- Describe the perception–planning–control loop and the strengths and failure modes of cameras, lidar, radar and IMUs.
- Derive and apply the Kalman filter predict and update equations, and explain how SLAM uses loop closure and factor graphs.
- Implement A* grid planning and compare graph search, sampling-based planning and MPC.
- Explain behaviour cloning, compounding error, domain randomisation and how vision-language-action models map images and instructions to actions.
- Classify driving-automation features by SAE J3016 level and outline the elements of an autonomous-system safety case.
Before this: Computer Vision: Tasks, Metrics, Models and Deployment, Reinforcement Learning, Linear Algebra for AI, Probability and Statistics for AI
Robotics is where AI meets physics. A robot has to sense a messy world, work out where it is, decide what to do and move its body, many times per second, with consequences that cannot be undone. The same stack runs warehouse robots, surgical assistants, agricultural machines, drones and self-driving cars. This lesson walks through that stack: the classical pieces every robotics engineer must know (estimation, SLAM, planning, control), the learning-based methods that are changing the field (imitation learning, sim-to-real, vision-language-action models), and how autonomous vehicles are classified, deployed and argued safe.
Intuition: driving to an unfamiliar address
Think about how you drive somewhere new. Your eyes and ears gather information (perception). You combine what you see with a map and your sense of motion to know where you are (localisation). You choose a route and, moment by moment, a path around the parked van ahead (planning). Your hands and feet turn that plan into steering and pedal movements, correcting continuously when the car drifts (control). Then you look again. Robots run the same loop, the perception–planning–control loop (often called sense–plan–act), typically at 10 to 100 Hz for planning and up to 1 kHz for low-level motor control.
The loop in detail
| Stage | Input | Output | Typical methods |
|---|---|---|---|
| Perception | Raw sensor data | Objects, free space, semantic map, tracks | CNN and Transformer detectors, segmentation, point-cloud networks, multi-object tracking |
| State estimation and localisation | Sensor data plus motion commands | Pose (position and orientation) with uncertainty | Kalman and particle filters, SLAM, factor graphs |
| Prediction | Tracks of other agents | Likely future trajectories | Learned trajectory forecasting |
| Planning | Map, pose, goal, predictions | A trajectory or action sequence | A*, RRT, trajectory optimisation, MPC, learned planners |
| Control | Planned trajectory, current state | Motor torques, steering, throttle | PID, LQR, MPC |
Classical systems build these as separate modules with well-defined interfaces, which makes them testable and explainable. End-to-end learned systems map sensor input more directly to actions and can capture subtle behaviour, but they are harder to verify. Most deployed systems in 2026 are hybrids.
Sensors
| Sensor | Measures | Strengths | Weaknesses |
|---|---|---|---|
| Camera | Colour images | Cheap, dense, rich semantics (signs, lights, text) | No direct depth; struggles in glare, darkness and fog |
| Lidar | Distance by timing laser pulses; 3-D point clouds | Accurate geometry at tens to hundreds of metres | Cost, sparse at range, degraded by heavy rain or snow; no colour |
| Radar | Range and radial velocity from radio reflections (Doppler) | Works in bad weather, measures speed directly | Low angular resolution, clutter from metal objects |
| IMU | Linear acceleration and angular velocity | High rate (hundreds of Hz), no external dependency | Drifts quickly when integrated over time |
| GNSS (GPS) | Global position | Absolute reference | Metres of error, lost in tunnels and urban canyons |
| Wheel encoders, joint encoders, force/torque sensors | Rotation, joint angles, contact forces | Precise proprioception | Wheel slip; contact is hard to model |
Sensor fusion combines these so that each covers the others' weaknesses: the IMU fills gaps between camera frames, radar confirms speed in fog, lidar anchors camera depth. Fusion requires accurate calibration (each sensor's position and orientation relative to the others) and time synchronisation; a 50 ms timing error at 30 m/s is a 1.5 m position error.
