Death By Uber 4: The NTSB Report and Conclusion

Marc Green

This final part examines the NTSB report and its conclusions. While I disagree with almost everything in the TPD report, I agree with almost everything in the NTSB report. However, the keyword is "almost." The NTSB largely agrees with my characterization of the mishap as being due to the collision of human nature with circumstances. Given this agreement on analysis of the collision, their conclusions seem nothing short of astonishing. The NTSB report extensively discusses the well-documented fact that humans are innately poor at maintaining vigilance when passively monitoring a highly reliable system and that the UATG has put Ms. Vasquez in precisely this situation, yet the NTSB concluded that she was the sole probable cause of Ms. Herzberg's death.

I started out to write a relatively straightforward review of the NTSB (and TPD) report's conclusions. However, my attempt to understand the NTSB's reasoning soon led me to issues that extend far beyond this single mishap. "What is the meanings of terms such as 'cause,' 'blame,' and 'victim' and how are they influence by ideology/worldview?" "How do these definitions affect perception of events?" "How do humans reason about causation?" And "What psychological factors influence that reasoning?" These are all topic that I have previous examined in Green (2024)

Below, I explain that the NTSB report (and other transportation safety organizations) apparently use the words "probable cause" and "contributing factor" as terms of art in a sense clouds the real explanation for the collision and, perhaps worst of all, implies blame. However, this cannot be the whole story because the NTSB report applies its apparent criterion for separating "probable cause" from "contributing factor" inconsistently. Some of the inconsistency is likely rooted in ideology/worldview and some in well-documented human cognitive biases when reasoning about causation.

The NTSB Conclusions

The previous part discussed the evidence that supervisors are different than drivers. Supervisors are performing a much different task, the passive supervision of a highly reliable process. Authorities, including the NTSB, who study transportation safety universally acknowledge that humans are very poor at such monitoring tasks due to the normal and inevitable automation complacency. Research evidence shows that even relatively short sessions monitoring highly automated vehicles result in decreased vigilance, longer response time, and increased likelihood of collision.

Given the NTSB's agreement with these premises, its conclusions are highly surprising. They divided the related events to the collision into "contributing factors" and "probable cause." The contributing factors include:

Uber Advanced Technologies Group's (1) inadequate safety risk assessment procedures, (2) ineffective oversight of vehicle operators, and (3) lack of adequate mechanisms for addressing operators' automation complacency-all a consequence of its inadequate safety culture. Further factors contributing to the crash were (1) the impaired pedestrian's crossing of N. Mill Avenue outside a crosswalk, and (2) the Arizona Department of Transportation's insufficient oversight of automated vehicle testing.

When it comes to attributing the "probable cause," however, the report points the finger at Ms. Vasquez and ignores the contributing factors as well as its own discussion of automation complacency. This raises the question as to why Ms. Vasquez was the probable cause as opposed to the UATG, the Arizona Department of Transportation, and the illegally crossing impaired pedestrian, who were merely contributing factors? Why was the issue of automation complacency not extended to its logical endpoint: Ms. Vasquez was acting under the influence of automation complacency created by her circumstances rather than by some internal flaw? Why not attribute causation to those who created the circumstances, i.e., the state of Arizona, UATG, and Ms. Herzberg, all of whom were in much better positions to have prevented the fatality?

To answer these questions, the ensuing discussion first evaluates the roles of the "contributing factors" and the "probable cause" in the collision. It then examines the reasons that lead the NTSB to incorrect identify the real causal factors.

Evaluating the "Contributing Factors"

One way to examine collision causation is to determine who had the best opportunity to avoid the negative outcome. The basic metrics for determining opportunity are time and knowledge. By these criteria, both the UATG and the pedestrian had a far better opportunity to prevent the collision than Ms. Vasquez. While the NTSB cites the State of Arizona's oversight of vehicle testing as a contributing factor, I won't comment on this since I don't know the details of their agreement with Uber.

1. The UATG

Let's look at the big picture. On the one hand, there is the UATG who failed to properly determine risk and to design the test protocol to minimize automation complacency. Although they had almost unlimited time and huge resources to design a system that would have prevented the collision, they failed to institute countermeasures. In fact, they decreased safety by removing the "co-pilot" in the vehicle and then ignored warning signs that this led to vehicle damage.

The NTSB criticized the UATG on several grounds but completely omitted other obvious UATG issues from the contributing factors. First, it failed to mention the ADS. The UBER Volvo's ADS exhibited three faults. It failed to identify Ms. Herzberg as a pedestrian for over four seconds. The software failed to recognize that it was outside of its ODD and didn't issue a TOR with sufficient time budget to avoid the collision. Even when the ADS finally made the identification at a TTC=1.2 seconds, it still waited another second before issuing a TOR.

