Jetson’s View: Designing Trustworthy Air Taxi Systems

Isadora Ferr

1 a

, Jos

e Cezar de Souza Filho

, K

athia Oliveira

, David Espes

, Catherine Dezan

Mohand Hamadouche

, Raﬁk Belloum

, Bruna Cunha

and Kalinka Branco

1 b

Institute of Mathematics and Computer Science, Universidade de S

ao Paulo, Brazil

Lab-STICC - CNRS, Universit

e de Bretagne Occidentale, France

Univ. Polytechnique Hauts-de-France, LAMIH, UMR CNRS 8201, F-59313, France

Keywords:

Autonomous Vehicles, Trustworthy Interface, Air Taxi.

Abstract:

As the world’s population grows and urbanization accelerates, the need for sustainable urban mobility solu-

tions becomes more and more important. Smart cities, considered the answer to urban challenges, are ready

to integrate innovative modes of transport, such as electric vertical take-off and landing vehicles (eVTOLs),

into their fabric. This paper discusses challenges and opportunities presented by eVTOLs, with a particular

focus on safety, security, and user experience. Based on a resilient architecture proposed by STRAUSS, which

integrates safety and fault tolerance measures, we characterize a framework for safe and reliable eVTOL oper-

ations in smart cities. In addition, we investigate the design of user interfaces for autonomous eVTOL systems

by employing personas and use case scenarios. A interface’s prototype illustrates the adaptability and func-

tionality of the interface in real-life scenarios, meeting the diverse needs of users and promoting trust in future

urban transport systems. Through this interdisciplinary approach, this research aspires to advance the adoption

of eVTOLs and enhance urban mobility at the dawn of the smart city’s future.

1 INTRODUCTION

According to the United Nations, 55% of the world’s

population currently lives in urban areas, which is

projected to increase to 68% by 2050 (Ferr

ao et al.,

2022a; Nations, 2018). In this context, urban plan-

ning is crucial for ensuring quality of life while pro-

moting sustainable economic development and infras-

tructure capable of meeting present and future de-

mands. Smart cities offer innovative solutions to ad-

dress the challenges of urban mobility. Electric verti-

cal takeoff and landing vehicles (eVTOLs), often re-

ferred to as air taxis, stand out among them. These

aircraft aim to provide safe, sustainable, and accessi-

ble air transportation for passengers and cargo, as well

as emergency services within and between metropoli-

tan areas and hard-to-reach peripheral regions.

Unlike conventional transportation systems, such

as cars or trains, which are limited by ground trafﬁc

space, air taxis do not occupy spaces within congested

trafﬁc areas (Ferr

ao et al., 2020b). Air mobility so-

lutions offer greater spatial and temporal ﬂexibility,

https://orcid.org/0000-0002-0612-486X

https://orcid.org/0000-0001-6816-208X

reduced congestion, and less user stress. Designed

for vertical takeoff and landing, these aircraft elimi-

nate the need for long runways required by traditional

airplanes. Additionally, air taxis are powered by elec-

tric motors and batteries, making them more energy-

efﬁcient and emitting fewer pollutants than traditional

aircraft. However, their practical implementation and

deployment face various challenges, especially con-

cerning safety, security, and passenger trust, which

are also recurrent issues in other aircraft types.

Passenger mistrust in adopting air transportation

systems is often fueled by concerns regarding about

safety and reliability, which are frequently exacer-

bated by past incidents involving conventional air-

planes and mistrust in automated systems. Research

shows that trust is signiﬁcantly inﬂuenced by design

and aspects of appearance, transparency, ease of use,

communication style and user control all play a cru-

cial role in shaping user trust (Hoff and Bashir, 2015).

Moreover, introducing emerging technologies such as

connected air taxis adds a new layer of concern. This

connectivity exposes aircraft to potential cybersecu-

rity vulnerabilities, such as network attacks on the ve-

hicle and its sensor systems, which can heighten resis-

tance and discomfort in adopting these technologies.

Ferrão, I., Filho, J. C. S., Oliveira, K., Espes, D., Dezan, C., Hamadouche, M., Belloum, R., Cunha, B. and Branco, K.

Jetson’s View: Designing Trustworthy Air Taxi Systems.

