Lessons from Autonomous Vehicles
| Reader’s Guide This is not a technical survey of autonomous driving, nor an attempt to decide whether Waymo or Tesla is more advanced. Autonomous vehicles are used here to examine a more general problem: when the external world is highly uncertain, when even the probability of error cannot always be estimated reliably, and when a system must nevertheless produce a determinate action immediately, what makes that action trustworthy? Using Waymo as the principal case, with Tesla, regulation, and real-world incidents as counterpoints, the article examines the arrow from uncertain input to determinate action. The central question is not which company is ahead. It is whether, once factual verification and probabilistic verification are insufficient to justify action, the decision-making regime that produces action can itself be inspected, constrained, overturned, and re-authorized. Autonomous driving pushes this problem to an extreme. The next second on a road does not come with a prewritten answer, but the vehicle cannot refuse to decide. At a particular moment it must brake or not brake, continue or stop, retain authority or degrade it. The world remains uncertain; the machine must still act. The difficult question is therefore not whether a machine can predict the future perfectly, but why humans should permit it to take determinate action in a world that cannot be fully predicted. |
1. What Waymo First Solves: Under What Conditions Is the System Entitled to Act?
Google launched its self-driving project in 2009 and established Waymo as an Alphabet company in 2016. Waymo One commercial ride-hailing began in 2018, and in 2020 Waymo opened paid service to the public without an in-vehicle safety driver.[1] After more than a decade of iteration, Waymo has accumulated large-scale driverless road experience.
Mileage alone, however, misses the more important point. Waymo has not tried to prove an impossible proposition: that its vehicles will never crash. Instead, it has built a different safety logic. It first limits the conditions under which the system is qualified to operate; it then uses testing, simulation, fault analysis, road data, and safety argumentation to assess whether unreasonable residual risk is absent within those conditions; deployment is bounded; and real-world operation continues to test the prior judgment.
The basic concept is the Operational Design Domain (ODD).[2] An automated driving system does not claim to handle every road, weather condition, traffic pattern, or circumstance in the real world. It first specifies the geographic areas, road types, speed ranges, weather conditions, and other circumstances in which it is designed to operate.
This apparently modest step is fundamental. An ODD does not eliminate uncertainty. It acknowledges that the system’s knowledge and capability have boundaries. A mature safety system begins not by expanding its claims of competence, but by specifying the conditions under which it is entitled to act.
2. What Uncertainty Really Changes Is How Much Authority the Machine Should Have
The software inside a vehicle can execute deterministic rules, while the world it encounters remains uncertain. Sensors observe only part of reality; predictions of other road users’ future behavior are probabilistic; and even flawless software cannot rule out hardware failure. The real safety question is therefore not whether uncertainty exists, but what the system is still allowed to do when uncertainty increases.
When evidence is richer, the situation is familiar, and remaining capability is high, the system can be granted a wider action space. When perception degrades, the environment becomes abnormal, the system suffers a fault, or risk cannot be assessed reliably, authority should contract. In the language of this article: the greater the uncertainty, the less action authority should be granted.
A fault, for example, does not mean that the safest response is always to stop immediately. Stopping in the middle of a freeway may create a new hazard. The relevant question is what capabilities remain, what the surrounding traffic conditions are, and what the consequences of continuing versus stopping would be. The objective is a lower-risk state that is feasible under current conditions.
A minimal-risk condition is therefore not a zero-risk condition. The machine must repeatedly answer not ‘What action is absolutely correct?’ but ‘Given the evidence I have now, what am I still entitled to do?’
3. The Safety Judgment Itself Must Also Be Verified
No single testing method can prove the safety of autonomous driving. Real-road testing provides direct evidence but encounters severe edge cases too rarely. Simulation can repeat dangerous scenarios, but simulation models have their own errors. Closed-course testing offers control and reproducibility, but it cannot reproduce the whole open world. Crash statistics are also sensitive to geography, road type, time period, and reporting rules.
