Jherrod ThomasThe Lion of Functional Safety™

September 9, 2026 · 15 min read

49 CFR 567 / Part 555 / FMVSS 135ISO 26262-3 §5 / §6 / §7 ControllabilityAQ26002 / SAE J3016 / UL 4600

When the Driver Was a Risk Control: The Tesla Cybercab Audit Query (AQ26002) Through an FMVSS Self-Certification and ISO 26262-3 Item Definition Lens

A vehicle with no steering wheel, no pedals and no mirrors was self-certified as compliant with all applicable Federal Motor Vehicle Safety Standards. Four days later a paying rider found a virtual joystick on the touchscreen that drives it by hand. Both of those statements can be true at once, and the distance between them is the entire safety argument.

Most of the commentary on NHTSA's Cybercab audit query has been about whether Tesla is allowed to decide for itself which federal standards apply. That is a legal question and it is not the interesting one. The interesting one is what happens to a safety analysis when you delete the human operator from the item definition and do not go back and re-open every place that operator was quietly carrying load.

Because the driver is not just a user. In every hazard analysis I have ever reviewed, the driver is a risk control measure — an unwritten, uncredited, extremely load-bearing one.

1. The public record

On September 3, 2026, Tesla began commercial Cybercab operations in Austin, Texas. The same day — within hours, by two independent accounts — NHTSA's Office of Defects Investigation opened AQ26002, an Audit Query, "prompted by public information," covering an estimated 1,000 vehicles (TechCrunch, September 4, 2026; Electrek, September 4, 2026).

The scope language is narrow and precise. NHTSA opened the query to "examine the process and technical data on which Tesla relied when certifying the Cybercab and related issues," and said it will consider "the extent to which Tesla's certification depended on determinations that certain FMVSS are inapplicable to the Cybercab."

Read that twice. NHTSA is not alleging a defect. It is auditing an inapplicability determination — the engineering judgment that a requirement does not attach to this design at all. That is a different animal from a nonconformance, and it is the same animal that functional safety practitioners call an assumption of use or a scoping assumption: the thing you write down once, early, and never re-verify.

The mechanism is 49 U.S.C. 30112 and 30115 read together with 49 CFR Part 567: manufacturers self-certify FMVSS compliance and affix the certification label; NHTSA polices after the fact. Tesla told the agency it certified the Cybercab as compliant with all applicable FMVSS and plans to expand deployment to more vehicles and more locations. Administrator Jonathan Morrison's statement drew the line the agency is defending: "NHTSA fully supports the safe development and deployment of automated vehicles. But as the federal regulator, we need to ensure that all of our laws are followed."

There is direct precedent. In 2022 Zoox self-certified its purpose-built robotaxi, which also lacks a steering wheel and pedals. NHTSA issued a special order in 2023, opened audit query AQ23001 the following year, and Zoox ultimately went the other route — a 49 CFR Part 555 temporary exemption from eight FMVSS, granted in final form in July 2026, capped at 2,500 vehicles added per year for two years, after which it began charging for rides in Las Vegas (TechCrunch, above). Roughly four years from self-certification to paid commercial service through the exemption door.

The regulatory ground is also moving underneath all of this. On June 26, 2026, NHTSA issued an NPRM amending FMVSS No. 135 (light vehicle brake systems, in force since 1995) so that the foot-pedal service brake control and hand-or-foot parking brake control requirements would apply only to vehicles that have manually operated driving controls (Crowell & Moring client alert, July 2, 2026; CNBC, June 25, 2026). Comments closed July 27, 2026. Four details from that NPRM matter here:

NHTSA said on September 4 that it is in the process of updating these standards, and then said the part that governs today: "Until that work is completed, however, existing standards remain in force." The same day it withdrew the AV STEP voluntary oversight program, the agency's stated rationale being that industry feedback pointed to "sparse participation."

And then, on September 7, 2026, a rider named Matthew Skrzypczak got into a Cybercab and found the touchscreen in an unfamiliar configuration: a split display with a virtual joystick for manual driving on the left, prompts to close cabin doors, buttons to open doors and call support, and a live surround-camera view on the right — with the side camera feeds apparently frozen on a frame captured earlier at a Supercharger. He said he had "a feeling I wasn't supposed to see this," and tried to drive the car with it (Electrek, September 8, 2026).

