Autopilot System Driver Controls

Summary

The Office of Defects Investigation (ODI) upgraded PE21020 to EA22002 on June 8, 2022, to extend work and deepen the PE21020 crash analysis, to supplement that analysis with additional data, and to perform vehicle evaluations to understand how Tesla’s Autopilot system may exacerbate human factors or behavioral safety risks by undermining the effectiveness of the driver’s supervision. To support this work, ODI collected additional crash information and assessed vehicle control authority, driver engagement technologies, and related human factors considerations associated with partial automation via analysis of peer vehicle data and hands-on vehicle evaluation, assessments from NHTSA human factors subject matter experts, and reviews of related publications dedicated to partial driving automation. Autopilot is the simultaneous use of the features that Tesla calls Traffic-Aware Cruise Control (TACC) and Autosteer. TACC is a type of adaptive cruise control that, like traditional cruise control, maintains a set speed but also slows or accelerates as necessary to maintain the vehicle’s following distance from a vehicle in front. As designed, Autosteer detects lane markings and the presence of other nearby vehicles and objects to keep the vehicle in its driving lane. Autopilot is characterized by Tesla as an SAE Level 2 (“L2 system”) partial driving automation system that provides driver assistance through steering, propulsion, and braking within a specified driving environment under direct supervision of the driver. L2 systems should be designed to support the driver’s need to monitor the system in response to the constantly changing driving environment and, if necessary, take over the dynamic driving task. To ensure sufficient driver engagement, vehicles with L2 systems should employ driver engagement systems and usage controls that are appropriate and sufficient for the L2 system design and driver expectations. ODI completed an analysis of 956 crashes reported up to August 30, 2023. In approximately half (489) of those crashes, ODI found: 1.) that there was insufficient data to make an assessment; 2.) the other vehicle was at fault; 3.) Autopilot was found to not be in use; or 4.) the crash was otherwise unrelated to EA22002. Of the remaining 467 crashes, ODI identified trends resulting in three categories: collisions in which the frontal plane of the Tesla struck another vehicle or obstacle with adequate time for an attentive driver to respond to avoid or mitigate the crash (211), roadway departures where Autosteerwas inadvertently disengaged by the driver’s inputs (111), and roadway departures in low traction conditions such as wet roadways (145). ODI observed this pattern across all Tesla models and hardware versions. Crash and human factors assessment showed that Autopilot controls did not sufficiently ensure driver attention and appropriate use. At the same time, peer analysis and vehicle evaluations established that Autopilot invited greater driver confidence via its higher control authority and ease of engagement. This mismatch of weak usage controls and high control authority was evident in these crash categories, which included indications of driver disengagement from the driving task. This mismatch was also evident in roadway departures when the system was engaged in low traction conditions outside of Tesla’s recommendations.Additional information regarding NHTSA’s crash analysis is available in the EA22002 file. ODI reviewed these findings with Tesla during several conversations in Quarter 4 of 2023. On December 12, 2023, Tesla filed a Defect Information Report (DIR) (Recall 23V838) applicable to all Tesla models produced and equipped with any version of its Autopilot system. Tesla’s DIR described the functionality of this system, stated that the prominence and scope of the system’s controls may be insufficient to prevent driver misuse, and described a remedy to improve the effectiveness of driver warnings and to reduce mode confusion. ODI completed an extensive body of work via PE21020 and EA22002, which showed evidence that Tesla’s weak driver engagement system was not appropriate for Autopilot’s permissive operating capabilities. This mismatch resulted in a critical safety gap between drivers’ expectations of the L2 system’s operating capabilities and the system’s true capabilities. This gap led to foreseeable misuse and avoidable crashes. During EA220002, ODI identified at least 13 crashes involving one or more fatalities and many more involving serious injuries, in which foreseeable driver misuse of the system played an apparent role. ODI’s analysis conducted during this investigation, which aligns with Tesla’s conclusion in its Defect Information Report, indicated that in certain circumstances, Autopilot’s system controls and warnings were insufficient for a driver assistance system that requires constant supervision by a human driver. Given Tesla’s recall (23V838) of all vehicles equipped with Autopilot for insufficient controls to prevent misuse, ODI is closing EA22002. Concurrent with that closing, ODI has opened a Recall Query (RQ24009) to assess the effectiveness of the 23V838 remedy. To review the ODI reports cited in the Closing Resume ODI Report Identification Number document, go to NHTSA.gov.

Vehicles under investigation (31)