Waymo therefore uses a Safety Case.[3] A Safety Case is not a single safety score. It requires important safety claims to be traced downward: why should the claim be believed, what evidence supports it, how credible is that evidence, and what counterarguments or residual doubts remain?
The object of verification has now moved upward. At first we verify the vehicle. We must then ask whether the argument used to justify the vehicle’s safety is itself reliable.
Assurance 2.0 goes further by explicitly introducing ‘defeaters’ – reasons or evidence that could weaken or overturn a conclusion.[4][5] A strong assurance argument does not merely collect supporting material; it must also record why the conclusion might be wrong.
In a highly uncertain world, safety does not require every doubt to disappear. What matters is whether doubts are discovered and recorded, whether they alter current authority, and whether new evidence can reopen a conclusion that was previously accepted.
4. When Error Probabilities Cannot Be Estimated Reliably, Exposure Becomes a Safety Instrument
A distinction is necessary before discussing probability. Quantifiable risk with wide error bars, model uncertainty, out-of-distribution risk, tail risk, and deep uncertainty are not the same. This article is concerned especially with cases in which the probability distribution itself cannot be established reliably, and with neighboring cases where uncertainty is severe but action is still required.
How often will a genuinely novel scenario occur? How dangerous is a new combination of factors? Could a new software version interact with an unusual weather condition in an unforeseen way? Assigning a precise-looking number where no reliable distribution exists creates false certainty.
In such cases, controlling exposure becomes a safety instrument. New software, new cities, and new operating conditions need not be opened without limit at the outset. Geography, fleet size, road type, mileage, and deployment scale can be bounded; the real world can then supply new evidence before expansion. Real-world operation is therefore not only product deployment. It is also part of the verification process.[2]
A sound safety regime cannot assume that the first judgment will never be wrong. It must ensure that, if the initial judgment is imperfect, exposure remains bounded; and when new facts appear, authority can be reduced, operations can be paused, a recall can be initiated, or the system can return to an unknown state.
‘Verified’ should therefore not be treated as a permanent label. A better interpretation is conditional: under a particular version, set of operating conditions, and body of evidence, the conclusion is presently acceptable. Change the version, the environment, or the evidence, and what was previously ‘safe’ may become ‘unknown’ again.
5. Waymo and Tesla Follow Different Routes, but They Ultimately Face the Same Question
Tesla follows a different route. It has formidable vehicle-manufacturing capability, a lower-cost hardware strategy, a very large deployed fleet, and substantial mileage under FSD (Supervised).[6] Those data are valuable.
But one evidentiary boundary must be maintained: safety data from supervised FSD cannot automatically be treated as evidence about a truly unsupervised robotaxi system. Under supervision, the human driver remains part of the safety system. A machine judgment that might otherwise have led to a crash may be interrupted by a timely human takeover and therefore never appear as a crash outcome.
If Tesla is assessed with the same framework used in this article, the important future questions are not limited to crash rates. They include how the unsupervised system defines its qualification boundary, how action authority contracts as uncertainty rises, how real-world exposure is staged, and how new evidence triggers de-escalation and re-authorization.
This is not a dismissal of Tesla. Waymo deserves respect for turning an almost precedent-free open-world safety problem, through more than a decade of iteration, into an operational system whose outcomes have begun to undergo independent statistical testing and whose procedures support continuing correction. Tesla deserves respect for a different reason: if it can ultimately demonstrate comparable safety under genuinely unsupervised conditions, its vertically integrated software-hardware architecture and manufacturing capability could make autonomous driving far more scalable as an industrial product.
The routes differ, but for verifiable safety the underlying question is the same: in a world whose future cannot be fully predicted, on what grounds should a machine be permitted to act?
6. A Company’s Safety Judgment Cannot Automatically Become Society’s Risk Authorization
A company may build its own Safety Case, convene a Safety Board, and conclude that a release does not present unreasonable residual risk. But the company cannot, by that conclusion alone, acquire the authority to decide how much residual risk society should accept. Corporate judgment and public authorization are different things.
