section 23123.5 (a) reads:
A person shall not drive a motor vehicle while holding and operating a handheld
wireless telephone or an electronic wireless communications device unless the
wireless telephone or electronic wireless communications device is specifically
designed and configured to allow voice-operated and hands-free operation, and it
is used in that manner while driving.
26
See the Cell Phone Records and Data Recovery report in the public docket for this crash. The recovered
CrashReporter logs are available to cell phone application developers for diagnostic purposes. When an application
on a phone crashes, a crash report is created and stored on the device. Users of Apple iPhones can access
CrashReporter logs on their device by going to Settings/Privacy/Analytics/Analytics Data.
27
Logs show that the game application was active on March 19, 2018, at 09:03:21; March 20, 2018, at 09:18:53;
March 21, 2018, at 09:37:53; and March 22, 2018, at 09:21:31. Tesla Carlog data show that Autopilot was active
during these time periods.
28
Data activity shown in cell phone records can include the network updating software and phone applications,
sending and receiving emails, internet usage, upload and download of photos, streaming of videos, and online game
playing. Estimated data usage for a specific phone activity includes: one email (no attachments) – 20 KB, one email
(with standard attachments) – 300 KB, 1 minute of “surfing” the web – 250 KB, one song download – 4 megabytes
(MB), one photo upload to social media – 5 MB, 1 minute of streaming standard-definition video – 11.7 MB, 1 minute
of streaming high-definition video – 41 MB, and 1 minute of online game playing – 200 KB.
19
Because the Tesla driver was an employee of Apple Inc. and was supplied with Apple cell
phones for business and personal use, investigators inquired about company policy regarding cell
phone use while driving. Apple advised the NTSB that it did not have any company policy
regarding cell phone use while driving.
1.8.3 Warnings for Hands Off Wheel
Tesla Carlog data showed that the crash trip lasted 28 minutes 33 seconds. Autopilot was
active more than 75 percent of the time and during the final 18 minutes 55 seconds. According to
the data, driver-applied torque to the steering wheel was not detected 34.4 percent of the time that
Autopilot was active. Figure 12 depicts the last Autopilot segment, during which the system issued
two visual alerts for hands-off driving. Because the system continued not to detect driver-applied
torque to the steering wheel, one of these visual alerts progressed to the second alerting stage,
with an audible warning.
About 6 seconds before the crash, no driver-applied steering wheel torque was detected
by Autosteer.29 This lack of driver input on the steering wheel continued until the impact with the
crash attenuator.
Figure 12. Last Autopilot segment of the crash trip, including warnings for hands-off driving
operation.
1.8.4 Vehicle Familiarity and Handling
1.8.4.1 Familiarity with Vehicle. The driver purchased the vehicle in October 2017, and received
the vehicle at the Fremont, California, Tesla dealership in November 2017. His family did not
recall whether he received any training on the use of the Tesla ADAS features, but his wife
remembered him being informed that he needed to keep his hands on the steering wheel while
using Autopilot. She told investigators that he became very familiar with the use of the system
and would watch YouTube videos related to the Autopilot feature in his spare time. She also stated
that the SUV would emit an audible signal if the driver did not have his hands on the steering
wheel when in Autopilot mode. The driver belonged to a Facebook group called “Tesla Model X
Owner’s Club” and would occasionally post about the vehicle’s features.
1.8.4.2 Vehicle Handling. Reports reviewed by the NTSB, originating from the driver’s family
and friends, described issues with the vehicle handling erratically when the driver was traveling
in the vicinity of the US-101−SR-85 interchange at the gore area. Investigators interviewed the
29
The hands-off-wheel detection occurred about the time the SUV entered the gore area.
20
driver’s family and a friend who reported that the driver experienced issues with the Autopilot
system steering to the left into the gore area on numerous occasions.30 One month of Tesla Carlog
data was reviewed for the time when the driver was making his morning trip to work. Although
GPS information was not available in the Carlog data, the NTSB―using information about the
driver’s daily patterns and routes―identified two similar incidents that occurred on March 19,
2018, and on February 27, 2018. The data showed that during both incidents, Autosteer induced
a steering action to the left, which appeared to be in the vicinity of the gore. The Autosteer action
was followed within 2 seconds by a driver-induced steering correction to the right, overriding
Autopilot functionality. During these two previous incidents, the driver’s hands were detected on
the steering wheel.31
1.9 Highway Factors

1.9.1 Description and General Characteristics
The crash occurred in the gore area of the US-101−SR-85 interchange, at milepost 48.38,
south of the North Shoreline Boulevard overcrossing. The highway is operated and maintained
by the California Department of Transportation (Caltrans). US-101 is designated as a north-south
roadway, but at the crash location it is aligned in a northwest-southeast direction. As shown earlier
in figure 2, the southbound roadway consists of seven traffic lanes. The width of the traffic lanes
varies between 11.5 and 12.9 feet.
The speed limit on US-101 in the vicinity of the crash is 65 mph. The average daily traffic
for this segment of US-101 is 245,000 vehicles, with a peak hourly total of 17,600 vehicles.32
1.9.2 Gore Area
1.9.2.1 Left-Exit Lane and Gore Delineation. Roadway delineation of the left-exit HOV lane
for SR-85 southbound begins about 1,540 feet from the crash attenuator, with 8-inch-wide painted
broken white lane drop markings designating the left lane as an exit lane. The lane drop markings
transition to an 8-inch-wide solid white line 940 feet from the crash attenuator.33 The apex of the
gore area begins about 630 feet from the attenuator where the solid white line bifurcates into two
8-inch-wide white channelizing lines, which form the gore. Before the crash, the gore’s neutral
(inside) area was not marked with optional diagonal cross-hatching or chevrons.
1.9.2.2 Condition of Roadway Pavement Markings. The lane markings delineating the gore
area from the left-exit HOV lane for SR-85 were worn at the time of the crash. On March 27,
2018 (4 days after the crash), NTSB investigators drove through the crash location at about
30
A friend of the Tesla driver provided the NTSB with a copy of a text message he received on March 19, 2018.
The text message(s) from the Tesla driver reported Autopilot “almost led me to hit the median again this morning” at
the “85 separation.” (Note: the text message was translated from Mandarin Chinese to English.)
31
The NTSB examined 15 days of Carlog data. Data from March 6 to March 12 were excluded from the review
because the vehicle was being serviced at that time. Additionally, investigators looked only at the time period between
9:00 a.m. and 10:00 a.m. on days when the Tesla driver was en route to work. It is possible that other gore area
incursions occurred during the month outside the focused review.
32
The traffic volume information is based on Caltrans 2016 data and reflects total traffic for both directions of
travel.
33
According to the California Manual on Uniform Traffic Control Devices, the function of a solid white line is
to discourage or prohibit crossing.
21
9:30 a.m. to approximate the lighting conditions (sun position) that had been present at the time
of the collision. As shown in figure 13, the right edge line of the gore was worn and faded in the
initial half of the gore. Since the crash, Caltrans has repainted the lane lines at the crash location.
Figure 13. Southbound US-101 view from a video drive-through at 685 feet from crash attenuator.
The 8-inch-wide solid white line marking the left side of the gore area (designated with red arrows)
was more prominent and visible than the right side of the gore. (Source: NTSB video
drive-through, March 27, 2018)
In July 2018, 4 months after the crash, Caltrans added chevron-shaped striping to the
neutral area of the gore at the Mountain View crash location (see figure 14). The NTSB asked
Tesla whether diagonal cross-hatching or chevron striping would have been effective in
preventing the Tesla from entering the gore area. Tesla responded as follows:
. . . for the firmware installed on the vehicle at the time, gore point striping would
not have affected the Autosteer behavior in this crash. In more recent firmware and
future firmware, gore point striping may have helped our vision system to
discriminate the gore from lanes.
22
Figure 14. Aerial view of US-101 at the crash location, depicting chevrons (cross-hatching) added
to the gore area in July 2018, 4 months after the crash. (Source: Google Earth, image date of
August 8, 2018)
1.9.3 Crash Attenuator
1.9.3.1 Background Information. The end of the concrete barrier that separates the left-exit
HOV lane (which leads to SR-85) and the HOV lane on US-101 was shielded by a proprietary
crash attenuator.34 The crash attenuator was an SCI Smart Cushion® 100GM crash cushion,
manufactured and marketed by Work Area Protection Corporation.35 The crash attenuator uses a
hydraulic cylinder and cable assembly to provide a variable stopping force based on vehicle
impact speed.36 In a frontal impact, the attenuator telescopes rearward to absorb impact energy.
Once the crash attenuator has been crushed by an impact, it must be replaced or repaired in order
to regain operational status. The crash attenuator is intended to protect motorists by reducing
collision forces as it gradually slows a colliding vehicle and helps to absorb the impact energy.
On the day of the crash, the crash attenuator was in a nonoperational, damaged state due
to a previous crash that occurred on March 12, 2018. During the March 12 crash, which happened
at 10:30 p.m., a 2010 Toyota Prius, operated by a 31-year-old male driver, was southbound on
US-101 when it entered the gore area and struck the crash attenuator at a speed in excess of
75 mph. The lap/shoulder-belted Toyota driver survived the crash and was transported to the
hospital with injuries.
34
In this report, the terms “crash attenuator” and “crash cushion” should be considered synonymous and are
used to describe the traffic safety hardware shielding the concrete median barrier on US-101.
35
See Work Area Protection website (accessed May 28, 2019).
36
The crash attenuator was tested to the requirements of Test Level 3 found in the American Association of State
Highway and Transportation Officials’ Manual for Assessing Safety Hardware (MASH).
23
The CHP responded to the March 12 crash but did not notify Caltrans of the damage to
state property as required by policy and interagency operational agreements. 37 On March 20,
2018, two Caltrans maintenance workers patrolling the area discovered that the crash attenuator
was damaged. Caltrans inspected the attenuator and determined that it was damaged beyond repair
and had to be replaced with a new attenuator. No date was scheduled for the replacement because
the Caltrans maintenance supervisor had to locate a replacement attenuator, and maintenance
crews were required to be on 12-hour storm patrol shifts due to inclement weather. The
maintenance supervisor directed that traffic cones and a Type 1 sawhorse-style plastic barricade
be placed in advance of the damaged attenuator until it was replaced. Figure 15 depicts the
precrash condition of the attenuator and the location of the displaced barricade and traffic cones.38
Figure 15. Southbound US-101 view depicting the precrash damaged condition of the crash
attenuator, orange traffic cones, and a displaced Type 1 sawhorse-style barricade on March 22,
2018. (Source: CHP photo provided by passerby)
1.9.3.2 Crash History. Crash and maintenance records show that the attenuator at the crash
location was damaged or repaired more frequently than any other left-exit crash attenuator in
Caltrans District 4―it had more than double the repairs of any other location.39 Traffic collision
data show that in the 3 years before the fatal March 23, 2018, crash, the attenuator was struck at
37
For more information, see the CHP/Caltrans Joint Operational Statement and the Caltrans Traffic Incident
Management Guidelines in the public docket for this investigation.
38
Several witnesses provided the CHP and the NTSB with dashcam videos showing the precrash condition of
the attenuator and the location of traffic control devices. One video was taken on the morning of March 23, 2018,
less than 2 hours before the crash. The image shows the plastic sawhorse barricade lying on the ground immediately
north of the attenuator and two orange traffic cones near the white line bordering the left side of the gore, with another
cone lying on its side near the end of the concrete barricade.
39
Between January 2006 and the fatal March 23, 2018, collision, the crash attenuator was damaged at least
12 times. Caltrans District 4 is headquartered in Oakland, California, and provides services to Sonoma, Napa, Solano,
Marin, San Francisco, Contra Costa, Alameda, San Mateo, and Santa Clara counties.
24
least five times, including one collision that resulted in fatal injuries.40 The crash attenuator at this
location was struck again on May 20, 2018, about 2 months after the crash involving the Tesla.
1.9.3.3 Maintenance of Traffic Safety Devices. The NTSB reviewed Caltrans’ maintenance
procedures and identified systemic problems related to the timely repair of traffic safety hardware.
Similar problems were identified during the NTSB investigation of a fatal crash in San Jose,
California, that occurred on January 19, 2016, and involved a motorcoach colliding with a crash
attenuator on US-101 (NTSB 2017a). Similar to the Mountain View case, the San Jose crash
attenuator had been damaged in a previous collision (in this case, 44 days earlier). The NTSB
determined that an inadequate work order tracking system contributed to Caltrans’ not completing
the necessary repairs to the San Jose crash attenuator, and recommended that Caltrans take the
following action:
H-17-4
Modify your work order tracking system to show completion status and to include
a means of providing reminders when work orders, particularly those for
proprietary devices, are overdue or incomplete.
The status of Safety Recommendation H-17-4 is “Open―Await Response.” In meetings

with the NTSB, Caltrans has communicated that the agency will officially respond once ongoing
litigation pertaining to the San Jose crash permits. In the meantime, Caltrans has developed a
dashboard to track overdue service requests and work orders, which is generated and shared daily
with maintenance personnel.
In August 2019, the NTSB adopted a safety recommendation report that concluded that
the Caltrans maintenance and repair program has been ineffective in ensuring the timely repair of
traffic safety hardware (NTSB 2019b). As a result, the NTSB issued the following safety
recommendation to the California State Transportation Agency (CalSTA)41:
H-19-13
compliance with repair timelines.
On December 10, 2019, the secretary of CalSTA updated the NTSB on actions that
CalSTA had taken to implement Safety Recommendation H-19-13. First, CalSTA outlined steps
that the CHP had taken to enhance reporting of damage to traffic safety hardware. These steps
included a revised statewide traffic crash report to include additional data elements to assist with
notification procedures, revised CHP policy directives about the reporting of highway conditions,
and development of an additional training module for officers regarding appropriate notification
40
The fatal crash occurred on November 14, 2015, and involved a previously damaged and nonoperational crash
attenuator. For additional detail, refer to the Highway Factors factual report in the public docket for this crash
investigation.
41
CalSTA is a cabinet-level state agency that focuses on addressing the state’s transportation issues. CalSTA
provides oversight of Caltrans, the CHP, the California Transportation Commission, the Office of Traffic Safety, and
the Department of Motor Vehicles.
25
procedures. Caltrans has also taken substantive action to facilitate timely repair of traffic safety
hardware. The department will have emergency on-call contractors in place who, within 48 hours
of notification, can repair or replace damaged traffic safety hardware when regular maintenance
personnel cannot immediately respond. In addition, Caltrans has developed performance
measures to monitor overdue service requests and work orders, which will be shared with the
maintenance divisions daily. Finally, as a long-term effort, Caltrans is researching
deployment-ready technologies that can alert Caltrans directly through electronic notification
about impacts to traffic safety devices.
1.10 Weather and Illumination

Data from the weather station at Moffett Federal Airfield in Mountain View, about
1.3 miles north of the crash site, indicate that on March 23, 2018, at 8:56 a.m. (31 minutes before
the crash), the weather was clear, the temperature was 49°F, and the wind was from the southeast
at 9 mph. According to the US Naval Observatory, at 9:27 a.m. at the crash location, the sun
altitude was 26.5 degrees (angle up from the horizon) and the sun azimuth was 110.6 degrees
(angle east of true north along the horizon).42
Based on the Tesla’s headway angle (117 degrees east of north), the sun at the time of the
crash was about 6 degrees to the left of the driver’s and forward-facing camera’s view and
26.5 degrees above the horizon. NTSB investigators completed a drive-through of the crash
location several days after the crash to examine the impact of sun position on a driver’s view.
Investigators determined that although the sun position resulted in minor glare, the lane lines and
lines delineating the gore were visible.
1.11 Other NTSB Investigations of Tesla Crashes with Autopilot Activated

