What happened
It was reported that during 2025 Waymo’s driverless taxis, which carry passengers with no safety driver at the wheel, were recorded more than once driving past school buses that had stopped to let children on or off, with their red lights flashing and their stop arms extended. In September a television station in Atlanta aired video of a Waymo doing this. A school district in Austin, Texas, said it had documented 19 cases of Waymo vehicles illegally passing stopped school buses over the school year, including one in which a car went by moments after a child had crossed in front of it.
It was reported that in October 2025 the United States road safety regulator, the National Highway Traffic Safety Administration, opened an investigation into how Waymo’s cars behave around stopped school buses, and that it later widened the inquiry. The regulator noted that the cases already recorded were likely to be only part of the picture. Waymo said it had identified a problem in its software and, in December 2025, filed a voluntary recall covering more than 3,000 vehicles, with its chief safety officer saying the company had decided to file the recall so its cars would slow and stop properly in these situations. The school district in Austin said some of the passes it recorded had happened after Waymo told it the software had been updated. No injuries were reported.
What an auditable version would have shown
A stopped school bus with its lights flashing and its stop arm out is one of the clearest rules on the road: the traffic around it must stop. The question an audit answers is why a car that could see the bus did not stop, and how often it happened across the fleet. A signed record of each encounter, what the car detected, what rule applied, and what it did, turns a set of filmed near misses into a count the operator and the regulator can read: how many times a Waymo met a stopped school bus, and how many times it failed to stop. What the school district had to gather by watching was, in a system that keeps such a record, already a number.
Where the gap was
The car could see the stopped school bus and drove past it anyway. What brought that to light was people filming it and a school district keeping count, not the car ever registering that it had done anything wrong. A ConstraintGate encodes a hard rule, such as remaining stopped for a school bus showing its stop signal, as a check the car must satisfy before it moves, so the rule holds every time rather than most of the time. A ConductRecord keeps each encounter and what the car did, so a pattern of failures is visible from the record. A MetricRecord keeps the count across the fleet, so the rate at which the rule is broken is a figure the operator watches rather than one an outside body assembles after the fact. The recall changed the software. The record is what shows whether the change holds.
What governance should have looked like
A driverless car carrying passengers on public roads has to treat the most important traffic rules as limits it cannot cross, not as behaviour it usually gets right. Best practice would be for the operator to encode a rule like stopping for a school bus as a check the car must pass before it proceeds, to keep a record of every such encounter and what the car did, and to track across the whole fleet how often the rule is met and how often it is broken, so a problem shows up as a rising number rather than as a video. Waymo found the problem and recalled the software. Whether the fix holds, on every car and every time, is something a record of these encounters can show.
Failure Pattern: a driverless vehicle that could detect a stopped school bus failed to stop for it, and the failures were found by people filming and counting rather than caught by the system and measured across the fleet.
Governance Principle: a safety-critical rule for an autonomous system must be enforced as a hard check before the action, every encounter must be recorded, and the rate at which the rule holds must be measured across the fleet.
The reference implementation of ConstraintGate, ConductRecord and MetricRecord is open source. It lives at github.com/saffronandindia/headlights-oss, Apache 2.0 licensed and free to install. The repository is public now.
Sources
- Waymo school buses recall (NPR)
- Waymo recalls, updates software for over 3,000 vehicles, US regulator says (Insurance Journal)
- Waymo recalls robotaxi software after school bus safety failures (The Robot Report)