A design concept exploring how vehicles can earn — not assume — driver trust when handing off control to the system. The core challenge: trust is invisible, relational, and deeply human.
Level 3 autonomy sits in a uniquely precarious position in the SAE stack. Unlike L2, where the driver remains the primary operator, or L4/L5, where the system takes full responsibility, L3 creates a shared custody arrangement — the system drives, but the human must be ready to take back control within seconds when requested.
This is not a technical handover problem. It is a human-machine relationship problem. The system must first earn enough trust for the driver to disengage — and then maintain that trust throughout the trip so the driver remains in the right cognitive state to re-engage when called.
"Over-trust leads to complacency. Under-trust means the system is never used. The design goal is calibrated trust — accurate mental models held by a human who is never fully out of the loop."
The design challenge is therefore not "how do we alert the driver?" It is: how do we build an ongoing, dynamic dialogue between human and machine — one that is legible, low-friction, and emotionally appropriate to the context of driving at highway speeds?
Human-Robot Interaction (HRI) research consistently shows that trust in autonomous agents is multi-dimensional: it encompasses competence (can it do the task?), integrity (will it behave predictably?), and benevolence (does it prioritize my wellbeing?). In L3 driving, all three must be communicated continuously — not just at activation.
L3 asks humans to be simultaneously "out of the loop" — disengaged from primary driving — while remaining "in the loop" enough to take over safely within the legal transition demand time (typically 10 seconds). Vigilance degrades rapidly in passive monitoring roles. Situation awareness — the driver's mental model of the environment — deteriorates the moment active attention is redirected.
The design system must do two things in tension: reduce unnecessary cognitive load during L3, while simultaneously maintaining enough ambient awareness that the takeover request doesn't arrive as a complete surprise.
Lee & See (2004) define trust calibration as the alignment between a person's trust in a system and the system's actual capability. HMI design in L3 must actively surface system capability and limitation — making the invisible visible — so the driver can maintain an accurate mental model at all times.
Continuous system confidence signals — road type eligibility, sensor confidence, weather limits — surfaced non-intrusively at DIM and HUD level.
Predictable activation / deactivation flows. Consistent notification patterns across trips. Every system-initiated event has a clear, readable rationale.
Handover requests are always framed as the system prioritizing driver safety, not failure. Tone, timing, and language are calibrated to feel supportive rather than alarming.
Endsley's three-level SA model (perception → comprehension → projection) predicts that out-of-the-loop drivers will have degraded Level 2 and 3 SA. Notification design must compensate — not by flooding the driver with information, but by efficiently restoring situation awareness at the moment it is needed.
Effective L3 notification is not about being loud — it is about being appropriately legible at the right moment. The system is designed around three scenarios: L3 activation, driver-initiated deactivation, and system-initiated takeover request (TOR).
The three modalities are layered by urgency. During routine L3, only ambient visual cues are active. As TOR urgency increases, haptic is added (5–7s before deadline), then audio (3s before deadline). This progression respects the driver's activity without treating every moment as an emergency.
"The most important notification is the one that doesn't feel like an intrusion until it needs to."
The decision to surface L3 activation as a dedicated hardware control on the steering wheel — rather than through the center console or voice — is grounded in three principles: physicality conveys commitment, haptic confirmation closes the action loop, and separation from other controls prevents accidental activation.
Located on the left spoke, within thumb reach from natural grip position. Flush-mount with distinct tactile texture. A 1.5-second press-and-hold prevents accidental activation. LED ring mirrors the DIM L3 status bar color in real time — giving peripheral-visible confirmation of system state without requiring a glance at the cluster.
The physical button also communicates something conceptual: L3 is a distinct mode deserving its own affordance. Giving it dedicated physical real estate signals — to the driver, to regulators, and to the broader ecosystem — that the transition between human and machine control is treated with appropriate gravity.
The L3 status bar is a persistent, low-prominence UI element spanning the lower edge of the DIM and mirrored as a thin band at the bottom of the HUD. Its purpose is ambient awareness — always visible, never demanding attention.
The fill level during TOR encodes remaining time as a draining bar rather than a digit countdown — spatial metaphors are processed faster and more intuitively than numeric ones under stress. The amber-to-red gradient shift reinforces urgency without requiring the driver to interpret a number.
When L3 activates, the Surround View (SR) and camera feeds undergo a deliberate simplification. The goal is not to hide information — it is to recalibrate the information environment to match what the system now owns versus what the human needs to track.
In L3, adjacent vehicle tracking is consolidated — only immediate-lane actors are surfaced. Secondary overlays (blind spot warnings, lane guidance) are suppressed because the system owns those responsibilities. This deliberate visual quieting communicates trust: the system is handling it.
"Showing less is a design statement. It says: we've got this. You don't need to watch every car."
The front camera transitions from a narrow driver-perspective angle to a wider situational overview when L3 activates. On TOR, the camera snaps back to the tight driver-perspective view within 1.5 seconds, pre-cuing the returning sense of agency.
L3 never activates without an explicit driver action. The system may suggest activation, but the human always initiates. Trust is built on the foundation of agency, not convenience.
Every state transition is communicated first at the ambient level. Urgency escalates only as deadline approaches. The system is never the first thing to raise its voice.
When L3 cannot activate or must deactivate, it says why — in plain language. "Road type not supported" is more trust-preserving than a silent exit from the mode.
The TOR is designed as a handshake, not a handoff. The system provides time, information, and physical cue. The human confirms with a press or a touch of the wheel. Both parties are active.
Each L3 session is a fresh calibration opportunity. Consistent behavior across trips — same patterns, same language, same timing — compounds into durable, well-calibrated trust over time.
L3 design forced me to think about what happens when nothing is happening. The most critical design moment isn't the takeover — it's the 20-minute stretch of highway driving where the driver slowly, imperceptibly drifts out of the loop. Designing ambient awareness isn't glamorous. But it is where the safety of the system is actually won or lost.
This shifted how I think about HMI generally: the job is not just to communicate events, but to maintain a continuous, honest relationship between person and system — one that doesn't demand attention but is always truthful about what's happening and why.
HRI research humbles you. The literature on over-trust, complacency, and the OOTL effect makes clear that no amount of careful UX design fully solves the psychophysiology of human attention. The most important principle I took from this project: design for the worst-case driver state that is still within the legal envelope of L3 use, not the attentive ideal.