Additional Information Regarding EA22002
Investigation: EA22002

Date: 4/25/2024

EA22002 (upgraded from PE21020) was opened to conduct extensive crash analysis, human factors
analysis, and vehicle evaluations, and to assess vehicle control authority and driver engagement
technologies. After discussions with NHTSA, Tesla filed a Defect Information Report (Recall 23V838)
on December 12, 2023, applicable to all Tesla models produced and equipped with any version ofits Autopilot 1 system, which Tesla described as an SAE Level 2 (L2) Advanced Driver Assistance
System (ADAS). Tesla concluded in its 23V838 filing that, in certain circumstances, Autopilot’ssystem controls may be insufficient for a driver assistance system that requires constant supervision
by a human driver. Tesla filed Recall 23V838 to address concerns regarding the Autopilot system
investigated in EA22002. These insufficient controls can lead to foreseeable driver disengagement
while driving and avoidable crashes.
ODI and other NHTSA subject matter experts performed substantial work in EA22002, including:1•Sent multiple Information Request (IR) letters to Tesla and to L2 peer manufacturers to collectthe following information concerning L2 vehicle technology:
o Production and field datao Engineering specifics concerning control authority, driver engagement, and operational
design domain
o Communications to customers
o Methods for detecting first responder scenes
o System changes, development, and validation/verification approaches
o Company approaches to crash evaluationo Assessment of L2 system involvement with reported crashes•Conducted an in-depth crash analysis to characterize crash circumstances•Convened multiple technical meetings with Tesla to review specific crashes and system changereleases•

Performed hands-on vehicle evaluations to assess vehicle human-machine interfaces andevaluated human factors consideration in design and controls•

Examined Tesla’s changes to Autopilot•

Compared Autopilot to peer L2 systems in-field by:o Control authority
o Operational Design Domain (ODD)o Object and Event Detection and Response (OEDR)o Driver engagement systems
o Ease of engagement

Autopilot refers to simultaneous engagement of TACC and Autosteer.

oNaming convention

Crash Analysis
Throughout the PE21020 and EA22002 investigations, ODI observed a trend of avoidable crashes
involving hazards that would have been visible to an attentive driver. Before August 2023, ODI
reviewed 956 total crashes where Autopilot was initially alleged to have been in use at the time of, or
leading up to, those crashes. ODI’s crash review involved two separate actions:
1. A detailed analysis covered 446 crashes occurring from early 2018 through August 2022 that
relied on in-depth assessments of video from the subject vehicle onboard cameras, event data
recorders (EDR), data logs, and other information; and2. A supplemental analysis, which focused on 510 Tesla incidents gathered through the Standing
General Order (SGO) process from August 2022 to the end of August 2023. ODI’s analysis ofthese crashes relied primarily on Tesla’s narratives and videos and data logs obtained from Tesla
for a portion of the 510 crashes. When supporting videos and data logs were unavailable, ODI
used Tesla’s source material inventory as stated in the SGO narrative (such as full, partial or novideo, logs, etc.) to assign a confidence level to its assessment. The supplemental analysis drew
similar conclusions to those of the detailed analysis.
ODI continued to observe and follow up on SGO-reported crashes after August 2023 up to the recall
filing and generally observed conditions similar to those identified in the analyses.

Detailed Crash Analysis (Jan 2018 - Aug2022)
Condition

Casualties

Crashes

FatalCrashes

DeathsInjuries

Frontal Plane
Struck Vehicle/ Object /Person intravel path

143

910

Yaw / Spin /Understeer(low tractionenvironment)

53--

Inadvertent
Steering
Override(Cancel AS,keep TACC)

55

FSD-Beta
CrashSupplemental Crash
Analysis (Aug 2022 Aug 2023)