State estimation and the Kalman filter
Every sensor is noisy, so robots maintain a belief: a probability distribution over the state. The Kalman filter is the optimal estimator for linear systems with Gaussian noise. It alternates two steps. With state estimate , covariance , motion model , process noise , measurement model and measurement noise :
Predict (motion makes us less certain):
Update (a measurement makes us more certain):
The Kalman gain weighs the measurement against the prediction by their relative uncertainties.
Worked example (1-D). A robot's predicted position is m with variance m². A range sensor reads m with variance m². Here , so . The updated estimate is m, and the variance becomes m². The result sits closer to the more trustworthy sensor, and the variance is smaller than either source alone.
import numpy as np
dt = 0.1
F = np.array([[1, dt], [0, 1]]) # constant-velocity motion model
H = np.array([[1.0, 0.0]]) # we measure position only (e.g. GPS)
Q = np.diag([1e-4, 1e-2]) # process noise covariance
R = np.array([[4.0]]) # measurement noise variance (2 m std)
rng = np.random.default_rng(1)
true_x = np.array([0.0, 1.5]) # start at 0 m moving at 1.5 m/s
x, P = np.array([0.0, 0.0]), np.eye(2) * 10.0
for k in range(100):
true_x = F @ true_x
z = H @ true_x + rng.normal(0, 2.0, 1) # noisy measurement
x, P = F @ x, F @ P @ F.T + Q # predict
S = H @ P @ H.T + R
K = P @ H.T @ np.linalg.inv(S) # Kalman gain
x = x + K @ (z - H @ x) # update with the innovation
P = (np.eye(2) - K @ H) @ P
print("true pos %.2f vel %.2f" % tuple(true_x))
print("est pos %.2f vel %.2f | pos std %.2f m" % (x[0], x[1], np.sqrt(P[0, 0])))
Measurements have 2 m of noise, yet after 10 seconds the filter estimates position to within about 0.3 m (true 15.00, estimate 14.71) with a reported standard deviation of 0.62 m. It also recovers the velocity (1.43 against the true 1.5 m/s), which was never measured directly. For non-linear systems, practitioners use the extended or unscented Kalman filter, or a particle filter, which represents the belief with weighted samples and can handle multi-modal beliefs ("I am in one of these two identical corridors").
Localisation and SLAM
Localisation estimates the robot's pose within a known map, for example by matching lidar scans to a prior high-definition map. When no map exists, the robot must build one while localising in it: simultaneous localisation and mapping (SLAM). This is a chicken-and-egg problem, because the map needs the pose and the pose needs the map, and errors accumulate as the robot moves. The key correction is loop closure: recognising a previously visited place, which reveals the accumulated drift and lets the system correct the whole trajectory.
Modern SLAM is usually formulated as a factor graph: nodes are robot poses and landmarks, and factors are constraints from odometry, IMU, landmark observations and loop closures. Solving SLAM means finding the poses that best satisfy all constraints, a non-linear least-squares problem solved with sparse optimisers (libraries such as GTSAM, g2o and Ceres). Variants include visual SLAM (cameras, e.g. ORB-SLAM), lidar SLAM, and visual-inertial odometry, which fuses a camera with an IMU and is what phones use for augmented reality. Learned components increasingly supply features, depth and place recognition, while geometry still does the optimisation.
Motion planning
Planning finds a collision-free, feasible path from start to goal. Planners work in configuration space (C-space): the space of all robot configurations, such as for a mobile robot or seven joint angles for an arm. Obstacles become forbidden regions in C-space.
- Graph search on a discretised grid or lattice: Dijkstra, and A*, which expands nodes in order of , where is the cost so far and an admissible heuristic (one that never overestimates the remaining cost), which guarantees an optimal path.
- Sampling-based planners for high-dimensional C-spaces: RRT (rapidly exploring random trees) grows a tree toward random samples; RRT* and PRM (probabilistic roadmaps) add asymptotic optimality and reuse.
- Trajectory optimisation: refine a path into a smooth trajectory that minimises cost (jerk, time, energy) subject to dynamics and collision constraints.
