You are legally required to have and use the turn signals. You are legally required to have and use the windshield wipers (because you need to be able to see the road when it's raining). Same is true for the horn and hazard lights - those are safety-critical features, with their use at least partially regulated by law.
While I agree that volume control should be a physical button due to my personal taste, I would not go so far as to mandate it legally to be a physical button, with the reason being that it is not a safety-critical feature. The market can figure this out by itself. But for safety-critical features whose swift and correct use is mandated and regulated by law, I would absolutely mandate them to be provided to the user in a way that supports the swift and uninterrupting use expected from the driver, and that means: physical controls, placed reasonably reachable.
Sir Issac Newton wrote down the laws about piloting a couple of ton of steel some time ago. Very unlikely to be repealed.
Every control that will be used by the driver for any purpose whilst the vehicle is in motion is safety critical.
You need to draw a line, otherwise really anything in your car can be safety-critical, you just need to imagine the right circumstances.
I would draw the line at the controls that are mandated by law. Every control mandated by law should not only be mandated to exist, but also be mandated to exist as a physical, easily reachable button.
> Every control that will be used by the driver for any purpose whilst the vehicle is in motion is safety critical.
Okay, that's at least limiting it somewhat. However, what about the setting for Bluetooth connectivity of the radio? It technically can be used while driving, and there's probably a non-zero count of people who have already used such a setting while driving to pair their phone or whatever. What about the time/date setting of the clock in your car? Same thing. Physical buttons for all of that?
You're being intentionally obtuse. Like everything else, this is a question of what options we have to make things safer. "Not allowing children in cars" isn't reasonable, because there isn't a simple alternative. Using controls that require less attention focus is reasonable.
Case: seat belts. First introduced in 1949, three-point seat belt invented in 1955, Saab made them standard in all their cars in 1958, Volvo in 1959 after being shown studies with fatalities. The first compulsory seat belt law was in 1970 (Victoria, Australia), and only began in the US in the 1980's (with great opposition).
Case: ABS. Patented anti-locks in 1930-ish, the modern ABS in 1971, the system was slowly introduced first in high-end models, soon in every model. The US only mandates ABS in cars since 2012, Europe since 2004 (for new cars). Read: all cars were already being sold with ABS in those dates, except for the cheaper and shittiest ones.
Case: Airbags. I skip the history there, because airbags are still not mandated anywhere. They are subject to some regulations, but you can technically build and sell a car without a single airbag in it.
My conclusion: we should not wait or even hope mandates do anything. In the car market we should do our own research and trust (to a point) car brand safety records and voluntary tests like NCAP, IIHS or NHTSA. If a brand doesn't give a shit about safety unless under a government mandate, don't buy that brand, because they are decades behind safety standards.
Mandates are not the bare minimum in safety, they are well below that. Take for example one of the lowest scores in the current NCAP: Lancia Ypsilon 2015, two stars. Still, they have (not mandated): two front airbags, two side head airbag, belt pretensioner, belt load limiter, belt reminder and ESC. Fear no more, even if we find today that kids in the back raises the death rate in a collision by 20%, we won't see it mandated until 2080 if ever, way after car makers figure out a solution by themselves.
If you want physical controls that actually are significantly safer to use than touchscreens, you need to lay down some ground rules for them as well (reachability, size of buttons, tactile difference from surroundings,...). And that rules out a "blacklist" approach (banning some particular undesired solution) and instead requires a "whitelist" approach (requiring a solution within a defined set of guidelines that constitute what's considered an acceptable solution).
It'll be exploited a lot, so the standards must be high enough, and implementations also must be continually scrutinized by independent neutral bodies.
And we know what comes of it; the industry consortium implementations pass the test with flying colors and it'll look like hugely unpalatable dinosaurs, while new entrants like Tesla struggle to even interpret the spec to follow. The consortium may also explicitly or implicitly ban Chromium based everything.
But at least it'll be safe.
The question isn't whether or not the interface needs to be interacted with at times when it would be a safety issue. The question is whether or not the interface _will_ be interacted with in a way that would be a safety issue. And how much of a safety issue that is to _other_ people. And what better options there are to prevent those issues.
"People can use it responsibly" is not a viable strategy here, when the (many) bad actors injure and kill 3rd parties.
A while ago I worked on a military vehicle intercom system (communication between different station in tanks and armored vehicles). It had a number of pragmatic requirements, learned through experience. One of them was that each station had a 3.5mm jack that mixed its signal into what the headset was hearing. They had learned that whatever you did, soldiers were going to listen to music when they got bored. If you gave them a jack then at least they'd still have their headset on, and would hear instructions (and you could override the music if necessary...). Without the jack they'd just take their headset off.
You have to accept the reality of the world you're designing for not the world you'd LIKE to be designing for.
[Another pragmatic requirements anecdote from the same system: the comms bus had to be able to cope with random disconnects. Why? Because on a tank, the comms bus went to the commander in the turret via a contact ring and when the main gun fired, sometimes that contact ring would disconnect. But then we were allowed 1.5s to reconnect. That's a surprisingly long time - how come? Because that's how long it takes the tank commander's hearing to recover after firing!]