DOI: 10.5220/0013279300003929

In Proceedings of the 27th International Conference on Enterprise Information Systems (ICEIS 2025) - Volume 2, pages 517-524

ISBN: 978-989-758-749-8; ISSN: 2184-4992

517

In this regard, conventional airplane interfaces fail to

present ﬂight information in a manner that instills user

conﬁdence. Additionally, existing architectures ad-

dress only safety requirements, disregarding security

issues, while both are equally important for user ac-

ceptability (EASA, 2021). Neglecting either of these

requirements can undermine the trustiness and effec-

tiveness of the systems, jeopardizing the company’s

reputation.

This article aims to contribute to the state of the art

through two pillars. Firstly, we propose STRAUSS, a

resilient architecture for air taxi operations in smart

cities. STRAUSS is a robust, fault-tolerant archi-

tecture capable of operating under adverse and in-

tentional conditions. It integrates security detection

and protection modules, decision-making, and ﬂex-

ibility to achieve these characteristics. STRAUSS

is designed to automatically adapt to detect fail-

ures and attacks, making real-time decisions to en-

sure mission integrity. We propose incorporating the

decision-making mechanism with the mission plan-

ning of these vehicles. According to the aircraft’s au-

tonomy level, the mission is deployed to match differ-

ent scenarios an air taxi can encounter. Secondly, we

present new and initial ideas for air taxi system user

interfaces, based on simple yet realistic scenarios de-

signed to inspire user trust. To this end, these con-

cepts are deﬁned based on the STRAUSS architecture

and the mission planning objectives. Furthermore,

since many user groups still approach aircraft auton-

omy with apprehension and skepticism (Lotz et al.,

2023), there is a gap in the literature regarding ap-

plying Human-Computer Interface (HCI) principles

to the context of air taxis within intelligent systems.

As air taxi systems become increasingly autonomous,

relying on decision-making based on artiﬁcial intelli-

gence algorithms, it becomes essential to ensure that

decisions are transparently explained to users. This

instills conﬁdence and trust in passengers regarding

the reliability of the system. Therefore, integrating an

interface that prioritizes trust within the air taxi sys-

tem enhances its reliability and dependability, foster-

ing positive experiences and building long-term trust

among passengers.

This work is organized as follows. We discuss re-

lated work in Section 2 and introduce STRAUSS in

Section 3. Then, we present the methodology for de-

signing a interface prototype in Section 4. Finally, we

conclude and outline future perspectives in Section 5.

2 RELATED WORK

Despite various models and system architectures in

the existing literature, adequately encompass all en-

compass all the requirements for creating generic and

safe air vehicles. Most architectures primarily focus

on deﬁning and developing specialized air vehicles

(Ferr

ao et al., 2022b; Siewert et al., 2019). How-

ever, they can serve as reference for replicating se-

curity techniques in air taxi architectures, especially

considering the substantial ratio of Unmanned Aerial

Vehicles (UAVs) to air taxis. Among these architec-

tures, there are dedicated UAVs, such as HAMSTER

(Pigatto, 2017), STUART (Ferr

ao et al., 2020a) and

ContainerDrone (Siewert et al., 2019), each employ-

ing different approaches.

The Health, Mobility, and Safety Based Data

Communications Architecture (HAMSTER) is a data

communication architecture designed to improve

overall system mobility and security (Pigatto, 2017).

Despite signiﬁcant efforts with HAMSTER, the au-

thors do not consider the resiliency aspects of provid-

ing autonomous vehicles.

In (Ferr

ao et al., 2020a), the authors present STU-

ART, a resilient architecture to dynamically man-

age UAV networks under attack. This architecture

one of the few that consider safety and security as

uniﬁed concepts. It employs decision-making tech-

niques through a state machine and achieves re-

silience through restoration techniques and histori-

cal data stored in a reference base. It is notewor-

thy that while ensuring safety requirements has been

a primary concern in the design and development

of UAV systems, the communication of these vehi-

cles with external entities introduces vulnerabilities.

Some architectures intended to meet security require-

ments may have inherent ﬂaws, and conversely, safety

requirements may also contain security weaknesses.

Therefore, it is essential to address both security and

safety in a UAV architecture. In that sense, STUART

is the only architecture that focuses on these vulner-

abilities. However, it is still in the simulation testing

phase, relies heavily on human intervention through-

out all test phases, and has not yet been tested in a real

avionics environment.

