Abstract: A method for controlling a robotic device. The method includes producing control software for the robotic device, carrying out field tests using the control software, determining scenarios in which events with at least a specified criticality (i.e., a specified value of a criticality metric) have arisen in the field tests, and determining, for each determined scenario, the frequency with which the determined scenario including an event with at least the specified criticality occurs, carrying out simulations for each determined scenario, determining, from the simulations, a collision rate for each determined scenario, combining the determined collision rates into an average (in other words overall) collision risk over all the determined scenarios, taking account of the determined frequency and controlling the robotic device using the control software if the average collision risk fulfills a specified safety criterion.

Abstract: A computer-implemented method for safeguarding a system against false positives. The method includes: receiving a time series of a criticality, the system including a functionality that is triggered when the criticality meets a first predetermined criterion; computing a time series of a reference, the reference being a comparison criticality for a triggering of the functionality; computing a time series of an error measure at least based on the time series of the criticality and the time series of the reference, a triggering of the functionality being classified as a false positive when a portion of the time series of the error measure meets a second predetermined criterion; and identifying at least one near-false positive, a non-triggering of the functionality being classified as a near-false positive when a portion of the time series of the error measure meets a third predetermined criterion, but not the second predetermined criterion.

Abstract: A computer-implemented method for safeguarding a system against false negatives. The method includes: receiving a time series of a criticality, the system including a functionality that is triggered when the criticality meets a first predetermined criterion; computing a time series of a reference, the reference being a comparison criticality for triggering the functionality; computing a time series of an error measure based on the time series of the criticality and the time series of the reference, a non-triggering of the functionality being classified as a false negative when a portion of the time series of the error measure meets a second predetermined criterion; and identifying at least one near-false negative, a non-triggering of the functionality of the system being classified as a near-false negative when a portion of the time series of the error measure meets a third predetermined criterion, but not the second predetermined criterion.