Counting Ghosts
ADAS has a diagnosis problem, not a detection problem
Since 2009 I have personally experienced dozens of false automatic emergency braking events. Different brands, different continents, different sensor generations — same jolt, same adrenaline spike, same thought afterward: the engineer who wrote that trigger rule will never know this happened.
That last part is the scandal. Not the false positive itself — perception is hard, physics is unforgiving, and a system tuned to never miss a real pedestrian will sometimes brake for a shadow. The scandal is that seventeen years into the ADAS era, the event dies in the driver's memory. It never travels back to the person who caused it. The algorithm's author sits in an ivory tower with a validation report that says the system passed, while the road keeps generating evidence that it didn't.
This month, someone finally started counting the ghosts.
What Thatcham found
Autocar's 15 July 2026 issue reports on Thatcham Research's event-based ADAS test programme — real cars, instrumented with roof lidar and interior cameras, driven for weeks on ordinary British roads rather than a proving ground. Thatcham, notably, spent over two decades inside Euro NCAP before leaving this year to run its own real-world programme.
Two findings deserve to reshape how the industry talks about driver assistance.
First, the metric mirage. Intelligent speed assist is regulated today on accuracy over distance travelled. Measured that way, the worst car in Thatcham's fleet scored a comfortable-sounding 91.3%. Measured event-based — at the moments where the speed limit actually changes, which is where the system earns its keep — the same car dropped to 74.3%. Wrong at one in four decisive moments. Even the best performer fell from roughly 98% to 90% when the yardstick changed. The regulated metric and the real-world experience are two different quantities that happen to share a name.
Second, the ghost-braking asymmetry. Across the same test regime, one vehicle logged 122 unnecessary braking events; the other two logged eight and six. Thatcham's engineers read this as sensitivity deliberately tuned beyond the regulation — a system that avoids crashing but irritates its owner into switching it off. Which is the quiet catastrophe of the whole category: a safety feature that gets disabled delivers exactly zero safety, no matter what its homologation certificate says.
Anyone who drives a modern car recognizes the texture of these findings. The indeterminate bongs. The steering tug for a pedestrian who was never in danger. The braking for a bus that had already cleared the lane. Thatcham has now put numbers on the annoyance — 4TB of data, six thousand tagged events, thousands of miles across highway, country and urban roads.
Detection without diagnosis
Here is what I find most interesting: even this programme — the most honest ADAS evaluation being run anywhere in public — can count events but cannot explain them.
Thatcham can tell you the car ghost-braked 122 times. It cannot tell you why event #47 happened: which sensor input, which fusion decision, which planner threshold. It cannot tell you whether the OEM's next software release fixes event #47 or merely reshuffles the failure distribution. And its only verification instrument is to drive another four and a half thousand miles and count again. Three cars, weeks of driving, terabytes of storage — to observe a sample that any single OEM's fleet reproduces before breakfast.
That is detection without diagnosis. It is the state of the art, and it is an open loop.
The closed loop is not exotic. Every field event with recorded context can be reconstructed as a simulation scenario. A reconstructed scenario can be systematically mutated — remove the roadside truck, shift the sun angle, swap the sign — until the trigger isolates itself. An isolated trigger becomes a named root cause. A named root cause becomes a regression test that sits in the release gate forever, so the ghost can never return unnoticed. This is how we learned to build operating systems and databases: every crash in the field becomes a test case in the suite. Automotive perception is the last major software discipline where field failures are allowed to evaporate.
Through the lens of the data flywheel, this is the missing left edge of the wheel. We talk endlessly about fleet data training better models — and the next generation of end-to-end driving models will indeed drive more like humans precisely because they learn from how humans drive and where machines fail. But a flywheel with no intake spins on nothing. The false positive is the single most information-dense artifact a fleet produces: it marks the exact coordinates where the model's world diverges from the world. Today we throw it away.
The lever that will actually move OEMs
The second thing Thatcham understands — and says out loud — is why a manufacturer would ever engage with this. Subjective complaints bounce off. Objective event logs tied to insurance economics do not. Thatcham holds the keys to motor insurance risk rating in the UK, and it is explicit that manufacturers listen when something threatens their customer base.
This lever already exists at industrial scale. Swiss Re and BMW built the ADAS Risk Score in 2018 precisely because insurers could not keep reassessing every manufacturer's safety features; the score feeds underwriting and pricing, Toyota's insurance arm joined the platform, and Swiss Re openly aims to make it an industry standard. Note what the score is built from: manufacturer specifications, real-world testing, claims portfolios — and computer simulation. The insurance industry already accepts simulated evidence as a rating input. The pipeline from "explained event" to "moved premium" is shorter than most engineering leaders realize.
So the commercial logic assembles itself. Event-based field data tells you where a system fails. Simulation-grounded forensics tells you why, and proves when it is fixed. Insurance rating converts that proof into money — a lower risk score, a stronger warranty position, a feature drivers keep switched on instead of off. For the first time, making ADAS genuinely pleasant to live with has a direct P&L expression rather than a soft "customer satisfaction" one.
The prescription
If I ran validation at an OEM or a Tier 1 tomorrow, four rules:
- Adopt event-based metrics internally before regulators force them on you. The distance-weighted average is a comfort blanket. Your customers live at the change points.
- Treat every field false positive as a defect with a name, not as noise. If it was worth braking for, it is worth root-causing.
- Close the loop in simulation. Replay, mutate, isolate, regress. Re-driving public roads to verify a fix is 1970s methodology with 2020s storage costs.
- Take the evidence to your insurer, not just your regulator. The rating table is where honest engineering finally gets paid.
Seventeen years of being braked at by ghosts taught me patience. Thatcham's programme suggests the industry's patience is ending too. The cars can already see ghosts. It is time someone named them.
Thomas Mueller writes The Un-Engineering Lens at unengineering.ai. Findings referenced from Autocar (15 July 2026) reporting on Thatcham Research's event-based ADAS programme, and from published Swiss Re / BMW Group ADAS Risk Score material. Views are his own.
