Christian Bolzmacher1*
Sabrina Panëels1
Céphise Louison1
Carlos Hidalgo2
Mauricio Marcano2
Sergio Diaz2
Margarita Anastassova1- 1Université Paris-Saclay, CEA, List, Palaiseau, France
- 2TECNALIA, Basque Research and Technology Alliance (BRTA), Derio, Spain
Understanding how passengers interpret information in shared autonomous shuttles requires Human-Machine Interfaces (HMIs) that support trust, safety, and privacy across both routine and non-routine situations. This study presents an integrated evaluation of an audio-visual HMI through an online survey (N = 66) and a preliminary real-world field study (N = 12). Across both contexts, passengers preferred concise, context-dependent communication, with brief multimodal cues judged most effective for conveying upcoming manoeuvres, degraded modes, and emergency events. Transparency in vehicle-to-passenger communication, such as timely indications of system state and manoeuvre intent, was generally well received. In contrast, transparency in passenger-to-passenger visibility, such as displaying other passengers’ entry or exit locations, was rejected by both genders, although women showed stronger privacy sensitivity and greater perceived vulnerability to such exposure. Women also expressed a higher preference for discreet, non-confrontational security features. These findings demonstrate that effective HMI design for shared autonomous mobility must distinguish between system transparency and interpersonal information exposure, supporting controlled information asymmetry and privacy-protective security mechanisms. The study provides empirically grounded directions for developing inclusive and trustworthy HMIs for future autonomous public transport.
1 Introduction
Autonomous shuttles are rapidly emerging as a transformative component of urban mobility ecosystems, offering efficient, low-emission, and accessible transport solutions for short- to medium-range travel (Golbabaei et al., 2021; Iclodean et al., 2020; Bucchiarone et al., 2020). Pilot deployments in cities worldwide, from Europe to Asia and North America, have demonstrated their potential to complement public transit networks and provide first- and last-mile connectivity (Bucchiarone et al., 2020; Nesheli et al., 2021; Debbaghi et al., 2025; Milakis et al., 2017). As these systems transition from experimental trials to wider public operation, effective communication between the vehicle and its passengers becomes a decisive factor for acceptance. Such communication is essential not only for wayfinding and usability but also for fostering trust, perceived safety, and a sense of control in a novel driverless context (Wintersberger et al., 2021; Walker et al., 2023; Nordhoff et al., 2018; Nordhoff et al., 2020; Yan et al., 2023; Yan et al., 2024; Wirtz et al., 2024; Kuck et al., 2025).
In traditional public transportation systems such as buses, trains, and airplanes, passengers often rely on direct human interaction with drivers or staff, which implicitly communicates both control and safety (Lee and See, 2004; Nordhoff et al., 2018). Even in automated rail systems, a sense of safety is maintained through physical infrastructure constraints, such as fixed tracks and enclosed stations, which clearly define the vehicle’s path and expected behaviour (Merat et al., 2018). In contrast, autonomous shuttles operate in open mixed traffic environments without predefined rails and typically accommodate only a small number of passengers (see Figure 1 for a shuttle example) without a driver’s visible oversight (Oliveira et al., 2018; Petermann and Papachristos, 2023; Schrank et al., 2024). These factors increase the need for reliable, transparent, and context-sensitive human-machine interfaces (HMIs), particularly in degraded or emergency situations (Enjalbert et al., 2021; Brandt et al., 2024).
Figure 1. Pixis Robobus, an autonomous shuttle used in the real-world simulated user study (left) and interior design with HMI (right).
A growing body of research confirms that HMI transparency and clarity play a pivotal role in building user trust and acceptance in automated systems (Lee and See, 2004; Walker et al., 2023; Verberne et al., 2012; Wintersberger et al., 2021; Körber et al., 2018; Wirtz et al., 2024). Visualizations of vehicle intent, detected objects, or decision logic improve comprehension and reduce anxiety (Oliveira et al., 2020; Wang et al., 2024; Kuck et al., 2025), yet most prior work has focused on driver-oriented rather than passenger-oriented contexts. Similarly, auditory and visual warnings can support rapid comprehension in critical manoeuvres, but their emotional tone and timing require careful balance to avoid alarm or overload (Graham, 1999; Politis et al., 2015). These findings suggest that autonomous shuttle HMIs must go beyond informational accuracy to support affective and situational communication, which is helping passengers to feel both informed and reassured.
While recent research on external HMIs (eHMIs) has substantially advanced understanding of how automated vehicles communicate intent to pedestrians and cyclists, these efforts primarily address interactions outside the vehicle. Studies consistently show that clear visual signalling of yielding intent or vehicle awareness improves pedestrian trust and crossing behaviour (Izquierdo et al., 2023; Merat et al., 2018; Albawaneh et al., 2024; Schieben et al., 2019; Abdulrazaq and Fan, 2025; Rothenbücher et al., 2016). Although external HMIs have been widely examined, internal HMIs for driverless shuttles have received comparatively less attention, despite their importance for passenger comfort, situational awareness, and reassurance. Addressing this imbalance requires treating internal and external communication as complementary components of a coherent HMI strategy.
While progress has been made on general information- and safety-related transparency (Hörold et al., 2015; Luger-Bazinger et al., 2021; Mirnig et al., 2019; Huff et al., 2020; Zhu et al., 2025; Zhong et al., 2024; Luo et al., 2025; Britten et al., 2023; Grobelna et al., 2025), security-oriented interactions remain underexplored. Shared Automated Mobility-on-Demand (SAMoD) services introduce psychosocial complexities, such as co-passenger behaviour, harassment risk, or vandalism, that strongly affect perceived security (Lee et al., 2024; Pervez et al., 2025; Flohr et al., 2024). The absence of a driver, a perceived deterrent to crime, has been shown to heighten passengers’ sense of vulnerability and risk of victimization, reducing willingness to use autonomous shuttles or shared services especially at night (Carter, 2005; Paes-Machado and Viodres-Inoue, 2017; Salonen, 2018; Pervez et al., 2025; Tsiktsiris et al., 2024). These psychosocial dynamics are further shaped by gender and situational context, with female passengers reporting greater comfort when visible security measures, such as surveillance cameras or emergency alerts, are present (Pervez et al., 2025; Flohr et al., 2024; Tsiktsiris et al., 2024). Studies in public transport and autonomous mobility contexts confirm that visible security provisions, such as closed-circuit television (CCTV) systems, remote operator access, or panic buttons, substantially enhance perceived safety and acceptance (Orozco-Fontalvo et al., 2019; Loukaitou-Sideris, 2014; Mayas et al., 2024). Yet, such transparency can raise privacy and data-protection concerns, calling for calibrated communication strategies. Despite growing recognition of these concerns, secure-by-design approaches that integrate physical panic buttons, reporting features, remote operator linkage, and adaptive visibility remain scarce (Schrank et al., 2024; Kettwich et al., 2021; Lee et al., 2024).
Recent work also points to the need for adaptive multimodal HMIs (Luo et al., 2025; Zhu et al., 2025; Wang et al., 2024) that adjust their information load and modality to the current driving state such as normal, degraded, or emergency modes. Studies on trust dynamics indicate that combining concise visual and auditory cues fosters confidence more effectively than over-detailed explanations (Smith et al., 2023; Walker et al., 2023). However, few studies have systematically examined these principles in a fully driverless, shared passenger setting, where users cannot rely on a human operator’s guidance.
In this context, safety refers to vehicle control, crash avoidance, and passive safety systems (e.g., seatbelts, airbags), whereas security encompasses interpersonal risks, vandalism, and cybersecurity.
The present study addresses this gap by exploring how passengers interpret, evaluate, and emotionally respond to HMI communication. Using both an online survey and a real-world closed-circuit study, we investigated:
• What types of information passengers expect to receive during normal, degraded, and emergency diving conditions;
• How they perceive clarity, trustworthiness, and reassurance of different audio-visual communication modalities; and
• How security and privacy considerations shape acceptance of shared driverless mobility.
The remainder of this paper is structured as follows: Chapter 2 presents the design principles and methodological approach used to develop and evaluate the audio-visual HMIs. Chapter 3 describes the results of the online questionnaire and the real-world user study in an autonomous shuttle. Chapter 4 provides a general discussion of the findings, highlighting their implications for passenger trust, clarity of communication, and perceived security. This chapter also outlines design recommendations. Chapter 5 describes the limitations of this work. Finally, Chapter 6 concludes the work and future research directions for passenger-facing HMIs in shared autonomous transport are given.
2 Methodology
This study employed a two-stage mixed-methods approach consisting of an online survey and a preliminary real-world evaluation of an autonomous shuttle. The online survey aimed to collect broad user expectations and preferences regarding HMI communication strategies in shared autonomous mobility, while the real-world evaluation investigated how selected HMI concepts performed under ecologically valid ride conditions. Both study components were approved by the CEA Digital Ethics Committee and conducted in accordance with GDPR data protection requirements.