Between May 2016 and March 2019, the NTSB investigated three other crashes involving
Tesla vehicles with Autopilot activated. This section of the report summarizes those crashes.
1.11.1 Williston, Florida (May 7, 2016)
At 4:36 p.m. on Saturday, May 7, 2016, a 2015 Tesla Model S 70D electric-powered car,
traveling east on US Highway 27A (US-27A), west of Williston, Florida, struck a refrigerated
semitrailer powered by a 2014 Freightliner Cascadia truck-tractor (NTSB 2017b). At the time of
the collision, the truck was making a left turn from westbound US-27A across the two eastbound
travel lanes onto NE 140th Court, a local paved road. The car struck the right side of the
semitrailer, crossed underneath it, and then went off the right side of the road. The driver, who
was the sole occupant of the car, died in the crash; the commercial truck driver was not injured
(see figure 16). System performance data downloaded from the car indicated that the driver was
operating it using the Autopilot system features TACC and Autosteer.
42
The altitude and azimuth values are for the center of the apparent disk of the sun.
26
Figure 16. The 2015 Tesla after striking the side of a semitrailer in Williston, Florida.
The NTSB determined that the probable cause of the Williston crash was the truck driver’s
failure to yield the right of way to the car, combined with the car driver’s inattention due to
overreliance on vehicle automation, which resulted in the car driver’s lack of reaction to the
presence of the truck. Contributing to the car driver’s overreliance on the vehicle automation was
its operational design, which permitted his prolonged disengagement from the driving task and
his use of the automation in ways inconsistent with guidance and warnings from the manufacturer.
1.11.2 Culver City, California (January 22, 2018)
At 8:40 a.m. on Monday, January 22, 2018, a 2014 Tesla Model S P85 electric-powered
car was traveling behind another vehicle in the HOV lane of southbound Interstate 405 (I-405) in
Culver City, California (NTSB 2019a). Because of a collision in the northbound freeway lanes
that happened 25 minutes earlier, a CHP vehicle was parked on the left shoulder of southbound
I-405, and a Culver City Fire Department truck was parked diagonally across the southbound
HOV lane. The emergency lights were active on both the CHP vehicle and the fire truck. The
vehicle ahead of the Tesla changed lanes to the right to go around the fire truck, but the Tesla
remained in the HOV lane, accelerated, and struck the rear of the unoccupied fire truck at a
recorded speed of 31 mph (see figure 17).43 The Tesla driver did not report any injuries. System
performance data downloaded from the car indicated that the driver was operating it using the
Autopilot system features TACC and Autosteer.
43
About 0.49 seconds before the crash, the FCW system detected a stationary object in the Tesla’s path. A visual
and audible warning was provided to the driver; however, the AEB system did not activate.
27
Figure 17. Overhead view of the 2014 Tesla and fire truck on I-405 in Culver City, California.
(Source: CHP)
The NTSB determined that the probable cause of the Culver City crash was the Tesla
driver’s lack of response to the stationary fire truck in his travel lane, due to inattention and
overreliance on the vehicle’s ADAS; the Tesla’s Autopilot design, which permitted the driver to
disengage from the driving task; and the driver’s use of the system in ways inconsistent with
guidance and warnings from the manufacturer.
1.11.3 Delray Beach, Florida (March 1, 2019)
At 6:17 a.m. on Friday, March 1, 2019, a 2018 Tesla Model 3 electric-powered car was
traveling south in the right lane of the 14000 block of US Highway 441 (US-441), also known as
State Road 7, in Delray Beach, Palm Beach County, Florida (NTSB 2020). At the same time, a
2019 International truck-tractor in combination with a semitrailer was eastbound in a private
driveway belonging to an agricultural facility. The truck driver intended to cross the US-441
southbound lanes and turn left into the northbound lanes. The combination vehicle entered the
highway without stopping and was subsequently struck by the southbound Tesla. The car struck
the left side of the semitrailer and crossed underneath it, shearing off the roof (see figure 18). The
driver, who was the sole occupant of the car, died in the crash; the commercial truck driver was
not injured.
28
Figure 18. The 2018 Tesla after striking the side of a semitrailer in Delray Beach, Florida.
The NTSB determined that the probable cause of the Delray Beach crash was the truck
driver’s failure to yield the right of way to the car, combined with the car driver’s inattention due
to overreliance on automation, which resulted in his failure to react to the presence of the truck.
Contributing to the crash was the operational design of Tesla’s partial automation system, which
permitted disengagement by the driver, and the company’s failure to limit the use of the system
to the conditions for which it was designed. Further contributing to the crash was the failure of
NHTSA to develop a method of verifying manufacturers’ incorporation of acceptable system
safeguards for vehicles with Level 2 automation capabilities that limit the use of automated
vehicle control systems to the conditions for which they were designed.
29
2 Analysis
2.1 Introduction
The Mountain View crash involved a 2017 Tesla Model X P100D electric-powered SUV.
The 38-year-old driver, traveling south on US-101, was using the Tesla Autopilot system. As the
Tesla approached the paved gore area dividing the main travel lanes of US-101 from the SR-85
left-exit ramp, the SUV steered to the left and entered the gore area. The Tesla continued traveling
through the gore area and struck a nonoperational crash attenuator at a speed of about 71 mph.
The Tesla was subsequently struck by two other vehicles, a 2010 Mazda 3 and a 2017 Audi A4.44
During the collision sequence, the Tesla’s high-voltage battery was breached and a
postcrash fire ensued. After the crash, on-scene witnesses found the driver in his seat with his
lap/shoulder belt buckled. They removed him from the vehicle before it was engulfed in flames.
The driver was transported to a local hospital, where he died from blunt-force trauma injuries.
Section 2.2 of the analysis focuses on the safety issues found in the Mountain View crash
related to the Tesla Autopilot performance, collision avoidance system performance, driver
distraction, and highway infrastructure issues.
Section 2.3 expands the analysis to include a review of three other Tesla crashes in which
vehicles were operating with Autopilot activated, as well as an evaluation of partial driving
automation systems in the following contexts:
• Risk Mitigation Pertaining to Monitoring Driver Engagement (section 2.3.1),
• Risk Assessment Pertaining to Operational Design Domain (section 2.3.2),
• Limitations of Collision Avoidance Systems (section 2.3.3), and
• Insufficient Federal Oversight of Partial Driving Automation Systems (section 2.3.4).
Section 2.4 discusses the need for event data recorders for driving automation systems.
Following a comprehensive review of the circumstances that led to the Mountain View
crash, the NTSB established that the following factors did not contribute to the cause of the crash:
• Driver licensing, qualification, or familiarization with the vehicle and roadway:

The Tesla driver was properly licensed and familiar with the vehicle driving
automation systems. He was also very familiar with the roadway and route of travel at
the crash location.
• Medical conditions, impairment, or fatigue: The Tesla driver had no known health
issues and did not take any medications. A postmortem toxicology test did not detect
44
The analysis and findings will only address issues related to the Tesla driver and vehicle.
30
alcohol or other tested-for drugs in his system. He routinely slept between 6.5 and
7.5 hours a night, including the night before the crash.
• Weather conditions: The weather was clear with no precipitation at or near the time
of the crash, and the roadway was dry.
The NTSB, therefore, concludes that none of the following were factors in the Tesla
driver’s actions in this crash: (1) driver licensing or qualification; (2) familiarization with the
vehicle and roadway; (3) medical conditions, fatigue, or impairment by alcohol or other drugs; or
(4) weather conditions.
Fire department, law enforcement, and emergency medical personnel arrived at the crash
location within 10 minutes of the collision. Initial fire suppression efforts were successful in
extinguishing the flames. However, occasional popping noises were emitted from the Tesla,
accompanied by smoke. Due to concerns regarding the high voltage of the Tesla’s lithium-ion
battery, which was breached during the crash, the fire department incident commander requested
Tesla Inc. assistance in helping to make the vehicle safe. About 6 hours after the crash, the vehicle
was able to be transported to an impound facility, and the highway was reopened for travel. The
NTSB concludes that the emergency response to the crash was timely and adequate. Additionally,
the NTSB concludes that the Tesla electric vehicle postcrash fire and related damage to the
lithium-ion battery presented unusual fire and electrical hazards to first responders.
2.2 Mountain View Crash Discussion

2.2.1 Crash Sequence
As the Tesla approached the US-101−SR-85 interchange, it was traveling on US-101 in

the second lane from the left with the Autopilot system engaged, at a speed of between 64 and
66 mph, and following a sedan at about 83 feet of distance. When the Tesla was 5.9 seconds and
about 560 feet from the crash attenuator, Autosteer initiated a left steering input (5.6 degrees at
the steering wheel) toward the neutral area of the gore not intended for vehicle travel. The
Autopilot system did not detect driver-applied steering wheel torque at the time when the vehicle
steered into the gore and did not provide any type of warning (visual, audible, or haptic) that the
vehicle was traveling through the gore.
As the SUV closed to within 375 feet of the crash attenuator―3.9 seconds from
impact―the Tesla was about centered in the gore area between the left and right 8-inch-wide
channelizing lines and the Autopilot system no longer detected a lead vehicle. The TACC began
accelerating from a speed of 61.9 mph to the preset cruise speed of 75 mph. The FCW did not
provide an alert, the AEB did not activate, and the Tesla struck the nonoperational crash attenuator
at a speed of 70.8 mph. The driver did not take evasive action (braking or steering) to prevent the
crash or mitigate its severity.
2.2.2 Autopilot Performance
Autopilot navigates roadways by detecting lane markings and predicting the path of the
vehicle’s travel lane. These predictions are made by the vehicle’s imaging system: the cameras
and the computing software. Tesla’s Autopilot technology package is a combination of systems
31
that control the vehicle speed and path by automated control of braking, steering, and torque to
the drive motors. All actions of predicting the lane and actuating steering are determined by the
vehicle’s vision system. NTSB investigators attempted to determine the exact reason Autosteer
directed the SUV into the neutral area of the gore, which was not intended for vehicle travel. As
acknowledged by Tesla in published information, including the owner’s manual, Autosteer is
subject to circumstances that can impair system operation. Autosteer is described as particularly
unlikely to operate in situations when unable to accurately determine lane markings, or when
bright light is interfering with the cameras’ view, visibility is poor, or the windshield area in the
cameras’ view is obstructed.
The lane markings delineating the gore area from the left-exit HOV lane for SR-85 were
worn at the time of the crash, with the right edge line of the gore being worn and faded in the
initial half of the gore where Autosteer directed the SUV left. In correspondence, Tesla engineers
surmised that the Autosteer system likely momentarily lost its lane line prediction and/or
identified a stronger lane line on the left side of the gore. Also, at the time of the crash, bright
sunlight was shining toward the Tesla’s forward-facing camera at an angle of 6 degrees to the left
of the vehicle’s center and 26 degrees above the horizon. Although the effect of the bright light
on the Tesla vision system cannot be determined with certainty, investigators determined that the
sunlight presented no more than discomfort glare to the human eye and the lines delineating the
gore were readily visible. Although an exact reason is not known, a steering movement into the
gore was associated with the vision system’s processing software not accurately predicting the
path of the current lane of travel. Therefore, the NTSB concludes that the Tesla’s Autopilot
lane-keeping assist system steered the SUV to the left into the neutral area of the gore, without
providing an alert to the driver, due to limitations of the Tesla Autopilot vision system’s
processing software to accurately maintain the appropriate lane of travel.
Since the crash, Tesla has changed the vision system processing software with firmware
updates designed to improve overall performance. According to Tesla, the revised processing
software improves the way the system determines lanes and provides better lane prediction on
pitched and curvy roads. In June 2018, Tesla also released firmware version 2018.23, which added
an immediate alert for no hands on the steering wheel if unusual lane lines are detected or if no
valid lane is detected when no lead vehicle is present. It is unknown whether these software
changes would have prevented the Mountain View crash or to what extent the new software would
have been able to accurately and consistently detect unusual or worn lane markings.
2.2.3 Collision Avoidance System Performance
The FCW and AEB features in Tesla’s collision avoidance system use camera and radar
information to provide warnings to the driver and to activate braking to prevent or mitigate an
imminent crash if the driver does not respond. The system is designed to recognize and detect
slow, stopped, and decelerating vehicles when they are traveling ahead of the Tesla in the same
lane. The Tesla Carlog data showed that on the approach to the crash attenuator, the FCW system
did not provide an alert and AEB did not activate. Tesla’s FCW/AEB, like most manufacturer
systems, are designed and tested primarily to detect and provide warnings for some vehicle
profiles, not targets such as a crash attenuator. Additionally, current NHTSA testing protocols for
FCW and AEB are limited to a maximum speed of 45 mph and use only vehicle profile targets.
Therefore, the NTSB concludes that the Tesla’s collision avoidance systems were not designed
to, and did not, detect the crash attenuator at the end of the gore, nor did NHTSA require such
32
capability; consequently, the FCW system did not provide an alert and the AEB did not activate.
Section 2.3.3 further discusses collision avoidance systems in reference to all four
Autopilot-related crash investigations.
2.2.4 Driver Distraction
The Tesla was more than 500 feet from the crash attenuator when the SUV first entered
the gore area of US-101. When the Tesla was 375 feet from the attenuator the vehicle was centered
between the two lines delineating the gore with no vehicles ahead to impede the driver’s view of
the approaching hazard. Additionally, forward of the attenuator were two orange traffic cones
marking the left side of the gore, and a plastic sawhorse-style barricade was lying on the ground
directly in front of the Tesla’s path of travel.
During the final 4 seconds of travel prior to impact, the Tesla accelerated toward the crash
attenuator and the driver took no evasive braking or steering action to avoid a collision. This level
of inaction, given the numerous visual cues of a hazard ahead and unobstructed view, indicates
that the driver was inattentive to his forward view and was not appropriately supervising the
Autopilot vehicle control system.
The driver was an avid gamer and game developer who routinely used gaming
applications on his cell phone. A review of cell phone records and data retrieved from his Apple
iPhone 8 Plus cell phone showed that a game application was active during his trip to work. It
was also determined that the game was the frontmost open cell phone application on his phone
when the crash occurred and data rate usage was consistent with gaming activity. Although the
data could not be used to ascertain whether the driver was holding the phone during the final
seconds before the crash, the Carlog data showed that his hands were not detected on the steering
wheel and that he made no evasive steering or braking input before the crash.
The driver’s lack of evasive action as the Tesla steered to the left into the gore area and
traveled more than 500 feet toward the crash attenuator, combined with data indicating that his
hands were not detected on the steering wheel, is consistent with a person distracted by a portable
electronic device (PED). Therefore, the NTSB concludes that the driver did not take corrective
action when the Tesla’s Autopilot lane-keeping assist system steered the vehicle into the gore area,
nor did he take evasive action to avoid the collision with the crash attenuator, most likely due to
distraction caused by a cell phone game application.
2.2.4.1 A National Problem. Eliminating distraction in transportation has been an issue on the
NTSB Most Wanted List of Transportation Safety Improvements for several years. NHTSA
reports that 3,166 people died in crashes involving distracted drivers in 2017; of those, 434 died
in crashes where cell phone use was cited as a distraction (NHTSA 2019a).
According to a 2018 National Occupant Protection Use Survey, which provides the only
nationwide probability-based observed data on driver electronic device use in the United States,
an estimated 9.7 percent of drivers were using some type of phone, either handheld or hands-free,
at a typical daylight moment in 2018 (NHTSA 2019b).
Interacting with a game application, similar to texting while driving, can be highly
distracting because it involves the three major types of distraction: visual distraction―taking your
eyes off the road; manual distraction―taking your hands of the wheel and manipulating a PED;
33
and cognitive distraction―taking your mind off driving and instead concentrating on game
strategy. Research has shown that both the visual–manual distraction of manipulating PEDs
(Hickman and others, 2010) and the cognitive distraction of using hands-free PEDs (Strayer and
others, 2013) significantly impair driver performance. An analysis of data from a naturalistic
study of more than 3,000 drivers showed that the crash risk was more than three times greater
when drivers were manipulating a cell phone compared to when they were not distracted (Dingus
and others, 2016).45
The NTSB has also found cell phone-related distraction to be a recurring safety issue; for
example, distraction was the main factor in a March 18, 2018, fatal crash in Tempe, Arizona. That
evening, a modified 2017 Volvo SC90 SUV struck and fatally injured a pedestrian crossing the
roadway outside a crosswalk. The Advanced Technologies Group of Uber Technologies, Inc. had
installed in the SUV a proprietary developmental ADS, which was active at the time of the
collision. During the entire crash trip, the driver was streaming a television show on her cell
phone. In addition to cell phone-related distraction, lack of adequate mechanisms for addressing
operators’ automation complacency was one of the contributing factors in the Tempe crash (NTSB
2019c).
Additionally, following the investigation of a fatal multivehicle collision in Gray Summit,

