Seite - 65 - in The Future of Software Quality Assurance

Testing Autonomous Systems 65 The SAE levels are structured according to the division of tasks between driver and vehicle.12 For robots and other basically driverless, autonomous systems, a more general definition is needed. [5] defines a generic framework for “Autonomy Levels for UnmannedSystems (ALFUS)” that is applicable to all types of UMS or autonomoussystemswith threeassessment dimensions: 1. Mission Complexity(MC) 2. EnvironmentalComplexity (EC) 3. HumanIndependence(HI) The framework describes how a metric-based classification can be performed within each of these dimensions and how an overall system rating (“Contextual AutonomousCapability”)canbedeterminedfromthis. 2.2 CapabilitiesofFullyAutonomousSystems A fully autonomoussystem should be able to accomplish a predeterminedmission goal without human intervention. For a service robot, one such goal could be “get me a bottle of water from the kitchen.” A fully autonomous car should be able to drive itspassengers“to Hamburg.” Thesystemmustbeable tonavigateautonomouslyin its respectiveenvironment. Anditmustbeable todetectpreviouslyunknownoradhocobstaclesandthenavoid them(e.g.,byanautonomousvehiclerecognizingablockedroadandthenbypassing it), or remove them(e.g.,byaservice robotopening thecloseddoor that blocks the way to the kitchen). In more general terms, this means that a fully autonomoussystem must be able to recognizeand interpret situations or eventswithin a certain spatial and temporal radius. In the contextof the identifiedsituation, it must be able to evaluatepossible optionsforactionandselect theappropriateorbestoptionwithregardtothemission objectiveand then implement it asmeasures. 3 Safetyof AutonomousSystems It is obvious that a self-driving car or autonomous robot poses a danger to people, animals, objects, and infrastructure in its vicinity. Depending on the mass and movement speed of the system (or of system parts, e.g., a robotic gripping arm), thedangercanbeconsiderableor fatal.Possible hazardcategoriesare: 12[2] itself avoids the term “autonomous” because “ ... in jurisprudence, autonomy refers to the capacity for self-governance. In this sense, also, ‘autonomous’ is a misnomer as applied to automateddriving technology,because even themostadvanced ADSsarenot ‘self-governing’ ... . For these reasons, this document does not use the popular term ‘autonomous’ to describe driving automation.”