Tesla has never shown this mode publicly. It plainly exists for depot repositioning and for nudging a vehicle out of a spot no ADS should attempt. That is a legitimate engineering need. It is also, in certification terms, a manually operated driving control on a vehicle certified on the basis that manually operated driving controls are absent.

Separately, and relevant to the fourth NPRM bullet above: Electrek reported in July that crash data collected by NHTSA shows a Tesla remote operator crashed a Robotaxi in Houston earlier in 2026, and NHTSA has an open Engineering Analysis into FSD covering roughly 3.2 million vehicles following a series of visibility-related crashes.

2. The standards lens

There is no ISO 26262 clause that says "you may delete the driver." There are three clauses that say what you owe if you do.

ISO 26262-3:2018 §5 — Item definition. Clause 5.4.1 requires the item's functional and non-functional requirements, its boundary, its interfaces, and — the sub-clause everyone skims — the operational scenarios and operating modes. An item definition for a driverless vehicle that enumerates "autonomous driving," "charging," and "parked" but not "depot repositioning under human touchscreen control" is not a complete item definition. It is a marketing description. The joystick mode is an operating mode with its own actuator authority, its own human-machine interface, its own failure modes, and — from the frozen camera tiles in that video — its own perception-latency question. It belongs in §5.4.1 whether or not it belongs in a press release.

ISO 26262-3 §6 — HARA, and specifically the controllability parameter. This is where the real bill comes due. ISO 26262-3 Table 4 defines controllability from C0 (controllable in general) through C3 (difficult to control or uncontrollable), and the C-rating is assessed for the driver or other persons potentially at risk. Nearly every production HARA in the automotive industry takes C1 or C2 credit somewhere on the strength of a sentence like "the driver can steer to the shoulder and brake." Delete the driver and every one of those rows is falsified simultaneously. The hazard did not change. The rating did.

That is not a philosophical point; it moves ASIL. With S and E held constant, a row that was S3/E4/C2 at ASIL C becomes S3/E4/C3 at ASIL D the moment there is no occupant who can intervene. ASIL D pulls in a different set of ISO 26262-5 hardware architectural metric targets (SPFM at least 99%, LFM at least 90%, PMHF under 10 FIT), different ISO 26262-6 method tables, and independent confirmation measures at the highest rigor under ISO 26262-2. You do not get to remove the driver and keep the old ASIL allocation.

ISO 21448:2022 (SOTIF) §6 and §7, because the driver was also the fallback for functional insufficiency — the human whose intervention converted "the perception stack did not understand this scene" from a hazardous event into an anecdote. SOTIF's whole Area 2/Area 3 framework (known and unknown hazardous scenarios) implicitly assumes a fallback exists. When the fallback is a remote operator over a cellular link, the fallback has its own latency distribution, its own availability, its own failure modes, and — per the Houston report — its own accident history.

SAE J3016 matters for one word: fallback. A Level 4 ADS performs the dynamic driving task fallback itself and achieves a minimal risk condition without human intervention. That is a requirement on the ADS, not a description of it. If a human is in the loop for any part of the fallback — including the joystick, including teleoperation — then either the fallback allocation is wrong or the human is an undeclared element of the safety architecture.

UL 4600 is the standard that would have forced this into the open. Its safety-case structure demands an explicit claim, argument and evidence chain, including for the operational design domain, the fallback strategy, and — pointedly — assumption validity over time. An FMVSS inapplicability determination is exactly the kind of assumption UL 4600 asks you to state, justify, monitor, and re-validate. That is what AQ26002 is: an external audit of an assumption that nobody internally was required to re-open.

And on the federal side, the clean framing is this. FMVSS 101 (controls and displays), 108 (lamps, including certain driver-visible telltales), 111 (rear visibility, whose test object is verified against a driver's view), and 135 (brake controls) are not arbitrary. Each one is a risk control measure allocated to the human operator. Certifying them "inapplicable" does not delete the hazard those standards were written against. It performs an allocation transfer: the control migrates from human to machine. The engineering obligation that follows is to show the receiving element meets or beats the transferred requirement. That obligation does not appear anywhere on a Part 567 certification label.