2.1 Online survey
2.1.1 Questionnaire design and structure
The online questionnaire was developed to assess passengers’ expectations for HMI communication across routine operations, degraded modes, emergency manoeuvres, and security- and privacy-related situations. The design followed established principles of transparency, accessibility, and safety communication in automated systems, and drew on prior research on trust calibration and situational awareness (e.g., Lee and See, 2004; Oliveira et al., 2020; Smith et al., 2023).
To enhance ecological validity, audio-visual mock-ups (Figure 2) were integrated into the survey. These scenarios illustrated different driving conditions and HMI responses and adhered to international accessibility and HMI standards (IEEE C37.1.3, 2025; ISO 9241-210, 2019; ISO/TR 21959-1, 2018; ISO 15005, 2017; CEUD-Universal Design Approach, EN 301 549, 2017). The questionnaire was pilot-tested with five individuals, resulting in minor adjustments to item clarity and scenario descriptions.
Figure 2. Screen examples shown in the online survey. From upper left to lower right: normal screen, at station screen, augmented view screen, degraded mode screen, emergency stop - stay inside shuttle screen, and emergency stop–leave shuttle screen.
The final survey contained four thematic blocks:
• Normal Driving Conditions
Evaluation of preferred information formats (visual, audio, combined) for route updates, stop announcements, system status, and travel progress.
• Reduced Visibility and Degraded Modes
Expectations regarding compensatory feedback (e.g., augmented views, intensified cues) and communication clarity during temporary functional degradation.
• Safety and Emergency Manoeuvres
Communication requirements during controlled stops, evasive manoeuvres, sudden braking, and stay-or-leave decisions following operational interruptions.
• Passenger Security and Privacy
Preferences regarding behavioural reminders, monitoring features, reporting mechanisms, co-passenger visibility, and privacy boundaries.
The survey included 5-point Likert scales (1 = strongly disagree, 5 = strongly agree), binary and multiple-choice questions, and open-text responses. Non-parametric analyses were applied when relevant: Mann–Whitney U tests compared median ratings between men and women, and Chi-square tests examined distributional differences across full Likert scale categories. Cramer’s V was used as the effect size metric for Chi-square tests (Agresti, 2013; Norman, 2010).
2.1.2 Participant recruitment and data collection
The survey was distributed via academic mailing lists, social networks, and mobility-related community groups. Participation was voluntary, anonymous, and open to adults aged 18 or older. Respondents provided informed consent and completed the questionnaire on the EUSurvey platform in approximately 15–20 min.
A total of 66 participants completed the survey (32 female, 34 male), aged 18–72 years (M = 38.63, SD = 12.47). Most participants were French, and only nine reported previous experience with autonomous shuttles. While 65% rarely used ride-hailing services, 82% frequently used digital journey-planning applications, indicating a generally digitally literate population.
2.2 Real-world study
2.2.1 Shuttle platform and test environment
The real-world evaluation was conducted using a Pixis Robobus autonomous shuttle operating on a private closed-circuit test track in Spain. The shuttle is a compact, fully electric vehicle designed for short-distance public transport. It measures 3.82 m × 1.90 m × 2.26 m, accommodates four seated passengers, and is equipped with drive-by-wire steering, four permanent magnet synchronous motors, 360° LiDAR, and dual GNSS antennas.
Communication was provided through a 72.6 cm internal display and an integrated audio system placed on the opposite side of the shuttle’s doors. The HMI presented information such as route progress, manoeuvre announcements, degraded mode notifications, and emergency instructions (Figure 3). Physical emergency buttons were also available and simulated using a Wizard-of-Oz procedure.
Figure 3. Screens shown inside the shuttle during the real-world simulated testing. From upper left to lower right: normal screen with augmented view, degraded mode with reduced speed for technical reasons showing the announcement at the centre, emergency brake screen, evasive manoeuvre screen, leave the shuttle screen for an emergency evacuation, and exit the shuttle screen in cases of an overcrowded vehicle.
2.2.2 Experimental procedure
The study followed a structured two-phase trajectory (Figure 4) consisting of routine driving followed by simulated degraded and emergency scenarios. For each session, three participants entered the shuttle alongside an operator who controlled the vehicle via joystick at a maximum speed of 15 km/h.
Figure 4. Test circuit in Spain with the different scenario trajectories.
Before departure, passengers received safety reminders (seatbelt, capacity limits) through the HMI’s audio-visual cues. The first phase (blue trajectory) simulated regular service operation with two stops. The HMI displayed typical travel information including contextual details (weather, time), an augmented view of the surroundings, and stop announcements.
The second phase (red trajectory) introduced non-routine conditions. A “degraded mode” notification appeared on the screen, followed by an evasive manoeuvre, a sudden emergency brake, and finally a simulated malfunction leading to a complete stop. Dedicated HMI screens were triggered for each event, including visual cues and short audio messages. An evacuation instruction screen was displayed at the final stop to represent a stay-or-leave scenario.
Security-related features (e.g., emergency reporting button, external assistance signal) were demonstrated through Wizard-of-Oz simulation only; these functions were not connected to operational infrastructure.
After the ride, participants completed an online questionnaire evaluating clarity, usefulness, and perceived appropriateness of the various HMI displays for normal driving, degraded modes, emergency manoeuvres, and security functions. Except for demographic items, responses followed 5-point Likert scales.
2.2.3 Participants and data collection
Twelve participants (11 male, 1 female), all employees of TECNALIA and authorised to operate or evaluate the vehicle, took part in the study. Although technically trained in automated mobility systems, none specialised in HMI design, making them representative of informed end-users rather than domain experts.
Participants ranged from 25 to 64 years old (M = 35.4, SD = 10.3) and represented four nationalities (Spanish, German, Portuguese, Italian). Most reported sporadic use of ride-hailing services and frequent use of digital mobility tools. Data were collected anonymously through an online post-ride questionnaire administered immediately after each test session.
3 Results
This chapter presents the findings from the two complementary phases of the study (online survey and real-world closed-circuit evaluation). Results are structured according to the four thematic categories defined in the study design: normal driving conditions, degraded modes, safety and emergency manoeuvres, and security and privacy aspects.
3.1 Online survey results
The following subsections summarise the quantitative and qualitative results obtained from the online survey. Each set of findings corresponds to one of the operational or critical scenarios presented to participants through audio-visual mock-ups (Figure 2).
3.1.1 Normal driving conditions
The first thematic block examined participants’ preferences for visual and auditory HMI feedback during regular service conditions. Results showed that most participants (48/66) preferred the route map and stop information to be combined on a single display, rather than separated. Respondents reported that simultaneous access to spatial orientation cues and contextual information, such as stop names, remaining travel time, and nearby landmarks, enhanced clarity and situational awareness. A large majority (58/66) supported displaying the remote operator’s contact number on the HMI for emergency assistance, and 51 participants favoured including public transport connection details. Sightseeing or contextual points of interest received moderate support (18/66), particularly for unfamiliar environments.
Regarding exit-related information, 43 participants (23 men, 20 women) opposed personalised exit announcements on the screen or by audio, while 23 supported the feature. When asked about preferred formats, 27 favoured on-screen messages, 22 preferred mobile app notifications, and 8 supported both. Only 9 participants (3 women, 6 men) opposed personalized exit information altogether. Over half (34) considered animated exit indicators unnecessary, as door movements were self-explanatory. Views on door status messages were divided, 27 found them not useful, 6 were neutral, 10 preferred only closing alerts, and 23 preferred both opening and closing messages. For safety communication when leaving the autonomous shuttle, most participants (28) favoured a combined safety message including “Mind the step” and “Be cautious of vehicles, cyclists, and pedestrians.” Thirteen preferred only traffic warning, seven only the step reminder, three were indifferent, and twelve preferred no message.
For audio communication, most respondents (37/66) had no preference for the voice gender used in shuttle announcements. Over half (42/66) preferred audio messages both before each stop and after new passengers boarded, indicating a need for regular and timely updates. A majority (44/66) did not support ambient music inside the shuttle, favouring a quiet environment. Preferences for audio feedback in a single selected language were mixed, with 25 supporting this option, while open comments highlighted the need for flexible multilingual options. Slightly more than half of the participants (36/66) considered audio interaction with a remote operator useful, particularly for emergencies or clarification needs. Respondents suggested that such a feature should be available but optional, accessed via a dedicated HMI function.
Overall, the findings indicate that participants valued clear and concise visual feedback, unified route information, minimal non-essential animations, and reliable audio announcements, with optional access to human assistance when necessary.
3.1.2 Reduced visibility and degraded modes
This set of survey items examined HMI preferences during reduced visibility and degraded operational modes. Participants evaluated an augmented view showing nearby vehicles, pedestrians, and upcoming manoeuvres under adverse weather such as snow, fog, rain, or strong sunlight. Most participants (46/66) reported that the augmented view increased their trust in the shuttle’s driving capabilities, while 12 disagreed and 8 remained neutral. Even under normal driving conditions, 49 participants considered the augmented view useful, indicating its general benefit for situational awareness.