Total

Crashes

FatalCrashes

Crashes

FatalCrashes

4968421113--

392--

145--

--

--

156--

111--

15--

--

260

175

1

AnalysisExcludeIndeterminate

66

3319651131

4AnalysisExclude- OtherVehicle Fault

83

--

--

1982

4165

4

AnalysisExcludeUnrelated to/ No full AP
engagement

31

35850

481

7

Other

--

--

--

--

37--

37--

Total

446

1518101

510

14956

29

Table 1: Detail and Supplemental Analysis Crash Counts, Conducted by NHTSA

Generally, the crashes that were the subject of ODI’s analysis fell into one of three categories:
Frontal Plane:
211 crashes were identified in which the frontal plane of the Tesla struck a vehicle or obstacle in its
path. This crash type includes the first responder crashes that prompted the original investigation.
When a driver is disengaged with the Tesla vehicle operating in Autopilot and the vehicle encountersa circumstance outside of Autopilot’s object or event detection response capabilities (e.g., obstacle
detection and/or forward path planning), crash outcomes are often severe because neither thesystem nor the driver reacts appropriately, resulting in high-speed differential and high energy crashoutcomes. The 211 crashes considered as part of this analysis resulted in 13 fatal crashes leading to
14 deaths and 49 injuries.
ODI’s analysis of crash data indicates that, prior to Recall 23V838, Autopilot’s design was not sufficient
to maintain drivers’ engagement. 109 of the 143 crashes from the detailed analysis included data
sufficient to measure the time between impact and the time a hazard would have come into the visualfield of an engaged driver. In more than half (59) of these crashes, the hazard was visible five or moreseconds prior to the impact, with a subset of 19 exhibiting a hazard visible for over 10 seconds prior
to the collision. For events unfolding faster, such as those where the hazard may have first been seen
less than two seconds prior to the crash, an attentive driver’s timely actions could have mitigated theseverity of a crash even if the driver may not have been able to avoid the crash altogether.
Hazard Visible Time Bin

TotalPercent≥ 10 sec

1917%

5 – 10 sec

4037%

2 – 5 sec

4239%

< 2 sec

87%

100%
Total
109
Table 2: Hazard Visible Time vs Roadway- Detailed Analysis, Conducted by NHTSA
For 135 incidents, the driver response to a hazard prior to impact was identified through a review of
the EDR and vehicle data logs. Drivers either did not brake or braked less than one second prior to thecrash in 82 percent of the incidents, and either did not steer or steered less than one second prior toimpact in 78 percent of the incidents.
For example, ODI reviewed a fatal crash that occurred in July 2023 in Warrenton, Virginia involving a2023 Model Y. The Tesla was traveling at highway speed on a rural highway with cross traffic andstruck the side of a turning tractor-trailer crossing its path. ODI conducted a post-crash inspection of
the vehicle and crash scene. Based on available information, the tractor-trailer would have beenvisible to an attentive driver with sufficient time to avoid the crash.
Another crash occurred in March 2023 in North Carolina and involved a 2022 Model Y. The vehicle
was traveling at highway speed when it struck a minor pedestrian exiting a school bus. The pedestrian
was evacuated by air to a hospital for treatment of serious injuries. Based on publicly available
information, both the bus and the pedestrian would have been visible to an attentive driver andallowed the driver to avoid or minimize the severity of this crash.