Missouri, on August 5, 2010, the NTSB recommended that all 50 states and the District of
Columbia address distraction due to PED use while driving (NTSB 2011):
H-11-39
(1) Ban the nonemergency use of portable electronic devices (other than those
designed to support the driving task) for all drivers; (2) use the National Highway
Traffic Safety Administration model of high visibility enforcement to support these
bans; and (3) implement targeted communication campaigns to inform motorists of
the new law and enforcement, and to warn them of the dangers associated with the
nonemergency use of portable electronic devices while driving.
The NTSB also concluded that manufacturers and providers of PEDs known to be
frequently used while driving should reduce the potential of those devices to distract drivers by
developing features that discourage their use or that limit their non-driving- or
nonemergency-related functionality while a vehicle is in operation. Accordingly, the NTSB
recommended that the Cellular Telecommunications Industry Association (CTIA) and the
Consumer Electronics Association (CEA) take the following action:
H-11-47

45
The naturalistic driving study, completed by researchers at the Virginia Tech Transportation Institute, found
that the overall crash risk when interacting with a handheld cell phone was 3.6 times higher.
34
Crash statistics for 2013–2017 show that fatal collisions involving cell phone use remain
persistently high and have not changed significantly, averaging more than 420 deaths per year
(NHTSA 2019a).46 Although many states have enacted legislation that restricts cell phone use by
drivers, no state completely bans all forms of cell phone use while driving. Currently, 15 states
prohibit drivers from using handheld cell phones while driving and 48 states, the District of
Columbia, Puerto Rico, Guam, and the US Virgin Islands ban text messaging for all drivers
(NHTSA 2019b).47
California has enacted some of the strongest state laws in the nation banning handheld cell
phone use while driving and supports these bans with high-visibility law enforcement campaigns.
In April 2019 (the year’s National Distracted Driving Awareness Month), the CHP participated in
law enforcement efforts across the state to crack down on drivers distracted by PEDs. During the
month, the CHP issued 19,850 citations to drivers who violated laws pertaining to hands-free cell
phone use (California Office of Traffic Safety [OTS] 2019). This total represented a 3.6-percent
increase over a similar campaign in April 2018. In addition, an observational study showed that
distracted driving due to PED use among California drivers increased from 3.58 percent in 2017
to 4.52 percent in 2018 (OTS 2018).48
Efforts to combat distraction have focused primarily on a combination of education,

legislation, and enforcement. Based on statistics showing that PED distraction in fatal crashes has
not decreased, it is clear that more needs to be done. Therefore, the NTSB concludes that
distracted driving due to PED use remains persistently high, and additional countermeasures are
needed.
2.2.4.2 Federal Driver Distraction Guidelines. In 2012, NHTSA proposed a long-term,

three-phase approach to combat distracted driving by issuing guidelines to address the distraction
potential of in-vehicle equipment and PEDs. Phase 1 of the proposal addressed visual–manual
interfaces of devices installed in vehicles as original equipment.49 Phase 2 focused on guidelines
for PEDs and aftermarket devices.50 The third phase, still in development, will expand the
guidelines to include auditory–vocal interfaces. In response to the two sets of guidelines, the NTSB
46
Safety Recommendation H-11-39 remains in an “Open” status for all state recipients. Refer to the NTSB’s
safety recommendation database for individual state responses. Safety Recommendation H-11-47 to the CTIA was
classified “Closed―Acceptable Action” because the CTIA promotes technological solutions at events and through
media campaigns. Safety Recommendation H-11-47 was also issued to the CEA; it responded to the recommendation
but did not provide details regarding efforts to develop technologies to mitigate distraction from PEDs. Note: The
CEA was renamed the Consumer Technology Association (CTA) in November 2015.
47
See also https://www.ghsa.org/state-laws/issues/distracted%20driving (accessed February 4, 2020).
48
The authors of the study emphasize that the value indicates that at any one time, the number of people distracted
by an electronic device was 4.52 percent, but the number of people engaging in this behavior across their time on a
given trip is likely much higher. A person may have been on a phone or sending a text message 5 minutes before they
were observed, and these cases are not included in the distracted driving figures (OTS 2018).
49
See 77 Federal Register 11200 (February 24, 2012), “Visual–Manual NHTSA Driver Distraction Guidelines
for In-Vehicle Electronic Devices.”
50
See 81 Federal Register 87656 (December 5, 2016), “Visual–Manual NHTSA Driver Distraction Guidelines
for Portable and Aftermarket Devices.”
35
expressed concern that NHTSA’s Driver Distraction Program underemphasized the role of
cognitive distraction.51
Phase 1 guidelines permit operating in-vehicle equipment―even for non-safety-related

purposes―as long as the driver can complete the tasks with glances away from the roadway of
2 seconds or less and a cumulative time spent glancing away from the roadway of 12 seconds or
less.52 In addition, Phase 1 includes lock-out requirements prohibiting certain activities while
driving, including displaying video not related to driving; displaying certain graphical or
photographic images; displaying automatically scrolling text; manual text entry for the purpose
of text-based messaging or internet browsing; and displaying text for reading from books,
publications, text-based messages, or other written content.
Phase 2 guidelines call for the pairing of PEDs with in-vehicle equipment to use the
built-in displays and controls. The NTSB expressed concern about pairing personal smartphones,
tablets, or music devices with original equipment interfaces unless the pairing supports the driving
task (for example, GPS navigation). Encouraging the use of PEDs while driving―as pairing
does―sends the wrong message to the driving public and may mislead drivers to believe that the
use of devices for non-driving tasks while driving is safe if paired with in-vehicle systems.
For devices that do not pair with in-vehicle equipment, NHTSA Phase 2 proposed
guidelines call for PEDs to be equipped with a “Driver Mode” that conforms with the Phase 1
glance and lock-out requirements.53 NHTSA’s preferred option is for automatic (as opposed to
manual) activation of a PED’s Driver Mode when a vehicle is in motion.54
In response to NHTSA Phase 2 guidelines, the CTIA called on NHTSA to withdraw the
proposed guidelines and re-establish an approach to distracted driving that concentrates on public
outreach and educational efforts.55 The CTIA also challenged NHTSA’s authority to issue
regulations, or even voluntary guidelines, for PEDs. The CTA (formerly CEA) also questioned
NHTSA’s regulatory authority to dictate the design of smartphone applications and other devices
used in cars, claiming that NHTSA’s legal jurisdiction begins and ends with motor vehicle
equipment. The CTA pointed to a January 20, 2017, White House Chief of Staff memorandum
calling for the withdrawal or delay of all pending regulations.56 Since issuing the proposed
guidelines in 2017, NHTSA has not taken any substantive action and is still considering whether
to issue a final set of visual–manual driver distraction guidelines for PEDs.
The NTSB’s response to the federal driver distraction guidelines maintained our firm
belief that until PEDs can be designed to have no effect on safe driving―or to improve safe
driving―they should be disabled in the driving environment.
51
See NTSB public comments to Phase 1 and Phase 2 guidelines in docket nos. NHTSA-2010-0053 and
NHTSA-2013-0137.
52
NHTSA research cited in 77 Federal Register 11200 found that glances away from the forward road scene
greater than 2 seconds at a time are associated with increased crash risk.
53
Driver Mode was modeled after the similar feature “Airplane Mode,” which, when activated, disables all
voice, text, telephone, and other signal-transmitting technologies such as Wi-Fi and Bluetooth.
54
Driver Mode does not activate when the device is being used by a non-driver (such as a passenger).
55
See CTIA letter dated February 3, 2017, in Docket No. NHTSA-2013-0137.
56
See CTA letter dated February 13, 2017, in Docket No. NHTSA-2013-0137.
36
2.2.4.3 Technological Solutions to Combat Distracted Driving. In 2013, CTA initiated a

working group focused on addressing portable and aftermarket electronic devices used by drivers
in vehicles.57 The group had the goal of developing industry-based guidelines for PED design that
would address driver distraction. In mid-2014, the working group abandoned its work to develop
guidelines due to liability concerns. In March 2014, NHTSA hosted a public meeting to bring
together vehicle manufacturers and suppliers, portable and aftermarket device manufacturers,
cellular service providers, industry associations, application developers, and consumer groups to
discuss technological solutions. Additionally, in 2014, the NTSB and NHTSA participated in
“Over-Connected and Behind the Wheel: A Summit on Technological Solutions to Distracted
Driving.”58
Many companies have demonstrated technical solutions for aspects of the distracted
driving problem. Cell phone providers have begun offering mobile phone applications that disable
texting and block nonemergency calls when a vehicle is in motion, and third-party devices are
currently available that allow motorists to voluntarily disable nonemergency calls on their cell
phones while driving. The two primary methods of detecting driving to activate the blocking
software use either GPS information or information directly from the vehicle’s on-board
diagnostic port. A field test of cell phone filter/blocking technology showed that participants
answered fewer incoming calls when the vehicle was in motion and placed more calls when a
vehicle was stopped during the blocking period (NHTSA 2013).
In 2017, Apple Inc. introduced a new feature for iPhones called “Do Not Disturb While
Driving.” This feature is designed to prevent cell phone owners from receiving messages and calls
when driving and lets contacts know they are occupied with driving. This application does not
automatically lock the cell phone from use but instead permits numerous options to receive
notifications and receive calls from certain contacts. Additionally, the feature can be disabled at
any time. After Apple released the application, the Insurance Institute for Highway Safety
conducted a nationally representative survey of iPhone owners and found that only about one in
five had the feature set to activate automatically while driving (Reagan and others, 2018). Because
voluntary activation of cell phone lock-out applications is likely to have limited implementation
by drivers, automatic activation of technology shows the most promise in combating driver
distraction.
Technological approaches have also been developed to identify which vehicle occupant is
using a PED. Most approaches use a combination of hardware and software installed in the vehicle
and on the PED to determine whether the device user is a driver or passenger. Device-only
solutions often use an authentication task approach, whereby a device automatically enters a
limited-use state at a speed threshold, and a quick, but challenging task is required to re-enable
its full functionality. These authentication tasks are designed to be quick and easy for non-drivers,
but nearly impossible for drivers to complete successfully within the short time limit. In
April 2014, Apple was granted a patent for technology that would disable all distracting functions
on a driver’s phone through a lock-out mechanism.59 In summarizing the invention, Apple
57
See 81 Federal Register 87656 (December 5, 2016), “Visual–Manual NHTSA Driver Distraction Guidelines
for Portable and Aftermarket Devices.”
58
This daylong summit featuring three roundtable discussions was held on February 6, 2014, and hosted by
Senator John D. (Jay) Rockefeller, IV, the chairman of the US Senate Committee on Commerce, Science and
Transportation.
59
See US Patent no. 8,706,143 B1 (“Driver Handheld Computing Device Lock-Out”), issued April 22, 2014.
37
described the lock-out mechanism as having the ability to lock out certain functions, such as
texting, while a person is driving. The device features a motion analyzer that can detect whether
the PED is in motion and beyond a predetermined threshold level, a scenery analyzer that can
determine whether the holder of the PED is located in a safe operating area of a vehicle, and a
lock-out mechanism that can disable the PED or one or more of its functions based on information
from the motion and scenery analyzers.
Apple’s patent describes the challenges of combating distracted driving, stating that
“texting while driving has become so widespread it is doubtful that law enforcement will have
any significant effect on stopping the practice.” The NTSB concludes that a technological
solution, such as a lock-out function or application that automatically disables highly distracting
features of a PED while driving, is an effective countermeasure for eliminating PED distraction
while driving.
Cell phone manufacturers have the technological capability and hold the key to
eliminating PED driver distraction.60 Although it may not be feasible or agreeable by
manufacturers to completely lock-out all cell phone features while driving, at a minimum, devices
should meet per se lock-out requirements described in NHTSA Phase 1 guidelines, including
locking out the display of video; displaying graphical or photographic images; displaying text
messages; prohibiting manual text entry for the purpose of text-based messaging or internet
browsing; and the displaying of text for reading from books, publications, text-based messages,
or other written content. Therefore, the NTSB recommends that manufacturers of PEDs (Apple,
Google, HTC, Lenovo, LG, Motorola, Nokia, Samsung, and Sony) develop a distracted driving
lock-out mechanism or application for PEDs that will automatically disable any driver-distracting
functions when a vehicle is in motion, but that allows the device to be used in an emergency;
install the mechanism as a default setting on all new devices and apply it to existing commercially
available devices during major software updates. Because this recommendation focuses on action
needed by individual cell phone manufacturers, Safety Recommendation H-11-47 to CEA (now
CTA) is reclassified from “Open―Await Response” to “Closed―No Longer Applicable.”
2.2.4.4 Employers’ Role in Combating Distracted Driving. The Tesla driver was an Apple
employee and was issued two cell phones by the company; one for business and one for personal
use. During his trip to work, the driver was most likely interacting with a gaming application on
his business-issued cell phone and thereby likely distracted at the time of the crash. Cell phone
records and data obtained from the driver’s phone also showed that he was most likely using his
Apple-supplied phone to play games while driving in the 4 days prior to the crash. Apple does not
have a distracted driving or company policy prohibiting the use of company-supplied phones
while driving.
Employers should have a responsibility to protect their employees and others with whom
they share the road. The National Safety Council (NSC), the Network of Employers for Traffic
Safety (NETS), and others have developed best practices and comprehensive tools. The NSC
advocates company cell phone policies that prohibit employees from using handheld and
hands-free devices while driving any company vehicle, using any company cell phone device
60
Percentages of US smartphone sales in the third quarter of 2019 were as follows: Apple (42 percent),
Samsung (25 percent), LG (12 percent), Lenovo (8 percent), and all others (13 percent). For more information, see
www.counterpointresearch.com/us-market-smartphone-share/.
38
while driving, or participating in any work-related communications while driving (even if in a