For degraded mode scenarios, where the shuttle reduced speed due to technical or GNSS issues, participants considered being informed essential (55/66). Nearly all respondents (60/66) wanted a clear visual indication on the degraded mode status, with 31 preferring a short explanatory note about the reason for the speed reduction, often paired with colour coding for clarity. Regarding audio feedback, 47 participants supported announcements during degraded modes, primarily at the onset of the event and after each stop, 10 opposed this and 9 were neutral. Open comments suggested that frequent audio updates were unnecessary unless required for accessibility or user preference. Ambient music was generally rejected (54/66).
Overall, participants favoured augmented visual representations, clear indicators of degraded modes, and concise optional audio feedback, with limited tolerance for frequent or intrusive announcements.
3.1.3 Safety and emergency manoeuvres
This subsection focuses on communication preferences during preventive safety manoeuvres (e.g., route deviations, slowing down) and fast, reactive emergency manoeuvres (e.g., emergency braking or evasive actions).
For general safety manoeuvres, participants expressed moderate interest in being informed about the occurrence of these events (1 strongly disagreed, 12 disagreed, 16 neutral, 22 agreed, and 15 strongly agreed), but showed a strong preference for understanding the underlying reasons. Most respondents wanted clear explanations for route deviations (61 agreed or strongly agreed, 3 neutral, 2 disagreed) and traffic-related delays (48 agreed or strongly agreed, 9 neutral, 9 disagreed), including estimated time impacts.
Regarding highly dynamic emergency manoeuvres, the majority of participants (53/66) indicated that being informed about the occurrence of such events increased their sense of safety, while 7 disagreed and 6 were neutral. Preferred communication modalities included voice messages (36/66), visual icons (33/66), and short visual text messages (29/66). Pure audio warnings such as tones or alarms were least preferred (15/66). Participants favoured automatic alerts at the start and end of emergency events to maintain situational awareness without excessive detail. Open comments highlighted that the brief duration of emergency manoeuvres (reaction times typically under one second) makes concise audio-visual cues more practical than full verbal explanations. Some respondents noted potential limitations for visually impaired users, suggesting that a combination of modalities may be necessary to ensure accessibility.
Overall, participants preferred contextual explanations for general safety events and brief multimodal alerts for highly dynamic emergency manoeuvres.
3.1.4 Emergency stop on the road due to technical failure or road crash
This section covers participants’ responses to emergency stop scenarios in which the shuttle instructed passengers to either stay inside or exit the vehicle following a technical failure or road crash.
3.1.4.1 Emergency stop–stay inside the shuttle
Participants viewed an HMI showing an orange border, an emergency stop message, and subsequent remote operator feedback. A large majority (57/66) considered the message clear and comprehensible, and 52/66 found the audio-visual cues reassuring. Most participants expressed a preference for receiving detailed information, including the cause of the stop (58/66), estimated delay (56/66), remote operator contact options (50/66), and the location of incoming assistance (46/66). Some participants suggested additional features such as visual indicators of operator connection status, response-time countdowns, and external camera views to maintain situational awareness, as well as masking non-essential HMI elements during emergencies to keep focus on the alert message.
Voice preferences were slightly in favour of female or neutral tones (43/66 combined), while most participants preferred adaptive updates triggered by changes in assistance status (44/66), rather than fixed periodic announcements. Participants also preferred direct human contact with calling via the shuttle interface (58/66) or smartphone (43/66), over text-based chat features.
Overall, participants valued clear explanations, visual reassurance, and direct operator contact during emergency stops requiring passengers to remain inside.
3.1.4.2 Emergency stop–exit the shuttle
Participants evaluated an HMI with a red border and textual instructions to evacuate the shuttle safely. Responses regarding reassurance from audio-visual cues were mixed, with 21 agreed or strongly agreed, 23 neither agreed nor disagreed, and 22 disagreed or strongly disagreed. While some participants appreciated structured guidance clarifying evacuations steps, others reported that strong visual cues (e.g., flashing red borders) increased stress. Participants emphasized the need for calm, clear, and structured instructional messages, along with contextual updates about the cause of the incident and ongoing rescue operations. Visual support such as exit animations was found helpful by 36 participants, neutral by 21, and unhelpful by 9. Voice preferences again showed a mild inclination toward female or neutral tones (42/66 combined). Maintaining a communication channel outside the shuttle was considered useful by 37 participants, suggesting continued reassurance is important after evacuation. Suggestions for encouraging passengers to stay nearby the shuttle included external displays, audio updates, door locking mechanisms to prevent re-entry, and comfort provisions, reflecting the perceived importance of authority, control, and situational guidance.
Overall, participants supported calm, guided communication, visual and auditory cues for evacuation steps, and continued external communication once outside the shuttle.
3.1.5 Passenger security, behaviour monitoring, and privacy
Ensuring passenger security in fully autonomous shuttles extends beyond technical safety to include social order, interpersonal trust, and privacy management in shared spaces. In the absence of an onboard driver, the system itself becomes the mediator of norm compliance, conflict prevention, and situational awareness. This section summarises participant responses to behaviour regulation and conformity, aggression reporting, and security-privacy balance.
3.1.5.1 Passenger conformity and behaviour regulation
Participants evaluated how the HMI should promote cooperative passenger behaviour in situations such as overcrowding, seatbelt non-compliance, and the accommodation of bulky items or mobility aids. A strong majority (58/66) supported displaying overcrowding warnings, and 54 endorsed remote operator intervention if self-regulation failed within 2 minutes. Dynamic visual cues, such as colour changes or animations, were widely accepted (43/66), suggesting that increased visual salience is an effective non-verbal signalling method. Nearly all participants (64/66) favoured targeted seatbelt reminders that appear only when necessary, and most (46/66) expected operator involvement if compliance does not follow. For bulky items or mobility aids, 52 respondents agreed that designated zones should be clearly indicated on the HMI, and the same number supported operator assistance when conflicts arise.
These results suggest that passengers view the HMI as an acceptable tool for behavioural regulation, provided communication remains clear, calm, and supported by human oversight.
3.1.5.2 Passenger security and aggression scenarios
Participants rated the perceived usefulness of four HMI-based aggression reporting mechanisms shown in Figure 5, including a physical emergency button connected to a remote operator, a button triggering an external visual alert, a mobile phone application, and a voice-activated keyword (e.g., “Help”).
Figure 5. Distribution of Likert-scale ratings for different aggression reporting tools.
Across all participants, the button connected to a remote operator received the highest usefulness rating (Median (Mdn), = 5.0). The external visual alert button, the mobile application, and audio with keyword activation followed, each with median ratings of 4.0. This indicates general support for direct, human-supervised reporting methods. Gender-based analysis revealed marginally significant differences for the mobile application only as summarised in Table 1, with women rating it as more useful than men (χ2 = 9.415, df = 4, p = 0.051; U = 378, p = 0.060). For the external visual alert button, women demonstrated slightly higher preference than men, though this difference did not reach statistical significance (χ2 = 6.368, df = 4, p = 0.095; U = 623, p = 0.275). The button connected to a remote operator and audio with keyword activation showed virtually identical ratings across genders (both p > 0.40).
Table 1. Gender differences in aggression reporting (emergency) HMI preferences with Mean, Median, Mann–Whitney U test, Probability value p, Chi-square test χ2.
Overall, participants preferred immediate operator contact during aggression scenarios, with gender effects limited to marginal trends.
3.1.5.3 Security and privacy concerns
This subsection examined perceptions of privacy and co-passenger transparency (summarised in Figure 6; Table 2). Participants evaluated statements concerning knowledge of co-passengers, display of exit locations, and visibility of boarding/exiting events.
Figure 6. Responses by gender on the information about other passengers during reservation (top) and security feeling by gender when enter/exit information is provided on the HMI by means of a map (bottom).
Table 2. Descriptive and inferential statistics for security and privacy concerns (N = 66) with Mean, Median, Mann–Whitney U test, Probability value p, Chi-square test χ2.
When asked whether they wanted to know the gender of co-passengers at reservation, women expressed higher agreement (62.5%) than men (44.1%), although the difference did not reach statistical significance (U = 419, p = 0.108; χ2 (2, N = 66) = 4.27, p = 0.118). Median ratings reflected this trend (women = 3.0, men = 2.0). While not statistically conclusive, the pattern suggests that women may place greater emphasis on co-passenger transparency.
Regarding the display of anonymised exit locations inside the shuttle, both genders showed similar levels of opposition (women: 37.5% in favour; men: 32.4%). No significant gender differences emerged (U = 528, p = 0.832; χ2 (1, N = 66) = 0.194, p = 0.66). This uniformity suggests that privacy concerns, and specifically, the risk of identification through location patterns, override any potential security benefits of sharing exit locations, even when anonymized. Both genders appear to prioritize protecting their movement data from public exposure.
