Fleet Console

Oversight of an AV test fleet, made visible before it fails.

My part: Proposed the concept and did its UX research, design and prototyping
When: Self-initiated at Woven by Toyota; an NDA re-creation
Status: A concept. Nothing shipped, no outcome metrics, outcome internal
Built on: Plumb, an original design system, and a three-surface prototype: desktop, iPhone and in-vehicle

Fleet Console motion reel: the Now screen, an escalation acknowledged, the iPhone takeover, then an in-vehicle tag.

Chapters

01The problem
02Two users
03The insight
04Decisions
05Three surfaces
06The system
07Proof and limits

01The problem

Interactive prototypeOpen the interactive prototype

The problem

The Now screen: a re-routed escalation, a coverage bar with gaps drawn, and span of control against the 15:1 baseline

Test fleets grow faster than their oversight

Leads can't see oversight debt, and escalation hangs on one phone call. Public reporting on AV test programs describes this; I used it as design pressure, not evidence.

Two users

One drives. One is the safety net.

Operator, in the car

Flags an issue in a glance, then triages it later with data.

Lead, remote

The human safety redundancy: follows up incidents, audits footage, answers emergency calls.

The insight

Information architecture: six navigation verbs on top (Now, Inbox, Owned, Review, Fleet, Plan) over objects underneath, with Incident as the canonical page.

Organize around “what needs me now”, not the data

Navigation is verbs and queues; objects sit one hop below. I rejected object-first and time-first.

Decisions

Six calls that shaped it

Workflow-first IA

Chose verbs and queues over object lists, because the hardest jobs are “act now” or “see now”.

Now owns debt

Chose a plain sum with its arithmetic shown over a composite score, because leads must reproduce it by counting.

Escalation rota

Chose a rota that re-routes on timeout over a fixed on-call field, because that field is a single point of failure.

Protocol-gated resolve

Chose five unskippable steps over “not applicable” toggles, because those hand judgment back to a tired lead.

No green

Chose shape plus label over color-only dots, because hue never carries meaning alone.

Preview width

Chose dropping the Vehicle column over horizontal scroll, because Status, Owner and Age are the triage signals.

Three surfaces

Each surface gets the job it's best at

The in-vehicle SEV1 call screen: one question, two answer keys, the lead's first name and a timer — In the car: one question, two answer keys, built to the 2-second glance.

The iPhone takeover after acknowledgement, with the protocol at 2 of 5 and Resolve locked — On iPhone: acknowledge in one tap; Resolve stays locked until the protocol is done.

Inbox in dark, compact density, grouped by severity, with proposed severity on raw tags — On desktop: Inbox grouped by severity, with proposed severity on raw tags.

The system

Plumb specimen sheet: severity marks, status bar, flags and density modes

Plumb: color is meaning, never the only signal

There is no green: severity uses shape plus a label. Two density modes, light and dark.

Proof and limits

Escalation takeover, re-created: chain, backup countdown, rota, and a protocol half done

What's real, what's assumed

The cross-surface hand-off check passes.
The 2-second glance floor is measured, not eyeballed.
Placeholders: Escalation rota timeout (5 minutes per link) and protocol wording.
No outcome metrics exist; the outcome is internal and I can't share it.

Next: run first-click, timed-triage and debt-trust tests with real safety owners. Try the live prototype (opens in new tab).