The timeline matters.

On April 20, a Waymo robotaxi in San Antonio encountered standing water on a higher-speed road. The vehicle's software detected the flood condition and decelerated — a signal that the system had flagged the hazard. The vehicle then continued forward into the water. Salado Creek floodwaters swept it off the road. No passengers were aboard. Crews recovered the vehicle four days later near Pletz County Park [1].

On May 12, NHTSA filed a recall covering 3,791 Waymo vehicles — effectively the entire U.S. fleet, operating on fifth and sixth generation automated driving systems. The recall describes a software condition in which vehicles could slow near standing water on high-speed roads and then proceed through it, rather than stopping or rerouting. Waymo had already issued an over-the-air software update before NHTSA's announcement [2].

The structure of what happened is specific. The vehicle did not fail to notice the flood. It decelerated in response to the flood. Something in the decision architecture then allowed it to proceed despite the deceleration. That gap — between hazard detection and hazard avoidance — is what the recall addresses. The sensor layer worked. The response layer did not [3].

In the public debate about autonomous vehicle safety, the failure modes that attract the most attention are the ones where a vehicle does not see something a human would have seen. A pedestrian that appears suddenly. A truck crossing an intersection. An object in the lane. The San Antonio incident is a different failure mode: the vehicle saw the hazard, slowed to acknowledge it, and then made the wrong decision about what to do next. The perception was adequate. The judgment was not.

Waymo has characterized the incident as a software condition rather than a fundamental limitation of the system's sensing or classification capability. The OTA fix is meant to ensure that vehicles which decelerate near standing water also stop or reroute, rather than continuing through. That is a tractable software constraint — a different decision outcome attached to the same detection signal [2].

Whether the fix is complete is harder to verify externally. NHTSA's recall filing creates a formal obligation for Waymo to document the remediation and report on its effectiveness. The agency can reopen the inquiry if subsequent incidents suggest the fix was incomplete. That accountability structure exists; its strength depends on whether Waymo encounters similar conditions after the OTA deployment and whether the outcome is different.

The broader context for the recall is a Waymo fleet that has accumulated more autonomous miles than any comparable program in history. The San Antonio incident is, in aggregate terms, a rare event in a large operating record. Waymo's safety statistics, measured against human driving fatality rates, have been consistently favorable. Rare events in large datasets still require investigation and correction — the recall is the correction mechanism, not evidence that the system is fundamentally unsafe [1].

The X framing — that the vehicle recognized the flood and overrode that recognition — is factually consistent with what NHTSA's filing describes. Waymo would frame it differently: the system detected a condition and made an incorrect subsequent decision, which has now been corrected. Both framings describe the same event. The disagreement is about what the event implies [2].

What it implies, at minimum, is that autonomous vehicle systems can produce unexpected behavior in edge conditions even when their perception is working correctly. San Antonio was an edge condition. The creek was real.

-- THEO KAPLAN, San Francisco