The third statement addressed whether participants felt more secure when others knew when they boarded or exited the shuttle. Men expressed significantly higher agreement (Mean = 3.06, SD = 0.95, Mdn = 3.0) compared to women (Mean = 2.41, SD = 1.07, Mdn = 2.5). The gender difference was statistically significant (U = 336, p = 0.005; χ2 (4, N = 66) = 13.43, p = 0.009), representing a medium effect size. This finding underscores a fundamental gender divide: Men associate visibility with security (e.g., being accounted for reduces perceived risk), while women associate visibility with vulnerability (e.g., sharing movement data increases exposure to potential harm).
Participants’ preferences, without pointing to possible security concerns, for receiving personalized exit messages further illustrate the privacy-security dynamic. Both genders favoured the in-vehicle screen (women: 50%, men: 41%), a public but impersonal channel, over the mobile app (women: 34%, men: 32%), which may feel more intrusive. Notably, more men (18%) than women (6%) opted for both modalities, and men were also more likely to reject notifications entirely (18% vs. 9%), suggesting greater comfort with either full visibility or full privacy.
Overall, findings show that privacy and security preferences vary by context and gender, with consistent caution regarding public exposure of movement-related data.
3.2 Real-world evaluation results
The real-world evaluation complemented the online survey by observing passengers’ reactions to the HMI concepts during simulated driving scenarios on a closed test track. Participants directly experienced the timing, physical movement, and sensory effects associated with normal driving, safety-relevant manoeuvres, emergency stops, and simulated security events. Figure 3 illustrates the HMI screens, message layouts, and multimodal feedback elements shown during the trials. The following subsections report self-reported and observed reactions for each operational category. Methodological details are provided in Chapter 2.
3.2.1 Normal driving state
Participants generally evaluated the normal-driving HMI positively. Regarding information sufficiency, 3 participants strongly agreed, 7 agreed, and 2 were neutral (median = 4.0, IQR = 1), indicating that the display was perceived as well balanced.
The augmented external view, visualising the shuttle’s perception of its surroundings, was also well received. Most participants agreed that it enhanced confidence in the shuttle’s autonomous driving functions. Open comments suggested that only contextually relevant elements, such as nearby road users, obstacles, or upcoming manoeuvres, should be displayed to maintain clarity.
Overall, the normal-driving interface was seen as informative without being intrusive, and the augmented view was identified as a key contributor to transparency and trust.
3.2.2 HMIs for safety-relevant driving manoeuvres
Participants generally felt safe during safety-relevant manoeuvres such as emergency braking or evasive actions. More than half agreed or strongly agreed that the level of information provided by the HMI was sufficient to maintain confidence in the shuttle’s operation (see Figure 7). A strong preference emerged for transparency in system behaviour: 11 of 12 participants agreed that any deviation from the planned route should be communicated in real time, and the same number supported displaying the reason for an unplanned stop (e.g., traffic jam or technical issue).
Figure 7. Real-world testing user feedback on safety-related questions.
Regarding the clarity of safety-related instructions during an emergency brake or evasive manoeuvre, 9 of 11 participants found the messages clear and easy to follow, and 10 of 12 indicated that being informed about emergency manoeuvres improved their overall perception of safety. Qualitative comments suggested enhancing feedback with specific causes of degraded operation (e.g., “sensor failure” or “obstacle detected”) to further strengthen trust.
Across safety-relevant manoeuvres, concise multimodal messages were effective in supporting situational awareness under time-critical conditions.
3.2.3 HMIs for emergency stops on the road
Two emergency stop scenarios were tested: one instructing passengers to remain inside the shuttle and another requiring them to exit.
Most participants (8/12) found the instructions clear and easy to follow (Figure 8). The majority (8/12) also reported feeling reassured by the information shown during the stop.
Figure 8. Real-world testing user feedback on emergency stop screens.
Qualitative feedback identified several areas for improvement. Participants described the emergency stop “exit” screen as overly alarming due to prominent red colouring and blinking elements. They recommended using calmer colour tones and consistent visual patterns to support reassurance under stress. Two participants expressed the need for information about the cause and expected duration of the stop, including updates from the remote operator.
Participants found the emergency-stop HMI generally effective but preferred calm visual design and additional contextual updates, particularly regarding timing and cause.
3.2.4 HMIs related to security-related events such as aggressions inside the shuttle
The final scenario tested HMI features related to security events, including rule violations and potential interpersonal tension or simulated aggression as shown in Figure 9.
Figure 9. Responses related to security-related events such as aggressions and devices for reporting inside the shuttle.
Most participants found emergency and security-related features easy to locate and understand, though one noted limited screen readability from a steep seating angle.
Responses were mixed regarding the ease of reporting a security concern. One participant strongly disagreed, two disagreed, six neither agreed nor disagreed, and three agreed that it was difficult to report an incident using the available HMIs. Suggested improvements included larger icons, clearer labelling, and multiple reporting-button locations.
Eight of twelve participants agreed that the presence of onboard security devices increased their overall sense of security, while four remained neutral. This result is consistent with the online-survey findings, indicating that visible and easily accessible safety features, particularly those enabling rapid contact with an operator, enhance perceived safety in shared autonomous shuttles.
Regarding behavioural guidance (e.g., seatbelt use, overcrowding messages), 9 of 12 participants found the messages clear and effective. One participant emphasised that enforcement should be system-driven rather than peer-driven to avoid interpersonal tension.
Overall, participants valued clear behavioural guidance and easily accessible reporting options, highlighting the importance of ergonomics and non-confrontational communication in shared autonomous transport.
4 General discussion
This study provides an integrated evaluation of HMIs in passenger-facing shared autonomous shuttles, combining an online survey (N = 66) with a constrained real-world trial (N = 12). Together, the findings extend prior HMI research, largely centred on driver-based autonomous vehicles, to the passenger domain, revealing how trust, cognitive comport, and security interact in driverless shared mobility. Three main themes emerge: (1) context-sensitive transparency as foundation of trust, (2) clear, calm multimodal communication as a determinant of cognitive and emotional comfort, and (3) gendered privacy-security trade-offs shaping perceptions of safety.
4.1 Trust through context-sensitive transparency
Findings across both studies emphasise that transparency fosters trust only when it is context-sensitive, selective, and meaningfully timed. Participants consistently valued being informed about what the vehicle perceived and why it acted, but rejected constant or overly detailed data displays. Instead, they preferred adaptive transparency like short explanations of degraded modes, nearby obstacles, or temporary slowdowns delivered at the moment of relevance. In the field trial, the top-view augmented representation was particularly effective, improving perceived system awareness and reliability (Kuck et al., 2025).
This result refines established models of trust-calibration (Lee and See, 2004; Verberne et al., 2012) and extends explainable autonomy research (Luo et al., 2025; Smith et al., 2023) to passenger contexts.
Previous studies demonstrated that visualizing vehicle perception increases driver trust (Oliveira et al., 2020; Wang et al., 2024), but our findings show that passengers seek simplified and temporally anchored explanations rather than continuous situational data. Trust, therefore, arises not from informational quantity but from informational quality namely, clarity, timing, and interpretive framing. This implies that transparency mechanisms in autonomous shuttles should prioritize timely and contextually filtered information, offering just enough explanation to enable anticipation without cognitive overload. Such calibrated transparency promotes trust as a dynamic, informed relationship rather than a static outcome.
4.2 Clarity, multimodality, and cognitive/emotional load
A second major insight concerns the manner in which information is delivered. Across safety-critical situations participants preferred short multimodal cues, typically a brief tone or very short voice message paired with a clear icon, over longer, verbal explanations. In emergency manoeuvres, such as rapid braking, these concise multimodal alerts were judged to be both comprehensible and reassuring, whereas intense visual warnings (e.g., flashing red) were frequently described as stressful or alarming. Calm, neutral visual language was consistently perceived as more trustworthy.
This pattern supports the two-stage communication model proposed in multimodal warning research (Graham, 1999; Jacob et al., 2011; Politis et al., 2015; Zhong et al., 2024; Saager et al., 2024), where an initial pre-attentive alert is followed by a concise explanatory phase once the situation stabilises. Our findings extend this model to autonomous shuttle passengers, highlighting that emotional regulation is integral to effective information design. Overly salient alerts may inadvertently signal loss of control, while measured, calm feedback conveys competence and reliability. Passenger HMIs should employ layered communication strategies such as immediate multimodal alerts followed by concise explanations balancing salience and calmness. These insights can refine existing standards such as IEEE C37.1.3, 2025, ISO 15005, 2017; ISO/TR 21959-1, 2018 by adding explicit guidance for affect-sensitive passenger information design (Yan et al., 2023).
