Seite - 68 - in The Future of Software Quality Assurance

68 T.Linz the danger that the system causes damage is naturally even greater than in normal operation. If a (rare) environmental situation occurs that is “not intended” by the software or that causesa softwaredefect that hashitherto remainedundetected in thesystem to take effect, this can transform an inherently harmless situation into a dangerous oneand/or renderexistingsafety functions ineffective. With conventional, nonautonomous safety-critical systems, sufficiently safe behavior can usually be achieved by a “fail-safe” strategy. This means that the system is designed in such a way that in the event of a technical fault, the system is switched off or its operation is stopped, thereby greatly reducing or eliminating immediatedanger (to theuseror theenvironment). This approach is not sufficient for autonomous systems! If a self-driving car wouldstop“in the middleof the road” in the eventofa failureofan important sen- sor, the car would increase the danger it poses instead of reducing it. Autonomous systemsshould thereforehaveappropriate“fail-operational”capabilities (see [12]). A self-drivingcar should act as a humandriverwould: pilot to the side of the road, park there, andnotify the breakdownservice. 4 TestingAutonomous Systems In which points does the testing of autonomous systems differ from the testing of software-based systems of today’s character? To answer this, we consider the followingsubquestions: • Which test topicsneed tobe covered? • What newtestingmethodsareneeded? • Which requirements for the test processbecomemorestringent? 4.1 QualityCharacteristics andTest Topics Theobjectiveoftestingis tocreateconfidencethataproductmeets therequirements of its stakeholders(customers,manufacturers, legislator,etc.).“Thosestakeholders’ needs(functionality,performance,security,maintainability,etc.) arepreciselywhat is represented in the quality model, which categorizes the product quality into characteristics and sub-characteristics.” [13]. This ISO 25010 [13] product quality modeldistinguishesbetween the following eightquality characteristics:Functional Suitability, Performance Efficiency, Compatibility, Usability, Reliability, Security, Maintainability,andPortability. These quality characteristics can be used as a starting point when creating a test plan or test case catalog for testing an autonomous system. Within each of these quality characteristics, of course, it must be analyzed individually which specific