Second, The NTSB overlooked another, less obvious, but highly problematic aspect of the UATG procedure-the choice of test vehicle. It is unclear the UATG selected the Volvo but regardless of the reason, choosing an SUV as the test vehicle significantly increased the risk of a pedestrian (and driver) fatality. Studies typically find that a vehicle-pedestrian crash is more likely to result in a fatality when the vehicle is a "light truck" (LTV), the category that includes SUVs, than when the vehicle is a passenger car. The danger lies in their increased mass and flat front which contacts the pedestrian higher up on the body and also causes the pedestrian to bounce off faster causing more violent contact with the ground (Simms & Wood, 2006). Estimates vary, with the increased risk ranging from 50 percent (Desapriya, Subzwari, Sasges, Basic, Alidina, Turcotte, & Pike, 2010) to 340 percent (Roudsari, Mock, Kaufman, Grossman, Henary, & Crandall, 2004) when adjusted for impact speed. SUVs are especially deadly for older pedestrians (Lefler & Gabler, 2004), likely due to the frailty factor.

SUVs are also unhealthy for drivers of sedans. The SUV's increased mass and rigid frame leads to more fatal collisions. When crashing into the passenger side of a car, SUVs double the likelihood of a fatality compared to when the striking vehicle is a sedan (Ross, Patel, & Wenzel, 2006).

It is unclear whether Ms. Herzberg would have died if the test vehicle had been a sedan, but there is no doubt that the UATG chose a vehicle known to be the most lethal in a collision to test experimental software ADS on public roads. It would have been far safer to use a smaller sedan.

In sum, the UATG should have been aware that automated vehicles lower supervisor performance. They failed to institute countermeasures even though that had the knowledge and time to do so. They even made matters worse by removing the second person from the vehicle. As Part 1 noted, one of their engineers expressed concern only a few days prior to the collision, yet they took no steps. Lastly, they used a test vehicle with a well-documented history of lethality.

2. The Pedestrian

It is also clear the Ms. Herzberg's behavior was a prime cause of the collision. She clearly had more time and better opportunity to prevent the outcome than Ms. Vasquez. Consider all the advantages that Ms. Herzberg had in the situation.

• Visibility: Vehicles are far more visible to pedestrians than pedestrians are to supervisors, especially at night. Ms. Herzberg made matters worse by walking a bicycle that was dark and failed to have the required lights or reflectors;


• Predictability: Cars travel highly constrained paths. Ms. Herzberg knew where to look for possible hazards - down the road. Mill Avenue was one-way at that point so she didn't even have to check both directions. In contrast, pedestrians can appear from almost anywhere at any time. It is also not predicable that a pedestrian will appear far from an intersection and walk directly into the vehicle's path. Impairment from drugs may have played a role in Ms. Herzberg's decision making;


• Time. Ms. Herzberg had virtually unlimited time to cross the road since she could have waited as long as necessary for a safe gap. Once the pedestrian starts crossing, Ms. Vasquez had at most a few seconds to avoid even under optimal conditions; and


• Reaction and maneuverability: Pedestrians can react, stop and turn faster and in a shorter distance than a moving vehicle.

Of course, saying that Ms. Herzberg's behavior was a cause, and probably the major cause, of her death will likely result in horrified cries that I'm blaming the victim. This complaint raises several issues that extend far beyond the scope of the present discussion. I'll just say for now that the issues lie in the implied definitions of words such as "blame," "cause," and "victim." "Blame" is not necessarily synonymous with the concept of "cause." Blame is a specific type of cause, one which is used in legal proceedings and everyday language to suggest responsibility. The TPD's goal was to determine blame. However, it is not a concept used in engineering and science where cause is defined through the operation of the mechanism. In theory, the NTSB is supposed to determine cause and not blame, but as I explain below, this is exactly what they do by implication.

Second, what does the term "victim" mean? The Merriam Webster dictionary definition says "one that is acted on and usually adversely affected by a force or agent." There is no notion of blame. Other definitions follow Collins in adding a phrase such as "because of the actions of someone or something else." Most use of the term "victim" follows Collins. If someone suffer and adverse effect, it must be due to someone or something else who is to blame (unless it is "an act of god"). By this definition then, it is impossible to be a victim due to one's own actions. The term victim then implies helplessness-the person could not have avoided her fate. That is certainly not true here and in most pedestrian collisions. As I've pointed out, research clearly shows that the prime cause of pedestrian collisions is pedestrian behavior. Ms. Herzberg could easily have avoided the collision by looking for traffic coming from the only possible direction and waiting to cross.