The regulatory discussion here uses the United States as its main example. The National Highway Traffic Safety Administration (NHTSA) handles vehicle safety, defect investigations, and recalls; state regulators control testing and deployment permissions; the California Public Utilities Commission (CPUC) regulates commercial passenger service; and the National Transportation Safety Board (NTSB) independently investigates major accidents and issues safety recommendations.
California’s recent automated-vehicle rules increasingly emphasize safety cases, lifecycle management, and continuous monitoring.[7] A complete safety regime therefore extends beyond internal corporate validation: it includes company verification, third-party review, public authorization, bounded deployment, real-world operation, and renewed regulatory scrutiny.
Regulatory approval is not truth either. Regulators face information asymmetry, rapid technological change, complex software, and incomplete incident data. Verifying the decision-making regime does not mean searching for an infallible final verifier. It means separating corporate judgment, independent review, public authorization, and real-world outcomes so that different actors can check and constrain one another.
7. Real Incidents Are the Most Important Stress Tests of the Decision Regime
Several recent Waymo incidents are especially informative because they expose different parts of the decision regime rather than merely asking whether the vehicle ‘saw’ an object.
On April 20, 2026, an unoccupied Waymo vehicle encountered impassable floodwater in San Antonio. NHTSA’s recall report states that the system had detected that the water might be impassable, slowed, and nevertheless continued into it. Waymo subsequently tightened its operating domain under high-risk flood conditions and its Safety Board decided on a recall.[8] The key question is not why the hazard was unseen, but why action authority did not contract further after the hazard had already been recognized.
Between April and May 2026, multiple Waymo vehicles entered closed or construction lanes in Phoenix and the San Francisco Bay Area. The recall documentation describes two mechanisms: failure to recognize a construction zone, or inappropriate prioritization of other freeway hazards when multiple hazards were present.[9] The problem is therefore not only hazard detection. It is also the ordering of competing safety objectives.
A school-bus incident raises a different issue. Public NTSB materials describe a sequence in which the vehicle stopped, asked Remote Assistance whether the bus ahead was displaying an active stop signal, received a negative response, and then resumed motion.[10] The investigation is not complete, so final responsibility should not be inferred at this stage.
Whatever the ultimate finding, the sequence is enough to show that an information input can alter the machine’s definition of external state, and that state definition can in turn alter action authority. Human intervention must therefore itself be subject to verification rather than treated as an inherently safe backstop. The right to provide information, the right to define state, the right to judge, the right to authorize, and the right to execute are not the same. A person does not need a steering wheel to exercise influence if the information he or she provides can change how the machine interprets reality.
8. Real-World Data Support Waymo, but They Do Not Replace Mechanism Verification
Waymo now has substantial independent support at the outcome level. In 2026, the Insurance Institute for Highway Safety (IIHS) analyzed roughly 50 million miles of driverless Waymo operation and matched the results against human driving in the same cities and time periods. Per mile, Waymo’s police-reportable crash rate was 68% lower and its injury-crash rate 81% lower than the matched human baseline.[11]
This is important evidence. It shows that Waymo’s safety system is not merely a paper architecture; it is producing observable real-world outcomes. But the result does not mean that ‘the Waymo safety problem is solved.’ Lower aggregate crash rates do not imply that every risk is understood. School buses, children, construction zones, extreme weather, infrastructure failure, and simultaneous fleet-wide anomalies may still reveal structural risks that aggregate statistics do not expose.
A mature safety regime must therefore test both aggregate outcomes and local mechanisms. Strong outcome evidence and incomplete external reproducibility of internal decision rules are not contradictory: the former tests results, while the latter tests the regime that produced them.
9. From an External Verifiability Perspective, Several Arrows Still Do Not Fully Close
After more than a decade of iteration, public evidence provides strong support for Waymo’s overall safety performance within its current operating boundaries. That is a substantial achievement. Yet an external observer still cannot reproduce its full Safety Case, internal thresholds, or complete operational data. At least several arrows therefore remain only partially closed from an external verification perspective.