personal vehicle or on a personal cell phone; NSC 2015). The NSC has also developed a cell
phone policy kit that provides in-depth information for safety-conscious employers on how to
successfully implement or strengthen company cell phone policy.
NETS conducts studies that analyze the number of crashes per million miles driven and
the percentage of fleet vehicles involved in crashes. Regarding distracted driving, NETS data
obtained from a 2018 fleet benchmarking study showed that the most effective fleet safety
practices are those that include: (1) a strong cell phone policy; (2) procedures to check if and
when the policy is violated; and (3) strong enforcement measures in the event of violations.61
First, regarding cell phone use policies, banning cell phone use resulted in measurably fewer
crashes and a lower percentage of vehicles involved in those crashes. When technological steps
were introduced to disable cell phone use under the cell phone bans, the crashes were further
reduced considerably.
Second, companies that checked cell phone use records after every crash, not just after
serious ones, experienced even fewer crashes and lower percentages than those that checked
selectively or not at all.
With regard to the third practice concerning enforcement, companies that enforced strong
actions following violations―including the possibility of termination―had considerably fewer
and lower percentages of crashes than those that just provided warnings, and much lower than
those that took no special action.
Although the Tesla driver was operating his personal vehicle on his way to work, the use
of his company-supplied PED may have been prevented if a company policy was in place
restricting cell phone use while driving with strict consequences for violating the policy. The
NTSB concludes that strong company policy, with strict consequences for using PEDs while
driving, is an effective strategy in helping to prevent distracted driving crashes, injuries, and
fatalities. Therefore, the NTSB recommends that Apple Inc. develop and implement a company
policy that bans the nonemergency use of PEDs while driving by all employees and contractors
driving company vehicles, operating company-issued PEDs, or using a PED to engage in work-
related communications.
Although many companies across the United States have strong programs in place
regarding distracted driving―including prohibition against using PEDs while driving―a large
majority still have not implemented this safety measure. The Occupational Safety and Health
Administration (OSHA) is the federal agency that sets and enforces standards for employees’
health and safety. As part of this mission, OSHA provides training, outreach, education, and
assistance to private sector employers and employees. Working with NETS and NHTSA, OSHA
published guidelines for employers to reduce motor vehicle crashes. 62 The OSHA guidelines,
however, are very broad and do not provide employers with specific guidance regarding how to
develop a clear and enforceable policy prohibiting the use of PEDs while driving.
61
Refer to NETS correspondence in public docket for this investigation.
62
https://www.osha.gov/Publications/motor_vehicle_guide.html (accessed 10/1/2019).
39
From an enforcement standpoint, in the absence of federal distracted driving laws for
noncommercial drivers, OSHA has authority to issue citations against employers under its general
duty clause for failure to address distracted driving hazards.63 However, a review of statistics
pertaining to OSHA’s enforcement of the general duty clause identified only a few cases where
the agency used this authority against employers for failing to develop and enforce effective
distracted driving policies. The NTSB concludes that although OSHA has guidelines for
companies to reduce motor vehicle crashes by prohibiting the use of PEDs while driving, the
guidelines lack specificity, are not widely adopted by companies, and are seldom
enforced―limiting their impact in addressing the hazards of distracted driving. Therefore, the
NTSB recommends that OSHA review and revise its distracted driving initiatives to increase
employers’ awareness of the need to develop strong cell phone policy prohibiting the use of PEDs
while driving. The NTSB further recommends that OSHA modify its enforcement strategies to
increase the use of the general duty clause cited in 29 United States Code section 654 against
those employers who fail to address the hazards of distracted driving.
2.2.4.5 Monitoring Driver Engagement. The Tesla driver was likely distracted for at least
5 seconds, as shown by his lack of evasive action as he traveled through the neutral area of the
gore and the vehicle accelerated toward the crash attenuator. Tesla Autopilot assesses the driver’s
level of engagement by monitoring driver interaction with the steering wheel through changes in
steering wheel torque.64 The system uses the driver’s interactions with the steering wheel to
determine the driver’s degree of engagement with the tasks of monitoring the road environment
and supervising the Autopilot system’s performance. If the system does not detect signs of driver
engagement for relatively long periods of time, an escalating series of visual and audible warnings
is presented to the driver.
In examining the Tesla Carlog performance data for this crash, investigators noted that the
Autopilot system provided two visual alerts and one auditory warning to the driver to put his
hands on the steering wheel earlier in the trip. However, during the final 15 minutes before the
crash, the system did not provide any visual or audible alerts warning the driver to put his hands
on the steering wheel even though his hands came off the steering wheel on multiple occasions
for time periods exceeding 10 seconds. At the time of the crash, the system allowed drivers to
have their hands off the steering wheel for up to 3 minutes under certain highway driving
conditions.
During the last 60 seconds before the crash, the system did not detect driver-applied
steering wheel torque 43 percent of the time and provided no warnings to the driver. The system
did not provide a hands-off alert to the driver when the system momentarily lost lane line
prediction as the vehicle steered to the left into the gore area.65 The NTSB concludes that the Tesla
63
The Occupational Safety and Health Act of 1970 general duty clause (29 United States Code section 654
[a][1]) states that “each employer shall furnish each of his employees employment and a place of employment which
are free from recognized hazards that are causing or are likely to cause death or serious physical harm to his
employees.” Penalties for willful violations of the general duty clause can range up to $132,598 per occurrence.
64
According to Tesla, although the weight of the hands on the steering wheel is often enough to register as driver
interaction, on some occasions the system will not register torque if the driver is only lightly touching the steering
wheel.
65
Recommendations to address driver monitoring deficiencies are included in section 2.3.1 of this report.
40
Autopilot system did not provide an effective means of monitoring the driver’s level of
engagement with the driving task. For further discussion, see section 2.3.1 of this report.
2.2.5 Highway Infrastructure Issues
2.2.5.1 Roadway Markings. A review of the highway environment in the Mountain View crash
investigation revealed faded roadway lane markings in the vicinity of where the Tesla Autopilot
lane-keeping assist system steered the SUV to the left into the gore. Additionally, the gore was
not marked with optional chevrons to designate the area as an off-limits zone for vehicular travel.
Although Tesla Inc. indicated that optional gore point striping would not have improved the
Autopilot behavior or prevented the crash, the manufacturer stated that in future firmware
updates, gore point and roadway striping may help the vision system discriminate the gore from
the travel lanes.
The design of highways―from the type and color of pavement used, to the signage, to the
lighting, and the speed limit―is based on extensive human performance research. Automated
vehicles, starting at even SAE Level 2 driving automation systems, may require that many of
these guidelines be revised in the future. In June 2018, the Federal Highway Administration
(FHWA) began a National Dialogue on Highway Automation to receive input from stakeholders
to prepare FHWA programs and policies to incorporate automation considerations. Additionally,
the National Cooperative Highway Research Program (NCHRP), funded by state DOTs, began a
major research project titled “Impacts of Connected Vehicles and Automated Vehicles on State
and Local Transportation Agencies” (NCHRP 20-102). The project looks specifically at
infrastructure design and operations, such as:
• Road Markings for Machine Vision (NCHRP 20-102[06]),
• Implications of Connected and Automated Vehicles (NCHRP 14-42), and
• Infrastructure Modifications to Improve the Operational Domain of Automated Vehicles

(NCHRP 20-102[21]).
The NTSB concludes that although the lack of gore area roadway striping at the Mountain
View crash location likely did not contribute to the crash, ongoing research led by the FHWA can
help identify what highway infrastructure changes may be needed in the future to accommodate
automated vehicles.
2.2.5.2 Traffic Safety Hardware. As part of the Mountain View crash investigation, the NTSB
issued a safety recommendation report on August 12, 2019, addressing systemic problems related
to the timely repair of traffic safety hardware in California (NTSB 2019b). Investigators found
that on the day of the crash, the crash attenuator at the US-101−SR-85 interchange was in a
nonoperational damaged condition due to a previous crash, which occurred 11 days earlier on
March 12, 2018. The CHP had responded to the March 12 crash but did not notify Caltrans of the
damage to state property. The damaged condition of the crash attenuator went unnoticed by
Caltrans―the entity responsible for replacing it―for 8 days until two Caltrans maintenance
workers discovered it. Because of prior scheduled work, required storm patrol shifts due to
inclement weather, and the need to locate a replacement, the attenuator was not repaired until
March 26, 2018, 3 days after the crash that resulted in the death of the Tesla driver.
41
In the August 2019 safety recommendation report, the NTSB determined that Caltrans did
not have a proactive surveillance and inspection program to identify damaged traffic safety
hardware, did not have a risk-based maintenance system that prioritizes repairs based on risk
factors, was lacking an accurate work order tracking system that provides feedback to
maintenance personnel concerning overdue or incomplete work, and did not have an active on-call
contract program that augments maintenance forces when necessary repairs cannot be completed
in a timely manner. The NTSB concludes that the crash attenuator was in a damaged and
nonoperational condition at the time of the collision due to the CHP’s failure to report the damage
following a previous crash and systemic problems with Caltrans’s maintenance division in
repairing traffic safety hardware in a timely manner.
Between August and December 2019, CalSTA coordinated substantive actions in response
to Safety Recommendation H-19-13, which are described in section 1.9.3.3 of this report.
Because of CalSTA’s efforts, the NTSB reclassifies the recommendation from “Open―Initial
Response Received” to “Open―Acceptable Response.”
2.2.5.3 Crash Survivability. The NTSB evaluated the potential survivability of the crash if the
Tesla had collided with an operational crash attenuator rather than the fully compressed damaged
attenuator. As part of the analysis, investigators reviewed data from crash testing of an operational
SCI Smart Cushion® 100GM crash cushion. Several crash tests were completed at an
FHWA-approved test site, using a range of light trucks and cars tested at a nominal impact velocity
of 60 mph.66 The purpose of a crash attenuator is to decelerate a vehicle more gradually, over a
longer distance and greater duration of time, thus reducing the crash forces on the occupant. The
SCI Smart Cushion® crash tests measured what the manufacturer calls the “ride-down
acceleration” of the occupant, which represents the average acceleration of the crash test dummy
relative to the deceleration of the vehicle in a collision.67 The tests, with roughly similar conditions
as the Mountain View crash, demonstrated that a functional attenuator increases stopping distance
and greatly reduces crash forces. The tests showed no penetration of the occupant compartment
or deformation of the vehicle, and the occupant risk values were within survivable limits.
The NTSB also examined the circumstances of the March 12, 2018, crash responsible for
damaging the crash attenuator before the Tesla collision. NTSB investigators inspected the
crash-involved Toyota Prius and downloaded the airbag control module, which had EDR
capability. Data obtained from the EDR showed that the Toyota was traveling in excess of 75 mph
when it collided with the crash attenuator. Although the data showed that the driver experienced
a longitudinal speed change greater than the Tesla driver experienced, the ride-down time was
much longer, resulting in lower collision forces and thus greater survivability.
Based on the NTSB analysis of crash test data and a comparison of the crash data from
the Toyota Prius and Tesla collisions, the NTSB concludes that if the crash attenuator at the
66
Refer to the Crash Attenuator MASH Eligibility and Crash Test Data report available in the public docket for
this crash investigation. The vehicle types ranged from sedans lighter than the Tesla to pickup trucks of about the
same mass as the Tesla, and with impact orientations similar to the crash.
67
Note that as the car is being decelerated in a crash, the occupant is being accelerated in his or her seat and then
decelerated by the restraint system. The forces acting on the occupant can be somewhat higher than the forces acting
on the vehicle, depending on the effectiveness of the restraint system.
42
US-101−SR-85 interchange had been repaired in a timely manner and in a functional condition
before the March 23, 2018, crash, the Tesla driver most likely would have survived the collision.
2.3 Safety Issues Found in Partial Driving Automation Crashes

This section of the report incorporates lessons learned from multiple NTSB crash
investigations involving vehicles operating with SAE Level 2 partial driving automation systems.
Between May 2016 and March 2019, the NTSB investigated four crashes involving Tesla vehicles
operating with Autopilot activated and identified several areas of concern, including:
(1) ineffective driver monitoring to ensure driver engagement; (2) use of Autopilot outside the
conditions the system was designed for and intended to be operated in, and (3) limitations of the
collision avoidance systems to avoid certain crash scenarios. These areas of concern will be
discussed in detail in the following report subsections, which include safety recommendations
aimed at reducing crashes involving partial driving automation systems.
2.3.1 Risk Mitigation Pertaining to Monitoring Driver Engagement
2.3.1.1 Tesla Driver Monitoring System. Based on system design, in an SAE-defined Level 2
partial driving automation system, it is the driver’s responsibility to monitor the automation,
maintain situational awareness of traffic conditions, understand the limitations of the automation,
and be available to intervene and take over for the driving automation system at all times. In
practice, however, drivers are poor at monitoring automation and do not perform well on tasks
requiring passive vigilance (Parasuraman and Riley 1997; Moray and Inagaki 2000; and
Parasuraman and Manzey 2010). Research shows that drivers often become disengaged from the
driving task for both momentary and prolonged periods during automated phases of driving
(Banks and others, 2018).
Driver disengagement from supervising Autopilot’s partial automation was a critical

factor in the four Tesla crashes the NTSB investigated.68 In the Mountain View and Culver City
crashes, the drivers were found to be distracted and not supervising Autopilot’s performance or
monitoring the driving environment (detecting and recognizing roadway hazards) leading up to
the crash. Likewise, in the Williston and Delray Beach crashes, the drivers were inattentive and
did not take any evasive action in response to semitrailer vehicles crossing the paths of their cars.
Autopilot assesses a driver’s level of engagement by monitoring his or her interaction with the
steering wheel through changes in steering wheel torque. However, because driving is a highly
visual task, a driver’s touch or torque on the steering wheel is an ineffective method to determine
whether he or she is fully engaged with the driving task. Simply checking whether the driver has
placed a hand on the steering wheel gives little indication of where the driver is focusing his or
her attention.
Following the investigation of the Williston crash, the NTSB concluded that the way the
Tesla Autopilot system monitored and responded to the driver’s interaction with the steering
wheel was not an effective method of ensuring driver engagement. As a result, the NTSB
68
SAE Level 2 features are capable of performing only part of the dynamic driving task (DDT) and thus require
a driver to perform the remainder of the DDT, as well as supervise the feature’s performance when the system is
activated. A driver may disengage from the responsibility of supervising the performance of the automation for a
variety of reasons such as inattention, driver distraction, fatigue, alcohol or drug impairment, medical incapacitation,
and so on.
43
recommended that six manufacturers of vehicles equipped with Level 2 driving automation
systems take the following action:
H-17-42
systems are in use.
Of the six automakers, Tesla was the only company that has not officially responded to
Safety Recommendation H-17-42.69 The NTSB continues to maintain that the operational design of
Tesla’s automated vehicle control systems requires an attentive driver as an integral system element.
Therefore, the NTSB reiterates Safety Recommendation H-17-42 to Tesla and reclassifies the
recommendation from “Open―Await Response” to “Open―Unacceptable Response.”
2.3.1.2 Development of Standards for Driver Monitoring Systems. SAE Level 2 partial
automation systems require that the driver monitor the highway and remain able to take control
of the vehicle at any time. The success of a Level 2 system depends on a driver completing a
monitoring task that requires sustained attention; however, humans generally perform poorly in
the role of monitors. Additionally, if a system behaves in a consistent and reliable manner for
prolonged periods, the user of that system can become complacent in its operation and may not
respond appropriately when required (Parasuraman, Molloy, and Singh, 1993; Lee and See, 2004;
Hollnagel and Woods, 2005).
Because driver attention is an integral component of partial automation systems, a driver

