Seite - 71 - in The Future of Software Quality Assurance

Testing Autonomous Systems 71 • “Functional safety” is not just a sub-item of “Functional Suitability”! Each of the eight quality characteristics from ISO 25010 [13] contains aspects which (especially if thereareweaknesses) influencewhetherthesystemcanbeassessed as“functional safe.”This isparticularly true for the topic“Security.” 4.2 ImplicationsofLearning The intelligence of highly autonomous systems will largely be based on learning algorithms(machinelearning).Learningwillnotonlybelimitedtothedevelopment phase of a system (learning system). From a certain Mission Complexity and Environmental Complexity on, it will be necessary for autonomous systems to learn from data they collect during normal operation (self-learning system) and thus continuously improve their behavior or adapt it for rare situations. This poses completelynewquestionstothedevelopment,testing,andapprovalofsuchsystems: If robots are required to be able to learn, this reveals additional questions with regard to the problem to ensure safe robot behavior. Learning capabilities implicate that the learning system is changed by the learning process. Hence, the system behavior is not anymore determined by its initial (designed) structure, and not only structure deviations due to occurring faults are of interest anymore. Learning changes the systems structure; thus, its behavior can as well be determined by the newly learned aspects. The residual incompleteness of thesafety-related knowledge consequence is that thesystemdiffers from its initiallydesigned version. [10, p.131] The testing branch is facing new questions: how to test that a system is learning the right thing? How do test cases, which check that certain facts have been learned correctly, look like? How to test that a system correctly processes the learned knowledge by forgetting for example wrong or obsolete information or abstracting other information? How to test that (for example with robot cars) self-learning software follows specific ethic rules? How to formulate test strategiesand testcases insuch away that theycanhandle the“fuzziness” of the behavior of AIsystems? [17] With regard to the introduction of self-learning systems, the protection of users’ physical integrity must be a top priority ... As long as there is no sufficient certainty that self- learning systems can correctly assess these situations or comply with safety requirements, decouplingofself-learning systemsfromsafety-critical functionsshouldbeprescribed.The use of self-learning systems is therefore conceivable with the current state of the art only for functions that are not directly relevant to safety. [4] 4.3 New Test Method:Scenario-BasedTesting An autonomous system is characterized by the fact that it is capable of indepen- dentlyheadingforandachievingagivenmissiongoal.Thesubtasks that thesystem must solve for this canbe formulatedas test tasksand lookas follows: • Sensing: Can the system capture the signals and data relevant to its mission and occurring in its environment?