The first is the threshold of acceptable risk. Science can help estimate the probability and severity of harm, but it cannot by itself answer a normative question: how low must risk be before society should accept it? ‘Absence of unreasonable risk’ ultimately contains a value judgment. Verifiable thinking cannot replace value choice, but it can require that the value judgment be made explicit, linked to public authorization, and subject to accountability.
The second is the scale of first exposure. When a risk has not yet been sufficiently observed and its error probability is itself uncertain, how many vehicles, how many miles, and how much public exposure should be allowed initially? Waymo clearly uses staged deployment, but public information is insufficient for an external observer to reproduce the mapping between current evidence strength and permitted deployment scale.
The third is the condition for expanding authority. When may the system expand from one city to another, from one road class to another, or from one software version to the next? Old evidence cannot be discarded completely or scaling becomes impossible. But it cannot be inherited without limit either, or new risks will be hidden.
The fourth is Remote Assistance. We know that it is not remote driving and that it mainly supplies context and advice. A full assessment, however, would require denominators: request frequency, error rate, the probability that erroneous advice changes vehicle state, and the distribution of waiting times under both normal and system-wide stress.
The fifth is the move from vehicle safety to system safety. Stopping may be the safest action for one vehicle. If hundreds of vehicles stop simultaneously during a citywide power outage or infrastructure failure, individually conservative behavior can create a new system-level risk. What must ultimately be verified is therefore not only the vehicle, but the coupled system of vehicle, fleet, remote support, cloud services, road infrastructure, and emergency response.
10. Autonomous Driving Extends the Meaning of ‘Verifiable’
The most important contribution of autonomous driving to Verifiable Thinking is not a new vocabulary of automotive safety. It forces the object of verification itself to move upward.
For determinate questions, we can directly verify whether a proposition is true or false. Did a transaction occur? Does an asset exist? Does a ledger reconcile? These questions have factual answers that can, in principle, be approached more closely. For uncertain questions, we cannot demand that a judgment always be correct, but we can verify the basis of the judgment, how its probability was formed, and how large its error may be.
Autonomous driving introduces a harder third case. Some problems are not only uncertain; even their error probabilities cannot be estimated reliably, and yet the system cannot refuse to act. At that point the object of verification must move beyond the conclusion to the decision-making regime that produces a determinate action.
Compressed further, under this condition in which action is unavoidable, at least four things should continue to be examined: Is the qualification boundary explicit? Does authority change with evidence and uncertainty? Is real-world exposure bounded? What conditions reopen a prior conclusion and trigger de-escalation, suspension, or re-authorization?
This claim is not made in a theoretical vacuum. Robust Decision Making (RDM), Info-Gap Decision Theory, Assurance 2.0, double-loop learning in adaptive management, and German and Japanese work on automated-driving safety each address parts of deep uncertainty, residual doubt, continuous updating, or institutional learning.[12]-[18] This article does not seek to replace those theories. Its proposed synthesis is to place them on a single verifiability axis: when uncertain inputs must yield determinate actions, the object of verification moves from facts, to judgments, and then to the regime that produces judgment and action.
Accordingly, Verifiable Thinking still retains two high-level rules, with a further extension under the second rule:
For determinate questions: verify what is true and what is false.
For uncertain questions: verify the basis of the judgment and its probability of error.
When even the probability of error cannot be estimated reliably, but reality still requires a determinate answer, verification cannot stop at the finding that the error probability is unknown. It must continue to examine the decision-making regime that produces action.
Autonomous driving does not prove that this institutional extension applies universally. Emergency medicine, grid dispatch, financial intervention, and other domains still require separate tests. What autonomous driving does provide is a demanding stress test: when an uncertain problem cannot remain at ‘unknown’ and must be converted into real-world action, the object of verification must extend from the judgment and its probability of error to the decision-making regime that produces action.
The value of Verifiable Thinking is not to eliminate uncertainty. It is to ensure that a determinate decision made under uncertainty can still be inspected, constrained, overturned, and continuously revised.