monitoring system must be able to assess whether and to what degree the driver is performing the
role of supervisor of the automation. As seen in the four recent NTSB Tesla Autopilot crash
investigations, drivers were able to disengage for prolonged periods of time. The type and timing
of alerts are vital components of an effective monitoring system (NHTSA 2018). Studies have
been performed to examine the most effective alerting approaches to maintain a driver’s attention.
A NHTSA study found that a 2-second prompt of disengagement compared to a 7-second prompt
increased the driver’s level of attentiveness. Additionally, it was found that bi-modal alerts (that
is, visual and auditory, visual and haptic) were more effective than unimodal alerts at getting
drivers to regain control of the vehicle when an unexpected lane change occurred (NHTSA 2015).
In the United States, no standards or regulations for driver monitoring system design are
currently in place, and the type and timing of alerts varies widely among manufacturers. Most
manufacturers’ owner’s manuals state that the automated systems “require” hands-on-wheel
operation. At the same time, active warnings provided by manufacturers, like Tesla, may not occur
until more than 3 minutes of hands off the wheel have passed. Following the Williston and
Mountain View crashes, Tesla released firmware updates that changed the alert timing to include
more immediate alerts when driver-applied steering wheel torque is not detected. As of the
publication of this report, the timing of visual alerts varies based on vehicle speed of travel (see
figure D-1 in appendix D). For example, at a speed of 25 mph, if the system does not detect
69
The recipients of Safety Recommendation H-17-42 were BMW of North America, Mercedes-Benz USA,
Nissan Group of North America, Tesla Inc., Volkswagen Group of America, and Volvo Car USA. During current
investigations, Tesla provided information on its alert timings and other Autopilot system changes that the automaker
reported were associated with improving driver engagement. These changes are documented in this report.
44
driver-applied steering wheel torque for 60 seconds, a visual alert will be provided. Even at
90 mph, it would take 10 seconds for the system to provide an alert, during which time the vehicle
would have traveled a quarter of a mile.
Although the alert timing is more immediate than previous Autopilot firmware versions,
it is still likely inadequate to prevent most crashes, which occur in a matter of seconds (as seen in
the Mountain View, Culver City, and Delray Beach collisions).70 For example, during NHTSA’s
evaluation of crash events, the agency’s Office of Defects Investigation (ODI) found that most
crash events develop in a short time frame and usually provide less than 3 seconds for a driver to
detect, observe, and react to a pending collision (NHTSA 2017). Any amount of hands-off-wheel
steering time (which is currently the surrogate measure of driver engagement that many
manufacturers use) is a safety risk because just a few seconds of inattention has been shown to
cause most crashes.
The timing of hands-off-wheel warning intervals has been addressed in Europe by the
United Nations Economic Commission for Europe (UNECE) (Mousel 2018). UNECE regulations
require that drivers who misuse lane-keeping assist systems by going “hands off” must be warned
by an optical signal (visual warning) after 15 seconds at the latest (see figure 19). Then, after
30 seconds, parts of the optical signal must turn red and an acoustic alert must be triggered. After
30 seconds of acoustic warning, an emergency signal of at least 5 seconds must sound a final
warning.71
Figure 19. UNECE escalating timing of alerts for hands off wheel. (“LKAS” in the image means
“lane-keeping assist system.”) (Source: Mousel 2018)
A monitoring system needs to assess whether and to what degree drivers are performing
their specified role. SAE J3016 states that monitoring is most frequently deployed as a
countermeasure for misuse or abuse, including overreliance due to complacency; however,
SAE J3016 is silent on what constitutes effective driver monitoring. Currently, no performance
standards exist for the appropriate timing of alerts, the type of alert (visual, auditory, haptic), or
70
The critical events leading to these four crashes developed in less than 10 seconds. In the Mountain View
crash, the Tesla Autopilot lane-keeping assist system steered the SUV to the left into the gore area less than 6 seconds
before the collision with the crash attenuator.
71
Tesla advised the NTSB that Tesla vehicles operating in Europe are designed to meet the timing of alerts
criteria set in UNECE regulations.
45
the use of redundant monitoring sensors to ensure driver engagement.72 Therefore, the NTSB
concludes that because monitoring of driver-applied steering wheel torque is an ineffective
surrogate measure of driver engagement, performance standards should be developed pertaining
to an effective method of ensuring driver engagement in SAE Level 2 partial driving automation
systems. Therefore, the NTSB recommends that NHTSA, for vehicles equipped with Level 2
automation, work with SAE International to develop performance standards for driver monitoring
systems that will minimize driver disengagement, prevent automation complacency, and account
for foreseeable misuse of the automation. The NTSB issues a corresponding recommendation to
SAE International to work with NHTSA. The NTSB further recommends that NHTSA, after
developing the performance standards for driver monitoring systems recommended in Safety
Recommendation H-20-3 (above), require that all new passenger vehicles with Level 2
automation be equipped with a driver monitoring system that meets these standards.
2.3.2 Risk Assessment Pertaining to Operational Design Domain
SAE J3016 discusses the need for manufacturers to accurately describe ADAS features
and clearly define the level of driving automation and its capabilities, but also its operational
design domain (ODD)―the conditions in which the driving automation system is intended to
operate.73 Examples of such conditions include roadway type, geographic location, clear roadway
markings, weather conditions, speed range, lighting conditions, and other manufacturer-defined
system performance criteria or constraints. As shown in appendix C and summarized below, Tesla
has outlined many operating conditions and limitations based on the Autopilot system design:
• Designed for use on highways with a center divider,
• Designed for areas with no cross-traffic and clear lane markings,
• Not for use on city streets or where traffic conditions are constantly changing,
• Not for use on winding roads with sharp curves, and
• Not for use in inclement weather conditions with poor visibility.
Despite communicating these operating conditions and limitations to owners and drivers,
Tesla Autopilot firmware does not restrict the system’s use based on functional road classification.
The system can essentially be used on any roads where it can detect lane markings, which allows
drivers to activate driving automation systems at locations and under circumstances for which
their use is not appropriate or safe, such as on roadways with cross traffic or in areas that do not
consistently meet the ODD, such as roadways with inconsistent lane markings. The Mountain
View crash occurred in a challenging multi-lane operational environment with exit ramps on both
sides of the highway and faded roadway lane markings. To characterize and evaluate the
72
Some manufacturers have developed different approaches to monitor system performance, such as the use of
eye-tracking cameras. The Driver Attention System in the 2018 Cadillac CT6 Super Cruise partial driving automation
system uses a small camera located at the top of the steering column; the camera focuses exclusively on the driver
and uses infrared light to track the driver’s head position.
73
The ODD discussion applies to the Autopilot partial driving automation system. Although the collision
avoidance systems FCW and AEB use some of the same sensors (cameras and radar) as Autopilot, FCW and AEB
are designed for, and meant to work in, all domains.
46
performance of Level 2 systems on public highways and in naturalistic environments, the

American Automobile Association (AAA) conducted testing, which found that Level 2 systems
performed best on open freeways but were challenged on freeways with moderate traffic and in
areas of transitions (AAA 2018).74 Most Level 2 systems were incapable of staying in their lane
on curved portions of freeways, including in freeway transition areas.
SAE J3016 considers the ODD for Level 2 systems to be limited (see table 1). Today’s
Level 2 systems can assess a vehicle’s location and the current roadway type/classification and
determine whether the roadway is appropriate for the system’s ODD. Despite this capability, Tesla
has chosen to permit operation of Autopilot under conditions that do not meet its ODD. Tesla has
informed the NTSB that its “operational design domain limits are not applicable for Level 2 driver
assist systems, such as Autopilot, because the driver determines the acceptable operating
environment.” Moreover, Tesla has advised the NTSB that “Autopilot can be safely used on
divided and undivided roads as long as the driver remains attentive and ready to take control.”
The Williston, Florida, crash involved a 2015 Tesla Model S that collided with a tractor
trailer combination crossing an uncontrolled intersection on a nonlimited-access highway.75
Partial automated vehicle operation on nonlimited-access highways presents challenges in
detecting cross-path intrusions, pedestrian and bicycle traffic, and signage at intersections.
Additionally, cross-path collisions are challenging for collision avoidance systems. The NTSB
concluded in the investigation of the Williston crash that if automated vehicle control systems do
not automatically restrict their own operation to those conditions for which they were designed
and are appropriate, the risk of driver misuse remains. The NTSB recommended that Tesla and
other manufacturers of Level 2 automation take the following action:
H-17-41
systems to those conditions for which they were designed.
Five automobile manufacturers responded to this recommendation with steps they were
taking to address the issue. Tesla, however, has not responded. As mentioned previously, Tesla
has stated that it does not believe ODD limits are applicable to the Autopilot system as long as
the driver remains attentive. During the Mountain View investigation, Tesla was queried regarding
plans to implement ODD restrictions and indicated that the driver was solely responsible for
choosing when to use the SAE Level 2 system. However, Tesla vehicles continue to be involved
in crashes where Autopilot is activated and operating outside the intended geographic ODD. In
March 2019, in Delray Beach, Florida, a fatal crash involving a 2018 Tesla Model 3 occurred
under circumstances very similar to the Williston crash. In the Delray Beach crash, a truck-tractor
in combination with a semitrailer was traveling eastbound in a private driveway belonging to an
agricultural facility on the west side of US-441. The combination vehicle entered the highway
without stopping and was subsequently struck by the southbound Tesla. At the time of the crash,
74
Vehicles tested included the 2018 Mercedes-Benz S-Class with Active Distance and Steering Assist, the 2018
Nissan Rogue with ProPILOT Assist, the 2017 Tesla Model S with Autopilot, and the 2019 Volvo XC40 with Pilot
Assist.
75
Access control is a key factor in the functional classification of roads. All interstates are “limited-access”
roadways, providing no access to abutting land users. Travelers use high-speed entrance and exit ramps to access
limited-access roadways (Federal Highway Administration 2013, p. 14).
47
the Autopilot system was active, and the Tesla was traveling at 68 mph in a 55-mph posted speed
limit area. The Autopilot system and collision avoidance systems did not classify the crossing
truck as a hazard, did not attempt to slow the vehicle, and did not provide a warning to the driver
of the approaching crossing truck. Further, the driver did not take evasive action in response to
the crossing truck. At the crash location, the highway was not limited-access and had more than
34 roadways and private driveways intersecting US-441 within the immediate 5-mile area.
The Delray Beach highway operating environment, like the cross-traffic conditions in
Williston, was clearly outside the Tesla Autopilot system’s ODD. Tesla, however, fails to provide
system safeguards to limit the use of Autopilot for the operating conditions for which it was
designed. By placing full reliance on the success of its partial automation system on the premise
that drivers will be attentive at all times and will be sufficiently knowledgeable to make proper
decisions regarding where to operate the system, Tesla has created a system designed to fail
because of the foreseeable misuse of the system. The NTSB concludes that if Tesla Inc. does not
incorporate system safeguards that limit the use of the Autopilot system to those conditions for
which it was designed, continued use of the system beyond its ODD is foreseeable and the risk
for future crashes will remain. Therefore, the NTSB reiterates Safety Recommendation H-17-41
to Tesla and reclassifies the recommendation from “Open―Await Response” to
“Open―Unacceptable Response.”
Without more rigorous standards or guidelines to manufacturers regarding Level 2

emerging automation technology, safeguards will be insufficient to prevent use of Level 2 systems
in nondesigned ways. After the Williston crash, the NTSB recommended that NHTSA address
this vital safety concern, as follows:
H-17-38

designed.
In response to Safety Recommendation H-17-38, NHTSA stated the following:
The agency has no current plans to develop a specific method to verify

manufacturers of vehicles equipped with Level 2 systems incorporate safeguards
limiting the use of automated vehicle control systems to those conditions for which
they were designed. Instead, if NHTSA identifies a safety-related defect trend in
design or performance of a system, or identifies through its research or otherwise,
any incidents in which a system did not perform as designed, it would exercise its
authority as appropriate.
In August 2018, the NTSB reclassified Safety Recommendation H-17-38

“Open―Unacceptable Response.” If NHTSA had been proactive in response to the
recommendation after the Williston crash and verified that manufacturers such as Tesla incorporate
ODD safeguards into their systems, the fatal Delray Beach crash might have been prevented.
Therefore, the NTSB concludes that NHTSA’s failure to ensure that vehicle manufacturers of SAE
Level 2 driving automation systems are incorporating appropriate system safeguards to limit
48
operation of these systems to the ODD compromises safety. The NTSB believes NHTSA should
reevaluate its position on the importance of verifying that manufacturers incorporate ODD
safeguards into their systems, and therefore reiterates Safety Recommendation H-17-38.
2.3.3 Limitations of Collision Avoidance Systems
The four Tesla crashes that the NTSB investigated highlight the limitations of the collision
avoidance systems FCW and AEB when vehicles equipped with the technology are traveling at
high speed or are faced with vehicle shapes or objects that the system has not been designed to
detect. In the Williston, Delray Beach, and Mountain View crashes, the involved vehicles were
traveling at speeds in excess of 65 mph. In each crash, the FCW and AEB did not provide a
warning and the AEB system did not activate the brakes because the systems are not designed or
tested to operate consistently at speeds over 50 mph. Additionally, in each of the four crashes, the
Tesla was faced with an object (fire truck, crash attenuator, or side of semitrailer) different from
the type of vehicle targets that the system was designed to detect during testing. Yet, these types
of objects are common on our roadways.
The NTSB previously addressed FCW and AEB testing and assessment protocols in a
special investigation report (NTSB 2015). The report concluded that NHTSA’s existing testing
scenarios and protocols for the assessment of collision avoidance systems in passenger vehicles
do not adequately represent the wide range of velocity conditions seen in crashes, particularly
high-speed crashes. Because of this deficiency, the NTSB recommended that NHTSA take the
following action:
H-15-4
avoidance systems in passenger vehicles at various velocities, including high
speed and high velocity-differential.
Since receiving the recommendation, NHTSA has taken no action toward gaining a better
understanding of how these lifesaving technologies perform in real-world high-speed crash
scenarios. Therefore, in June 2016, the NTSB classified the recommendation
“Open―Unacceptable Response.” In this report of the Mountain View crash, the NTSB reiterates
Safety Recommendation H-15-4 to NHTSA.
Because most manufacturers have designed SAE Level 2 driving automation systems to
operate on high-speed, limited-access, divided highways such as interstate freeways, it is
important that when the automation or the driver makes an error, that collision avoidance systems
act as an additional layer of safety. The NTSB concludes that in order for driving automation
systems to be safely deployed in a high-speed operating environment, collision avoidance systems
must be able to effectively detect and respond to potential hazards, including roadside traffic
safety hardware, and be able to execute forward collision avoidance at high speeds. Therefore,
the NTSB recommends that NHTSA expand NCAP testing of forward collision avoidance system
performance to include common obstacles, such as traffic safety hardware, cross-traffic vehicle
profiles, and other applicable vehicle shapes or objects found in the highway operating
environment.
49
2.3.4 Insufficient Federal Oversight of Partial Driving Automation Systems
2.3.4.1 Nonregulatory Approach. The US Department of Transportation (DOT) and NHTSA

have taken a nonregulatory approach to automated vehicle safety as described in policy and in
response to NTSB recommendations. The DOT has emphasized that “the right approach to
achieving safety improvement begins with a focus on removing unnecessary barriers and issuing
voluntary guidance, rather than regulations that could stifle innovation” (DOT 2018). Although
the DOT has described how it will address increasing levels of automation (Levels 3–5), few if
any vehicle performance regulations or guidelines have been explicitly provided for Level 2
systems in the United States. NHTSA has informed the NTSB that it plans to ensure the safety of
Level 2 systems through its enforcement authority and surveillance program aimed at identifying
safety-related defect trends in design or performance. The NTSB concludes that NHTSA’s
approach to the oversight of automated vehicles is misguided, because it essentially relies on
waiting for problems to occur rather than addressing safety issues proactively.76 Additionally, for
an acceptable level of safety to be achieved, a robust surveillance program must be present so that
vehicle safety-related defects can be identified in a timely manner.
2.3.4.2 NHTSA Enforcement of Automated Vehicle Safety-Related Defects. The National

