The floor was not written.
It was earned.
A safety board's first question is not whether the floor works in a simulator. It is where did you get these rules? Ours come from 8,219 public federal records of automated driving going wrong: 3,336 NHTSA crash reports for Level 3–5 systems, 4,839 for Level 2, 21 recalls of automated-driving software, 18 defect investigations and 5 NTSB findings. Every invariant below names the records that earned it.
Five federal sources.
Downloaded, checksummed, rebuilt by one command.
5,286 records classify into at least one failure mode with the evidence attached. 1,830 Level 2 filings cannot be read at all: the manufacturer redacted the narrative and left the movement fields Unknown. We report that instead of hiding it. California's own DMV reports sit behind a CAPTCHA wall; the same crashes are in the federal filings with State = CA.
What counts as earned
An invariant is earned when at least one public record classifies into a failure mode that names it. Classification is rule-based and auditable: structured crash fields first, narrative keywords second, regulator findings assigned explicitly. No model reads a record.
What the record is mostly
52% of Level 3–5 crash reports are the automated vehicle being struck while stopped. That earns no rule and is counted as such. The floor's rules are earned by the minority of crashes where the system proposed the danger.
What earned each rule.
Records earning each invariant, by source. One record can earn several invariants.
| invariant | the rule | records | severe / fatal | enforced |
|---|---|---|---|---|
| ONROAD | Stay on the drivable lane/road surface; steer back toward the centre before the edge is reached. | 1,255 | 36 / 6 | enforced |
| STATIC | The reachable path must be free of static geometry (pole, gate arm, chain, barrier, curb, wall, attenuator); an unmodelled fixed object in the corridor forces a stop. | 1,120 | 26 / 3 | enforced |
| FOLLOW | Keep a speed-dependent gap to whatever is ahead in the lane: gap >= max(min_gap, v * headway), and brake now if the projected gap would fall below min_gap. | 1,187 | 43 / 8 | enforced |
| STOP_FOR_STATIONARY | A stationary object or vehicle in the travel lane must be stopped for within the available distance, whatever the lead vehicle just did. | 834 | 26 / 7 | enforced |
| VRU | A pedestrian, cyclist, scooter, wheelchair or motorcyclist in or entering the reachable path forces yielding; classification uncertainty never delays braking. | 169 | 31 / 16 | enforced |
| SPEED_LIMIT | No throttle above the posted limit. | 74 | 4 / 1 | enforced |
| STOP_CONTROL | Complete stop at stop signs and red signals; no entry on a steady yellow without clearance; no passing a stopped school bus with its stop arm out; no through-movement from a turn-only lane. | 74 | 4 / 1 | not yet |
| CROSS_TRAFFIC | Crossing or approaching traffic at intersections and unprotected turns is a threat until its reachable set clears the ego path; a slowly approaching perpendicular vehicle is not assumed to stop. | 1,047 | 31 / 10 | not yet |
| WORST_CASE_HEADING | Articulated, towed or ambiguous-orientation objects get a worst-case motion prediction; heading and orientation disagreement widens the reachable set, it never narrows it. | 30 | 2 / 2 | not yet |
| BRAKE_AUTHORITY | A hard brake must itself be justified by a hazard in the forward reachable set; approach from the rear is not a reason to brake; a justified brake is never suppressed or delayed. | 7 | 0 / 0 | not yet |
| HOLD_AFTER_CONTACT | After any collision the vehicle holds still until cleared; no pull-over, no creep. | 2 | 0 / 0 | not yet |
| NO_MOTION_PERSON_ADJACENT | No motion from rest while a person is inside the near envelope of the vehicle. | 1 | 0 / 0 | not yet |
| ODD_ENTRY | No entry into a closed zone, standing water, heavy smoke or low visibility; speed is bounded by the distance the sensors can actually see (stop within visible distance). | 73 | 2 / 1 | not yet |
| LANE_DISCIPLINE | Lane changes and merges require a verified gap; never cross the centre line into oncoming traffic. | 159 | 9 / 0 | not yet |
| MRC_FALLBACK | On a system fault the vehicle reaches a minimal-risk condition; the floor itself stays live and never hands raw proposals to the actuator. | 2 | 0 / 0 | not yet |
6 rules enforced. 9 earned and not yet.
The grid below is the honest centre of this page. Green cells name the floor check that enforces a rule. Red cells are rules the record has already earned that neither simulator floor enforces — cross-traffic conflict alone has 1,047 records behind it. They are the roadmap, published as debt rather than implied as coverage.
Derived from measured braking,
not picked.
The record fixes what must be prevented and at what speeds. It does not fix a headway; physics does. Stopping distance is d = v·tr + v²/(2a). We measured the guarded MetaDrive vehicle: response latency 0.1 s, sustained deceleration 11.28 m/s². At the 55 km/h scenario limit that requires a headway of 0.78 s; the floor holds 1.6 s. A real car brakes less hard: at an assumed 5 m/s² the requirement is 1.63 s and 1.6 s is no longer enough, which is why the CARLA floor holds 2.4 s and why a real vehicle's headway must be re-derived from its own measured braking.
What this proves, and what it does not.
- Provenance, not completeness. The floor refuses only what it models. A hazard absent from the record and the state is absent from the floor.
- Self-reported record. Crash narratives are written by the operators; counts are lower bounds, not rates.
- Rule-based classification, spot-audited. Every match carries its evidence; no inter-rater study yet.
- No hazard analysis, no real perception, no adversary, simulation only.
| source | sha256 |
|---|---|
| Standing General Order 2021-01, ADS (SAE L3-5) crash reports, Jul 2021 - Jun 15 2025 | cb2b38a21e2c… |
| SGO 2021-01 ADS crash reports, Jun 16 2025 onward (third amended order) | f856d0b9cedc… |
| SGO 2021-01, Level 2 ADAS crash reports, Jul 2021 - Jun 15 2025 | 99579d4c9add… |
| SGO 2021-01 Level 2 ADAS crash reports, Jun 16 2025 onward | 1b15d76e4b0c… |
| field definitions for the SGO CSVs | c92e1bec238e… |
| every Part 573 safety recall since 2010, tab-delimited | 306e4fb488c4… |
| every ODI defect investigation (PE/EA/RQ/AQ) | 632a7f12837b… |
| Williston FL 2016, Tesla Autopilot vs crossing tractor-trailer (HWY16FH018) | 4fca215cec75… |
| Tempe AZ 2018, Uber ATG test vehicle vs pedestrian (HWY18MH010) | 1a0bb130efd5… |
| Mountain View CA 2018, Tesla Autopilot into gore attenuator (HWY18FH011) | 3784e2ed8219… |
| Delray Beach FL 2019, Tesla Autopilot vs crossing truck (HWY19FH008) | 3157beeb98b1… |
| Culver City CA 2018, Tesla Autopilot into stationary fire truck (HWY18FH004) | 8a6fc9fd6f2f… |
Source manifest at build time (2026-09-27T07:00:26Z). Rebuild: python -m failure_corpus build.