The Tempe, Arizona crash and what the contract said

In March 2018, an Uber self-driving Volvo XC90 struck and killed a pedestrian in Tempe, Arizona. A safety driver—the person hired to monitor the vehicle and take control if needed—was behind the wheel when the crash occurred. The safety driver's employment contract with Uber included specific language about when she was required to be attentive, what counted as acceptable monitoring, and what happened if an accident occurred while she was employed.

The contract stated that the safety driver's job was to watch the road and be ready to intervene. However, investigations later revealed that the driver was looking at her phone in the seconds before impact. The National Transportation Safety Board (NTSB) found that the self-driving system itself also failed to detect the pedestrian, but the safety driver's inattention meant there was no human backup when the system missed the hazard.

This case became a turning point in how companies, regulators, and the public understood the role of backup drivers in autonomous vehicle testing. It raised hard questions about what a contract can require, what a person can realistically do, and who is responsible when both the machine and the human fail at the same moment.

Key Takeaways

  • Uber's safety driver contract required the driver to monitor the road and intervene if needed, but did not explicitly ban phone use or define what "attentive monitoring" meant in measurable terms.
  • The NTSB investigation found that the safety driver was looking at her phone approximately one second before the collision, and the self-driving system also failed to detect the pedestrian.
  • Uber settled a wrongful death lawsuit with the victim's family for an undisclosed amount and made changes to how it trains and monitors safety drivers.
  • The accident led to stricter industry standards and regulatory scrutiny around what safety driver contracts must specify about attention, phone use, and intervention protocols.
  • Safety driver roles have since become more tightly defined, with many companies now using cabin cameras, alert systems, and explicit rules about device use during testing.

What the safety driver contract required and did not require

Uber's contract with the safety driver in the Tempe crash did not explicitly prohibit phone use or specify how often the driver needed to look at the road. The contract said the driver should be ready to take control, but it did not define what "ready" meant or how the company would measure it. This vagueness became central to the legal and regulatory response after the crash.

The contract also did not require the use of cabin cameras or other monitoring technology to verify that the driver was actually watching the road. Uber relied on the assumption that a trained professional would stay alert during an eight-hour shift, but provided no technical means to enforce or verify that assumption. The company did conduct some in-vehicle observations and training, but these were not continuous or systematic.

After the crash, Uber and other autonomous vehicle companies began rewriting these contracts to be much more specific. Modern safety driver agreements now typically include explicit bans on phone use, requirements to keep both hands visible, rules about when the driver can look away from the road, and consent to cabin monitoring systems.

How the NTSB investigation assigned responsibility

The NTSB's final report, released in November 2019, found that multiple failures led to the death. The self-driving system did not detect the pedestrian, Elaine Herzberg, who was crossing the street outside a marked crosswalk at night. The system's camera and radar both missed her. However, the report also stated that a human driver paying attention would likely have seen her and braked.

The investigation found that the safety driver was looking at her phone—specifically at the Hulu app—in the 5.2 seconds before the crash. She looked down approximately one second before impact. The NTSB concluded that this inattention was a contributing factor, though not the sole cause. The report emphasized that the self-driving system's failure was the primary cause, but that the safety driver's role was supposed to be a backup to catch exactly this kind of system failure.

The NTSB did not recommend criminal charges against the driver, and Uber did not pursue legal action against her. Instead, the focus shifted to Uber's practices: how it trained drivers, what it required of them, and whether the company had created conditions where a driver could reasonably be expected to stay alert for eight hours with no technical support or monitoring.

What changed in safety driver contracts after Tempe

Within months of the crash, Uber and other companies began implementing stricter safety driver protocols. Uber introduced cabin cameras to monitor driver attention, added explicit rules about phone use and hand placement, and increased the frequency of breaks during test drives. The company also began requiring drivers to acknowledge in writing that they understood their role and the consequences of inattention.

Other autonomous vehicle testing companies—including Waymo, Cruise, and Aurora—adopted similar measures. Industry groups began drafting best practices for safety driver contracts that included specific language about attention requirements, phone policies, and what constitutes acceptable monitoring. Some companies added alert systems that would notify the driver if the vehicle detected a potential hazard, giving the human a chance to intervene.

Regulators also took notice. The National Highway Traffic Safety Administration (NHTSA) began asking companies to detail their safety driver training and monitoring practices as part of the approval process for autonomous vehicle testing. States like California, which oversee autonomous vehicle testing permits, began requiring companies to show that they had systems in place to verify driver attention.