4.3 Privacy, security, and social safety: gendered dimensions of information visibility
While Sections 4.1 and 4.2 addressed trust-building through context-sensitive transparency and affect-sensitive communication between vehicle and passenger, this section examines a distinct dimension of HMI design, namely, the information dynamics between passengers in shared autonomous mobility. Our findings reveal that transparency principles effective for vehicle-to-passenger communication do not straightforwardly translate to passenger-to-passenger information architectures, and that visibility, often framed as a universal trust mechanism, operates through fundamentally different psychological pathways for men and women.
4.3.1 Beyond vehicle-centred transparency–social information dynamics
Prior HMI research, including findings from Sections 4.1 and 4.2, has predominantly theorized transparency as vehicle-system explainability with what the vehicle perceives, why it acts, and how passengers should interpret its behaviour (Lee and See, 2004; Oliveira et al., 2020; Luo et al., 2025; Mirnig et al., 2019). This vehicle-centred paradigm assumes a single passenger or treats all passengers as informationally equivalent. However, shared autonomous vehicles introduce horizontal information flows, with the potential visibility of one passenger’s data to other passengers, that activate different trust and privacy mechanisms than vertical vehicle-to-passenger communication.
Our findings show that while passengers welcomed context-sensitive transparency about vehicle behaviour (Section 4.1), they uniformly rejected transparency about personal movement patterns when visible to co-passengers. Both genders opposed public display of personalized exit locations (p = 0.66-0.83), despite accepting private exit notifications via individual screens or mobile devices. This divergence reveals a critical distinction absent from current HMI frameworks, the difference between functional personalization (private, navigation-aiding information) and social exposure (public, pattern-revealing information). The former aligns with the calibrated transparency principles identified in Section 4.1, delivering relevant information when needed, while the latter introduces privacy costs without corresponding functional gain.
This distinction extends privacy calculus models to shared physical mobility contexts (Dinev et al., 2006; Schomakers et al., 2022), demonstrating that privacy trade-offs involve not only data collection by system operators (vertical privacy) but also information exposure to co-passengers (horizontal privacy). Existing privacy-by-design frameworks in vehicle contexts (Cavoukian, 2009; Spiekermann and Cranor, 2008; Benyahya et al., 2022) have not adequately theorized these horizontal information dynamics, representing a significant gap as autonomous vehicles increasingly operate in shared-use configurations.
4.3.2 Visibility as a gendered security mechanism
The most significant finding concerns how visibility functions differently as a security mechanism across genders. Men expressed significantly higher comfort with others knowing their entry/exit times, suggesting they frame visibility as a deterrent, where social observation acts as a form of accountability that enhances safety. Women’s opposition to the same visibility suggests a perception of vulnerability, where social observation is seen as increasing exposure to potential threat. This divergence challenges prevailing assumptions in autonomous vehicle security design, which often treat visibility as uniformly beneficial (Nordhoff et al., 2019a; Nordhoff et al., 2019b).
The empirical grounding for this divergence is substantial, with 67%–90% of women worldwide report experiencing sexual harassment on public transit (Ceccato and Loukaitou-Sideris, 2022; Tiznado-Aitken and Sagaris, 2024; Cowan and Liu, 2025; Ariel et al., 2025), with 85%–90% of incidents unreported due to fear of retaliation or lack of accessible mechanisms (Natarajan et al., 2017; Smith et al., 2008). Women’s resistance to movement visibility reflects rational risk assessment based on documented threat prevalence, not irrational privacy concern. For populations experiencing systematic harassment, visibility does not function as the trust-building transparency mechanism, but rather as a vulnerability amplifier.
This gendered divergence introduces complexity to transparency frameworks. While Section 4.1 established that trust arises from informational quality such as clarity, timing, and interpretive framing, the findings for security-related aspects demonstrate that for passenger-to-passenger information, trust for women may require strategic opacity such as the intentional concealment of personal data from co-passengers. Effective security HMI must therefore balance transparent communication with authorities (enabling rapid response) and opaque communication shielded from potential aggressors (preventing vulnerability exploitation) using a dual-layer architecture not yet theorized in autonomous vehicle design literature.
4.3.3 Information asymmetry and configurable visibility
A marginally significant trend (p = 0.11) suggested women may prefer to be informed about other passengers and their gender during the reservation process while rejecting exposure of their own data, which means desired information asymmetry of knowing without being known. This preference for advance information aligns with established compensatory strategies women employ to mitigate perceived vulnerability in public transport contexts (Loukaitou-Sideris, 2014; Ceccato and Loukaitou-Sideris, 2022; Useche et al., 2024). Though not reaching statistical significance, this directional pattern warrants theoretical consideration as it challenges assumptions of information reciprocity embedded in many sharing platforms, which presume mutual transparency as foundational to trust (Hawlitschek et al., 2016). In contexts with documented gendered threat patterns, configurable asymmetry, where users can access aggregated information about others (e.g., “3 passengers, mixed gender”) without exposing granular personal data, may better serve vulnerable users’ security needs than symmetric transparency models. This approach represents a novel extension of privacy as contextual integrity (Nissenbaum, 2004) and selective disclosure principles (Palen and Dourish, 2003) to shared autonomous mobility, where security and privacy co-constitute rather than trade off against one another.
4.3.4 Rethinking security reporting: affect-sensitive and non-confrontational design
Section 4.2 established that passengers prefer multimodal alerts that balance salience with emotional calm, avoiding intense warnings that signal loss of control. Security reporting mechanisms reveal a parallel principle, where effective emergency communication requires strategic invisibility to co-passengers while maintaining direct channels to authorities.
Physical emergency buttons connected to operators (and relevant authorities) received uniformly high ratings, while voice-activated systems were less priortised despite extensive research positioning voice as a primary HMI modality (Nobili et al., 2023; Ceccato and Loukaitou-Sideris, 2020; Siripanich, 2020). This difference likely stems from recognition that voice activation requires verbal articulation during high-stress situations, may alert potential aggressors to reporting activity, and may fail due to ambient noise or emotional distress. The marginally significant gender difference for mobile applications (p ≈ 0.05, women more favourable) suggests women particularly value self-initiated, technology-mediated reporting or action (such as re-routing the shuttle to a save place) that avoids direct confrontation, aligning with documented underreporting patterns where fear of retaliation prevents help-seeking (Natarajan et al., 2017; Smith, 2008). Just as Section 4.2 demonstrated that calm, measured feedback conveys system competence, our findings show that silent, discreet security mechanisms convey passenger empowerment. Security HMIs must enable reporting without broadcasting vulnerability, a principle of affect-protective communication that extends Section 4.2’s affect-sensitive design framework from vehicle behaviour explanation to interpersonal threat management.
Together, these findings contribute to emerging discussions on secure-by-design principles in autonomous mobility (Schrank et al., 2024; Kettwich et al., 2021; Lee et al., 2024), illustrating that security mechanisms must address both technical and psychosocial threats. The observed gender differences highlight that transparency, privacy, and perceived safety are co-dependent constructs rather than trade-offs.
4.4 Design guidelines derived from this work
The results of this study provide actionable insights for designing HMIs in driverless shared shuttles. These guidelines emphasize context sensitivity, affective stability, and inclusive security as key pillars of user-centred design.
4.4.1 Context-sensitive and selective information presentation
Information displayed to passengers should be timely, relevant, and minimal. Displays should prioritise functional content such as upcoming manoeuvres, surrounding traffic, or temporary system degradations while avoiding redundant or decorative data. Over-information can dilute situational awareness and increase cognitive load, whereas concise, context-specific cues reinforce system transparency and user trust. Interfaces should allow dynamic adjustment of information density according to trip phase and user preference, consistent with the principle of calibrated transparency established in this study.
4.4.2 Multimodal and affect-sensitive communication
Safety-critical feedback is most effective when multimodal and emotionally neutral. Short auditory signals combined with simple visual symbols were perceived as less stressful and more comprehensible than lengthy voice announcements or high-contrast warning displays. Colour schemes and animation patterns should convey urgency without inducing alarm; calm, consistent visual design supports reassurance and perceived control. This affect-protective communication is particularly important during emergency stops or degraded driving conditions.
4.4.3 Privacy, security, and configurable visibility
Security and privacy mechanisms should be designed for discretion as well as redundancy. Physical emergency buttons (coupled to remote operators, police or relevant authorities, and automated video recordings), subtle external indicators, and optional mobile app notifications were preferred over conspicuous or purely voice-based reporting channels. Interfaces must also recognise gendered differences in perceived security and visibility: women in particular valued knowing without being known. Configurable visibility settings, allowing passengers to access aggregated co-passenger information (e.g., “three passengers, mixed gender”) without disclosing personal or locational data, should replace one-size-fits-all transparency models. These findings underscore the need for horizontal privacy-by-design strategies, complementing established data protection frameworks.
4.4.4 Inclusive, accessible, and adaptive HMI standards
HMI design should comply with relevant accessibility and human-centred standards (IEEE C37.1.3, 2025, ISO 15005, 2017; ISO/TR 21959-1, 2018; EN 301 549:2021). Beyond compliance, systems should support user-controlled transparency, enabling passengers to personalise information modality, density, and feedback intensity according to individual needs and sensitivities. Such adaptive interfaces foster inclusivity, comfort, and trust across diverse passenger groups and situational contexts.