Traffic and Motor Vehicle Safety Act provides the basis and framework for NHTSA’s enforcement
authority over motor vehicle equipment defects. NHTSA is charged with reducing deaths, injuries,
and economic losses from motor vehicle crashes.77 Part of that mandate includes ensuring that
motor vehicles and motor vehicle equipment, including automated vehicle safety technologies,
perform in ways that “protect the public against unreasonable risk of accidents occurring because
of design, construction, or performance of a motor vehicle, and against unreasonable risk of death
or injury in an accident.”78
The NHTSA enforcement guidance states that when an automated safety technology
causes crashes or injuries, or poses other safety risks, the agency will evaluate such technology
through its investigative authority to determine whether the technology presents an unreasonable
risk to safety.79 The guidance also states that manufacturers should take steps necessary to ensure
that technology introduced on US roadways accounts for any foreseeable misuse that may occur,
particularly in circumstances that require driver interaction while a vehicle is in operation.80
Included in the enforcement guidance is information directly relevant to the Mountain

View crash and other recent Tesla crashes investigated by the NTSB. NHTSA states that “a
semi-autonomous driving system that allows a driver to relinquish control of the vehicle while it
is in operation but fails to adequately account for reasonably foreseeable situations where a
76
Refer to the testimony of NTSB Chairman Robert L. Sumwalt, III, before the US Senate Committee on
Commerce, Science and Transportation on November 20, 2019, titled “Highly Automated Vehicles: Federal
Perspectives on the Deployment of Safety Technology.”
77
See 49 United States Code section 30101.
78
See 49 United States Code 30102(a)(8).
79
NHTSA Enforcement Guidance Bulletin 2016-02; “Safety-Related Defects and Automated Safety
Technologies,” 81 Federal Register 65705.
80
NHTSA has defined misuse as an operator, when having knowledge and understanding of the system’s
limitations and operational use instructions, deliberately chooses not to act according to the intent and design of the
automated component. When a driver, having full knowledge of the responsibility to supervise and monitor the
roadway, engages in a secondary task that may disrupt or eliminate the capability to effectively perform monitoring
duties, such disengagement can qualify as misuse.
50
distracted or inattentive driver must retake control of the vehicle at any point may also be an
unreasonable risk to safety.”
In determining whether a vehicle design poses an “unreasonable risk” to safety, NHTSA

is charged with answering the question through a forward-looking risk analysis. According to the
enforcement guidance, the forward-looking risk analysis “is not to protect individuals from the
risks associated with defective vehicles only after serious injuries have already occurred; it is to
prevent serious injuries stemming from established defects before they occur.”
Because NHTSA has determined that oversight of Level 2 driving automation systems will
be based primarily on tracking safety-related trends and enforcement authority, the NTSB concludes
that it is essential that NHTSA’s surveillance and defect investigation program closely examine
issues related to foreseeable misuse of automation and perform a forward-looking risk analysis to
identify partial driving automation system defects that pose an unreasonable risk to safety.
On June 28, 2016, NHTSA’s ODI opened a preliminary investigation to examine the
design and performance of Tesla’s driving automation systems in use at the time of the Williston
crash.81 The investigation did not identify any defects but added that NHTSA intended to monitor
the issues and reserved the right to take further action if circumstances warranted. An NTSB
review of the ODI investigation report identified shortfalls in the agency’s evaluation of the Tesla
Autopilot design. Deficiencies in the investigation include the following:
• ODI described the Tesla hands-on steering wheel system for monitoring driver
engagement but did not evaluate the effectiveness of the user monitoring system (type
and timing of alerts) in maintaining driver engagement.82
• ODI examined steps taken by Tesla in the design process to safeguard against driver
misuse but did not evaluate the degree to which drivers are currently misusing the
Autopilot system.83
• ODI described the Autopilot ODD as highways with a center divider and clear lane
markings but did not complete a forward-looking risk analysis to assess the
ramifications of continued operation outside the ODD.84
Additionally, NHTSA identified numerous limitations of the Tesla Autopilot system but
did not evaluate foreseeable consequences of drivers’ continued use beyond the system’s ODD.
Therefore, the NTSB concludes that NHTSA’s ODI has failed to thoroughly investigate the Tesla
Autopilot design regarding the degree to which drivers are currently misusing the system, the
81
NHTSA ODI investigation PE 16-007 (Automated vehicle control systems) closed January 19, 2017.
82
The ODI investigation stated that “driver misuse in the context of semi-autonomous vehicles is an emerging
issue and the agency intends to continue its evaluation and monitoring of this topic, including best practices for
handling driver misuse as well as driver education.”
83
A review of Tesla historical Carlog data could inform NHTSA of the prevalence of driver misuse of the
Autopilot system and address the foreseeability of future misuse needed by investigators to make a defect
determination.
84
ODI reported that the Autopilot system does not prevent operation on any road types. ODI also described that
the crash avoidance systems (FCW/AEB) were not designed to detect and brake for cross-traffic and that certain
vehicle shapes or objects, may delay or prevent the system from classifying various threats. ODI did not complete a
review of historical Tesla Carlog data to determine the propensity of drivers to operate outside the ODD.
51
foreseeable consequences of continued use by drivers beyond the system’s ODD, and the
effectiveness of the driver monitoring system in ensuring driver engagement. Following the
closure of NHTSA’s ODI investigation PE-16-007 in January 2017, the agency stated that it would
monitor Autopilot’s functionality and reserved the right to take further action if circumstances
warranted it. During the past 3 years, numerous crashes, injuries, and fatalities have occurred
involving Tesla vehicles operating with Autopilot activated.85 In addition, Tesla has collected a
large data set that can be accessed to answer important questions related to how and where
Autopilot is being used and the foreseeability of driver misuse.86 Therefore, the NTSB
recommends that NHTSA evaluate Tesla Autopilot-equipped vehicles to determine if the system’s
operating limitations, the foreseeability of driver misuse, and the ability to operate the vehicles
outside the intended ODD pose an unreasonable risk to safety; if safety defects are identified, use
applicable enforcement authority to ensure that Tesla Inc. takes corrective action.
2.4 Need for Event Data Recorders for Driving Automation Systems
Title 49 Code of Federal Regulations (CFR) Part 563 sets forth requirements for data
elements, data capture and format, data retrieval, and data crash survivability for EDRs installed
in light vehicles manufactured on or after September 1, 2012.87 The regulation did not mandate
installation of EDRs in light vehicles; rather, if the vehicle manufacturer chooses to install an
EDR, the regulation defines the format and specifies the requirements for providing commercially
available tools and/or the methods for retrieving EDR data in the event of a crash.
On December 13, 2012, NHTSA issued a notice of proposed rulemaking (NPRM) that
proposed a new federal motor vehicle safety standard mandating that EDRs meeting 49 CFR
Part 563 requirements be installed on most light vehicles. On February 8, 2019, NHTSA withdrew
the proposed rulemaking because the agency determined that a mandate was not necessary.
NHTSA’s internal analysis showed that for model year 2017, 99.6 percent of new light vehicles
sold were equipped with EDRs that met Part 563 requirements. NHTSA added that given the
near-universal installation of EDRs in light vehicles, NHTSA no longer believed that the safety
benefits of mandating EDRs justified the expenditure of limited agency resources.
In the withdrawal of the final rule, NHTSA advised that it would continue its efforts to
modernize and improve EDR regulations, including fulfilling the agency’s statutory mandate to
promulgate regulations establishing an appropriate recording duration for EDR data to “provide
accident investigators with vehicle-related information pertinent to crashes involving such motor
vehicles.”88 Because the data recording requirements codified in 49 CFR Part 563 more than a
decade ago are very limited, requiring the reporting of only 15 data elements, NHTSA advised
85
For example, NHTSA’s Special Crash Investigations program has initiated 14 investigations into Tesla crashes
with Autopilot activated.
86
The NTSB requested that Tesla provide any studies, analyses, or reviews that examine driver habits when
Autopilot was active. Tesla’s legal counsel replied, “we don’t have any data analysis on user habits. We form our
viewpoints based on review of engineering experience, customer complaints, feedback, social media, service visits,
and incident review, but this is subjective and anecdotal and not analytical as you describe.”
87
The EDR requirements apply to “light vehicles” required to have frontal airbags – those with a gross vehicle
weight rating of 3,855 kilograms (8,500 pounds) or less and an unloaded vehicle weight of 2,495 kilograms
(5,500 pounds) or less.
88
See the Fixing America’s Surface Transportation Act, Public Law 114-94 (December 4, 2015) section 24303.
52
that it is actively investigating whether the agency should revise the data elements to account for
advanced safety features.
In the Mountain View, Culver City, and Delray Beach Tesla crashes, NTSB investigators
were able to retrieve data from the RCM EDR, but the data did not address ADAS activation or
engagement. As a result, the NTSB used Carlog data to interpret ADAS functionality, but this
type of data is not available on many vehicles currently operating with these systems. Further, no
commercially available tools are currently able to retrieve and review any non-EDR vehicle
recorded data, and other manufacturers of vehicles with driving automation systems similarly
control access to the postcrash proprietary information associated with their vehicles. The NTSB
concludes that vehicle performance data associated with activation and engagement of SAE
Level 2 partial driving automation systems on vehicles involved in crashes are not required nor
available on most EDRs.
As more manufacturers deploy driving automation systems on their vehicles, to improve

system safety, it will be necessary to develop detailed information about how the active safety
systems performed during, and how drivers responded to, a crash sequence. Manufacturers,
regulators, and crash investigators all need specific data in the event of a system malfunction or
crash. Recorded data can be used to improve the automated systems and to understand situations
that may not have been considered in the original designs. Investigators need event data to conduct
effective and productive investigations involving vehicles using automated vehicle control
systems. Further, data are needed to distinguish between automated control actions and driver
control actions. Therefore, the NTSB concludes that a standardized set of retrievable data is
needed to enable independent assessment of automated vehicle safety and to foster automation
safety improvements.
Following the Williston fatal crash, on September 28, 2017, the NTSB made a
recommendation to the US DOT regarding the need to define data parameters necessary to
understand automated vehicle control systems, and made two recommendations to NHTSA to
define a standard reporting format and to require manufacturers of vehicles equipped with driving
automation systems to report incidents, crashes, and vehicle miles operated with the systems
enabled:
To the US DOT:
H-17-37
and vehicle performance before and during a crash.
To NHTSA:
H-17-39

53
Safety Administration regulators.
H-17-40
In response to these recommendations, NHTSA advised that it had communicated with

SAE International about developing industry standards but explained that “manufacturers are not
currently required to enable vehicles to record data from usage of driving automation systems
(SAE levels 1–2) or operation of such systems during crash triggered events. The ability for
traditional vehicle manufacturers and other stakeholders to report on automated technology
system use and its operation during incidents and crashes is highly dependent on each vehicle’s
specific recording and downloading technology.” Additionally, NHTSA advised that it believes
development of recording requirements is best accomplished through voluntary compliance until
industry consensus on standard data elements can be established.
NTSB experience with crashes involving different levels of driving automation shows that
the amount and availability of recorded data varies widely amongst manufacturers. In the more
than 2 years since these important safety recommendations were issued, neither the DOT nor
NHTSA has taken any substantive action to address them. Although NHTSA replied on
February 7, 2018, the DOT has not responded to Safety Recommendation H-17-37 since issuance.
Because it is unlikely that crash investigators and regulators will fully understand the causal
factors in a crash without easily accessible data from driving automation systems, the NTSB
reiterates Safety Recommendation H-17-37 to the DOT and reclassifies it from “Open―Await
Response” to “Open―Unacceptable Response.” In addition, the NTSB reiterates Safety
Recommendations H-17-39 and -40 to NHTSA and reclassifies them from “Open―Acceptable
Response” to “Open―Unacceptable Response.”
54
3 Conclusions
3.1 Findings
1. None of the following were factors in the Tesla driver’s actions in this crash: (1) driver
licensing or qualification; (2) familiarization with the vehicle and roadway; (3) medical
conditions, fatigue, or impairment by alcohol or other drugs; or (4) weather conditions.
2. The emergency response to the crash was timely and adequate.
3. The Tesla electric vehicle postcrash fire and related damage to the lithium-ion battery
presented unusual fire and electrical hazards to first responders.
4. The Tesla’s Autopilot lane-keeping assist system steered the sport utility vehicle to the
left into the neutral area of the gore, without providing an alert to the driver, due to
limitations of the Tesla Autopilot vision system’s processing software to accurately
maintain the appropriate lane of travel.
5. The Tesla’s collision avoidance systems were not designed to, and did not, detect the
crash attenuator at the end of the gore, nor did the National Highway Traffic Safety
Administration require such capability; consequently, the forward collision warning
system did not provide an alert and the automatic emergency braking did not activate.
6. The driver did not take corrective action when the Tesla’s Autopilot lane-keeping assist
system steered the vehicle into the gore area, nor did he take evasive action to avoid
the collision with the crash attenuator, most likely due to distraction caused by a cell
phone game application.
7. Distracted driving due to portable electronic device use remains persistently high, and
additional countermeasures are needed.
8. A technological solution, such as a lock-out function or application that automatically

disables highly distracting features of a portable electronic device while driving, is an
effective countermeasure for eliminating portable electronic device distraction while
driving.
9. Strong company policy, with strict consequences for using portable electronic devices
while driving, is an effective strategy in helping to prevent distracted driving crashes,
injuries, and fatalities.
10. Although the Occupational Safety and Health Administration has guidelines for
companies to reduce motor vehicle crashes by prohibiting the use of portable electronic
devices while driving, the guidelines lack specificity, are not widely adopted by
companies, and are seldom enforced―limiting their impact in addressing the hazards
of distracted driving.
11. The Tesla Autopilot system did not provide an effective means of monitoring the
driver’s level of engagement with the driving task.
55
12. Although the lack of gore area roadway striping at the Mountain View crash location
likely did not contribute to the crash, ongoing research led by the Federal Highway
Administration can help identify what highway infrastructure changes may be needed
in the future to accommodate automated vehicles.
13. The crash attenuator was in a damaged and nonoperational condition at the time of the
collision due to the California Highway Patrol’s failure to report the damage following
a previous crash and systemic problems with the California Department of
Transportation’s maintenance division in repairing traffic safety hardware in a timely
manner.
14. If the crash attenuator at the US Highway 101−State Route 85 interchange had been
repaired in a timely manner and in a functional condition before the March 23, 2018,
crash, the Tesla driver most likely would have survived the collision.
15. Because monitoring of driver-applied steering wheel torque is an ineffective surrogate

measure of driver engagement, performance standards should be developed pertaining
to an effective method of ensuring driver engagement in SAE Level 2 partial driving
automation systems.
16. If Tesla Inc. does not incorporate system safeguards that limit the use of the Autopilot
system to those conditions for which it was designed, continued use of the system
beyond its operational design domain is foreseeable and the risk for future crashes will
remain.
17. The National Highway Traffic Safety Administration’s failure to ensure that vehicle
manufacturers of SAE Level 2 driving automation systems are incorporating
appropriate system safeguards to limit operation of these systems to the operational
design domain compromises safety.
18. In order for driving automation systems to be safely deployed in a high-speed operating
environment, collision avoidance systems must be able to effectively detect and
respond to potential hazards, including roadside traffic safety hardware, and be able to
execute forward collision avoidance at high speeds.
19. The National Highway Traffic Safety Administration’s approach to the oversight of
automated vehicles is misguided, because it essentially relies on waiting for problems
to occur rather than addressing safety issues proactively.
20. It is essential that the National Highway Traffic Safety Administration’s surveillance
and defect investigation program closely examine issues related to foreseeable misuse
of automation and perform a forward-looking risk analysis to identify partial driving
automation system defects that pose an unreasonable risk to safety.
21. The National Highway Traffic Safety Administration’s Office of Defects Investigation
has failed to thoroughly investigate the Tesla Autopilot design regarding the degree to
which drivers are currently misusing the system, the foreseeable consequences of
continued use by drivers beyond the system’s operational design domain, and the
effectiveness of the driver monitoring system in ensuring driver engagement.
56
22. Vehicle performance data associated with activation and engagement of partial driving
automation systems on vehicles involved in crashes are not required nor available on
most event data recorders.
23. A standardized set of retrievable data is needed to enable independent assessment of

automated vehicle safety and to foster automation safety improvements.
57
3.2 Probable Cause

