Waymo flood accident: The safety cost of efficiency

Why did > autonomous driving fail in heavy rain?

Four cities are out of service, a $30 million recall cost, and the unmanned vehicles trapped in the water in heavy rains are not a technical failure-it is the inevitable defeat of efficiency in the field of autonomous driving. Waymo engineers spent ten years optimizing lane change timings, but forgot that there shouldn't be cars on the road during heavy rains.

The picture taken by local television stations in Atlanta is absurd: a Waymo Cruise is moving at a constant speed against half a meter of water, elegant as if it is participating in an autonomous driving technology exhibition. It was not until two-thirds of the wheel was submerged that the system stopped "carefully". At this time, seven blocks past the hotel from which it had started, water in the underbody control box paralyzed the $180,000 machine for 63 minutes.

** The essence of the rainstorm dilemma of autonomous driving is the long-tail paradox **: When 99.9% of daily scenes are optimized to the extreme, 0.1% of extreme scenes become fatal blind spots. A test report released by Waymo in 2025 showed that of Phoenix's cumulative 30 million test miles, heavy rain scenarios were less than 30,000 miles-accounting for 0.1%. What's even more ironic is that most of these "storm tests" occur in artificially designated closed test areas with water depths of no more than 10 centimeters.

The temptation of efficiency

Autonomous driving companies are all playing the same game: get the highest availability data at the lowest cost. Behind Cruise's boasted of "zero-liability accidents on San Francisco streets" last year, the system automatically locks cars when weather warnings are issued-the cars will not move, and the accident rate is of course zero. Waymo's strategy is even more subtle: their car can drive in drizzling rain, but as soon as the rain exceeds 2 millimeters per minute, the car will immediately pull over.

The input-output ratio of heavy rain scenario testing is hopelessly low. Simulating a real urban flood requires: 1) renting an abandoned airport and transforming it into streets;2) deploying hundreds of dynamic water level sensors; and 3) a rainfall simulation system of 2 tons per second. The cost of a single test is about $800,000, which is equivalent to 1000 regular road tests. To make matters worse, such extreme cases cannot feed back on daily algorithm optimization and are purely cost black holes.

** The logic of risk calculation is completely distorted here **: When the probability of heavy rains is counted as "once in a decade" and investors meet quarterly once a month, all resources must flow to scenarios that can improve short-term data.

Technical Director of a Data Center

Li Lang's most stressful moment every day is the traffic report at 7 a.m. The e-commerce platform data center he manages carries 350,000 requests per second, and any 0.1-second delay will cause user loss. Last year, he took the lead in eliminating the "redundant power switching test"-changing the quarterly disaster recovery drill to once a year, and investing all the 1.8 million yuan saved into cache server upgrades.

"Of the 99.99% availability indicator, that 0.01% is defaulted to an acceptable loss," he said at an internal meeting. Until this year's typhoon season, when heavy rain flooded the substation and caused the main power supply to trip, the backup generator stuck during the automatic switching process. The server response speed that has been optimized countless times is meaningless in the darkness of downtime at this moment.

(* Note: This is an embedded scene section, with no terminology *)

The truth about the failure of the ## sensor Waymo's public relations statement emphasized that "lidar performance declines in heavy rains," but this is only half the truth. The complete truth is hidden in the 2025 patent US2025367421A1: To reduce the false alarm rate, the system will mark continuously abnormal sensor data as "noise interference." When the water depth sensor readings exceed the standard for 10 consecutive seconds-exactly when the vehicle passes through the stagnant area-the algorithm determines that it is a sensor failure rather than a true water level rise.

** Disasters are hidden in the default settings **: In order to improve daily driving comfort, engineers lowered the acceleration threshold of emergency braking from 8m/s² to 5m/s² to prevent passengers from being strangled by seat belts. As a result, the system was still slowly slowing down linearly during heavy rain when it should have stopped at full strength.

Who will pay for extreme scenarios?

The sharpest cross-examination came from the CTO of an autonomous driving company: "If all extreme scenarios were required to be covered, the industry would have closed down ten years ago." This holds true in the financial model: Waymo's average daily revenue per vehicle last year was $62, and the cost of heavy rain testing was diluted to an increase of $41 per vehicle per day-directly erasing the possibility of profit.

But financial books never record social costs. The floods in Atlanta paralyzed three main roads and took ambulances an extra 17 minutes to detour-no investor would ask about this at an earnings conference. What is even more absurd is the definition of responsibility: When Waymo stated that "passengers can take over the vehicle at any time," they did not mention that the system would disable the manual takeover function during heavy rain to prevent "accidental operation leading to accidents."

** Security is reduced to a word game **: When the technical team says "security redundancy", it actually means hot standby on both servers; when the public relations draft says "security first", the subtext is "We do not proactively hit people." As for being passively trapped in the flood? That is not on the numerator and denominator of the KPI calculation formula.

failure defense mechanism

The comparison in the aviation industry is like a slap in the face: the heavy rain test of the Airbus A350 must complete the landing on the ship with a single engine failure, and even the position of the wheel well drain valve has gone through 300 iterations. Because the FAA understands that extreme scenarios are not a matter of probability, but a matter of life and death.

The autonomous driving industry is still using Internet thinking for safety. Waymo's "safety committee" is home to three former Google product managers, and the incident analysis template is similar to that of handling APP crash reports back then. When the engineer suggested adding heavy rain simulation tests, the reply he received was: "Collect more natural scene data first"-wait for God to cooperate with the stress test.

** When 99.9% perfection becomes a KPI, 0.1% destruction becomes a lottery ticket **. Waymo's shutdown of four cities was not a technical accident, but a price that must be paid for efficiency first. The question now is not when the heavy rain will stop, but when will the robots trapped in the water wait for mankind to truly awe?