The legal settlement and ongoing liability questions

Uber settled a wrongful death lawsuit with Elaine Herzberg's family in 2018 for an amount the company did not disclose publicly. The settlement included a confidentiality clause, which meant the terms were not made public. This was typical for high-profile cases, but it also meant that the public did not learn the specific amount Uber paid or what conditions, if any, were attached to the settlement.

The settlement did not resolve the larger question of liability in autonomous vehicle accidents. If a self-driving car causes an injury, who is responsible: the company that built the system, the company that deployed it, the safety driver, or some combination? The Tempe case did not go to trial, so there was no court ruling on this question. Instead, the case became a reference point for how companies should structure their safety practices to reduce risk.

Insurance companies and regulators have since begun to address this question more formally. Most autonomous vehicle testing now requires specific insurance coverage that names the testing company, the vehicle manufacturer, and sometimes the safety driver as insured parties. The contracts between companies and safety drivers now often include language that clarifies who is responsible for what, though this remains an evolving area of law.

How safety driver roles are monitored today

Modern autonomous vehicle testing programs use multiple methods to ensure that safety drivers stay attentive. Cabin cameras with AI-powered attention monitoring can detect when a driver is looking away from the road, drowsy, or distracted. Some systems will alert the driver or even trigger a safe stop if attention lapses are detected. Hand-tracking systems can verify that the driver's hands are on or near the steering wheel.

Companies also use shorter shifts—typically four to six hours instead of eight—to reduce fatigue. Breaks are scheduled into the testing protocol, and drivers are rotated to prevent monotony. Some programs pair two safety drivers in the vehicle so that one can monitor the road while the other handles administrative tasks or takes a break.

Training has also become more rigorous. Safety drivers now typically undergo weeks of classroom and in-vehicle training before they are allowed to monitor a test vehicle. They learn to recognize the specific failure modes of the self-driving system they are monitoring, practice intervention scenarios, and are tested regularly on their ability to respond quickly to hazards.

What this case means for people considering autonomous vehicles

The Tempe crash happened during testing, not with a consumer product. Uber's self-driving car program was not available to the public and was not intended to be. However, the case illustrates a real tension in autonomous vehicle development: the technology is not yet reliable enough to drive itself without human oversight, but human oversight is difficult to maintain over long periods.

For consumers, this means that any autonomous vehicle you might use in the near future will likely still have a human driver or operator who can take control. The safety of that system depends partly on the technology itself and partly on how well that human can stay alert and respond. The Tempe case showed that companies need to design their systems and contracts to support human attention, not just assume it will happen.

It also means that liability and insurance for autonomous vehicles remain unsettled questions. If you are injured by an autonomous vehicle, the question of who is responsible—the company, the driver, the manufacturer—may not have a clear answer yet. This is one reason why autonomous vehicle testing remains limited and heavily regulated in most places.

Frequently Asked Questions

Was the safety driver charged with a crime?

No. The NTSB investigation found that the safety driver's inattention was a contributing factor, but the agency did not recommend criminal charges. Uber did not pursue legal action against the driver either. The focus was on Uber's practices and the self-driving system's failure, not on prosecuting the individual driver.

Did Uber's contract with the safety driver protect the company from liability?

Uber settled the wrongful death case, which suggests the contract did not fully shield the company from responsibility. The settlement amount was not disclosed, but the fact that Uber paid indicates the company accepted some liability. After the crash, Uber rewrote its safety driver contracts to be more explicit about driver responsibilities and monitoring.

Could the self-driving system have avoided the crash on its own?

No. The NTSB found that the self-driving system's camera and radar both failed to detect the pedestrian. The system did not brake or attempt to avoid the collision. This is why the safety driver's role was supposed to be critical—to catch exactly this kind of system failure and intervene manually.

Do all autonomous vehicle testing programs use cabin cameras now?

Most do, but practices vary by company and by state. Cabin cameras have become standard in the industry after the Tempe crash, but they are not universally required by regulation. Some companies use them, others use hand-tracking or alert systems. State regulators in California and Arizona now ask companies to describe their monitoring practices as part of the testing permit process.

What happens if a safety driver fails to intervene in a modern test?

Modern systems are designed to detect and respond to driver inattention before a crash occurs. If a cabin camera detects that a driver is distracted, the system may alert the driver, trigger a safe stop, or end the test drive. If an accident does occur, the cabin camera footage provides evidence of what the driver was doing, which affects liability and insurance claims.