How terrible software design decisions led to Uber’s deadly 2018 crash

2 min read Original article ↗

The system used an object’s previously observed locations to help compute its speed and predict its future path. However, “if the perception system changes the classification of a detected object, the tracking history of that object is no longer considered when generating new trajectories,” the NTSB reports.

What this meant in practice was that, because the system couldn’t tell what kind of object Herzberg and her bike were, the system acted as though she wasn’t moving.

From 5.2 to 4.2 seconds before the crash, the system classified Herzberg as a vehicle and decided that she was “static”—meaning not moving—and hence not likely to travel into the car’s path. A little later, the system recognized that she was moving but predicted that she would stay in her current lane.

When the system reclassified her as a bicycle 2.6 seconds before impact, the system again predicted that she would stay in her lane—a mistake that’s much easier to make if you’ve thrown out previous location data. At 1.5 seconds before impact, she became an “unknown” object and was once against classified as “static.”

It was only at 1.2 seconds before the crash, as she was starting to enter the SUV’s lane, that the system realized a crash was imminent.

“Action suppression”

At this point, it was probably too late to avoid a collision, but slamming on the brakes might have slowed the vehicle enough to save Herzberg’s life. That’s not what happened. The NTSB explains why:

“When the system detects an emergency situation, it initiates action suppression. This is a one-second period during which the [automated driving system] suppresses planned braking while the system verifies the nature of the detected hazard and calculates an alternative path, or vehicle operator takes control of the vehicle.”

NTSB says that according to Uber, the company “implemented the action suppression process due to the concerns of the developmental automated detection system identifying false alarms, causing the vehicle to engage in unnecessary extreme maneuvers.”

As a result, the vehicle didn’t begin to apply the brakes until 0.2 seconds before the fatal crash—far too late to save Herzberg’s life.