5 Limitations of the study
Both the online survey and real-world evaluation offer valuable but exploratory insights. The online survey (N = 66) provided gender balance but limited demographic representativeness, while participants assessed static HMI concepts rather than interactive systems, reducing ecological validity. The real-world study, though immersive, involved only twelve participants, mostly male engineers, restricting diversity and statistical power. Both studies relied on self-reported Likert data in controlled settings, which may not fully reflect behavioural or emotional responses in real traffic environments.
Several trends approached but did not reach significance suggesting potential gender effects that warrant confirmation with larger and more diverse samples. Broader cultural contexts should also be examined, as privacy norms and security perceptions vary regionally. Moreover, the binary gender classification used here excludes non-binary and transgender experiences, which future studies should address. Finally, behavioural and usability studies with operational autonomous vehicles are needed to validate how specific HMI design choices, such as screen placement, timing, and anonymisation, affect real-world trust, comfort, and safety.
6 Conclusion
This study integrated findings from an online survey (N = 66) and a real-world field test (N = 12) to identify user expectations for human–machine interfaces (HMIs) in shared autonomous shuttles. Three overarching themes emerged: (1) preferences for clear, context-sensitive multimodal communication; (2) mechanisms that sustain trust and reassurance during degraded or emergency scenarios; and (3) privacy, security, and gendered perceptions of social safety.
Across both studies, passengers valued timely, concise information that clarified vehicle intentions without overwhelming or alarming them. Multimodal cues, particularly brief auditory tones or short voice messages paired with calm visual indicators, were regarded as the most effective means of maintaining situational awareness and trust. At the same time, the findings showed that transparency principles effective in vehicle-to-passenger communication do not translate directly to passenger-to-passenger visibility. For many women, increased visibility of personal movement data heightened perceived vulnerability rather than trust, indicating that security in shared mobility depends on controlled information asymmetry and discreet, non-confrontational reporting mechanisms.
This work advances HMI research by extending transparency and privacy-by-design frameworks to socially complex shared-ride contexts. It demonstrates that effective communication in autonomous public transport must balance functional clarity, emotional reassurance, and differentiated privacy needs. Future research should validate these findings with larger and more diverse samples, examine cultural and gender variations in perceived safety, and conduct behavioural field trials in open-traffic environments. Such work will be essential for developing inclusive, trustworthy, and secure HMIs for next-generation autonomous mobility services.
Data availability statement
The datasets presented in this article are not readily available because they contain sensitive personal data collected under strict confidentiality agreements that do not allow unrestricted third-party sharing. Requests to access the datasets should be directed to the corresponding author, and will be considered on a case-by-case basis in accordance with ethical and legal requirements.
Ethics statement
The studies involving humans were approved by CEA’s digital ethics committee (20 November 2024). The studies were conducted in accordance with the local legislation and institutional requirements. The participants provided their written informed consent to participate in this study.
Author contributions
CB: Conceptualization, Data curation, Formal Analysis, Visualization, Writing – original draft. SP: Formal Analysis, Methodology, Validation, Writing – original draft. CL: Software, Validation, Visualization, Writing – review and editing. CH: Formal Analysis, Investigation, Visualization, Writing – review and editing. MM: Methodology, Software, Supervision, Validation, Writing – review and editing. SD: Software, Validation, Visualization, Writing – review and editing. MA: Formal Analysis, Methodology, Supervision, Validation, Writing – review and editing.
Funding
The authors declare that financial support was received for the research and/or publication of this article. This project has received funding from the European Union’s Horizon research and innovation programme under grant agreements 101076868 and 101187937.
Conflict of interest
The authors declare that the research was conducted in the absence of any commercial or financial relationships that could be construed as a potential conflict of interest.
Generative AI statement
The authors declare that no Generative AI was used in the creation of this manuscript.
Any alternative text (alt text) provided alongside figures in this article has been generated by Frontiers with the support of artificial intelligence and reasonable efforts have been made to ensure accuracy, including review by the authors wherever possible. If you identify any issues, please contact us.
Publisher’s note
All claims expressed in this article are solely those of the authors and do not necessarily represent those of their affiliated organizations, or those of the publisher, the editors and the reviewers. Any product that may be evaluated in this article, or claim that may be made by its manufacturer, is not guaranteed or endorsed by the publisher.
References
Abdulrazaq, M. A., and Fan, W. (2025). A priority based multi-level heterogeneity modelling framework for vulnerable road users. Transp. Sci., 1–34. doi:10.1080/23249935.2025.2516817
Albawaneh, A., Nugent, B., Mayangamutse, P., Veeramachaneni, A., and Kim, H. (2024). “External human-machine interface for robotaxis,” in 2024 IEEE conference on virtual reality and 3D user interfaces abstracts and workshops (VRW) (IEEE), 257–258.
Ariel, B., Ceccato, V., McDonnell, A., and Webster, K. (2025). Experiences and reporting of unwanted sexual behaviors on great Britain’s rail network: a survey of victims and witnesses with an embedded randomized vignette experiment on callback effects. Vict. and Offenders 20 (7), 1228–1257. doi:10.1080/15564886.2024.2330094
Benyahya, M., Kechagia, S., Collen, A., and Nijdam, N. A. (2022). The interface of privacy and data security in automated city shuttles: the GDPR analysis. Appl. Sci. 12 (9), 4413. doi:10.3390/app12094413
Brandt, T., Wilbrink, M., and Oehl, M. (2024). Transparent internal human-machine interfaces in highly automated shuttles to support the communication of minimal risk maneuvers to the passengers. Transp. Res. Part F Traffic Psychol. Behav. 107, 275–287. doi:10.1016/j.trf.2024.09.006
Britten, N., Johns, M., Hankey, J., and Kurokawa, K. (2023). Do you trust me? Driver responses to automated evasive maneuvers. Front. Psychol. 14, 1128590. doi:10.3389/fpsyg.2023.1128590
Bucchiarone, A., Battisti, S., Marconi, A., Maldacea, R., and Ponce, D. C. (2020). Autonomous shuttle-as-a-service (ASaaS): challenges, opportunities, and social implications. IEEE Trans. Intelligent Transp. Syst. 22 (6), 3790–3799. doi:10.1109/tits.2020.3025670
Carter, M. (2005). Gender differences in experience with and fear of crime in relation to public transport. in Research on women’s issues in transportation, Chicago, IL, 100.
Cavoukian, A. (2009). “Privacy by design: the 7 foundational principles,”, 5. Inf. Privacy Commissioner Ont. 12.
V. Ceccato, and A. Loukaitou-Sideris (2020). Transit crime and sexual violence in cities: international evidence and prevention 1st edn. New York: Routledge. doi:10.4324/9780429290244
Ceccato, V., and Loukaitou-Sideris, A. (Editors) (2022). Fear of sexual harassment and its impact on safety perceptions in transit environments: a global perspective. Violence Against Women 28 (1), 26–48. doi:10.1177/1077801221992874
CEUD-Universal Design Approach, EN 301 549 (2017). Customer communications toolkit for the public service - a universal design approach. Available online at: https://universaldesign.ie/products-services/customer-communications-toolkit-for-the-public-service-a-universal-design-approach/customer-communications-toolkit-for-the-public-services-a-universal-design-approach.pdf.
Cowan, G., and Liu, P. (2025). Rethinking transit safety: understanding and addressing gender-based harassment and enhancing safety on san francisco’s muni transit system. Transp. Res. Rec. 2679 (1), 1642–1661. doi:10.1177/03611981241255603
Debbaghi, F. Z., Rombaut, E., and Vanhaverbeke, L. (2025). Lessons learned from shared automated vehicles pilots in Europe: an evaluation of safety, traffic, and user acceptance. Case Stud. Transp. Policy 20, 101447. doi:10.1016/j.cstp.2025.101447
Dinev, T., Bellotto, M., Hart, P., Russo, V., Serra, I., and Colautti, C. (2006). Privacy calculus model in e-commerce–a study of Italy and the United States. Eur. J. Inf. Syst. 15 (4), 389–402. doi:10.1057/palgrave.ejis.3000590
EN 301 549 (2021). European’s commission accessibility requirements for ICT products and services. Available online at: https://accessible-eu-centre.ec.europa.eu/content-corner/digital-library/en-3015492021-accessibility-requirements-ict-products-and-services_en.