- Model predictive control (MPC): repeatedly solve a short-horizon optimisation from the current state, execute the first control, and re-plan. MPC blurs planning and control and is standard in autonomous driving and legged locomotion.
import heapq
GRID = ["S...#....",
".##.#.##.",
".#.....#.",
".#.###.#.",
"...#....G"]
ROWS, COLS = len(GRID), len(GRID[0])
find = lambda ch: next((r, c) for r in range(ROWS) for c in range(COLS) if GRID[r][c] == ch)
start, goal = find("S"), find("G")
h = lambda p: abs(p[0] - goal[0]) + abs(p[1] - goal[1]) # admissible on a 4-connected grid
def astar():
heap, came_from, g_best = [(h(start), 0, start)], {start: None}, {start: 0}
while heap:
f, g, node = heapq.heappop(heap)
if node == goal:
path = []
while node is not None: path.append(node); node = came_from[node]
return path[::-1]
if g > g_best[node]: continue # stale heap entry
r, c = node
for nb in [(r+1, c), (r-1, c), (r, c+1), (r, c-1)]:
if 0 <= nb[0] < ROWS and 0 <= nb[1] < COLS and GRID[nb[0]][nb[1]] != "#":
if g + 1 < g_best.get(nb, float("inf")):
g_best[nb], came_from[nb] = g + 1, node
heapq.heappush(heap, (g + 1 + h(nb), g + 1, nb))
return None
path = astar()
print("length:", len(path) - 1, path)
A* finds a 12-step path through the gap in the walls. Here the path length equals the Manhattan distance, so the heuristic was exact along this route. Real planners add costs for proximity to obstacles, inflate obstacles by the robot's radius, and smooth the result into a dynamically feasible trajectory.
Control
The controller makes the robot follow the plan despite disturbances. The workhorse is the PID controller: with tracking error between desired and measured state, the command is
where the proportional gain reacts to the current error, the integral gain removes steady offsets, and the derivative gain damps oscillation. LQR (the linear–quadratic regulator) computes optimal feedback gains for linear models with quadratic costs, and MPC handles constraints such as actuator limits explicitly.
Learning in robotics
Imitation learning
Behaviour cloning trains a policy by supervised learning on expert demonstrations of observations and actions , collected by teleoperation or kinesthetic teaching. It is simple and data-efficient, but it suffers from compounding error (covariate shift): small mistakes lead the robot into states the expert never visited, where its errors grow. DAgger (Ross, Gordon and Bagnell, 2011) fixes this by running the learned policy, asking the expert to label the states it actually reaches, and retraining. Modern recipes predict action chunks (short sequences of future actions) and use expressive generative heads, such as diffusion or flow-matching policies, to handle demonstrations with several valid ways to do a task. Low-cost bimanual teleoperation rigs such as ALOHA made collecting such data much cheaper.
Sim-to-real
Simulation offers unlimited, safe, parallel experience, which is ideal for reinforcement learning. Policies trained in simulation often fail on hardware because of the reality gap: mismatches in friction, masses, latency, sensor noise and visual appearance. Remedies:
- Domain randomisation (Tobin et al., 2017): randomise textures, lighting, masses, friction and delays during training so the real world looks like just another variation.
- System identification: measure real parameters and calibrate the simulator.
- Fine-tuning on real data, and learning residual corrections on top of a simulated policy.
Sim-to-real RL is now standard for legged locomotion: quadruped and humanoid walking controllers are commonly trained in massively parallel GPU simulators and deployed zero-shot. OpenAI's 2019 Rubik's Cube work with a robot hand was a landmark demonstration of heavy domain randomisation for dexterous manipulation.
Vision-language-action models
Vision-language-action (VLA) models extend vision-language models so that they output robot actions. A pretrained VLM brings web-scale knowledge of objects and language; fine-tuning on robot demonstrations teaches it to map camera images plus an instruction ("put the banana in the blue bowl") to actions. Published examples:
- RT-2 (Google DeepMind, 2023) introduced the VLA term, representing actions as text tokens in a VLM's vocabulary and showing transfer of web knowledge to new instructions.