Likewise, (Chen et al., 2019) presented the Con-

tainerDrone Framework that proposes resilient con-

trol of Denial of Service (DoS) attacks for real-

time UAV systems using containers. The frame-

work has proven reliable in protecting against DoS

attacks launched within the container, limiting the at-

tacker’s access to critical system resources. Experi-

ments showed that the proposed framework is effec-

tive against various types of DoS attacks. Neverthe-

ICEIS 2025 - 27th International Conference on Enterprise Information Systems

518

less, the authors did not consider physical and soft-

ware component failures caused by bugs, logical er-

rors, or any other attack besides DoS.

Although the related works discussed so far have

contributed to characterizing architectures for aerial

vehicles, it is imperative to note that a limited por-

tion of these efforts addresses the speciﬁc complex-

ities associated with air taxis. The inherent pecu-

liarities of air taxis, such as their imminent integra-

tion into densely populated urban environments, de-

mand meticulous handling. Such environments re-

quire strong integration with existing infrastructure

and air trafﬁc management systems, making safety

and resilience a critical and complex requirements.

Additionally, aspects such as redundancy and fault

tolerance play a central role in ensuring the safety of

both occupants on board and people on the ground.

Air taxi architectures must also be sensitive to

long-term maintenance and reliability. The complex

nature of the technologies employed in these vehicles

requires robust strategies to ensure that the systems

remain operational and safe over time. In particular,

the ability to make concise and real-time decisions

during missions is a crucial characteristic to consider

and is still a gap little explored in the literature. Fur-

thermore, the effectiveness of an architecture depends

not only on its technical functionality but also on in-

tuitive user interfaces to ensure an optimized and reli-

able user experience.

Regarding HCI, several studies have been ded-

icated to the design and evaluation of autonomous

cars, exploring aspects related to user experience, in-

terface design, and passenger well-being. For exam-

ple, research on user experience has examined pas-

senger satisfaction, perceived safety, and comfort dur-

ing autonomous vehicle journeys (Ranscombe et al.,

2019). Furthermore, studies have considered user de-

sign for drivers, pedestrians, and other public roads

users, aiming to ensure safety and efﬁciency in urban

trafﬁc (Verma et al., 2019; Meurer et al., 2020).

Among the approaches to interaction design,

metaphors have been explored to make interactions

with autonomous vehicles more intuitive and under-

standable for users (Str

omberg et al., 2017). Ad-

ditionally, there is a growing interest in evaluating

passenger well-being during journeys in autonomous

vehicles, considering aspects such as physical com-

fort, relaxation, and stress minimization (Sauer et al.,

2021). However, as already mentioned, there is a gap

in the literature regarding applying these HCI princi-

ples in the context of air taxis within intelligent sys-

tems. As air taxi systems become autonomous, it is

essential to ensure that decisions are transparently ex-

plained to users. This not only fosters passenger trust

in the system but also enhances their understanding

of how it operates and responds to various situations.

Therefore, it is important to investigate the design of

interfaces that effectively convey the decisions and

actions of air taxi systems to users, presenting in-

formation about planned routes, weather conditions,

safety protocols, and emergency procedures in a clear

and accessible manner (de Souza Filho et al., 2024;

Muralidhar et al., 2023).

3 ReSilienT aiR TAXIS architectUre

FOR SMART CITIES (STRAUSS)

STRAUSS is a resilient, robust, and fault-tolerant

architecture for aerial taxis operating in adverse

conditions, whether intentional or unintentional.

STRAUSS dynamically adapts its mission, sharing

information with other aircraft, consisting of three

main modules: detection, decision-making, resilience

and Jetson’s interface.

3.1 Detection’s Module

The ability of an avionic architecture to automati-

cally identify impending failures in aircraft at early

stages is crucial, as it prevents costly and potentially

catastrophic system failures, ensuring greater safety

and reliability of components. This, in turn, reduces

damage and operational costs. In this regard, the

detection module of STRAUSS plays a fundamental

role in the reliability process, being responsible for

identifying issues at safety (physical security) (Ferr

et al., 2023) and security (computational security) lev-

els (Ferr

ao et al., 2024a).

Since STRAUSS focus on detecting issues from

both safety and security perspectives, it stands apart

from other architectures described in the literature.