The view that pedestrians are unfortunate innocents is even enshrined in law as the "reverse onus." In western jurisprudence, people are supposed to be innocent until proven guilty. In theory then a pedestrian would have to prove that the driver caused the collision. The reverse onus flips the burden of proof so that the driver has to prove that he wasn't at fault. This usually means that drivers are forced to explain why they failed to compensate for even the most extremely egregious pedestrian behavior.

The next question is why this definition of victimhood as innocent is so pervasive. The answer, at least in part, is ideology, which is an increasing influence in the law, science and many other parts of society. Ideology is an important factor in defining terms such as blame and victim because they are not inherent in events but are rather socially constructed and the result of the language used to describe the event (Dekker 2009). The choice of the terms such as victim and "vulnerable road user," rather than the more neutral "nonoccupants," is a perfect example. Slovic (1999) underscored the importance of worldview/ideology when noting that risk and by inference blame:

[i]s socially constructed. Risk assessment is inherently subjective and represents a blending of science and judgment with important psychological, social, cultural, and political factors.Whoever controls the definition of risk controls the rational solution to the problem at hand. If risk is defined one way, then one option will rise to the top as the most cost-effective or the safest or the best. If it is defined another way...one will likely get a different ordering of action solutions. Defining risk is thus an exercise in power.

In short, the NTSB downplayed Ms. Herzberg's behavior even, as we shall see shortly, she fit their definition of "probable cause." Those using terms like "victim" are attempting to further an ideological agenda based on "White Hat Bias," "paradise past" thinking, and similar beliefs. One consequence is the belief, as Frankenstein would have said, that "Pedestrians good, cars bad." See this page and Green (2024) for more discussion.

Evaluating the "Probable Cause"

NTSB's reason for naming Ms. Vasquez as the probable cause seems to lie in their statement that:

Had the vehicle operator been attentive, she would likely have had sufficient time to detect and react to the crossing pedestrian to avoid the crash or mitigate the impact.

This statement asserts that had she been looking at the road, she would have avoided the crash. In making this assertion, the NTSB seemed to accept most of the TPD report and did not highlight the flaws (except for sight distance) exposed in section 2. The NTSB further seemed to ignore all of their own evidence that automation complacency degrades performance.

There is no doubt that Ms. Vasquez was apparently looking away from the road in the seconds leading up to the collision. The TPD and NTSB concluded that she was watching TV on Hula while Ms. Vasquez said that she was interacting with the UATG base on the Slack app as part of her job. At first glance, the issue of whether or not she was performing a job-related task might seem an important question in determining causation (and blame). Many will seize upon this as the key issue in explaining the crash. The assumption is that she would have avoided the collision had she been attentive to the road. But the discussion of sections 2 and 3 cast grave doubt on this conclusion.

In fact, asking whether Ms. Vasquez could have avoided the crash if looking at the road and/or whether Ms. Vasquez was watching Hulu or performing a work-related task is asking the wrong questions. The real question is: What made her feel comfortable looking away from the road for an extended period to perform any task? The NTSB report itself answered the question:

Why would someone do this? The report shows she had made this exact same trip 73¹ times successfully. Automation complacency!

The "!" at the end of the sentence doubtless highlights the strength of the NTSB's belief that the conclusion is both correct and obvious. Ms. Vasquez looked away from the road because experience had taught her that nothing much would happen since the vehicle was controlling itself. As the NTSB (and Cummings) quotes in section 2 show, authorities are well aware that monitoring the ADS is the type of task that humans are poor at performing.

In addition, Ms. Vasquez had two expectations violated. First, the pedestrian appeared in a very unlikely location and then performed the inexplicable action of walking directly into the vehicle's path. Second, there was no timely takeover request (TOR). A fundamental property of level 3 automation is that when encountering a problem, the ADS would issue a TOR with a sufficient "time budget" allowing the supervisor to take control and to perform the avoidance maneuver. In the crash, the ADS did not issue a TOR until only 0.2 second prior to impact, far too late to allow avoidance. The ADS failed to notify her five seconds before impact when it could not identify the object ahead or even 1.2 seconds before collision when it actually identified the pedestrian.

Ms. Vasquez's behavior was an inevitable result of her circumstances and these expectation violations. Research (e.g., Large, Burnett, Morris, Muthumani, & Matthias, 2017) shows that supervisors begin to spend increasing amounts of time on NDRT's as trust in the ADS reliability grows and that they can become deeply immersed. The idea that any single human could continuously monitor the same monotonous roadway with focused attention for 73 circuits is nonsense. No one can do it. The UATG and authorities can wish that people are attentive 100 percent of the time, but as I have explained Green (2024), it is just wishful thinking. Norman (1988) summarized the reality of designing for humans by saying:

[t]echnologies are designed to be used by people, ordinary people, people who grow fatigued, whose attention wanders, whose mind is preoccupied. It does no good to legislate against such properties of human nature. It does no good to complain that if only workers would keep their minds focused on the task, they would not be getting injured. Everyone's mind wanders, everyone daydreams, gets fatigued, workers and management alike. Proper design takes this into account.