The National Transportation Safety Board determines that the probable cause of the
Mountain View, California, crash was the Tesla Autopilot system steering the sport utility vehicle
into a highway gore area due to system limitations, and the driver’s lack of response due to
distraction likely from a cell phone game application and overreliance on the Autopilot partial
driving automation system. Contributing to the crash was the Tesla vehicle’s ineffective
monitoring of driver engagement, which facilitated the driver’s complacency and inattentiveness.
Contributing to the severity of the driver’s injuries was the vehicle’s impact with a crash attenuator
barrier that was damaged and nonoperational at the time of the collision due to the California
Highway Patrol’s failure to report the damage following a previous crash, and systemic problems
with the California Department of Transportation’s maintenance division in repairing traffic
safety hardware in a timely manner.
58
4 Recommendations
4.1 New Recommendations
As a result of its investigation, the National Transportation Safety Board makes the
following nine new safety recommendations:
Expand New Car Assessment Program testing of forward collision avoidance

system performance to include common obstacles, such as traffic safety hardware,
cross-traffic vehicle profiles, and other applicable vehicle shapes or objects found
in the highway operating environment. (H-20-1)
Evaluate Tesla Autopilot-equipped vehicles to determine if the system’s operating

limitations, the foreseeability of driver misuse, and the ability to operate the
vehicles outside the intended operational design domain pose an unreasonable risk
to safety; if safety defects are identified, use applicable enforcement authority to
ensure that Tesla Inc. takes corrective action. (H-20-2)
For vehicles equipped with Level 2 automation, work with SAE International to
develop performance standards for driver monitoring systems that will minimize
driver disengagement, prevent automation complacency, and account for
foreseeable misuse of the automation. (H-20-3)
After developing the performance standards for driver monitoring systems

recommended in Safety Recommendation H-20-3, require that all new passenger
vehicles with Level 2 automation be equipped with a driver monitoring system that
meets these standards. (H-20-4)
To the Occupational Safety and Health Administration:
Review and revise your distracted driving initiatives to increase employers’

awareness of the need to develop strong cell phone policy prohibiting the use of
portable electronic devices while driving. (H-20-5)
Modify your enforcement strategies to increase the use of the general duty clause
cited in 29 United States Code section 654 against those employers who fail to
address the hazards of distracted driving. (H-20-6)
To SAE International:
For vehicles equipped with Level 2 automation, work with the National Highway
Traffic Safety Administration to develop performance standards for driver
monitoring systems that will minimize driver disengagement, prevent automation
complacency, and account for foreseeable misuse of the automation. (H-20-7)
59
To Manufacturers of Portable Electronic Devices (Apple, Google, HTC, Lenovo, LG,

Motorola, Nokia, Samsung, and Sony):
Develop a distracted driving lock-out mechanism or application for portable

electronic devices that will automatically disable any driver-distracting functions
when a vehicle is in motion, but that allows the device to be used in an emergency;
install the mechanism as a default setting on all new devices and apply it to existing
commercially available devices during major software updates. (H-20-8)
To Apple Inc.:
Develop and implement a company policy that bans the nonemergency use of
portable electronic devices while driving by all employees and contractors driving
company vehicles, operating company-issued portable electronic devices, or using
a portable electronic device to engage in work-related communications. (H-20-9)
4.2 Previously Issued Recommendations Reiterated in This Report

As a result of its investigation, the National Transportation Safety Board reiterates the
following two safety recommendations (already classified “Open―Unacceptable Response”) in
sections 2.3.3 and 2.3.2, respectively, in this report:
avoidance systems in passenger vehicles at various velocities, including high speed
and high velocity-differential. (H-15-4)

designed. (H-17-38)
4.3 Previously Issued Recommendations Reiterated and Reclassified

in This Report
As a result of its investigation, the National Transportation Safety Board reiterates and
reclassifies the following five safety recommendations:
To the US Department of Transportation:
and vehicle performance before and during a crash. (H-17-37)

60

Safety Administration regulators. (H-17-39)

(H-17-40)

To Tesla Inc.:
systems to those conditions for which they were designed. (H-17-41)

systems are in use. (H-17-42)

4.4 Previously Issued Recommendations Reclassified in This Report

As a result of its investigation, the National Transportation Safety Board reclassifies the
following two safety recommendations:
To the Consumer Electronics Association (now the Consumer Technology Association):

61

(H-11-47)

“Closed―No Longer Applicable” in section 2.2.4.3 of this report.
To the California State Transportation Agency:
compliance with repair timelines. (H-19-13)
Safety Recommendation H-19-13 is reclassified from “Open―Initial Response

Received” to “Open―Acceptable Response” in section 2.2.5.2 of this report.
62
BY THE NATIONAL TRANSPORTATION SAFETY BOARD
ROBERT L. SUMWALT, III JENNIFER HOMENDY

Chairman Member
BRUCE LANDSBERG THOMAS B. CHAPMAN

Vice Chairman Member
MICHAEL E. GRAHAM
Member
Report Date: February 25, 2020
63
Board Member Statement

Member Jennifer Homendy filed the following concurring statement on March 3, 2020:
The most dangerous way to travel in our country is on the road. In 2018, there were
36,560 fatalities on our nation’s roadways. Each and every one of these fatalities is tragic and that
tragedy is compounded by the fact that most of these fatal crashes can be traced back to human
error. The driver is the most vital part of the safe operation of a vehicle, but they can also be the
most dangerous part of operating a vehicle. The appropriate use of proven technologies that
support drivers in the safe operation of their vehicle has the potential to prevent crashes, reduce
injuries, and save lives.
Nearly 25 years ago, based on the investigation of a multi-vehicle crash in Menifee,

Arkansas, the NTSB issued a safety recommendation to the US DOT to begin testing of collision
warning systems on commercial motor vehicles. This safety recommendation was
“Closed―Unacceptable Action” in 1999 because the DOT failed to take action and the industry
had taken the lead in testing the technology. The NTSB has continued to issue safety
recommendations related to collision avoidance systems and most have been directed to NHTSA.
In fact, increasing the implementation of collision avoidance systems in all new highway vehicles
is on our 2019–2020 Most Wanted List of Transportation Safety Improvements. Unfortunately,
like the safety recommendation to the DOT in 1995, NHTSA has continued the trend of inaction
and has failed to implement many of our safety recommendations related to collision avoidance
systems and other vehicle safety technology.
There is no disputing the benefits of vehicle safety technology. As technology matures

and becomes more robust and integrated into vehicles across the country, many of the issues on
our Most Wanted List could be addressed. Even before we see fully autonomous vehicles on our
roads, the variety of technologies being discussed now could help prevent or mitigate
speeding-related crashes; eliminate distraction; and recognize fatigue and driver impairment.
While there is tremendous potential for vehicle automation systems, there needs to be
strong federal guidance around the testing and application of the technology. Since 2016, the
NTSB has investigated four crashes that involved vehicles with varying levels of automation and
our investigators are seeing many of the same issues over and over. As a result of our 2016
investigation in Williston, Florida, a safety recommendation was issued to NHTSA specific to
Level 2 vehicle automation systems:

designed. (H-17-38)
This safety recommendation has not been acted on and because of that inaction, NHTSA
was identified in the probable cause as contributing to the 2019 crash in Delray Beach, Florida.
NHTSA maintains that voluntary standards for manufacturers of vehicles with Level 3–5
automation systems is the best way forward and they completely ignore issues and concerns
64
around Level 2 vehicle automation systems that are on our roads now. Instead, they are choosing
to rely on their recall authority to address the safety of Level 2 systems.
The recall authority that NHTSA has is an important part of making sure vehicles in the
United States are as safe as they can be, but that recall can only be utilized after a problem has
been identified. This often means that lives have been lost while NHTSA is waiting for a problem
to present itself. As Finding 19 of this report states, NHTSA’s “approach to the oversight of
automated vehicles is misguided, because it essentially relies on waiting for problems to occur
rather than addressing safety issues proactively.”
As a federal agency with the mission to “save lives, prevent injuries, and reduce economic
costs due to road traffic crashes through education, research, safety standards, and enforcement
activity,” the hands-off approach NHTSA is taking to collision avoidance systems and Level 2
vehicle automation systems seems counter to their mission. The latest policy on automated vehicle
technologies from the DOT – Ensuring American Leadership in Automated Vehicle
Technologies; Automated Vehicles 4.0 – is more focused on protecting innovation rather than
promoting safety.
Our investigation of the Tempe, Arizona, automated test vehicle crash found that the lack
of leadership has led states to try to fill the safety gaps that are being left by NHTSA. As vehicle
technologies are developed and implemented, states have an important role in making sure their
roadways are safe, but they shouldn’t be doing it alone. The Mountain View crash is an example
of how NHTSA needs to first and foremost be focused on the safety of the traveling public and
not on promoting innovation. The longer NHTSA decides to not be a safety leader, the longer our
roadways will continue to see lives lost from the misuse of vehicle technology by drivers and
manufacturers.
Chairman Robert L. Sumwalt, III; Vice Chairman Bruce Landsberg; and Members
Thomas B. Chapman and Michael E. Graham joined in this statement.
65 CORRECTED COPY
Appendix A: Investigation
The National Transportation Safety Board was notified of this crash on March 23, 2018,
and initially dispatched two investigators to the scene to examine safety issues related to the
electric-powered vehicle fire. The investigation was expanded to include the human performance,
vehicle automation, and highway safety issues addressed in this report. The NTSB team also
included staff from the Office of Aviation Safety and the Office of Research and Engineering.
Parties to the investigation were the California Department of Transportation and the
California Highway Patrol.
Pursuant to Title 49 CFR section 831, Tesla Inc. was designated as a party to this
investigation because the automaker could provide qualified technical personnel who could
actively assist in the investigation. On April 11, 2018, the NTSB revoked Tesla’s status as a party
member because of the company’s failure to abide by the terms of the NTSB Party Agreement.
After being removed as a party member, Tesla’s general counsel office continued to assist the
NTSB and provided answers to investigators’ technical questions.
66
Appendix B: Tesla Carlog Data

The table below depicts 14.9 seconds of data recorded immediately before the crash,
retrieved from the Tesla’s Carlog.1
Table 3. Tesla Carlog data.
Time Time to Speed Distance Lead Steering Lateral

from Vehicle (L or R) Acceleration
Crash
Attenuator Distance
9:27:12.5 14.9 secs 69.5 mph 1437.9 feet 98.4 feet 1.6 deg. L 0.046 g’s
9:27:14.5 12.9 secs 69.4 mph 1234.7 feet 93.5 feet 0.4 deg. L .005 g’s
9:27:15.5 11.9 secs 68 mph 1133.9 feet 88.6 feet 0.2 deg. L 0.020 g’s
9:27:18.5 8.9 secs 64.6 mph 842.3 feet 82 feet 0.8 deg. L 0.005 g’s
9:27:21.5 5.9 secs 64.05 mph 559.6 feet 82 feet 5.6 deg. L 0.122 g’s
9:27:22.5 4.9 secs 63.1 mph 466.3 feet 80.4 feet 0.8 deg. L .005 g’s
9:27:23.5 3.9 secs 61.9 mph 374.6 feet NA 0.3 deg. R -.005 g’s
9:27:24.5 2.9 secs 62.35 mph 283.5 feet NA 1.1 deg. R -.026 g’s
9:27:25.5 1.9 secs 65.25 mph 189.9 feet NA 1 deg. R -.031 g’s
9:27:26.5 0.9 secs 68.4 mph 91.9 feet NA 3.8 deg. L .036 g’s
9:27:27.4 0 70.84 mph2 0 NA NA NA
1
Distance measurements from the attenuator are approximate and were derived based on kinematic equations
taking into account the speed recorded and individual time intervals. Lead vehicle distance was converted from
meters to feet. Steering wheel angle is reported by the electronic assisted power steering system. Lateral acceleration
values were converted from meters per second to g units.
2
Approximate speed at impact was not recorded in the Tesla Carlog. The speed was obtained from the Tesla
EDR report, which was based on the imaging of the RCM.
67
Appendix C: Autopilot and Collision Avoidance

Limitations
Limitations of Traffic-Aware Cruise Control (TACC):
The Tesla Model X Owner’s Manual states that TACC is primarily intended for driving on
dry, straight roads, such as highways and freeways, and should not be used on city streets. The
manual contains numerous warnings regarding the use of TACC related to the limitations of the
system, including the following:
• Warning: TACC is designed for your driving comfort and convenience and is not a
collision warning or avoidance system. It is your responsibility to stay alert, drive
safely, and be in control of the vehicle at all times. Never depend on TACC to
adequately slow down Model X. Always watch the road in front of you and be
prepared to take corrective action at all times. Failure to do so can result in serious
injury or death.
• Warning: Although TACC is capable of detecting pedestrians and cyclists, never

depend on TACC to adequately slow down Model X for them. Always watch the road
in front of you and be prepared to take corrective action at all times. Failures to do so
can result in serious injury or death.
• Warning: Do not use TACC on city streets or on roads where traffic conditions are
constantly changing.
• Warning: Do not use TACC on winding roads with sharp curves, on icy or slippery
road surfaces, or when weather conditions (such as heavy rain, snow, fog, etc.) make
it inappropriate to drive at a consistent speed. TACC does not adapt driving speed
based on road and driving conditions.
• Warning: Due to limitations inherent in the onboard GPS, you may experience
situations in which TACC slows down the vehicle, especially near highway exits
where a curve is detected and/or you are actively navigating to a destination and not
following the route.
• Warning: TACC cannot detect all objects and may not brake/decelerate for stationary
vehicles, especially in situations when you are driving over 50 mph and a vehicle you
are following moves out of your driving path and a stationary vehicle or object is in
front of you instead. Always pay attention to the road ahead and stay prepared to take
immediate corrective action. Depending on TACC to avoid a collision can result in
serious injury or death. In addition, TACC may react to vehicles or objects that either
do not exist or are not in the lane of travel, causing Model X to slow down
unnecessarily or inappropriately.
• Warning: TACC may be unable to provide adequate speed control because of limited
braking capability and hills. It can also misjudge the distance from a vehicle ahead.
68
Driving downhill can increase driving speed, causing Model X to exceed your set
speed. Never depend on TACC to slow down the vehicle to prevent a collision. Always
keep your eyes on the road when driving and be prepared to take corrective action as
needed. Depending on TACC to slow down enough to prevent a collision can result
in serious injury or death.
• Warning: TACC may occasionally brake Model X when not required or you are not
expecting it. This can be caused by closely following a vehicle ahead, detecting
vehicles or object in adjacent lanes (especially on curves), etc.
• Warning: TACC can cancel unexpectedly at any time for unforeseen reasons. Always
watch the road in front of you and stay prepared to take appropriate action. It is the
driver’s responsibility to be in control of Model X at all times.
• Limitations: TACC is particularly unlikely to operate as intended in the following

types of situations: (1) the road has sharp curves; (2) visibility is poor (due to heavy
rain, snow, fog, etc.); (3) bright light (oncoming headlights or direct sunlight) is
interfering with the camera’s view; (4) the radar sensor is obstructed (dirty, covered,
etc.); (5) the windshield area in the camera’s field of view is obstructed (fogged over,
dirty, covered by a sticker, etc.).
Limitations of Autosteer
The Tesla Model X Owner’s Manual lists the following warnings regarding Autosteer:
• Warning: Autosteer is a hands-on feature. You must keep your hands on the steering
wheel at all times.
• Warning: Autosteer is intended for use only on highways and limited-access roads with
a fully attentive driver. When using Autosteer, hold the steering wheel and be mindful
of road conditions and surrounding traffic. Do not use Autosteer on city streets, in
construction zones, or in areas where bicyclists or pedestrians may be present. Never
depend on Autosteer to determine an appropriate driving path. Always be prepared to
take immediate action. Failure to follow these instructions could cause serious
property damage, injury or death.
• Warning: Many unforeseen circumstances can impair the operation of Autosteer.