3. A worked snippet — the controllability ledger

Here is the HARA excerpt I would expect to see in a driverless item's Clause 6 work product. Same item, same hazards, two columns of controllability: one for the human-driven baseline the platform inherited, one for the no-controls configuration.

| ID | Hazardous event (operational situation + malfunction) | S | E | C (driver present) | ASIL | C (no controls) | ASIL | Delta | |---|---|---|---|---|---|---|---|---| | HZ-01 | Unintended deceleration in a 70 mph freeway lane with following traffic | S3 | E4 | C2 (driver accelerates / changes lane) | C | C3 | D | +1 | | HZ-02 | Loss of directional control during a lane change at 45 mph | S3 | E4 | C3 | D | C3 | D | 0 | | HZ-03 | Vehicle fails to achieve a stop at an intersection, 25 mph urban | S3 | E4 | C2 (driver brakes) | C | C3 | D | +1 | | HZ-04 | Vehicle creeps forward with a cabin door not fully closed, depot, walking speed | S2 | E3 | C1 (occupant releases pedal) | A | C3 | C | +2 | | HZ-05 | Reverse manoeuvre with a person in the rear blind zone, parking lot | S3 | E3 | C2 (driver checks mirror, FMVSS 111 view) | B | C3 | C | +1 | | HZ-06 | Manual joystick command executed against stale surround-camera imagery, depot | S2 | E2 | n/a — mode does not exist with driver | — | C3 | B | new row |

Two things fall out of that table. First, four of six rows escalate on controllability alone. Second, HZ-06 does not exist in the inherited HARA at all, because the operating mode does not exist in the inherited item definition. New mode, new row, new requirements, new verification.

And here is the fault tree for the top event that the joystick discovery actually opened up. Not "the ADS crashes" — that tree is well trodden. This one is about the manual path.

TOP: Unintended vehicle motion during depot manual-control mode
     (occupant or bystander in the swept path)
                     |
                  [ OR ]
       ________________|________________________
      |                |                        |
  IE-1 Command      IE-2 Situational        IE-3 Authority
  integrity fault   awareness fault         boundary fault
      |                |                        |
   [ OR ]           [ OR ]                   [ OR ]
      |                |                        |
  BE-1 Touch       BE-4 Surround-camera     BE-7 Manual mode
  input mis-       frame stale / frozen     entered while
  registered on    (observed: side views    cabin occupied
  split display    frozen on prior          by a rider
      |            location)                    |
  BE-2 Command     BE-5 No indication to     BE-8 Manual mode
  latency over     the operator that a       has no speed
  the UI stack     tile is not live          or torque cap
  exceeds budget       |                     distinct from ADS
      |            BE-6 Depot bystander          |
  BE-3 No dead-    outside all camera        BE-9 No physical
  man / release-   coverage at the           E-stop reachable
  to-stop on the   relevant standoff        by a bystander
  virtual control                            in the swept path

Every basic event on that tree is a requirement that either exists in Tesla's file or does not. From the outside I cannot tell you which. What I can tell you is that BE-4 and BE-5 are visible in a publicly posted video, and that a stale camera tile presented without a staleness indicator is a textbook ISO 26262-9 §7 dependent failure candidate and an ISO 26262-6 Annex D data-freshness gap at the same time.

An AIAG-VDA style row for the same defect, if you prefer the FMEA framing:

| Failure mode | Effect | S | Cause | O | Current detection control | D | AP | |---|---|---|---|---|---|---|---| | Surround-view tile presented from a cached frame in manual-control mode | Operator commands motion against a scene that no longer exists; contact with bystander | 9 | Camera pipeline retains last-good frame on feed loss; no staleness gate at the render layer | 4 | None identified — no visible timestamp, no greying, no mode inhibit | 8 | High |

Severity 9 because the harm is contact injury with no occupant protection for the person outside the vehicle. Detection 8 because the only detection control on the record is a human noticing that a picture has stopped changing.