This stems from the fact that traditional airplanes pri-

marily focused on physical safety, prioritizing struc-

tural integrity and proper functioning of mechanical

systems. However, security has become an equally

important concern with the emergence of autonomous

aerial vehicles and the increasing integration of digi-

tal technologies such as communication systems and

computer control.

Currently, concerning security, STRAUSS en-

compasses the detection of the most recurrent attacks

on aircraft, namely GPS Spooﬁng and GPS Jamming.

GPS Spooﬁng is a technique in which false GPS sig-

nals are sent to the aircraft, causing it to calculate an

incorrect position. GPS Jamming involves the emis-

sion of radio signals that interfere with the aircraft’s

Jetson’s View: Designing Trustworthy Air Taxi Systems

519

GPS receiver, preventing it from determining its posi-

tion. Regarding safety, STRAUSS detects seven criti-

cal failures that make up the structural and operational

integrity of aircraft, such as engine failures, eleva-

tor failures, left aileron failures, right aileron failures,

failures in both ailerons, left rudder failures and right

rudder failures.

The algorithms and techniques used to detect

safety and security in STRAUSS are based on arti-

ﬁcial intelligence methodologies that guarantee the

early identiﬁcation of failures and attacks with an ac-

curacy greater than 90%, providing a quick and efﬁ-

cient response. Speciﬁcally, STRAUSS employs ma-

chine learning models, such as Random Forests and

Boosting variations, for anomaly detection, combined

with simulated and real data to increase the reliabil-

ity of detections. These methods have been carefully

integrated into STRAUSS to ensure air taxis’ safe

and reliable operation in unpredictable urban environ-

ments. For more details on the technical implementa-

tion, see the following: (Ferr

ao et al., 2024b)

3.2 Decision-Making’s Module

Air taxis must be able to continually adapt to missions

and effectively detect unexpected internal problems or

external threats. In this sense, STRAUSS proposes

an architecture for autonomous vehicles capable of

making appropriate decisions in real-time, ensuring

the successful fulﬁllment of their mission. STRAUSS

considers mission objectives and adjusts its actions

according to random events related to mission con-

text, system-wide integrity, mission safety and secu-

rity, and risk management. It is important to empha-

size that the STRAUSS decision-making process re-

lies signiﬁcantly on the detection module to determine

the appropriate time for decisive intervention.

The current STRAUSS study addresses the

decision-making mechanism through MDP. MDPs

provide a mathematical approach to modeling

decision-making in scenarios where outcomes are in-

ﬂuenced by both randomness and partly by the ac-

tions of a decision-maker. This framework is suited to

the dynamic and uncertain environment in which air

taxis operate. In this scenario, the state space encom-

passes all possible aircraft statuses, including sensor

readings and detected faults, while the action space

consists of all possible maneuvers and responses that

the system can perform. This STRAUSS module uses

reinforcement learning algorithms to optimize policy

for MDPs. Algorithms such as Q-learning and Deep

Q-Networks (DQN) are employed to learn the opti-

mal actions in each state to maximize the expected

cumulative reward.

3.3 Resilience’s Module

According to (Hollnagel et al., 2006), resilience is

the ability to return to its original state after defor-

mation. The STRAUSS resilience module communi-

cates directly with the decision-making module and is

invoked whenever any safety or security action needs

to be applied. The resilience module is responsible

for recovering and restoring the air taxi if it is sub-

jected to an attack or a failure. STRAUSS incorpo-

rates this module to stabilize the functional level of

the air taxi system even in successful operations. The

module ensures that the system continues to function

even if it is subjected to a successful attack, incorpo-

rating techniques that allow the restoration of the air-

craft or an emergency landing to guarantee the physi-

cal and computational integrity of the vehicle.

The STRAUSS resilience module features fault

containment isolation, recovery protocols, redun-

dancy management, post-incident monitoring, analy-

sis and learning, emergency landing and shutdown,

and communication with other elements. For fault

isolation and containment, upon detecting a fault or

security breach, the resilience module isolates the af-

fected components to prevent the issue from spread-

ing to other parts of the system. This containment

strategy helps maintain overall system stability and

functionality. Additionally, the module includes a set

of predeﬁned recovery protocols tailored to different

types of failures and attacks. For instance, the sys-

tem activates a secondary power source in the event

of an engine failure or switches to backup communi-

cation channels during an attack. To increase relia-

bility, the resilience module leverages redundant sys-

tems and components. STRAUSS ensures continu-

ous operation by maintaining backup systems that can

take over in the event of a primary system failure. Af-

ter dealing with a failure or attack, the resilience mod-

ule conducts an analysis to understand the root cause

and enhance future responses. This involves record-

ing incident data, evaluating system performance, and

updating recovery protocols.