This analysis, conducted before Recall 23V838, indicated that drivers involved in the crashes were notsufficiently engaged in the driving task and that the warnings provided by Autopilot when Autosteer
was engaged did not adequately ensure that drivers maintained their attention on the driving task.
The drivers were involved in crashes while using Autopilot despite fulfilling Tesla’s pre-recall driver
engagement monitoring criteria. Crashes with no or late evasive action attempted by the driver were
found across all Tesla hardware versions and crash circumstances.
Yaw Loss of Control:
53 crashes were identified where Autosteer was in use in a lower traction environment, such as on
wet roads, where the vehicle lost traction and subsequently directional control, leading to a crashwhere the first harmful event was road departure. In these low traction incidents, generally, thevehicle almost immediately departs the lane after losing lane centering that often results in an impact
with a roadway barrier or other object.
Inadvertent Override:
55 crashes were identified where Autopilot was in use, but it appeared that the driver may have
inadvertently or unknowingly deactivated Autosteer while TACC remained engaged. This happened
either through steering inputs that exceeded the manual override threshold, resulting in the vehicle
drifting out of its lane, or through enough intermittent steering input to change the heading, generally
resulting in a single vehicle roadway departure crash as the first harmful event. Crash factors indicatethat driver disengagement, coupled with the Autopilot system design, is the key contributor to thesecrashes. Almost all the incidents (43) were involved in a crash less than 5 seconds after Autopilot wasoverridden by a steering torque and the vehicle lost lane centering and departed the travel lane.
Crash Rate and Telemetry
Gaps in Tesla’s telematic data create uncertainty regarding the actual rate at which vehicles
operating with Autopilot engaged are involved in crashes. Tesla is not aware of every crash involving
Autopilot even for severe crashes because of gaps in telematic reporting. Tesla receives telematic
data from its vehicles, when appropriate cellular connectivity exists and the antenna is not damaged
during a crash, that support both crash notification and aggregation of fleet vehicle mileage. Teslalargely receives data for crashes only with pyrotechnic deployment, 2 which are a minority of police
reported crashes. 3 A review of NHTSA’s 2021 FARS and Crash Report Sampling System (CRSS) findsthat only 18 percent of police-reported crashes include airbag deployments.
Tesla’s telematics also do not fully account for the difference in crash report trends with other L2systems. A majority of peer L2 companies queried by ODI during this investigation rely mainly on
traditional reporting systems (where customers file claims after the crash and the company follows
up with traditional information collection and/or vehicle inspection). NHTSA has a wide variety ofways to receive crash reports and ODI did not rely on a simplistic crash rate comparison between
Tesla and its L2 peers based on report counts alone. Rather, ODI also relied on a qualitative reviewof the crash circumstances as reported by the Tesla systems, including such information as how long
Pyrotechnic deployment in this case refers to deployment of passive protection systems including air bags, seatbelt pre-tensioners, and the pedestrian impact mitigation feature of the vehicle hood.
3Tesla’s published Autopilot technology and non-Autopilot technology crash rates are also typically expressed inmiles driven per pyrotechnic deployment.
2the hazard was visible, whether the crash was reasonably avoidable, and vehicle/driver
performance.
ODI uses all sources of crash data, including crash telematics data, when identifying crashes thatwarrant additional follow-up or investigation. ODI’s review uncovered crashes for which Autopilot
was engaged that Tesla was not notified of via telematics. Prior to the recall, Tesla vehicles withAutopilot engaged had a pattern of frontal plane crashes that would have been avoidable byattentive drivers, which appropriately resulted in a safety defect finding.
Peer Comparison
Data gathered from peer IR letters helped ODI document the state of the L2 market in the UnitedStates, as well as each manufacturer’s approach to the development, design choices, deployment,and improvement of its systems. A comparison of Tesla’s design choices to those of L2 peers identified
Tesla as an industry outlier in its approach to L2 technology by mismatching a weak driver engagement
system with Autopilot’s permissive operating capabilities.
Unlike peer L2 systems tested by ODI, Autopilot presented resistance when drivers attempted toprovide manual steering inputs. Attempts by the human driver to adjust steering manually resulted
in Autosteer deactivating. This design can discourage drivers’ involvement in the driving task. Othersystems tested during the PE and EA investigation accommodated drivers’ steering by suspendinglane centering assistance and then reactivating it without additional action by the driver.
Notably, the term “Autopilot” does not imply an L2 assistance feature, but rather elicits the idea ofdrivers not being in control. This terminology may lead drivers to believe that the automation hasgreater capabilities than it does and invite drivers to overly trust the automation. Peer vehicles
generally use more conservative terminology like “assist,” “sense,” or “team” to imply that the driverand automation are intended to work together, with the driver supervising the automation.