4. Derived requirements (excerpt)

Stable IDs, numeric where numeric is possible, each traceable to a row above.

CC-SR-001 (ASIL B, from HZ-06 / BE-7). Manual control mode shall be inhibited unless all of the following are simultaneously true: vehicle is inside a geofenced depot polygon, all cabin doors report closed, occupant-detection reports zero occupants, and an authenticated maintenance credential is presented. Entry into manual control mode with any condition unmet shall be refused and logged. Verification: HIL fault injection across all 16 condition permutations plus vehicle-level test at the depot boundary.

CC-SR-002 (ASIL B, from BE-8). In manual control mode the commanded longitudinal speed shall be limited to 1.5 m/s and commanded longitudinal acceleration to 0.8 m/s², enforced by a monitor independent of the touchscreen application and executing on a separate processing element. Verification: independent monitor fault injection; measured speed shall not exceed 1.65 m/s at any point including the actuator overshoot transient.

CC-SR-003 (ASIL B, from BE-3). The virtual control shall implement release-to-stop: loss of continuous touch contact for more than 250 ms shall command zero torque and apply service braking to a full stop within 0.5 s. Loss of the UI heartbeat for more than 500 ms shall produce the same result. Verification: touch-release timing test across the full display temperature range; heartbeat starvation injection.

CC-SR-004 (ASIL B, from BE-4 / BE-5). Every camera tile rendered in manual control mode shall carry a frame-age gate. A tile whose newest frame is older than 200 ms shall be visually degraded and annotated as stale; a tile older than 1000 ms shall inhibit motion commands entirely. Verification: frame-injection test with controlled staleness at 150, 250, 900 and 1100 ms.

CC-SR-005 (ASIL D, from HZ-01 / HZ-03, allocation transfer). For each FMVSS requirement determined inapplicable on the basis of absent manual controls, the item definition shall record the hazard the requirement addressed, the element the corresponding risk control is now allocated to, the ASIL of that allocation, and the verification evidence that the receiving element meets or exceeds the original performance. Verification: traceability audit; zero unallocated transfers permitted at the certification gate.

CC-SR-006 (QM, process, from the FMVSS 135 NPRM). No braking command originating outside the vehicle shall be capable of actuating the service or parking brake. Remote assistance shall be limited to route-level and goal-level inputs that the on-board ADS may accept, defer or reject; the on-board system retains sole authority over the brake actuator. Verification: interface-level penetration test against the teleoperation channel; static analysis of the actuator command path for external entry points.

CC-SR-006 is the one I would put first in the binder, because it is the only one on this list that a proposed federal rule already states nearly verbatim, and because a remote operator has already crashed one of these vehicles.

5. What the headline really tells us

The headline is "feds investigate Tesla's steering-wheel-free robotaxi." The engineering content is quieter and more portable than that.

Every safety standard written before autonomy assumed a human operator, and that assumption is load-bearing in places nobody documented. The human is the fallback in SAE J3016, the controllability credit in ISO 26262-3, the Area 2 mitigation in ISO 21448, and the addressee of half the FMVSS. Remove the human and none of those obligations vanish — they all become allocations to something else, and an allocation you have not written down is an allocation you have not verified.

AQ26002 is not really an investigation into a vehicle. It is an external audit of a set of assumptions, arriving because no internal process was obliged to re-open them. That is the missing artifact: not a monitor, not a mechanism, but a transfer ledger — one row per requirement that used to point at a person, saying where it points now and who proved it holds.

The virtual joystick is what makes this a story rather than a policy debate. It is the counter-example sitting inside the claim. The certification rests on the absence of manual driving controls; the vehicle contains a manual driving control; the mode it lives in appears nowhere in any public description of the item. It may well be entirely defensible. But the way you find that out is by opening the item definition and looking for the operating mode — and if it is not in there, the audit has already found what it came for.

Sources

Jherrod Thomas — The Lion of Functional Safety™. Certified ISO 26262 Functional Safety Expert, ISO/SAE 21434 (TÜV SÜD), SOTIF Advanced, PMP.