Enjalbert, S., Gandini, L. M., Pereda Baños, A., Ricci, S., and Vanderhaegen, F. (2021). Human–machine interface in transport systems: an industrial overview for more extended rail applications. Machines 9 (2), 36. doi:10.3390/machines9020036
Flohr, L. A., Schuß, M., Wallach, D. P., Krüger, A., and Riener, A. (2024). Designing for passengers' information needs on fellow travelers: a comparison of day and night rides in shared automated vehicles. Appl. Ergon. 116, 104198. doi:10.1016/j.apergo.2023.104198
Golbabaei, F., Yigitcanlar, T., and Bunker, J. (2021). The role of shared autonomous vehicle systems in delivering smart urban mobility: a systematic review of the literature. Int. J. Sustain. Transp. 15 (10), 731–748. doi:10.1080/15568318.2020.1798571
Graham, R. (1999). Use of auditory icons as emergency warnings: evaluation within a vehicle collision avoidance application. Ergonomics 42 (9), 1233–1248. doi:10.1080/001401399185108
Grobelna, I., Mailland, D., and Horwat, M. (2025). Design of automotive HMI: new challenges in enhancing user experience, safety, and security. Appl. Sci. 15 (10), 5572. doi:10.3390/app15105572
Hawlitschek, F., Teubner, T., and Gimpel, H. (2016). “Understanding the sharing economy--Drivers and impediments for participation in peer-to-peer rental,” in 2016 49th Hawaii international conference on system sciences (HICSS) (IEEE), 4782–4791.
Hörold, S., Mayas, C., and Krömker, H. (2015). Interactive displays in public transport–Challenges and expectations. Procedia Manuf. 3, 2808–2815. doi:10.1016/j.promfg.2015.07.932
Huff Jr, E. W., Lucaites, K. M., Roberts, A., and Brinkley, J. (2020). “Participatory design in the classroom: exploring the design of an autonomous vehicle human-machine interface with a visually impaired co-designer,”, 64. Proc. Hum. Factors Ergonomics Soc. Annu. Meet. Sage CA: Los Angeles, CA SAGE Publications, 1921–1925. doi:10.1177/1071181320641463
Iclodean, C., Cordos, N., and Varga, B. O. (2020). Autonomous shuttle bus for public transportation: a review. Energies 13 (11), 2917. doi:10.3390/en13112917
IEEE C37.1.3 (2025). IEEE approved draft recommended practice for human machine interfaces (HMIs) used with electric utility automation systems. IEEE.
ISO 15005 (2017). International organization For standardization, 2009. Road vehicles-ergonomic aspects of transport information and control systems-specifications and test procedures for In-vehicle visual presentation. Geneva, Switzerland: International Organization for Standardization.
ISO 9241-210 (2019). Ergonomics of human-system interaction—part 210: human-centred design for interactive systems. Geneva, Switzerland: International Organization for Standardization.
ISO/TR 21959-1 (2018). Road vehicles — human performance and comfort in automated driving systems — part 1: terms, concepts, and frameworks. Geneva, Switzerland: International Organization for Standardization.
Izquierdo, R., Martín, S., Alonso, J., Parra, I., Sotelo, M. A., and Fernaádez–Llorca, D. (2023). “Human-vehicle interaction for autonomous vehicles in crosswalk scenarios: field experiments with pedestrians and passengers,” in 2023 IEEE 26th international conference on intelligent transportation systems (ITSC) (IEEE), 2473–2478.
Jacob, R., Shalaik, B., Winstanley, A. C., and Mooney, P. (2011). “Haptic feedback for passengers using public transport,” in International conference on digital information and communication technology and its applications (Berlin, Heidelberg: Springer Berlin Heidelberg), 24–32.
Kettwich, C., Schrank, A., and Oehl, M. (2021). Teleoperation of highly automated vehicles in public transport: user-centered design of a human-machine interface for remote-operation and its expert usability evaluation. Multimodal Technol. Interact. 5 (5), 26. doi:10.3390/mti5050026
Körber, M., Baseler, E., and Bengler, K. (2018). Introduction matters: manipulating trust in automation and reliance in automated driving. Appl. Ergonomics 66, 18–31. doi:10.1016/j.apergo.2017.07.006
Kuck, I., Wagner-douglas, L., Wirtz, L., and Ladwig, S. (2025). An autonomous shuttle for everyone: what information do users need when using shuttles? Intelligent Hum. Syst. Integration (IHSI 2025) Integrating People Intelligent Syst. 160 (160). doi:10.54941/ahfe1005861
Lee, J. D., and See, K. A. (2004). Trust in automation: designing for appropriate reliance. Hum. Factors 46 (1), 50–80. doi:10.1518/hfes.46.1.50.30392
Lee, J., Mao, R., and Pervez, A. (2024). Perceived risk of crime on driverless public bus and ride-pooling services in China. Travel Behaviour Society 35, 100730. doi:10.1016/j.tbs.2023.100730
Loukaitou-Sideris, A. (2014). Fear and safety in transit environments from the women’s perspective. Secur. Journal 27 (2), 242–256. doi:10.1057/sj.2014.9
Luger-Bazinger, C., Zankl, C., Klieber, K., Hornung-Prähauser, V., and Rehrl, K. (2021). Factors influencing and contributing to perceived safety of passengers during driverless shuttle rides. Future Transportation 1 (3), 657–671. doi:10.3390/futuretransp1030035
Luo, X., Ding, F., Panda, R., Chen, R., Loo, J., and Zhang, S. (2025). ““What’s Happening” — a human-centred multimodal interpreter explaining the actions of autonomous vehicles,” in WACV workshops 2025.
Mayas, C., Sheibani, R., and Hirth, M. (2024). Expectations of emergency communication systems in autonomous bus shuttles. Hum. Factors Des. Eng. Comput. 159 (159). doi:10.54941/ahfe1005780
Merat, N., Louw, T., Madigan, R., Wilbrink, M., and Schieben, A. (2018). What externally presented information do VRUs require when interacting with fully automated road transport systems in shared space? Accid. Analysis and Prev. 118, 244–252. doi:10.1016/j.aap.2018.03.018
Milakis, D., Van Arem, B., and Van Wee, B. (2017). Policy and society related implications of automated driving: a review of literature and directions for future research. J. Intelligent Transportation Systems 21 (4), 324–348. doi:10.1080/15472450.2017.1291351
Mirnig, A. G., Gärtner, M., Wallner, V., Trösterer, S., Meschtscherjakov, A., and Tscheligi, M. (2019). “Where does it go? A study on visual on-screen designs for exit management in an automated shuttle bus,” in Proceedings of the 11th international conference on automotive user interfaces and interactive vehicular applications, 233–243.
Natarajan, M., Schmuhl, M., Sudula, S., and Mandala, M. (2017). Sexual victimization of college students in public transport environments: a whole journey approach. Crime Prev. Community Saf. 19 (3–4), 168–182. doi:10.1057/s41300-017-0025-4
Nesheli, M. M., Li, L., Palm, M., and Shalaby, A. (2021). Driverless shuttle pilots: lessons for automated transit technology deployment. Case Studies Transport Policy 9 (2), 723–742. doi:10.1016/j.cstp.2021.03.010
Nissenbaum, H. (2004). Privacy as contextual integrity. Wash. L. Rev. 79, 119. Available online at: https://digitalcommons.law.uw.edu/wlr/vol79/iss1/10.
Nobili, M., Gonnella, M. T., Mazza, B., Lombardi, M., and Setola, R. (2023). Review of measures to prevent and manage aggression against transport workers. Saf. Science 166, 106202. doi:10.1016/j.ssci.2023.106202
Nordhoff, S., de Winter, J., Madigan, R., Merat, N., van Arem, B., and Happee, R. (2018). User acceptance of automated shuttles in berlin-schöneberg: a questionnaire study. Transp. Res. Part F Traffic Psychol. Behav. 58, 843–854. doi:10.1016/j.trf.2018.06.024
Nordhoff, S., de Winter, J., Payre, W., Van Arem, B., and Happee, R. (2019a). What impressions do users have after a ride in an automated shuttle? An interview study. Transp. Res. Part F Traffic Psychol. Behav. 63, 252–269. doi:10.1016/j.trf.2019.04.009
Nordhoff, S., Kyriakidis, M., Van Arem, B., and Happee, R. (2019b). A multi-level model on automated vehicle acceptance (MAVA): a review-based study. Theor. Issues Ergonomics Science 20 (6), 682–710. doi:10.1080/1463922x.2019.1621406
Nordhoff, S., Stapel, J., van Arem, B., and Happee, R. (2020). Passenger opinions of the perceived safety and interaction with automated shuttles: a test ride study with ‘hidden’ safety steward. Transp. Research Part A Policy Practice 138, 508–524. doi:10.1016/j.tra.2020.05.009
Norman, G. (2010). Likert scales, levels of measurement and the “laws” of statistics. Adv. Health Sciences Education 15 (5), 625–632. doi:10.1007/s10459-010-9222-y
Oliveira, L., Luton, J., Iyer, S., Burns, C., Mouzakitis, A., Jennings, P., et al. (2018). “Evaluating how interfaces influence the user interaction with fully autonomous vehicles,” in Proceedings of the 10th international conference on automotive user interfaces and interactive vehicular applications, 320–331.
