Urban Autonomy Lab
Chapter 4 · EV109

Waymo Pauses Service in Five Cities as Robotaxis Keep Driving into Floods; 3,791-Vehicle OTA Recall Fails to Prevent Repeat — 21 May 2026

Date collected: 25 May 2026
Summary

Service paused in five cities after a 3,791-vehicle OTA recall shipped with no final remedy and failed to stop a robotaxi driving into a flooded Atlanta street

Headline Finding

On 21 May 2026 Waymo suspended robotaxi service in five US cities — Atlanta, Austin, Dallas, Houston, and San Antonio — because its vehicles kept driving into flooded roads, a failure mode that had already triggered a voluntary recall of 3,791 robotaxis less than two weeks earlier. The 8 May recall shipped an interim over-the-air software update that placed operating restrictions during elevated flood risk, but Waymo acknowledged at the time of filing that it had not yet developed a “final remedy.” The update did not work: on the evening of 20 May an unoccupied Waymo drove into a flooded Midtown Atlanta street during severe storms and was stuck for about an hour before recovery. This is the clearest contemporaneous evidence to date of three failure surfaces the paper argues about simultaneously: an operational design domain boundary the operator does not fully control (weather), a fleet-coherence failure mode (a single shared software state producing correlated multi-city service withdrawal), and the inadequacy of over-the-air recall as a corrective governance instrument (a “recall” was filed before a fix existed).

Detail

  • Sources: TechCrunch (Sean O’Kane) 21–22 May 2026; The Next Web 23 May 2026; BBC 21 May 2026; documents posted to the NHTSA website. Window: 19–25 May 2026.
  • Cities paused (driverless ride-hailing): Atlanta, Austin, Dallas, Houston, San Antonio.
    • San Antonio: offline since late April 2026 following a 20 April incident in which an empty Waymo on a road with a 40 mph speed limit detected standing water, reduced speed, and then drove into it anyway — because its decision system had no hard-stop condition for water in its path. The vehicle was swept into a creek.
    • Atlanta: paused after an unoccupied Waymo drove into a flooded Midtown street on the evening of 20 May during severe storms and was stuck for roughly one hour before being recovered and removed.
    • Dallas and Houston: paused “out of an abundance of caution” for forecast severe weather across Texas (confirmed to TechCrunch late 21 May; expansion first reported by Bloomberg).
  • The recall: on 8 May 2026 Waymo issued a voluntary recall covering 3,791 robotaxis running its fifth- and sixth-generation automated driving systems. Per a letter on the NHTSA website, the flaw could allow vehicles “to slow and then drive into standing water on higher speed roadways.” The interim update placed “restrictions at times and in locations where there is an elevated risk of encountering a flooded, higher-speed roadway.” Waymo conceded the “final remedy” had not been developed when the recall was filed.
  • Why the interim fix failed in Atlanta: Waymo told reporters the storm produced flooding before the National Weather Service had issued any flash-flood warning, watch, or advisory. Waymo’s weather-preparation logic relies in part on those official alerts, so it had no signal to act on.
  • Regulator posture: “NHTSA is aware of this incident, is in communication with Waymo, and will take appropriate action if necessary.”
  • Recall history (third since February 2024):
    • First (Feb 2024): 444 vehicles, after two Phoenix robotaxis separately struck the same improperly towed vehicle.
    • Second (May 2025): 1,212 vehicles, low-speed collisions with stationary objects (parking gates, telephone poles).
    • Third (May 2026): 3,791 vehicles, the flooded-roadway defect.
  • Two further active NHTSA / NTSB investigations run in parallel: (a) robotaxis illegally passing stopped school buses — on 15 May 2026 NHTSA issued a second document request because Waymo’s initial (fully redacted) response “necessitates that [NHTSA] receive further data and information”; (b) a 23 January 2026 incident in Santa Monica in which a Waymo struck a child (Waymo says it braked to about 6 mph; minor injuries).
  • Operational scale at the time of the suspensions: fleet of 3,791 vehicles; more than 500,000 paid trips per week; 2026 expansion targets include San Diego, Las Vegas, and Detroit, plus London later in the year; stated goal of one million paid rides per week by end-2026.
  • Fleet-coherence precedents this pattern joins: the December 2025 San Francisco power outage that stalled Waymo vehicles across the city (EV67); the April 2026 Apollo Go mass outage in Wuhan that stopped more than a hundred robotaxis mid-traffic (EV44, EV49, EV89).

Governance Implication

Five points for the paper.

  1. Fleet coherence is now an empirically confirmed sub-mode of Allocation failure, not a theoretical risk. A single architectural defect plus a single over-the-air patch produced correlated service withdrawal across five cities within a fortnight. The defining property is that one software state is shared across the entire fleet: an ODD-boundary defect is therefore systemic rather than localised, and “the fleet” is the correct unit of regulatory attention, not the individual vehicle. Ch.5 should treat the May 2026 flood sequence as the canonical worked example of fleet coherence, alongside the SF power outage (EV67) and Wuhan (EV44/EV49/EV89) — the difference being that this case is a software-decision defect rather than an external shock, which makes the correlation endogenous to the operator’s own code.

  2. Over-the-air recall is not a reliable corrective instrument as currently practised, and the paper’s Ch.7 and Ch.9 treatments should say so explicitly. Waymo filed a federal recall on 8 May while openly stating no final remedy existed; the interim mitigation then failed on 20 May. For a city or state regulator, the lesson is that the word “recall” does not certify that a hazard has been corrected — an OTA recall can be a notification that a fix is being attempted. Ch.7’s instruments should include a requirement that operators disclose recall remedy status (interim vs. final), the population of vehicles still exposed, and a verification standard before resumption — rather than allowing self-certified resumption.

  3. ODD boundaries are defined relative to external infrastructure the operator does not control. Waymo’s flood avoidance depends partly on National Weather Service alerts; when flooding outran the alert, the system had no independent fallback. The paper’s Institutional ODD framing (Ch.3) should require that weather and hydrological operating conditions be specified as part of the ODD a city authorises, and should treat dependence on third-party signals as a declarable ODD assumption — not something an operator may leave implicit. Cities with known flash-flood geographies (San Antonio, Houston, Atlanta) have local hydrological data and floodplain mapping that operators demonstrably lack; this is a concrete data-sharing governance hook (Ch.6 Sensing).

  4. Legitimacy. As The Next Web put it, “floods are not edge cases. They are weather.” Three recalls in fifteen months and a five-city shutdown during the run-up to a World Cup the operator has explicitly targeted (EV106) erode the public trust the expansion requires. Ch.5’s Legitimacy treatment should note that repeated, visible, recurrence-after-recall failures compound differently from one-off incidents: each repeat converts a safety story into a competence story.

  5. No single city regulator saw the whole picture. The five-city pause was executed at operator discretion, not by regulatory order, and no municipal authority had visibility of the fleet-wide software state that linked the incidents. This reinforces the multi-city consolidated-operator-oversight instrument flagged in EV106 and argues that city authority should extend to requiring disclosure of fleet-wide software versions, active recall status, and ODD restrictions in force at any time.

Sources

Thread