Finally, the resilience module prioritizes passen-

ger and vehicle safety in scenarios where recovery is

impossible. It can perform emergency landing proce-

dures by selecting the safest location based on real-

time data. Additionally, it can perform a controlled

shutdown of critical systems to prevent further dam-

age.

ICEIS 2025 - 27th International Conference on Enterprise Information Systems

520

4 INSIGHTS OF JETSON’S USER

INTERFACE

In this section, we present a scenario designed to gain

insights into the interface of future autonomous air

taxi systems, intended for use by citizens for short

trips. As noted by the European Union Aviation

Safety Agency, potential users of Urban Air Mobil-

ity (UAM) are likely to prioritize safety, reliability,

predictability, and ease of use. While affordability

and convenience are also mentioned, they fall outside

the scope of the system interface (EASA, 2021). Ac-

cording to (Hoff and Bashir, 2015), factors such as

appearance, transparency, communication style, and

user control are crucial in autonomous vehicles. Al-

though the STRAUSS architecture emphasizes safety,

reliability, and security, it is essential that the inter-

faces effectively convey these attributes to the end

user.

To explore and propose an end-user-interface, we

deﬁned two personas (Nielsen, 2019) and, based on

their needs, designed two scenarios of use, which are

detailed in Section 4.1. These initial concepts will be

further explored in future work through usability tests.

4.1 Deﬁning Personas for Air Taxi

Systems

A persona is a ﬁctitious representation of an appli-

cation user (Nielsen, 2019), created by deﬁning the

characteristics, needs, and objectives of real users.

Developing personas aims to humanize and better un-

derstand the target audience, allowing us to design

solutions that meet users’ speciﬁc needs and prefer-

ences. With the idea of autonomous air taxi systems,

we deﬁned the two following personas:

• Jane Jetson – Jane is always interested in new

technologies and is open to trying new experi-

ences. She works in digital marketing and plans

to use air taxis for her holiday trips. Although

Jane has no piloting experience, she is familiar

with conventional airplanes. In the event of an

emergency, Jane wants to understand what is hap-

pening to feel safe, but she lacks the knowledge to

grasp all the technical details.

• George Jetson – George is an economist who

works for a multinational company, and traveling

is a part of his job. He is a ﬂight enthusiast with

amateur ﬂying experience who enjoys visiting the

pilot’s cabin to follow the journey on the in-ﬂight

panels. He plans to use air taxis for various pur-

poses, including commuting to work and going on

holidays. In the event of an emergency, George

wants to understand what happened, along with

the measures being taken to address the situation.

4.2 Scenarios of Use – Activity

Diagrams and Prototype Interface

Based on the two personas, two scenarios of use were

deﬁned as activity diagrams (OMG, 2017) to support

the deﬁnition of possible user interfaces. We detail

each scenario as follows.

Scenario 1 – Jane decides to travel to Nice for the

weekend after a tiring week. It starts when the user

(Jane) takes an air taxi in Lille (Fig. 1). Once seated

inside the aircraft, the system displays the dashboard,

and the ﬂight begins. After a while, Jane selects the

stop-over option to pick up a friend in Lyon, France.

Thus, the system decides if the stop-over is safe asks

the Control Tower for authorization, which may or

may not be granted. The system displays the result,

adapts the interface accordingly, and continues the

journey. The system continuously refreshes the dash-

board with the position from where it is being from

which is ﬂying until it reaches its destination (Nice).

The ﬁrst scenario exempliﬁes a successful ﬂight

with no incidents. As illustrated in Fig. 1, the inter-

face features a straightforward communication style

that aligns well with Jane’s proﬁle. Additionally,

users can personalize their routes by adding strategic

stops, providing a sense of control. Transparency is

emphasized through all information displayed along-

side the map, including system health (battery, en-

gine, elevator, rudder, and aileron), detected issues,

and feeds from front, rear, and side cameras. The

interface cues are designed to provide information

that enhances users predictability and reassures them

about the safety of the ﬂight.