Oliveira, L., Burns, C., Luton, J., Iyer, S., and Birrell, S. (2020). The influence of system transparency on trust: evaluating interfaces in a highly automated vehicle. Transp. Research Part F Traffic Psychology Behaviour 72, 280–296. doi:10.1016/j.trf.2020.06.001
Orozco-Fontalvo, M., Soto, J., Arévalo, A., and Oviedo-Trespalacios, O. (2019). Women's perceived risk of sexual harassment in a bus rapid transit (BRT) system: the case of barranquilla, Colombia. J. Transp. and Health 14, 100598. doi:10.1016/j.jth.2019.100598
Paes-Machado, E., and Viodres-Inoue, S. (2017). Perception of fear and coercive management of victims of intercity bus robberies. Criminol. and Crim. Justice 17 (1), 22–39. doi:10.1177/1748895816656032
Palen, L., and Dourish, P. (2003). Unpacking privacy for a networked world. Proc. SIGCHI Conference Hum. Factors Computing Systems, 129–136. doi:10.1145/642611.642635
Pervez, A., Lee, J. J., Mao, R., and Chang, F. (2025). Perception toward autonomous ride-pooling services and public buses in Pakistan: perspectives in crime and victimization. Secur. J. 38 (1), 53. doi:10.1057/s41284-025-00504-1
Petermann, F. M., and Papachristos, E. (2023). Autonomous systems: human facing explanatory interface for an urban autonomous passenger ferry. Intell. Hum. Syst. Integr. 69, 56.
Politis, I., Brewster, S., and Pollick, F. (2015). “Language-based multimodal displays for the handover of control in autonomous cars,” in Proceedings of the 7th international conference on automotive user interfaces and interactive vehicular applications, 3–10.
Rothenbücher, D., Li, J., Sirkin, D., Mok, B., and Ju, W. (2016). “Ghost driver: a field study investigating the interaction between pedestrians and driverless vehicles,” in 2016 25th IEEE international symposium on robot and human interactive communication (RO-MAN) (IEEE), 795–802.
Saager, M., Steinmetz, A., Osterloh, J. P., Naumann, A., and Hahn, A. (2024). Ensuring fast interaction with HMI´s for safety critical Systems-An extension of the human-machine interface design method KONECT. in Intelligent Human Systems Integration (IHSI 2024): Integrating People and Intelligent Systems (Editors). Tareq Ahram, Waldemar Karwowski, Dario Russo, and Giuseppe Di Bucchianico. United States: AHFE International, 119. doi:10.54941/ahfe1004483
Salonen, A. O. (2018). Passenger's subjective traffic safety, in-vehicle security and emergency management in the driverless shuttle bus in Finland. Transp. Policy 61, 106–110. doi:10.1016/j.tranpol.2017.10.011
Schieben, A., Wilbrink, M., Kettwich, C., Madigan, R., Louw, T., and Merat, N. (2019). Designing the interaction of automated vehicles with other traffic participants: design considerations based on human needs and expectations. Cognition, Technol. and Work 21 (1), 69–85. doi:10.1007/s10111-018-0521-z
Schomakers, E. M., Lidynia, C., and Ziefle, M. (2022). The role of privacy in the acceptance of smart technologies: applying the privacy calculus to technology acceptance. Int. J. Human–Computer Interact. 38 (13), 1276–1289. doi:10.1080/10447318.2021.1994211
Schrank, A., Kettwich, C., and Oehl, M. (2024). Aiding automated shuttles with their driving tasks as an on-board operator: a case study on different automated driving systems in three living labs. Appl. Sci. 14 (8), 3336. doi:10.3390/app14083336
Siripanich, S. (2020). Designing for women’s safety in autonomous rideshares. Available online at: https://teague.com/insights/designing-for-womens-safety-in-autonomous-rideshares.
Smith, M. J. (2008). Addressing the security needs of women passengers on public transport. Secur. Journal 21 (1), 117–133. doi:10.1057/palgrave.sj.8350071
Smith, D. H., Manzini, D. A., Kennedy, D. M. R., and Ives, P. J. (2023). “Ethics of trust/worthiness in autonomous systems: a scoping review,” in Proceedings of the first international symposium on trustworthy autonomous systems, 1–15.
Spiekermann, S., and Cranor, L. F. (2008). Engineering privacy. IEEE Trans. Software Engineering 35 (1), 67–82. doi:10.1109/tse.2008.88
Tiznado-Aitken, I., and Sagaris, L. (2024). Uncovering gender-based violence and harassment in public transport: lessons for spatial and transport justice. J. Transport Geography 114, 103766. doi:10.1016/j.jtrangeo.2023.103766
Torrao, G., Htait, A., and Wong, S. H. S. (2024). Perceptions of women’s safety in transient environments and the potential role of AI in enhancing safety: an inclusive mobility study in India. Sustainability 16 (19), 8631. doi:10.3390/su16198631
Tsiktsiris, D., Vafeiadis, A., Lalas, A., Dasygenis, M., Votis, K., Tzovaras, D., et al. (2024). “In-Vehicle services to improve the user experience and security when traveling with automated minibuses,” in Automated vehicles as a game changer for sustainable mobility: learnings and solutions (Cham: Springer Nature Switzerland), 125–149.
Useche, S. A., Colomer, N., Alonso, F., and Faus, M. (2024). Invasion of privacy or structural violence? Harassment against women in public transport environments: a systematic review. PLoS One 19 (2), e0296830. doi:10.1371/journal.pone.0296830
Verberne, F. M., Ham, J., and Midden, C. J. (2012). Trust in smart systems: sharing driving goals and giving information to increase trustworthiness and acceptability of smart systems in cars. Hum. Factors 54 (5), 799–810. doi:10.1177/0018720812443825
Walker, F., Forster, Y., Hergeth, S., Kraus, J., Payre, W., Wintersberger, P., et al. (2023). Trust in automated vehicles: constructs, psychological processes, and assessment. Front. Psychol. 14, 1279271. doi:10.3389/fpsyg.2023.1279271
Wang, M., Mehrotra, S., Wong, N., Parker, J. I., Roberts, S. C., Kim, W., et al. (2024). Human-machine interfaces and vehicle automation: a review of the literature and recommendations for system design, feedback, and alerts. Transp. Res. Part F Traffic Psychol. Behav. 107, 549–561. doi:10.1016/j.trf.2024.08.014
Wintersberger, P., Janotta, F., Peintner, J., Löcken, A., and Riener, A. (2021). Evaluating feedback requirements for trust calibration in automated vehicles. It-Information Technol. 63 (2), 111–122. doi:10.1515/itit-2020-0024
Wirtz, L., Feger, I., Wagner-Douglas, L., Oetermann, T., Lennartz, T., and Eckstein, L. (2024). “Customized HMI as a key to increased acceptance? Implications of an online survey assessing relationships of experience, trust and information interest,” in Adjunct proceedings of the 16th international conference on automotive user interfaces and interactive vehicular applications, 117–122.
Yan, M., Lin, Z., Lu, P., Wang, M., Rampino, L., and Caruso, G. (2023). Speculative exploration on future sustainable human-machine interface design in automated shuttle buses. Sustainability 15 (6), 5497. doi:10.3390/su15065497
Yan, M., Rampino, L., and Caruso, G. (2024). Comparing user acceptance in human–machine interfaces assessments of shared autonomous vehicles: a standardized test procedure. Appl. Sci. 15 (1), 45. doi:10.3390/app15010045
Zhong, R., Tian, Z., Liao, J., and Shi, W. (2024). “Autonomous shuttle operation for vulnerable populations: lessons and experiences,” in 2024 IEEE 10th international conference on collaboration and internet computing (CIC) (IEEE), 1–8.
Keywords: HMI (human machine interface), autonomous shuttle, online survey, real-world testing, safety, security, gender difference
Citation: Bolzmacher C, Panëels S, Louison C, Hidalgo C, Marcano M, Diaz S and Anastassova M (2026) Safety and security perception in shared autonomous shuttles: a user-centred evaluation of interface design and passenger behaviour. Front. Mech. Eng. 11:1677376. doi: 10.3389/fmech.2025.1677376
Received: 14 August 2025; Accepted: 26 November 2025;
Published: 07 January 2026.
Edited by:
Amjad Pervez, Central South University, ChinaReviewed by:
Ayomide Muftaudeen, Queensland University of Technology, AustraliaNaveed Marazi, Chandigarh University, India
Copyright © 2026 Bolzmacher, Panëels, Louison, Hidalgo, Marcano, Diaz and Anastassova. This is an open-access article distributed under the terms of the Creative Commons Attribution License (CC BY). The use, distribution or reproduction in other forums is permitted, provided the original author(s) and the copyright owner(s) are credited and that the original publication in this journal is cited, in accordance with accepted academic practice. No use, distribution or reproduction is permitted which does not comply with these terms.
*Correspondence: Christian Bolzmacher, Y2hyaXN0aWFuLmJvbHptYWNoZXJAY2VhLmZy