Reason (2000) puts this more pithily:

[w]e cannot change the human condition, but we can change the conditions under which humans work.

The NTSB would probably agree with these quotes. They acknowledged that the reason for Ms. Vasquez's comfort in looking away from the road was that the 72 circuits created massive automation complacency. They further agree with Cummings that humans by their nature are not very good at such passive monitoring tasks. Moreover, the report explained that the resulting performance impairment is normal in humans and is highly predictable. Yes, Ms. Vasquez was not attentive to the road, but the report also presents some of the vast scientific evidence that it would be normal and expected behavior in her circumstances. So how is Ms. Vasquez the probable cause while the UATG and Ms. Herzberg are only contributing factors?

Why Did NTSB Conclude that Ms. Vasquez was the "Probable Cause?"

After all the discussion of automation complacency and its effects on behavior, why then was Ms. Vasquez singled out at the probable cause while the behavior of the UATG, Ms. Herzberg, and the State of Arizona were merely contributing factors. The NTSB provides no formal definition of "probable cause" in their report. However, it likely follows a long tradition in the safety literature where "probable cause" could be viewed as a "term of art, a word or phrase that has a specialized meaning is a specific field of work.

The definition of "cause" has been the topic of much philosophical analysis and debate. However, if the NTSB is using "probable cause" as a term of art, it is likely following a tradition in the transportation safety literature that was possibly first stated by Jerome Lederer, the head of the Civil Aviation Authority (CAA) Safety Board to explain why crashes occurred. He wrote that "The why is the proximate cause as the probable cause and sets up the underlying or more remote causes as contributing factors." He does not define "proximate" but The Merriam Webster Dictionary defines "proximate" as "immediately preceding or following (as in a chain of events, causes, or effects)." Similarly, the legal world uses the "term of art" definition that "probable cause" is the "proximate cause," which is "that which in natural and continuous sequence, unbroken by an efficient intervening variable produces the injury" (Black's Law Dictionary, 1990)². However, in common speech, proximate suggests very close proximity. In sum, the probable/proximate cause is an event that happens just prior to the mishap while a contributing factor is an event that happens earlier at a different time.

While the NTSB is not explicit in this reasoning, other transportation safety agencies are. The National Highway Traffic Safety Administration (NHTSA), seems to apply the same criterion for causation using a plainer, more direct language. Their 2015 publication Critical Reasons for Crashes Investigated in the National Motor Vehicle Crash Causation Survey concluded that "human error" "was involved" in 94 percent of all crashes. This number is often quoted to show the fallibility of human drivers and to prove that self-driving vehicles would greatly reduce road fatalities. However, few read the NHTSA's fine print that explains what the number means. The NHTSA says that the number only indicates cases where the driver had the last chance in the event sequence to avoid the crash. The NHTSA then states that the number "is not intended to be interpreted as the cause of the crash nor as the assignment of fault to the driver, vehicle or environment." Yet, the NHTSA contradicts itself by doing exactly that - implying that 94 percent of crashes were due to human error. Doesn't labeling the driver actions as "error" imply that she did something wrong? Despite their disclaimer, moreover, they strongly imply that the event closest in time to the event is the cause and that event is driver behavior. Other sources (e.g., Treat, Tumbas, McDonald, Shinar, Hume, Mayer, Stansifer, & Castellan, 1979) claiming that human error causes over 90 percent of all collision have used the same "logic" (Green, 2024). There is more discussion on this here.

In sum, it appears that safety organizations attribute causation to the "sharp end" of the system, the people who interact with the hazardous process in their capacities as pilots, physicians, drivers or automation supervisors. They generally are the last element that could theoretically have changed the outcome. In contrast, the UATG (and the Arizona State Transportation Department) was the "blunt end" of the system, far from the scene of the events. Those at the blunt end of the system affect safety by creating the conditions and constraints acting on the humans at the sharp end. By this thinking, Ms. Herzberg should have been a probable cause. The reason that NTSB let her (relatively) skate is taken up later.

Studies of past mishaps show that organizations such as the NHTSA and the NTSB have a strong bias toward simply blaming the human at the sharp end. Holden (2009) examined 27 mishaps investigated by the NTSB. The cause was a human in 26 of them. In short, organizations blame the sharp-end human operator if it were theoretically possible to avoid the mishap. Said another way, they do not differentiate between what is humanly possible and what is humanly reasonable or likely. There are several reasons for this. Many involve inherent human cognitive biases in reasoning about causal attribution.