Always keep this in mind and remember that as a result, Autosteer may not steer
Model X appropriately. Always drive attentively and be prepared to take immediate
action.
• Limitations: Autosteer is particularly unlikely to operate as intended in the following

situations: (1) when unable to accurately determine lane markings due to poor
visibility (heavy rain, snow, fog, etc.), or an obstructed, covered or damaged camera
or sensor; (2) when driving on hills; (3) when approaching a toll booth; (4) the road
has sharp curves or is excessively rough; (5) bright light is interfering with the
camera’s view; or (6) the sensors are affected by other electrical equipment or devices
that generate ultrasonic waves.
69
Limitations of Forward Collision Warning (FCW) System

The Tesla Model X Owner’s Manual lists the following warnings regarding the FCW
system:
• Warning: FCW is for guidance purposes only and is not a substitute for attentive
driving and sound judgment. Keep your eyes on the road when driving and never
depend on FCW to warn you of a potential collision. Several factors can reduce or
impair performance, causing either unnecessary, invalid, inaccurate, or missed
warnings. Depending on FCW to warn you of a potential collision can result in serious
injury or death.
• Warning: The cameras and sensors associated with FCW are designed to monitor an
approximate area of up to 525 feet in your driving path. The area being monitored by
FCW can be adversely affected by road and weather conditions. Use appropriate
caution when driving.
• Warning: FCW is designed to provide visual and audible alerts. It does not attempt to
apply brakes or decelerate the Tesla Model X. When seeing and/or hearing a warning,
it is the driver’s responsibility to take corrective action immediately.
• Warning: FCW may provide a warning in situations where the likelihood of collision
may not exist. Stay alert and always pay attention to the area in front of the Tesla
Model X so the driver can anticipate whether any action is required.
• Warning: FCW does not operate when the Tesla Model X is traveling less than 4 mph.
• Warning: FCW does not provide a warning when the driver is already applying the
brake.
Limitations of Automatic Emergency Braking (AEB) System

The Tesla Model X Owner’s Manual lists the following warnings regarding the AEB
system:
• Warning: AEB is not designed to prevent a collision. At best, it can minimize the
impact of a frontal collision by attempting to reduce the driving speed. Depending on
AEB to avoid a collision can result in serious injury or death.
• Warning: It is strongly recommended that you do not disable AEB. If you disable it,
Tesla Model X does not automatically apply the brakes in situations where a collision
is considered likely.
• Warning: Several factors can affect the performance of AEB, causing either no
braking or inappropriate or untimely braking. It is the driver’s responsibility to drive
safely and remain in control of the vehicle at all times. Never depend on AEB to avoid
or reduce the impact of a collision.
70
• Warning: AEB is designed to reduce the impact of frontal collisions only and does not
function when the Tesla Model X is in reverse.
• Warning: AEB is not a substitute for maintaining a safe traveling distance between
you and the vehicle in front of you.
• Warning: The brake pedal moves downward abruptly during AEB events. Always
ensure that the brake pedal can move freely. Do not place material on top of the
Tesla-supplied driver’s floor mat (including an additional mat) and always ensure the
driver’s floor mat is properly secured. Failure to do so can impede the ability of the
brake pedal to move freely.
• Limitations: Collision avoidance assist features cannot always detect vehicles, bikes,
pedestrians, and you may experience unnecessary, inaccurate, invalid, or missed
warning for many reasons, particularly if: (1) the road has sharp curves; (2) visibility
is poor; (3) bright light is interfering with the camera’s view; (4) the radar sensor is
obstructed; or (5) the windshield area in the camera’s field of view is obstructed.
71
Appendix D: Postcrash Changes Made to Tesla

Autopilot
After the Mountain View crash, Tesla made design changes to the Autopilot firmware. The
changes are summarized below:
• Hydranet Vision System (Firmware Update 2018.10.4, released March 2018): The
firmware update includes vision system changes designed to improve the ability of the
system to recognize poor and faded lane markings, slopes/banks, and higher-curvature
roads. A higher fidelity “roadway estimator” was incorporated to improve lane and
path prediction. The Hydranet Vision System also includes changes that impact depth
detection, vision-radar association, and vehicle detection.
• Autopilot Hands-Off-Wheel Alert Timing (Firmware Update 2018.23, released

June 2018): The firmware changed the alert timing to include more immediate alerts
when hands are not detected on the steering wheel and there is no valid lane line (plus
no lead vehicle) or if an unusual lane line is detected (see figure D-1). It also includes
visual alerts based upon speed-based escalation for travel speeds over 25 mph. For
example, at a speed of 25 mph if the vehicle does not detect hands on wheel for
60 seconds, a visual alert would be provided. At 90 mph, the alert would be provided
after 10 seconds. Tesla advised that more immediate audible warnings are also
provided if the system no longer recognizes a lane while hands are not detected on the
steering wheel.
Figure D-1. Autosteer hands-on alert timing for the Tesla after firmware 2018.23 was
implemented in June 2018. (Changes are highlighted in green)
72
• Drivable Space Collision Warning (Firmware Update 2018.23): The firmware was
updated with a forward collision warning and active braking when certain unknown
objects are identified in the path of the vehicle. This “Drivable Space”
time-to-collision provides a warning up to 2.5 seconds based on detection. Because
this warning is part of the Autopilot system it cannot be disabled when the Autopilot
system is operating. The warning system is determined by the camera vision system
without radar fusion and establishes a boundary ahead of the vehicle. When the vehicle
approaches the end of the drivable space, a chime will sound and maximum braking
will be applied. Drivable space provides heavy deceleration but is primarily intended
to give drivers an audible warning and reduce impact severity, not to fully prevent all
crashes at highway speeds.
73
References
AAA American Automobile Association. 2018. “AAA Level 2 Autonomous Vehicle Testing;
AAA Propriety Research into the Performance of SAE Level 2 Autonomous Systems.”
Banks, V. A., A. Erickson, J. O’Donoghue, and N.A. Stanton. 2018. Is Partially Automated
Driving a Bad Idea? Observations from an On-Road Study. Applied Ergonomics 68:
138–145.
Dingus, T. A., F. Guo, S. Lee, J. Antin, M. Perez, M. Buchanan-King, and J. Hankey. 2016.
Naturalistic Driving Evaluation of Crash Risk. Proceedings of the National Academy of
Sciences, March 2016, 113 (10) 2636–2641; DOI: 10.1073/PNAS.1513271113.
DOT (US Department of Transportation). 2018. Preparing for the Future of Transportation:
Automated Vehicle 3.0, Washington, DC: DOT.
Hickman, J., R. Hanowski, and J. Bocanegra. 2010. Distraction in Commercial Trucks and Buses:
Assessing Prevalence and Risk in Conjunction with Crashes and Near Crashes.
FMCSA-RRR-10-049. Washington, DC: FMCSA.
Hollnagel, E, and D. D. Woods. 2005. Joint Cognitive Systems Foundations of Cognitive Systems
Engineering, Boca Raton, Florida: CRC Press.
Lee, J. D., K. A. See. 2004. “Trust in Automation: Designing for Appropriate Reliance.” Human
Factors, vol. 46, pp. 50–80.
Moray, N., and T. Inagaki. 2000. “Attention and Complacency.” Theoretical Issues in Ergonomics
Science 1: 354–365.
Mousel, T. 2018. Hands off Detection Requirements for UN R79 Regulated Lane Keeping Assist
Systems, IEE S.A. Luxembourg, paper number 17-0202.
NHTSA 2015. Human Factors Evaluation of Level 2 and Level 3 Automated Driving Concepts,
2015, DOT-HS-812-182. Washington, DC: NHTSA.
_____. 2017. Office of Defects Investigation Preliminary Evaluation of Automatic Vehicle Control
Systems, PE 16-007. Washington, DC: NHTSA.
_____. 2018. Human Factors Design Guidance for Level 2 and Level 3 Automated Driving
Concepts, DOT-HS-812-555. Washington, DC: NHTSA.
_____. 2019a. Distracted Driving in Fatal Crashes, 2017, DOT-HS-812-700. Washington, DC:
NHTSA.
_____. 2019b. Driver Electronic Device Use in 2018, DOT-HS-812-818. Washington, DC:
NHTSA.
74
NSC (National Safety Council). 2015. Employer Liability and the Case for Comprehensive Cell
Phone Policies.
NTSB (National Transportation Safety Board). 2011. Multivehicle Collision, Interstate 44

Eastbound, Gray Summit, Missouri, August 5, 2010, NTSB/HAR-11/03. Washington, DC:
NTSB.
_____. 2015. The Use of Forward Collision Avoidance Systems to Prevent and Mitigate Rear-End
Crashes, NTSB/SIR-15/01. Washington, DC: NTSB.
_____. 2017a. Motorcoach Collision with Crash Attenuator in Gore Area, US Highway 101, San
Jose, California, January 19, 2016, NTSB/HAR-17/01. Washington, DC: NTSB.
_____. 2017b. Collision Between a Car Operating with Automated Vehicle Control Systems and
a Tractor-Semitrailer Truck Near Williston, Florida, May 7, 2016, NTSB/HAR-17/02.
Washington, DC: NTSB.
_____. 2019a. Rear-End Collision Between a Car Operating with Advanced Driver Assistance
Systems and a Stationary Fire Truck, Culver City, California, January 22, 2018,
NTSB/HAB-19/07. Washington, DC: NTSB.
_____. 2019b. Addressing Systemic Problems Related to the Timely Repair of Traffic Safety
Hardware in California, NTSB/HSR-19/01. Washington, DC: NTSB.
_____. 2019c. Collision Between Vehicle Controlled by Developmental Automated Driving

System and Pedestrian, Tempe, Arizona, March 18, 2018, NTSB/HAR-19/03.
Washington, DC.
_____. 2020. Collision Between Car Operating with Partial Driving Automation and
Truck-Tractor Semitrailer, Delray Beach, Florida, March 1, 2019, NTSB/HAB-20/01.
Washington, DC: NTSB.
OTS (California Office of Traffic Safety). 2019. Results of Statewide Distracted Driving
Awareness Campaign, May 17, 2019.
_____. 2018. Observational Study of Distracted Driving Due to Electronic Device Use Among
California Drivers for 2018.
Parasuraman, R., and D. H. Manzey. 2010. “Complacency and Bias in Human Use of Automation:
An Attentional Integration.” Human Factors 52(3): 381–410.
Parasuraman, R., R. Molloy, and I. L. Singh. 1993. “Performance Consequences of Automation-

Induced ‘Complacency’.” International Journal of Aviation Psychology 3: 1–23.
Parasuraman, R., and V. Riley. 1997. “Humans and Automation: Use, Misuse, Disuse, and
Abuse.” Human Factors 39(2): 230–253.
Reagan, J., and J. Cicchino. 2018. Do Not Disturb While Driving – Use of Cellphone Blockers
Among Adult Drivers. Insurance Institute of Highway Safety, December 2018.
75
SAE (SAE International). 2018. Taxonomy and Definitions for Terms Related to Driving
Automation Systems for On-Road Motor Vehicles, Recommended Practice J3016, June
2018.
Strayer, D. L., J. M. Cooper, J. Turill, J. Coleman, N. Medeiros-Ward, and F. Biondi. 2013.

Measuring Cognitive Distraction in the Automobile, Washington DC: AAA Foundation
for Traffic Safety (www.aaafoundation.org/sites/default/files/MeasuringCognitive-
Distractions.pdf).
Tesla Inc. 2017. Tesla Model X Owner’s Manual.
76

HAR2001 Rel

Uploaded by

Copyright:

Available Formats

HAR2001 Rel

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

HAR2001 Rel

Uploaded by

Copyright:

Available Formats

Collision Between a Sport Utility Vehicle Operating With

Partial Driving Automation and a Crash Attenuator

Highway Accident Report

490 L’Enfant Plaza SW

Acronyms and Abbreviations .................................................................................................... iv

Terminology Related to Driving Automation Systems .......................................................... vii

1 Factual Information ................................................................................................................. 1

Board Member Statement ........................................................................................................ 64

Figure 2. Depiction of travel lanes and gore area ......................................................................... 2

Figure 3. Crash vehicles at final rest ............................................................................................ 3

Figure 4. Tesla postcrash fire ....................................................................................................... 4

Figure 5. Tesla movement leading up to the crash ....................................................................... 5

Figure 6. Positions of Tesla airbags.............................................................................................. 8

Figure 7. Tesla before being engulfed in flames .......................................................................... 9

Figure 9. Damage to Mazda 3 .................................................................................................... 11

Figure 10. Damage to Audi A4 .................................................................................................. 12

Figure 11. Tesla Autopilot components ....................................................................................... 13

Figure 13. Postcrash drive-through, showing faded lane marking ............................................. 22

Figure 14. Added postcrash gore cross-hatching/chevrons ........................................................ 23

Figure 15. Precrash damaged condition of the crash attentuator ................................................ 24

Figure D-1. Autosteer hands-on alert timing .............................................................................. 72

Acronyms and Abbreviations

ADAS advanced driver assistance systems

ADS automated driving systems

AEB automatic emergency braking

CalSTA California State Transportation Agency

Caltrans California Department of Transportation

CEA Consumer Electronics Association (renamed Consumer Technology Association

CFR Code of Federal Regulations

CHP California Highway Patrol

CTA Consumer Technology Association (formerly Consumer Electronics Association

CTIA Cellular Telecommunications Industry Association

DDT dynamic driving task

DOT US Department of Transportation

EDR event data recorder

FCW forward collision warning

FHWA Federal Highway Administration

GPS global positioning system

HAZMAT hazardous materials

HOV high-occupancy vehicle

I-405 Interstate 405

MAIT Multidisciplinary Accident Investigation Team

MASH Manual for Assessing Safety Hardware

MCU media control unit

mph miles per hour

MVFD Mountain View Fire Department

NCAP New Car Assessment Program

NCHRP National Cooperative Highway Research Program

NETS Network of Employers for Traffic Safety

NHTSA National Highway Traffic Safety Administration

NSC National Safety Council

NTSB National Transportation Safety Board

ODD operational design domain

ODI Office of Defects Investigation (NHTSA)

OEDR object and event detection and response

OTS California Office of Traffic Safety

PED portable electronic device

RCM restraint control module

SAE SAE International (formerly Society of Automobile Engineers)