Designing software updates that millions of Ford and Lincoln drivers actually trust.

Problem

Updates were a trust problem. You're asking someone to let their car rewrite its own software, usually overnight while they sleep, and nothing about the old flow made that feel okay.

So people stalled. They figured an update might brick the car or strand them halfway through, so they put it off. And when something did go wrong, the screen just went quiet, with no status and no way out. Sometimes an update would cut in while they were still using the car. Then it would finish, and nothing on screen told them it had done anything at all.

You can guess how that went. Installs stayed low, plenty of cars ran old software, and the whole point of over-the-air, a car that keeps improving long after you buy it, quietly stopped being true.

Why it mattered

Over-the-air updates are a big deal for a car. They're how it picks up new features, fixes, and security patches without anyone booking a service appointment. But none of that reaches the driver if they don't install it. A feature that ships to a car still sitting on old software might as well not have shipped.

So the real work was getting millions of people to say yes to an update, and to keep saying yes for years. A nicer progress bar was never going to do that on its own.

The approach

I stopped thinking about this as one screen to get right. An update is really a sequence. You set it once and let it run, you see what's happening if you catch it live, you can check where your car stands anytime, and you find out what changed when it's done. Each of those moments can earn a little trust or lose it.

So I designed for all four.

Designing for trust, step by step

Make it a non-event

Most people don't want to think about updates at all, so automatic became the default. The car installs when it's parked and idle, usually overnight, and the driver sets that preference once. They don't stand around watching a progress bar or hunt for the right time to run it. It just happens, and the car is ready in the morning. Once installing wasn't the driver's job anymore, most of the fear went with it.

Be honest in the moment

When the driver does see an update, the screen answers the questions they're actually asking, in plain language. What's happening, how long it will take, and whether they can still drive. I cut the jargon and the empty reassurance. This is the one part of the process they get to watch, so it had to be straight with them.

Make no news good news

A lot of trust just comes from being able to check. A driver can open the updates screen whenever they want and get a straight answer about where their car stands. Most of the time there's nothing to do, and the screen says exactly that and confirms the car is already up to date. They don't have to wonder whether they're behind or dig through settings to find out. The status is always a tap away, and it's usually good news.

Pay it off

When an update finishes, the car shows the driver what they actually got. A short, clear “what's new,” not a changelog nobody reads. It's a small thing, but it matters. The next time an update is ready, the driver remembers the last one gave them something, and saying yes comes a little easier.

Impact

The redesign shipped across Ford and Lincoln. Updates went from something drivers actively avoided to something they mostly stopped noticing, and more cars ended up on current software because of it.

I can't put the exact numbers on a public page, since they sit behind NDA. But the shape of the result was the whole point. Once people trusted the update, they stopped turning it off.

Learnings

Trust doesn't come from one good screen. It builds up, or breaks down, across the whole interaction, and the quiet parts ended up mattering more than I expected. A screen that just confirms you're already up to date, or an update that bothers to tell you what you got, does more for someone's confidence than polishing the screens where everything already goes right.

The best version of this feature is one the driver barely has to think about, right until the moment it's worth telling them it happened.