References
[1] Waymo. Autonomous Driving Technology – Learn more about us. Waymo corporate history/timeline. https://waymo.com/about/
[2] Favaro, F., Schnelle, S., Fraade-Blanar, L., Victor, T., Peña, M., Webb, N., et al. “Determining Absence of Unreasonable Risk: Approval Guidelines for an Automated Driving System Release.” SAE International Journal of Connected and Automated Vehicles, 9(4), 2026. DOI: 10.4271/12-09-04-0026.
[3] Schnelle, S., Favaro, F. M., Fraade-Blanar, L., Wichner, D., Broce, H., Miranda, J. “Assessing a Safety Case: Bottom-up Guidance for Claims and Evidence Evaluation.” Waymo Research, 2026. https://waymo.com/research/assessing-a-safety-case-bottom-up-guidance-for-claims-and-evidence/
[4] Bloomfield, R., Rushby, J. “Assessing Confidence with Assurance 2.0.” arXiv:2205.04522, 2022.
[5] Bloomfield, R., Netkachova, K., Rushby, J. “Defeaters and Eliminative Argumentation in Assurance 2.0.” arXiv:2405.15800, 2024.
[6] Tesla. FSD (Supervised) Evidence Dashboard, 2025 data. https://www.tesla.com/fsd-evidence-dashboard
[7] California Department of Motor Vehicles. California Autonomous Vehicle Regulations; Final Statement of Reasons, 2026. https://www.dmv.ca.gov/portal/vehicle-industry-services/autonomous-vehicles/california-autonomous-vehicle-regulations/
[8] National Highway Traffic Safety Administration. Part 573 Safety Recall Report 26E026, Waymo LLC, May 6, 2026. https://static.nhtsa.gov/odi/rcl/2026/RCLRPT-26E026-6527.pdf
[9] National Highway Traffic Safety Administration. Part 573 Safety Recall Report 26E035, Waymo LLC, 2026. https://static.nhtsa.gov/odi/rcl/2026/RCLRPT-26E035-7637.pdf
[10] National Transportation Safety Board. HWY26FH007, “Automated Driving System-Equipped Vehicle Passed School Bus Loading Student Passengers,” March 3, 2026. https://www.ntsb.gov/investigations/Pages/HWY26FH007.aspx
[11] Insurance Institute for Highway Safety. “Waymo’s driverless cars crash less often than people,” July 23, 2026. https://www.iihs.org/news/detail/waymos-driverless-cars-crash-less-often-than-people
[12] Lempert, R. J. “Robust Decision Making (RDM).” In Decision Making under Deep Uncertainty: From Theory to Practice. Springer, 2019, pp. 23-51.
[13] Ben-Haim, Y. “Info-Gap Decision Theory (IG).” In Decision Making under Deep Uncertainty: From Theory to Practice. Springer, 2019.
[14] Williams, B. K., Brown, E. D. “Double-Loop Learning in Adaptive Management: The Need, the Challenge, and the Opportunity.” Environmental Management, 62, 995-1006, 2018.
[15] Burton, S., McDermid, J. A. “Closing the gaps: Complexity and uncertainty in the safety assurance and regulation of automated driving.” Fraunhofer / University of York, 2023. DOI: 10.24406/publica-1795.
[16] Adee, A., Munk, P., Gansch, R., Liggesmeyer, P. “Uncertainty representation with extended evidential networks for modeling Safety of the Intended Functionality (SOTIF).” ESREL/PSAM 2020. DOI: 10.3850/978-981-14-8593-0_5737-cd.
[17] 北岛创, 中村弘毅, 村田智良, 田口研治, ウォレン郁恵. “自動運転の安全性評価フレームワーク（Ver.3）の安全論証構造分析” [Analysis of the Safety Argument Structure of the Automated Driving Safety Evaluation Framework (Ver.3)]. JARI Research Journal, JRJ20241203, December 2024. [Japanese].
[18] Japan Automobile Manufacturers Association (JAMA). “自動運転の安全性評価フレームワーク Ver.4.0” [Automated Driving Safety Evaluation Framework Ver.4.0], December 2025. https://www.jama.or.jp/operation/safety/automated_driving/pdf/framework_ver_4_0.pdf
