Pattern 01 · Transition
The Handoff
The machine yields control on purpose: it signals the transfer, hands over its current state, and gives the human time to orient before they are accountable.
The mechanism
machine leads → human leads
- 01Machine leadsAutonomy nominal
- 02TriggerApproaching the edge of its limits
- 03 · Key momentSignal + stateMode, intent, hazards, time left
- 04OrientHuman acknowledges, gets bearings
- 05Human leadsMachine confirms release
At 02: Hand off early and on purpose, at a designed boundary — not at the moment of failure.
At 04: The window is sized to how long a human needs to re-enter the task, not to when the machine runs out.
On this page
When to use Draft
Use this whenever a machine can reach the edge of what it can safely do and a person is expected to take over. It matters most at autonomy levels where the human isn't watching continuously, so they arrive cold.
Design considerations Draft
Trigger at a designed boundary. Decide in advance which conditions start a handoff, and start it before the machine runs out of options. A handoff that begins at the moment of failure is already late.
Size the window to the human. Planned takeovers vary widely in how long they take. Base the orientation window on people who have been out of the loop, not on emergency takeover data.
Brief all three levels. Tell the human what is happening, what it means, and what happens next. Raw state alone leaves them holding data instead of understanding.
Clear the channel. Suspend unrelated displays and media once a handoff starts, so the briefing is the only thing competing for attention.
Release only on acknowledgment. Responsibility moves when the human confirms, not when a timer expires. If nobody confirms, fall back to a safe stop rather than handing control to no one.
Without / with the pattern
Without
Machine driving, then Sudden alarm, then Human takes over cold
Control drops with no context. The human inherits the situation at the worst possible moment.
With the pattern
Early signal, then State briefing, then Confirmed takeover
The transfer is announced, explained and acknowledged. Responsibility moves only once the human is oriented.
Examples Draft
- [Image: ALKS transition-demand HMI]
Applies the pattern
UN R157 names this moment the transition demand, and requires non-driving displays to suspend once it starts.
- [Image: AF447 cockpit, with the message display zone marked]
BEA, AF447 Final Report, 2012, Figure 70 Without it
Air France 447: the autopilot disconnected suddenly and the crew took over cold. The handoff arrived as a few lines of text in this zone.
- [Image: NTSB Tempe timeline figure]
NTSB HAR-19/03, 2019 Without it
Tempe, 2018: the system never alerted the safety operator, and the operator was not monitoring.
Related patterns
- Requires · 05Shared Mental ModelThe state briefing only works if the human's model of the situation is already current.
- Follows · 03Graceful DegradationWhen the ladder runs out of fallbacks, the system escalates by handing control back.
- Follows · 11Readiness CheckA takeover request assumes someone is ready to receive it. This is the check that assumption rests on, and the reason the escalation ends in a stop rather than a handover.
- Complements · 12Return of ControlThe Handoff covers the machine giving control up. This is the same transfer in the other direction, where the failure mode is not a cold takeover but a contest neither side acknowledges.
- Complements · 13Operator-to-Operator HandoverThe Handoff moves control between a machine and a human. This moves it between two humans, where the state has to survive a gap in which nobody is watching.
Sources
Timing is where this one usually goes wrong. A handoff triggered when the machine runs out of options is already too late, because the operator has been out of the loop and needs time to work out what is happening before they can act.5 Planned takeovers vary enormously in how long they take, so sizing the window from emergency data will leave people short.3
- Ironies of AutomationPaper
- “Take over!” How long does it take to get the driver back into the loop?Paper
- Takeover Time in Highly Automated Vehicles: Noncritical Transitions to and From Manual ControlPaper
- Designing for Situation AwarenessBook
- The Glass CageBook
- UN Regulation No. 157 — Automated Lane Keeping Systems (ALKS)Standard
- SAE J3016 — Taxonomy and Definitions for Terms Related to Driving Automation SystemsStandard
- NTSB HAR-19/03 — Collision Between Vehicle Controlled by Developmental Automated Driving System and Pedestrian, Tempe, ArizonaIncident
- BEA Final Report — Air France Flight AF447, Rio de Janeiro to ParisIncident