Cognitive Factors in Reasoning about Causation

Spatiotemporality. Reasoning about causation requires a conceptual model. Perhaps the most basic and intuitive is the Chain-of-Events (CoE) model. It suggests that mishaps are the result of a linked sequence of events that evolve over time. The causal chain would look something like this:

Collision←Driver behavior←Condition A←Condition B←...

As I have explained on this page and Green (2024), such chains are alternating sequences of cause and symptom. The analysis picks a starting event which is a symptom produced by a higher level cause. Reasoning stops when reaching a symptom that does not require explanation. In this case, it is Ms. Vasquez's low vigilance, which then becomes a symptom "caused" by the next higher link, automation complacency. This is a symptom for the cause of UATG risk mitigation failure. Finally, the UATG risk mitigation failure is a symptom whose cause is the Arizona Department of Transportation's insufficient oversight of automated vehicle testing. Now here's the rub: the ultimate cause is not an objective fact because it depends on the goal of the investigator/organization. Just to take a hypothetical example, suppose an unnamed state wanted to develop a large self-driving vehicle industry and allowed an unnamed corporation to test their vehicles with minimal supervision on public roads. If a fatality occurs, the incentive structure would certainly favor blaming the bad apple "driver" and not going further up the chain to the corporation, which could then evade responsibility.

Given the arbitrariness of assigning causation, the question still remains as to why the NTSB stopped at Ms. Vasquez instead of following the chain up to the UATG or the state of Arizona. The apparent answer is that she was the proximate cause in the sense that her actions were the closest in time to the collision. However, proximate cause doesn't have to be the closest in time. I cited the legal definition of proximate above, but the same source also says the proximate cause is "That which is next in causation to the effect, not necessarily in time or space but in causal relation (Black's Law Dictionary, 1990).

Despite this, the NTSB arbitrarily selected Ms. Vasquez although she was simply responding to her circumstances. Michotte (1963) called this "temporality," the time proximity of two events compels humans to perceive the first as the cause of the second. The causal strength is further magnified by spatial proximity of the two objects, so the cognitive bias should properly be termed "spatiotemporality." This perception is so powerful that it occurs even when the viewer is cognitively aware that events A and B have no connection.

In sum, the NTSB apparently reasoned using spatiotemporality that Ms. Vasquez's was the probable, proximate cause because her behavior came just before the collision. By contrast, the UATG was merely a contributing factor because they were remote from the collision scene in space & time.

If this temporal proximity is the criterion for attributing causation, however, the NTSB was inconsistent. It could easily have constructed a chain that makes Ms. Herzberg's behavior the link that immediately preceded the collision, making her the (or at least a) probable cause. Of course, this would be blaming the victim. Moreover, the NTSB also didn't mention the ADS failure which also occurred just before the collision, even as a contributing factor. There must be more than just spatiotemporality at work for the NTSB to reach its conclusions.

2. Counterfactual thinking/hindsight bias. Spatiotemporality is supported by another common cognitive process, counterfactual thinking. Human behavior is generally the most malleable component of the system. It is well-known in human factors that human nature is the least malleable part of a man-machine system, so the best way to have avoid a mishap was to have changed the circumstances (e.g., see the safety hierarchy). It is easy to say that the collision would have been avoided if the person had done otherwise. This leads inevitably to counterfactual thinking, hindsight and blame (Roese & Olson, 2006).

The problem with this thinking is that "behavior is not random but lawful, i.e., there are empirical regularities, factors that influence behavior and are external to individuals" (Woods & Cook, 1999). If behavior were truly random, it would be impossible to design anything for human use-human factors would not exist. Instead, human behavior is constrained by expectations and circumstances. The NTSB certainly accepts that behavior is lawful by frequently acknowledging that passive monitoring of a high-reliability system produces automation complacency resulting in lower vigilance and slower response. It is difficult for people to accept that we are not the complete masters of our fates. In hindsight, it was theoretically possible for Ms. Vasquez to have looked at the road, but this ignores the influence of the environmental factors on her decision making and behavior.

The NTSB statement above that an attentive driver would have avoided the collision both misleading and misguided. It is misleading because it is probably wrong and misguided because it creates a counterfactual that implicitly blames Ms. Vasquez for the collision. Asking why an actor did not behave otherwise is again asking the wrong question as it induces counterfactual thinking and hindsight bias. Instead Dekker (2002b) suggests that the proper question is why a person's action seemed reasonable to him just before the collision. The NTSB answered this question themselves: 73 (really 72) successful circuits and the failure of the UATG to recognize the risk and to forestall problems by instituting countermeasures.