- OpenVLA (Kim et al., 2024), an open 7-billion-parameter VLA trained on the Open X-Embodiment dataset.
- π0 (Physical Intelligence, 2024), which pairs a VLM backbone with a flow-matching action expert to produce smooth, high-frequency continuous actions across several robot bodies.
- Gemini Robotics (Google DeepMind, 2025) and NVIDIA's GR00T N1 (2025), aimed at general-purpose and humanoid robots.
The trend is toward generalist policies trained across many robot embodiments. As of November 2026 these models handle impressive tabletop and household manipulation in research and pilot deployments, but reliability, speed and safety guarantees still lag what factory and road deployment require. Most production robots still rely on classical stacks with learned perception.
Autonomous vehicles and SAE driving automation levels
SAE J3016 (latest revision April 2021) defines six levels. The key concepts are the dynamic driving task (DDT), meaning the real-time operational and tactical functions of driving (steering, braking, monitoring the environment and responding to objects and events); the operational design domain (ODD), meaning the conditions a feature is designed for (road types, speeds, weather, geography, time of day); and DDT fallback, meaning who responds when something fails.
| Level | Name | Who drives | Who is the fallback | ODD |
|---|---|---|---|---|
| 0 | No driving automation | Human (warnings and momentary interventions such as emergency braking only) | Human | n/a |
| 1 | Driver assistance | Human, with the system on steering or speed | Human | Limited |
| 2 | Partial driving automation | System on steering and speed; the human must supervise at all times | Human | Limited |
| 3 | Conditional driving automation | System performs the whole DDT while engaged | Human must take over when the system requests | Limited |
| 4 | High driving automation | System performs the whole DDT | System (no takeover expected) | Limited |
| 5 | Full driving automation | System, everywhere a human could drive | System | Unlimited |
The line that matters legally and practically is between Level 2 and Level 3: at Level 2 the human is driving even with hands off the wheel, while at Level 3 and above the system is driving while engaged. The levels describe features, not whole vehicles, and are not a ranking of quality.
Deployment as of November 2026
- Level 4 robotaxis are in commercial service. Waymo runs fully driverless paid ride-hailing in multiple US metropolitan areas; TechCrunch counted ten in February 2026 (including Phoenix, the San Francisco Bay Area, Los Angeles, Austin, Atlanta and Miami), and the company has continued to add cities and has announced plans for London. Tesla began offering some robotaxi rides in Austin with no safety monitor in the car in January 2026, starting with a small number of unsupervised vehicles within a larger supervised fleet.
- Level 3 in consumer cars has stalled. Mercedes-Benz Drive Pilot was the first Level 3 system certified in the US (Nevada and California, 2023), limited to mapped highways at low speeds, and Germany approved it at up to 95 km/h in the right-hand lane. In January 2026, however, Mercedes was reported to be dropping Drive Pilot from the facelifted S-Class in favour of a more capable Level 2 system, and BMW dropped its Level 3 Personal Pilot from the 7 Series facelift. The industry has shifted toward broad "hands-off, eyes-on" Level 2 systems.
- Level 2 systems, including Tesla's "Full Self-Driving (Supervised)", GM Super Cruise and Ford BlueCruise, are widespread. The driver remains responsible at all times.
- No Level 5 system exists.
Treat any deployment snapshot as perishable; check operators' and regulators' current publications before citing it.
Safety cases
A safety case is a structured argument, supported by evidence, that a system is acceptably safe for a specific use in a specific environment. It is usually organised as claims, arguments and evidence, often drawn in Goal Structuring Notation. For autonomous systems, evidence combines:
- Functional safety (ISO 26262 for road vehicles): hazard analysis, safety integrity levels, redundancy, and freedom from faults in hardware and software.
- Safety of the intended functionality (ISO 21448, SOTIF): hazards that arise even when nothing is broken, such as a perception model misreading an unusual scene. This standard matters most for machine learning.
- UL 4600: a standard for safety cases of fully autonomous products, requiring coverage of the ODD, of machine-learning limitations and of field monitoring.
