NHTSA to robotaxi makers: emergency scenes "are not rare edge cases," fix them this month

Autonomy hit a strange stretch this summer. The cars are getting good enough to scale into new cities, and they are still failing in ways that make the news. Both things are true at once. A Waymo drove over a lit firework in San Francisco. Others stalled and got towed in gridlock the same weekend. Meanwhile Tesla kept opening new markets. And the feds sent a letter. Let me catch you up on what that mix actually tells you if you ship safety-critical products.

The demo works, the holiday does not

The easy part is going well. Tesla's Robotaxi service launched in a slice of West Miami, after Houston, Dallas, and a jump from limited to full coverage in Austin. Waymo runs the largest robotaxi fleet in the country. Expansion is real.

Then July 4th happened. A Waymo drove straight into an intersection where people were lighting illegal fireworks and ran one over. A passenger asked, "Are we on fire, dude?" The same weekend, other Waymos ran out of charge while idling in traffic and had to be towed, stranding drivers for hours. The product handles the normal night. The unusual night breaks it.

The rare case is your Tuesday

Here is the line worth pinning to your wall. NHTSA administrator Jonathan Morrison told AV developers that emergency scenes "are not rare or extreme edge cases." He called the failure to handle them a "functional insufficiency," and he wants solutions by the end of the month.

The pattern behind that letter is ugly. A TechCrunch investigation found at least six cases where first responders had to physically take control of a Waymo and move it. One happened during a mass shooting response. Another blocked crews headed to a gas explosion at an apartment building. Flares, cones, flashing lights, smoke: the system did not read them. When you ship into the real world, the thing you filed under "rare" is somebody's regular Tuesday.

When the escape hatch is a tow truck

Watch what the fallback actually is. A firework, a power outage, a crowd, a road closure, and the plan becomes: wait for a human to arrive. In San Francisco that meant hours of gridlock and a tow. The car did not fail loudly. It froze, and freezing in the wrong spot is its own kind of failure.

This is the trap for any team building autonomy: your recovery path has to be as fast as your happy path, or it is not a recovery path. Two days before the July 4 mess, Waymo posted a video about how simple it is to hail a ride home after a night out. The gap between that promise and a car stuck in traffic is exactly the gap regulators are now watching.

The battlefield already knows

The clearest read on where the tech actually is comes from a war zone. Forterra put more than 100 autonomous ATVs into Ukraine, and after 2,500 miles and 1,100 missions, soldiers still mostly teleoperate them. The vehicles cross rough terrain on their own. They cannot yet spot an unexpected threat and react.

"Until you hit the realities of combat, you're just not going to know," said Forterra's Scott Sanders, a former Marine. That is the same lesson San Francisco is teaching in a friendlier setting. Autonomy is solid on the known route and shaky the instant the world does something it did not train for. A human stays in the loop because the machine is too expensive to lose and not ready to improvise.

The deep cut

The regulator moved the line on you, and that is the part to bring to your next review. Morrison did not say make it safer someday. He named a specific failure class, called it a defect, and set a deadline. For anyone shipping safety-critical products, that reframes your edge-case backlog. The scenarios your team keeps deferring as "low frequency, high effort" are the ones that now carry legal and reputational weight, not just a low ticket priority.

So audit your failure modes by consequence, not by how often they happen. A rare event that blocks an ambulance or strands a city is not a P3. Build the recovery path with the same care as the main feature, and staff a human in the loop until it earns its way out. That is what the battlefield does on purpose and what the robotaxis learned the hard way.

Three questions for your team

1. Which failure modes are we filing as "rare" that would actually be catastrophic, and what is our real recovery time when they hit, not our average?
2. If our automated flow freezes, who or what takes over, how fast, and have we tested that path under a bad day instead of a demo day?
3. If a regulator or a reporter named our worst public failure tomorrow, could we show the fix was already in progress, or would we be starting the clock the day the letter arrives?