3. Mentalistic "folk psychology" explanation. Folk psychology is the explaining and predicting the behavior of others by assigning them unobservable mental states. Dekker (2004) notes that folk psychology models are characterized by 1) substituting one label for another and 2) immunity from falsification.

These characteristics are obvious in the NTSB's attempt to blame Ms. Vasquez for the collision. First, they simply substitute one label for another. Recall that the NTSB defines automation complacency as "self-satisfaction that can result in non-vigilance based on an unjustified assumption of satisfactory system state." But this definition explains nothing. It simply trades one unobservable, undefined mental state (automation complacency) for two others (self-satisfaction and unjustified assumption). There is no advance in understanding of what caused the collision. This definition seems to put the locus of control in the drivers head and blames her for "self-satisfaction" and "unjustified assumption." Consider the following chain:

Collision←Vasquez automation complacency←monitoring reliable system for 73 circuits

The collision and the monitoring of 73 circuits are observable events but the automation complacency is invisible. It is what psychologists call a mediating variable. If it were removed from the chain, no explanatory power would be lost. The NTSB moved the actual cause of the vigilance reduction from the real-world into some hypothetical mental state so that causation could be applied to Ms. Vasquez, the sharp end of the system, rather than the blunt end of UATG who created the empirical conditions that 1) led to 72 routine circuits, 2) failed to mitigate against the inevitable vigilance decrement and 3) deployed the faulty ADS software..

Second, causes such as "automation complacency" cannot be falsified. The "logic" is:

Q: Why was there a collision?
A. Because Ms. Vasquez was self-satisfied and made an unjustified assumption.
Q: How do we know that Ms. Vasquez was self-satisfied and made an unjustified assumption?
Q. Because there was a collision.

One is left wondering how many circuits would the NTSB have required Ms. Vasquez to have negotiated before the NTSB would say that her assumption became "justified!" The answer is that there is no answer because the definition is based on circular reasoning. As I explain when discussing "inattention" such folk psychology explanation merely attaches a label to what is already known. However, such labels can be useful as short-hand descriptions of a situation but they are not explanations. When I use the term, it is merely short hand for saying lower vigilance and slower response produced by the passive monitoring of the highly reliable automation. Unfortunately, the NTSB and many other accident investigators (and most laypeople) mistakenly believe that the label provides some deeper insight into causation. As Dekker (2004) said:

"It has become increasingly common in, for example, accident analyses to mistake the labels themselves for deeper insight (Woods 1993), but although it is tempting to do so it is definitely wrong.

Lastly, in using a folk psychology explanation, the NTSB is implicitly blaming Ms. Vasquez for the collision. First, the causal locus is a flaw within Ms. Vasquez, her internal mental state. Second, she is the sole cause. The rest are merely contributing factors. Given these conclusions, any blame attribution must fall on Ms. Vasquez. This conclusion is supported by several other cognitive biases.

4. Resulting. Behavior is often judged solely by its outcome, a process that is sometimes termed "resulting" (e.g., Duke, 2018). Resulting creates the inference that a bad outcome must be due to bad behavior. There is no allowance for the fact that the real-world is probabilistic so that it is possible to make a correct decision that produces a bad outcome or vice versa. (Or it is possible that a decision had no effect on the outcome.) Resulting makes no allowance for context.

Evaluating behavior solely on outcome is a flawed way to perform analysis. Duke (2018) further explains that resulting causes people to learn the wrong lessons by confusing the quality of decision making with the quality of outcomes. Unfortunately most people are resulters who reason backwards from effect to behavior. If there is pedestrian collision, then the bad outcome must be due the driver/supervisor's bad decision. The driver/supervisor is to blame.

5. Fundamental attribution error. Now we come to one of the biggest and most powerful human cognitive causal attribution bias, the "Fundamental attribution error" (FAE) (Ross, 1997). When people judge the cause of an event involving a human actor, they can assign it either to 1) dispositional factors inside the actor or to 2) situational factors outside the actor's control. People in Western culture are heavily biased toward blaming individual disposition even though most individuals act the same way in the same situation. The fundamental attribution error is very powerful and highly resistant even to strong evidence that environmental constraints were the primary cause. It is also a prime promoter of hindsight bias.

The NTSB conclusions are good examples of the FAE at work. It notes several failures that contributed to the crash. These were all situational factors that were outside of Ms. Vasquez's control. Ms. Vasquez may have suffered from "automation complacency" but it was not due to any inadequacy or intent on her part but due to the situation created by the UATG test protocol. However, the NTSB report chose to cite Ms. Vasquez as the cause rather than all the situational factors that led up to the collision.