- Testing evidence at scale: simulation of millions of scenarios, closed-course tests of edge cases, and on-road miles with statistical comparison of crash rates against human benchmarks, analysed with confidence intervals because severe events are rare.
- Operational controls: ODD enforcement (the system refuses to engage outside it), a minimal-risk manoeuvre such as pulling over safely, remote assistance, and incident reporting to regulators.
The safety case is a living document, updated as the ODD expands and as field data arrives.
Common pitfalls
- Bad calibration and timing. Most "perception bugs" in fused systems are extrinsic calibration or timestamp errors.
- Overconfident filters. Setting process noise too small makes a Kalman filter ignore measurements and diverge.
- Testing inside the training distribution only. Rare events (unusual vehicles, construction zones, glare) dominate real-world risk.
- Behaviour cloning without recovery data. Policies trained only on perfect demonstrations cannot recover from their own mistakes.
- Trusting simulation results. Policies exploit simulator artefacts; validate on hardware early.
- Mislabelled autonomy. Calling a Level 2 system "self-driving" encourages misuse; regulators and courts take this seriously.
- Ignoring latency. A planner that takes 300 ms in a 100 ms control loop is acting on stale data.
In practice
Start with ROS 2, the de facto middleware for robot software, and a simulator (Gazebo, MuJoCo, NVIDIA Isaac Sim, or CARLA for driving). Get calibration, time sync and logging right before any learning. Use proven estimation (robot_localization, a factor-graph SLAM package) and planning stacks (Nav2 for mobile robots, MoveIt for arms), then add learned perception. For manipulation, collect teleoperated demonstrations and train imitation policies, or fine-tune an open VLA when you need language-conditioned generality. Use RL in simulation with domain randomisation for locomotion and contact-rich skills. For any safety-relevant deployment, define the ODD first, build the safety case alongside the system, and log everything so you can learn from the field.
Key takeaways
- Robots run a continuous perception–planning–control loop, and every stage must handle uncertainty and latency.
- Sensor fusion works because sensors fail differently; the Kalman filter weights each source by its uncertainty.
- SLAM builds a map and localises in it at the same time, using loop closures and factor-graph optimisation to remove drift.
- Classical planners (A*, RRT, MPC) remain the backbone; learning increasingly supplies perception and, through imitation learning and VLAs, manipulation skills.
- SAE Level 3 and above means the system drives while engaged; Level 4 robotaxis are in commercial service, while consumer Level 3 has largely stalled as of November 2026.
- Safety is argued, not assumed: a safety case ties the ODD, functional safety, SOTIF, testing evidence and operational controls together.
Terms in this lesson
- Perception–planning–control loop
- The repeated cycle in which a robot senses its environment, decides on actions and executes them.
- Lidar
- A sensor that measures distances by timing reflected laser pulses, producing 3-D point clouds.
- IMU
- An inertial measurement unit measuring linear acceleration and angular velocity at high rate.
- Kalman filter
- A recursive estimator that alternates prediction with a motion model and correction with measurements, weighting each by its uncertainty.
- SLAM
- Simultaneous localisation and mapping: estimating a robot's trajectory and a map of its environment at the same time.
- Loop closure
- Recognising a previously visited place so that accumulated drift in a SLAM estimate can be corrected.
- Configuration space
- The space of all possible robot configurations, in which planning is performed.
- Behaviour cloning
- Imitation learning by supervised training of a policy on expert observation–action pairs.
- Domain randomisation
- Training in simulation with randomised physical and visual parameters so policies transfer to the real world.
- Vision-language-action model
- A model, typically built on a vision-language model, that maps images and language instructions to robot actions.
- Operational design domain (ODD)
- The specific conditions under which a driving-automation feature is designed to operate.
- Safety case
- A structured, evidence-backed argument that a system is acceptably safe for a defined use and environment.
Check your understanding
- 1.
A predicted position has variance 9 m², and a GPS reading has variance 3 m². With H = 1, what is the Kalman gain?
- 2.