We designed interfaces as high-ﬁdelity mock-ups,

which serve as a detailed visual representation of the

interface by simulating the expected design and fea-

tures of the end product (Wiegers and Beatty, 2013),

using support design tools such as Figma

. Fig. 2

presents the high-ﬁdelity mock-up for scenario 1.

Scenario 2 – George planned a trip to Porto Ale-

gre to visit relatives and decided to take an air taxi

(Fig. 3). Once seated, the system displays the dash-

board (as shown in Fig. 2(a)). The journey begins, but

at some point, an attacker executes a GPS Spooﬁng on

the aircraft. At this moment, the dashboard displays

The elements used to create the mock-ups were

retrieved as follows: icons from Figma Community

(https://www.ﬁgma.com/community), geolocation from

Google Maps (https://www.google.com/maps), and

unlicensed pictures for cameras from Google Images

(https://www.google.com.br/imghp).

Jetson’s View: Designing Trustworthy Air Taxi Systems

521

Figure 1: Scenario of use 1 - Jane Jetson’s journey.

a completely different situation: the aircraft appears

to be ﬂying over Europe, while it is actually in South

America (Brazil) (Fig. 4(a)). The air taxi system an-

alyzes the situation, identiﬁes the attack, and initiates

the decision-making process. As the battery is not full

(indicated in Fig. 4(b) as a yellow star), the decision is

made to change direction and execute an emergency

landing at the nearest location. Authorization is re-

quested from the Control Tower, which is granted.

The interface provides a one-level textual explana-

tion “The air taxi is conducting an security landing.

Everything is under control. More information will

be provided by aircraft attendants after landing.”. At

this point, George selects the option to ﬁnd more de-

tails. Thus, the decisions are explained through three

levels of progressive disclosure (Springer and Whit-

taker, 2019) presented one at a time as requested by

the user. First, the explanation unveils the detected

attack (see message (1) in Fig. 4(b)). Second, if the

user ask for more details, it reveals the causes of the

attack, including the spotted location and time (mes-

sage (2) in Fig. 4(b)). Finally, when the user request

one more detail, the explanation indicate the decision

(i.e., emergency landing) (message (3) in Fig. 4(b))

and its reasoning.

In the second scenario, the explanations were tai-

lored speciﬁcally for users with piloting experience,

like George. For users such as Jane, however, these

details may not only be unnecessary but could also

(a) Dashboard containing stopover button; time to land;

cameras; degrees of battery, engine, elevator, rudders, and

ailerons; and diagnosis.

(b) Screen to request authorization for a stopover.

Figure 2: High-ﬁdelity mock-up for the scenario of use 1.

hinder their experience. The scenarios illustrate the

importance of deﬁning user proﬁles prior to the ﬂight,

as communication style and transparency must be

aligned with user needs. George feels comfortable

with additional information, as he understands tech-

nical terms and the decision-making process, unlike

typical users. Our designed interface demonstrates

the levels of transparency that can inﬂuence users’

perceptions of system safety and readability.

It is important to note that the architecture pro-

vided by STRAUSS allows for the exploration of spe-

ciﬁc scenarios related to interface functionalities, pri-

oritizing aspects such as safety, security, and decision-

making. In other words, our architecture provides

a framework for exploring User Experience (UX)

ICEIS 2025 - 27th International Conference on Enterprise Information Systems

522

Figure 3: Scenario of use 2 - A journey with GPS attacker.

dimensions highlighted by potential users, such as

safety, reliability and predictability, as the end-user is

continuously informed trough the graphical interface.

Regarding user control, we anticipate that certain ac-

tions will be available for customizing routes. How-

ever, since safety is a primary concern, the system

evaluates whether any unplanned actions are risk-free

and conducts a permission protocol accordingly. We

also considered the facets of transparency and com-

munication style. As represented by the characteris-

tics of our personas, it is essential for the interface to

accommodate different user proﬁles, as this can sig-

niﬁcantly impact users’ perceptions of safety. Fur-

thermore, we considered aspects of ease of use and

appearance (i.e., aesthetics). Although the personas

supported our design, users evaluations will be essen-

tial for assessing usability and hedonic aspects.