6. Res Ipsa Loquitur. In law, the doctrine of Res Ipsa Loquitur, meaning that the thing speaks for itself, allows the assignment of blame without the need to reference any other factor. The video showing Ms. Vasquez looking away from the road could not have been better designed create Res Ipsa Loquitur, the impression that she was solely to blame for the collision. It is little wonder that when it somehow found its way to social media it resulted in such an outburst of condemnation and vitriol. Those few seconds did not show the previous 72 uneventful circuits, the UATG's failure to take countermeasures against the inevitable vigilance decrement, the warnings and red flags that should have alerted the UATG that there was a problem having only one person in the vehicle, the failure of the ADS to issue a timely TOR, and possibly the state of Arizona's lack of oversight on the tests. I cannot say with certainty that the NTSB was influenced by Res Ipsa Loquitur but neither can it be ruled out.

In summary, the NTSB apparently followed the transportation safety tradition of assigning causation based on spatiotemporality: the probable cause was the proximate cause, which was the closest in time. At the same time, however, it rendered Ms. Herzberg's behavior merely a contributing factor and did not even mention the ADS software that failed just before collision. So how did the NTSB decide that Ms. Vasquez was the sole cause? It certainly was not simply using "probable cause" as a term of art based on the criteria suggested by Lederer. In fact, it is uncertain what the reasoning was, but was likely influenced by the cognitive biases described above. Perhaps the worst aspect of the NTSB report is that in naming Ms. Vasquez as the sole cause the majority of readers, especially those ignorant of accident investigation reporting, will doubt draw the TLDR³ conclusion that Ms. Vasquez was to blame for Ms. Herzberg's death. A more accurate TLDR can be summarized by what an Uber whistleblower who was concerned about their safety practices said in his interview with a TPD detective: the UATG set Ms. Vasquez up for failure.

The New View vs. the Old View of Human Error

Perhaps the most general reason for the NTSB's conclusion about causation is that stems from the "old view" of human error. This is the traditional view that originated with Heinrich's (1927) analysis of 75,000 industrial accidents and concluded that human "unsafe acts" caused 88 percent of the mishaps. This old view focuses on the unsafe human acts, implicitly accepting that the system is safe until a human does something wrong. In contrast, the "new view" (Dekker, 2002) says that human error is a consequence of system design. The NTSB, although criticizing the UATG, still concluded that Ms. Vasquez's unsafe act caused the Ms. Herzberg's death. This is most obvious in their explaining the crash by appealing to a folk psychology mentalistic flaw.

The new view of human was developed primarily to handle accidents in complex systems such as nuclear power plants and it has received much less attention in the road transportation safety world. As car technology increasing integrates humans into the system, there is ever-growing need to discard the old view and adopt the new. The analysis of this accident is certainly best understood by the new view: Ms. Vasquez's "error" was a consequence of the way the UATG designed the system and was not the cause.

Conclusions

After reviewing the facts and the TPD and NTSB reports I have drawn the following conclusions beyond a reasonable degree of scientific certainty⁴:

1. About the reports:

• The TPD used incorrect methods to measure sight distance and to determine PRT;


• The TPD performed misguided cookbook analyses that reflected little or no understanding of the methods that they employed. They also failed to understand the source upon which much of their methodology was based;


• The TPD stated that the collision was avoidable. They erred if they used the term "avoidable" to mean "likely avoidable;"


• The NTSB erred in apparently accepting the TPD report's conclusion that an "attentive" "driver" would have avoided the collision;


• The NTSB correctly emphasized the role of "automation complacency in the collision and explained that it was an innate human response to situations that required extensive passive monitoring of highly reliable automation. It also correctly noted faults in the UATG handling of risk and safety⁵;


• The NTSB conclusion contradicted their collision analysis which explained that 1) the monitoring of a highly reliable automation results in decreased alertness, vigilance and slower response and 2) this is an inherent human response to the situation that the UATG placed Ms. Vasquez in. The situation was made worse by the UATG removing the co-pilots from their vehicles and both failing to create counter measures and ignoring warnings signs;


• The NTSB apparently named Ms. Vasquez the "probable cause" and the UATG and Arizona DOT as contributing factors using a term of art which made the proximate cause be the probable cause. However, the NTSB applied this criterion of proximity inconsistently since it noted that Ms. Herzberg was merely a contributing factor and did not mention the ADS failure at all;


• The NTSB's decision to cite Ms. Vasquez as the probable cause was likely influenced by a worldview and ideology that employs particular definitions of words such as "victim" as well as several common cognitive biases including, spatiotemporality, counterfactual thinking/hindsight bias, resulting, Res Ipsa Loquitur, and fundamental attribution error.