A car keeps itself centred in its lane and controls its speed on highways, but the driver must watch the road at all times and is responsible for responding to hazards. What SAE level is this?
- 3.
Why does pure behaviour cloning often fail after a few seconds of autonomous operation?
- 4.
Which sensor most directly provides an object's radial velocity and keeps working in heavy fog?
- 5.
You must plan motions for a 7-joint arm in a cluttered workcell. Which planner family is the most natural first choice?
Exercises
Work each problem before opening the solution.
- Exercise 1Core
A robot's position estimate is 5.0 m with variance 2.0 m². It moves forward by a commanded 1.0 m with motion noise variance 0.5 m², and then a sensor measures 6.4 m with variance 1.0 m². Compute the predicted mean and variance, the Kalman gain, and the updated mean and variance (1-D, F = H = 1).
Show solution
Predict: mean = 5.0 + 1.0 = 6.0 m. Variance = 2.0 + 0.5 = 2.5 m².
Gain: K = 2.5/(2.5 + 1.0) = 0.714 (2.5/3.5).
Update: mean = 6.0 + 0.714 x (6.4 - 6.0) = 6.0 + 0.286 = 6.286 m. Variance = (1 - 0.714) x 2.5 = 0.2857 x 2.5 = 0.714 m².
The posterior variance (0.714) is smaller than both the prediction (2.5) and the measurement (1.0): fusing information always reduces uncertainty in the linear-Gaussian case.
- Exercise 2Core
Classify each feature by SAE level and justify it: (a) adaptive cruise control only; (b) a highway system that drives itself in traffic jams below a set speed, lets the driver watch a film, and gives 10 seconds' notice to take over; (c) a driverless shuttle that operates only on a fixed campus route in daylight and pulls over by itself if a sensor fails; (d) a hands-free highway system that monitors the driver's eyes and requires them to watch the road.
Show solution
(a) Level 1: the system sustains longitudinal control (speed) only, and the human steers and supervises. (b) Level 3: the system performs the entire DDT within a limited ODD, the user may do other things, but the human is the fallback and must respond to a takeover request. (c) Level 4: the system performs the entire DDT and its own fallback (a minimal-risk manoeuvre) within a limited ODD (campus, daylight). No human takeover is expected. (d) Level 2: steering and speed are automated, but the driver must supervise continuously. Hands-free does not change the level; eyes-on supervision is the defining feature.
- Exercise 3Core
Explain why Manhattan distance is an admissible heuristic for A* on a 4-connected grid with unit step costs, and why it is not admissible on an 8-connected grid where diagonal moves cost sqrt(2). Give an admissible heuristic for the 8-connected case.
Show solution
On a 4-connected grid, every move changes either the row or the column by exactly 1 and costs 1. Reaching the goal requires at least |dr| + |dc| moves, so the true cost is at least the Manhattan distance, and the heuristic never overestimates: it is admissible.
On an 8-connected grid, a diagonal move changes both coordinates at a cost of sqrt(2) (about 1.414), which is less than 2. For a goal at (1, 1), Manhattan distance gives 2, but the true cost is sqrt(2), about 1.414. It overestimates, so A* may return a suboptimal path.
Admissible alternative: the octile distance, h = max(|dr|, |dc|) + (sqrt(2) - 1) x min(|dr|, |dc|), which is the exact cost on an empty 8-connected grid. Straight-line Euclidean distance is also admissible but less tight.
- Exercise 4Challenge
Extend the lesson's A* code so that cells adjacent to obstacles cost 3 to enter instead of 1 (to keep a safety margin). Keep the Manhattan heuristic. Is it still admissible? Show the code change and explain how the path changes.
Show solution
def near_wall(p): r, c = p for dr, dc in [(1,0),(-1,0),(0,1),(0,-1)]: rr, cc = r + dr, c + dc if 0 <= rr < ROWS and 0 <= cc < COLS and GRID[rr][cc] == '#': return True return False def cost(p): return 3 if near_wall(p) else 1 # inside astar(), replace the neighbour update with: # ng = g + cost(nb) # if ng < g_best.get(nb, float('inf')): # g_best[nb], came_from[nb] = ng, node # heapq.heappush(heap, (ng + h(nb), ng, nb))Admissibility: every step still costs at least 1, so the true remaining cost is at least the number of steps, which is at least the Manhattan distance. The heuristic remains admissible, so A* still returns the minimum-cost path, though it may expand more nodes because the heuristic is now less tight.