5 FINAL REMARKS

To improve the robustness and accuracy of STRAUSS

security, we incorporate machine learning techniques

to enhance detection and decision-making in the face

of random events, as one of the main causes of ve-

hicle problems is human error. Therefore, our archi-

tecture includes autonomous decision-making capa-

bilities, even in the face of random events. Another

differential of STRAUSS, compared to other architec-

tures in the literature, is the inclusion of a resilience

module, which is essential for maintaining the vehi-

cle’s operational stability even during successful op-

erations. In future works, we will implement the re-

(a) Dashboard updated to a wrong destination due to the

attack.

(b) Dashboard updated the direction and explains the de-

cision in three progressive levels as the user requests more

details.

Figure 4: High-ﬁdelity mock-up for the scenario of use 2.

silient module and conduct boarding tests on a real

aircraft.

Additionally, this paper presents initial concepts

for the user interface design of air taxi systems. In our

prototype, we designed screens that focus on safety,

reliability, predictability, and ease of use, taking into

account different transparency levels based on user

proﬁles. Our next step is to conduct a deep literature

analysis on the design of the user interfaces for this

domain and to conduct user studies to gather the needs

and preferences of potential users, as well as insecuri-

ties, in managing different ﬂight scenarios (e.g., hail-

ing, pick-up, travel, and drop-off). In this scenario,

trust is a key factor that will be assessed during user

evaluations. The results will be used to design initial

interface prototypes following an iterative process.

ACKNOWLEDGEMENTS

Scania Latin America funded this study — Project

Code 27192*54. It also received ﬁnancial support

from CAPES (Coordination for the Improvement of

Higher Education Personnel — Brazil) — Funding

Code 001.

Jetson’s View: Designing Trustworthy Air Taxi Systems

523

REFERENCES

Chen, J., Feng, Z., Wen, J.-Y., Liu, B., and Sha, L. (2019).

A container-based dos attack-resilient control frame-

work for real-time uav systems. In 2019 Design, Au-

tomation & Test in Europe Conference & Exhibition

(DATE), pages 1222–1227. IEEE.

de Souza Filho, J. C., Belloum, R., and de Oliveira, K. M.

(2024). Where are we and where can we go on the

road to reliance-aware explainable user interfaces?

In 2024 IEEE Symposium on Visual Languages and

Human-Centric Computing (VL/HCC), pages 282–

288.

EASA, N. (2021). Study on the societal acceptance of urban

air mobility in europe.

Ferr

ao, I., Da Silva, L., Bonilla, D., Dezan, C., Espes, D.,

and Castelo Branco, K. (2024a). Detecting spooﬁng

and gps jamming in uavs: Multiclass approach to at-

tack diagnosis.

Ferr

ao, I. G., da Silva, L. M., da Silva, S. A., Dezan, C.,

Espes, D., and Branco, K. C. (2023). Intelligent diag-

nosis of engine failure in air vehicles using the alfa

dataset. In 2023 International Conference on Un-

manned Aircraft Systems (ICUAS), pages 871–878.

IEEE.

Ferr

ao, I. G., da Silva, S. A., Pigatto, D. F., and Branco,

K. R. (2020a). Gps spooﬁng: Detecting gps fraud in

unmanned aerial vehicles. In 2020 Latin American

Robotics Symposium (LARS), 2020 Brazilian Sym-

posium on Robotics (SBR) and 2020 Workshop on

Robotics in Education (WRE), pages 1–6. IEEE.

Ferr

ao, I. G., De Oliveira, A. L., Espes, D., Dezan, C., and

Branco, K. C. (2024b). Smart self-diagnosis method

for gps attacks and safety faults in uavs. In 2024 Inter-

national Conference on Unmanned Aircraft Systems

(ICUAS), pages 1301–1308. IEEE.

Ferr

ao, I. G., Espes, D., Dezan, C., and Branco, K. R. L.

J. C. (2022a). Security and safety concerns in air taxis:

a systematic literature review. Sensors, 22(18):6875.

Ferr

ao, I. G., Espes, D., Dezan, C., and Branco, K. R. L.

J. C. (2022b). Security and safety concerns in air taxis:

a systematic literature review. Sensors, 22(18):6875.