• The NTSB failed to cite the UATG for using an SUV as the test vehicle despite the increased risk it posed to pedestrians and occupants of other vehicles; and


• The not explicitly stated, the NTSB's decision to 1) name Ms. Vasquez as the sole cause and 2) engage in counterfactual thinking and hindsight bias created the strong impression that Ms. Vasquez was the blame for Ms. Herzberg's death.

2. About the collision:

• The performance losses created by the passive monitoring of a highly reliable self-driving vehicle are similar to the losses exhibited by "drivers" impaired by other causes. The difference is that "automation complacency" is not due to "driver" intent but rather the natural human response to the task demands;


• Ms. Vasquez looking away from the road was due to her long experience of uneventful supervision which created low risk;


• Ms. Vasquez did not exhibit "automation complacency" through any intent. Instead, it was the natural human response to the situation that the UATG had created. In contrast, the UATG actions, removing the co-pilot, failing to review supervisor videos, ignoring warnings, and introducing no countermeasures, were intentional acts. In short, the UATG set Ms. Vasquez up to fail;


• Ms. Herzberg's walking directly into the path of a high speed vehicle violated strong driver/supervisor expectation;


• The ADS failure violated expectation. It both failed to identify Ms. Herzberg for over four seconds and then delayed another second before notifying Ms. Vasquez to takeover control with only a TTC of 0.2 second and no possibility of avoidance;


• Judging by who had the most time, knowledge, and resources to have prevented the collision, the major causes of the collision were the UATG's failure to mitigate against "automation complacency" and Ms. Herzberg's walking directly into the path of the vehicle while wearing dark clothes and pushing a dark bicycle;


• Many or most normal drivers of conventional vehicles would not have avoided the collision with Ms. Herzberg;


• Ms. Vasquez's looking away from the road and the task she was performing are irrelevant because very few supervisors of highly reliable self-driving vehicles, even if looking down the road, would have avoided the collision with Ms. Herzberg. This is due to the low lighting, dark clothing and dark bicycle, the geometry of a laterally approaching pedestrian and the violated expectation, and performance losses (low arousal, decreased vigilance and longer response time) created by the "automation complacency;" and


• In sum, Ms. Vasquez's looking away from the road had no effect on the outcome.

3. General Observations:

• Research studies demonstrate that automation produces "driver" impairment. Given that current studies 1) often use only level 2 automation, 2) driving sessions of very limited duration and 3) subjects who are on high alert because they know that they are in research studies, real-world impairments with level 3 self-driving vehicles and hours/days of travel are likely to be massive;


• Given the massive amounts of "automation company" that they generate, it is unrealistic to expect "drivers" to takeover control in emergency situations where the ADS fails;


• Given that research has suggested that "drivers" require time budgets as high as seven seconds, "drivers" will even have difficultly handling TORs with short time budgets;


• When such events occur, blaming the "driver" is an exercise in scapegoating. The effects of automation are an inherent part of our human nature and not due to any mental defect of the "driver;"


• The continued appearance of cognitive biases such as counterfactual thinking and folk psychology mentalistic explanations in accident investigations conducted by government agencies, who should know better, is not conducive to promoting public safety;


• Criminializing human "error," especially when it is due to foreseeable circumstances and/or design created by organization dictate, is not conducive to promoting public safety;


• When an investigation involves parties that have vested agenda which may be affected by the outcome, scapegoating the "driver" as a "bad apple" is especially likely and is not conducive to promoting public safety; and


• As car technology increases, accident investigation should discard the "old view" of human errror for the "new view" which Views human error as a consequence rather than a cause.

Endnotes

¹Actually, she was on her 73rd lap so she had only made 72 successful runs. The NTSB has a few other minor errors and inconsistencies.

²I am not a lawyer. Although my experience as an expert witness has exposed me to some aspects of the legal system and its reasoning processes, anything I say about the law should be taken as an educated lay understanding.

³TLDR is a common acronym for "too long, didn't read." It is take home message remembered by people who want the bottom line conclusions but don't want to read the entire document.

⁴For those unfamiliar with the law, experts are not allowed to testify about mere possibilities. They must state their conclusions as being "beyond a reasonable degree of scientific/human factors/professional, etc. certainty" which means that the conclusion is more probably than not true. Courts do not require experts to have 100 percent certainty. The world is too messy a place to require absolute certainty.

⁵Uber had a history of noncompliance and ignoring safety measures. See, for example, Self-driving cars: Uber's open defiance of California shines light on brazen tactics in the Guardian.

---

A division of 2057949 Ontario, Inc.
Copyright © 2024 Marc Green, Ph. D.
Home Page
Contact Us