Effect: the planner prefers routes that stay one cell away from walls when the detour costs less than the penalties avoided. Through narrow gaps (one cell wide between walls) it must still pay the penalty, because no alternative exists. The reported cost rises above 12 for this map, since the only corridors pass beside walls. This is a discrete version of the costmap inflation used in Nav2.
- Exercise 5Challenge
You lead a team deploying a delivery robot on university sidewalks. Draft the top-level structure of its safety case: the top claim, four supporting sub-claims, and the kinds of evidence for each. Include at least one claim specific to the machine-learned perception system.
Show solution
Top claim (G0): The delivery robot is acceptably safe for pedestrians, cyclists and property when operating within its defined ODD (campus sidewalks, daylight and dusk, no snow, at most 6 km/h).
G1 — The ODD is defined and enforced. Evidence: an ODD specification; geofence and weather-check logic with tests; logs showing the robot refuses to start, or stops safely, outside the ODD.
G2 — Hardware and software faults are detected and handled (functional safety). Evidence: hazard analysis (HARA/FMEA); redundant emergency stop and bumper; watchdogs; fault-injection test results showing transition to a minimal-risk condition (stop and alert) within a specified time.
G3 — The ML perception system detects relevant hazards with sufficient reliability within the ODD (SOTIF). Evidence: a dataset coverage analysis across lighting, weather, mobility aids, children, pets and scooters; recall at the required range with confidence intervals; analysis of known triggering conditions (glare, reflective surfaces); a conservative fallback, such as slowing when perception confidence is low; regression tests on every model update.
G4 — Residual risk is acceptable and is monitored in operation. Evidence: simulation and closed-course scenario testing; a supervised pilot with the incident rate compared against a defined target; remote monitoring and teleoperation procedures; incident reporting and triage; a change-management process that updates the safety case when the ODD or the models change.
Arguments link each sub-claim to the top claim. The case is reviewed by an independent assessor (UL 4600 expects independent assessment) and maintained as a living document.
Further reading
- bookKevin M. Lynch and Frank C. Park, Modern Robotics: Mechanics, Planning, and Control (2017)
- bookSebastian Thrun, Wolfram Burgard, Dieter Fox, Probabilistic Robotics (2005)
- paperCesar Cadena et al., Past, Present, and Future of Simultaneous Localization and Mapping: Towards the Robust-Perception Age (2016)
- paperJosh Tobin et al., Domain Randomization for Transferring Deep Neural Networks from Simulation to the Real World (2017)
- paperAnthony Brohan et al., RT-2: Vision-Language-Action Models Transfer Web Knowledge to Robotic Control (2023)
- docsSAE International, J3016_202104: Taxonomy and Definitions for Terms Related to Driving Automation Systems for On-Road Motor Vehicles (2021)
Go further
Sources
- SAE J3016_202104 (SAE Mobilus)
- ANSI Blog: SAE Levels of Driving Automation (J3016-2021)
- TechCrunch via Yahoo Finance: Waymo robotaxis are now operating in 10 US cities (Feb 24, 2026)
- TechCrunch: Tesla launches robotaxi rides in Austin with no human safety driver (Jan 22, 2026)
- electrive: Mercedes pauses Level 3 driving assistance – for now (Jan 12, 2026)
- Automotive World: BMW drops Level 3 ADAS as industry backing ebbs away (Feb 24, 2026)
- heise: Mercedes allowed to drive up to 95 km/h at Level 3
- Electrek: California certifies Mercedes Level 3 Drive Pilot (June 8, 2023)
- InsideEVs: Nevada-approved Mercedes Drive Pilot limited to 40 mph
Fact-checked and last reviewed 2026-11-05