Ferr

ao, I. G., Pigatto, D. F., Fontes, J. V., Silva, N. B., Es-

pes, D., Dezan, C., and Branco, K. R. (2020b). Stu-

art: Resilient architecture to dynamically manage un-

manned aerial vehicle networks under attack. In 2020

IEEE Symposium on Computers and Communications

(ISCC), pages 1–6. IEEE.

Hoff, K. A. and Bashir, M. (2015). Trust in automation: In-

tegrating empirical evidence on factors that inﬂuence

trust. Human factors, 57(3):407–434.

Hollnagel, E., Woods, D. D., and Leveson, N. (2006). Re-

silience engineering: Concepts and precepts. Ashgate

Publishing, Ltd.

Lotz, V., Kirste, A., Lidynia, C., Stumpf, E., and Zieﬂe,

M. (2023). User acceptance of urban air mobility

(uam) for passenger transport: A choice-based con-

joint study. In International Conference on Human-

Computer Interaction, pages 296–315. Springer.

Meurer, J., Pakusch, C., Stevens, G., Randall, D., and Wulf,

V. (2020). A wizard of oz study on passengers’ expe-

riences of a robo-taxi service in real-life settings. DIS

’20, New York, NY, USA. Association for Computing

Machinery.

Muralidhar, D., Belloum, R., de Oliveira, K. M., and

Ashok, A. (2023). Elements that inﬂuence trans-

parency in artiﬁcial intelligent systems - a survey. In

Abdelnour Nocera, J., Krist

ın L

arusd

ottir, M., Petrie,

H., Piccinno, A., and Winckler, M., editors, Human-

Computer Interaction – INTERACT 2023, pages 349–

358, Cham. Springer Nature Switzerland.

Nations, U. (2018). 2018 revision of world urbanization

prospects.

Nielsen, L. (2019). Personas - User Focused Design. Pub-

lishing Company, Incorporated.

OMG (2017). Uniﬁed modeling language.

Pigatto, D. F. (2017). Hamster healthy, mobility and

security-based data communication architecture for

unmanned systems. PhD thesis, Universidade de S

Paulo.

Ranscombe, C., Rodda, J., and Johnson, M. (2019). Vi-

sualising user experiences: Analysing embodiment of

ux in autonomous vehicle concepts. Proceedings of

the Design Society: International Conference on En-

gineering Design.

Sauer, V., Mertens, A., Heitland, J., and Nitsch, V. (2021).

Designing for trust and well-being: Identifying design

features of highly automated vehicles. In Extended

Abstracts of the 2021 CHI Conference on Human Fac-

tors in Computing Systems, CHI EA ’21, New York,

NY, USA. Association for Computing Machinery.

Siewert, S., Sampigethaya, K., Buchholz, J., and Rizor, S.

(2019). Fail-safe, fail-secure experiments for small

uas and uam trafﬁc in urban airspace. In 2019

IEEE/AIAA 38th Digital Avionics Systems Conference

(DASC), pages 1–7. IEEE.

Springer, A. and Whittaker, S. (2019). Progressive disclo-

sure: Empirically motivated approaches to designing

effective transparency. In Proceedings of the 24th In-

ternational Conference on Intelligent User Interfaces

(IUI ’19), pages 107–120, New York, NY, USA. As-

sociation for Computing Machinery.

Str

omberg, H., Pettersson, I., Nolhage, J., Ju, W., and

Martelaro, N. (2017). Setting the stage with

metaphors for interaction – researching methodolog-

ical approaches for interaction design of autonomous

vehicles. In Proceedings of the 2017 ACM Conference

Companion Publication on Designing Interactive Sys-

tems, DIS ’17 Companion, page 372–375, New York,

NY, USA. Association for Computing Machinery.

Verma, H., Ev

equoz, F., Pythoud, G., Eden, G., and

Lalanne, D. (2019). Engaging pedestrians in design-

ing interactions with autonomous vehicles. CHI EA

’19, page 1–6, New York, NY, USA. Association for

Computing Machinery.

Wiegers, K. and Beatty, J. (2013). Risk reduction through

prototyping, pages 295–311. Microsoft Press, Red-

mond, USA, 3 edition.

ICEIS 2025 - 27th International Conference on Enterprise Information Systems

524