Autonomous Manufacturing Processes under Legal Uncertainty

In the field of autonomous systems, manufacturers still face a high level of uncertainty, especially in the development phase. These systems are characterized by their ability to adapt to new conditions without any further action by the developer. One of the future challenges will be that autonomous systems continue to evolve during the use phase. These changes are hard to predict because they are affected by the specific product environment. Nevertheless, manufacturers are exposed to liability claims if damage events occur. Uncertainty about the question of the specific conditions for liability results in an incalculable risk for the manufacturer. This paper takes an interdisciplinary approach. The first step is to identify the manufacturers' legal obligations for the entire product lifecycle. These obligations are then checked for their technical feasibility and evaluated in terms of efficiency. Manufacturers can only be obligated to take measures that are sustainable. The aim of the study is to translate the legal requirements for manufacturers of autonomous systems into concrete solutions that are both practical and manageable.

. Levels of automation [7] following [6] Manufacturing experiences an upheaval towards a fully automated production plant. In this area, closed-loop manufacturing processes have been vigorously developed [8]. Fig. 1 shows an adaption of the VDA taxonomy for automated driving to manufacturing processes. While current research projects focus on controlling chosen product features and therefore operate at level 3, future research issues aim for a full automation. The current change of technical systems towards autonomous systems does not only challenge engineers but also society and legal experts. We are accustomed to deal with less variable systems that are reliable and predictable. Autonomous systems learn and change by nature such that a future behavior cannot be foreseen to its full extent. This may cause a loss of secondary or even main functions and even harm to a person.

Product Liability in Germany
In order to specify legal obligations regarding production processes, especially regarding the ongoing progress of automation, it is necessary to point out the current legal framework. The following should give a brief overview of product liability in Germany. The producer's liability for damages done to any of the legally protected rights such as a person's life, body, health or property due to his product, depends on the general principles of Section 823 of the German Civil Code, the Product Liability Act and the Product Safety Act.
Liability in respect of Section 823 paragraph 1 of the German Civil Code. Section 823 paragraph 1 of the German Civil Code is the pivotal rule of tortious liability. Its scope of application covers compensation due to damages done to life, body, health or property of a person. It is not limited to damages caused by dangerous products but it also applies to cases of producer's liability due to its generalist regulatory nature (See for beginnings and further references: [9]). The conditions set out in Section 823 paragraph 1 of the German Civil Code require damages done to one of the aforementioned protected rights, caused by an intentional or negligent action, which also has to be unlawful. Furthermore, causality requirements between the tortfeasor's action and the legal infringement as well as causality requirements between the legal infringement and the actually occurred damage have to be met. The means of cause and effect limit the infringer's liability to damages that verifiably arise from his sphere. Moreover, liability is excluded, if the tortfeasor proves that his actions were neither intentional nor negligent. The differentiation between both cases is less relevant, as both lead to the producer's liability [10]. However, it is relevant, in which way the negligence is determined. A negligent action is assumed if any security obligation is violated. Generally speaking, anybody who creates or uses any source of danger has to secure such source in a way that no third party is harmed [11; 12].

Uncertainty in Mechanical Engineering III
With regard to the specific liability of a producer the safety requirements derive from the legitimate expectation, the endangered group of users has towards the product. For further specifications of the obligations it is necessary to take into consideration, which use of the product is intended by the producer and which use can be foreseen regardless of his intention. The scope of safety requirements is defined by specific needs and abilities of the targeted group of users. For example, if a product is predominantly used by consumers, the safety requirements have to be higher as if primarily used by professionals. Unintended but foreseeable use of the product is limited by any intentional misuse of that product. Hence, the producer cannot be held accountable for damages caused by such misusage of the product. Additionally to meeting the users' expectations, the required safety measurements have to meet latest state-of-the-art standards relevant at the time, when the product is marketed. It is critical for the producer's liability whether an alternative construction of the product would have been safer and technically possible, considering state-of-the-art standards, than the construction chosen in the production process. What is considered state-of-the-art from a legal perspective is shaped by the practical operational technical solutions deemed to be existent among the relevant experts in respect of the specific production. Therefore, only solutions, which are fully developed for serial production have to be taken into account by the producer [13, recital 16]. Technical regulations, such as DIN standards or harmonized European standards, can only be consulted for the purpose of identifying the minimum level of required security. Producers should therefore comply with existing standards when developing and testing new products, but such compliance cannot exempt a producer from taking further precautions to ensure the safety of his product. However, if the producer can ensure to provide the required safety of his product without complying with aforementioned standards, he is free to apply his own safety precautions. DIN standards or harmonized standards have no compulsory or legally binding character. [14; 15] Liability in respect of the Product Liability Act. The Product Liability Act is applicable to producers of a defective product. It is a special legislation act; however, it explicitly does not affect the liability on the basis of other provisions. Section 1 paragraph 1 of the Product Liability Act is the central rule of the act. The producer of a defective product is obligated to compensation, if the product causes a person's death, injury to his body or damage to his health or an item of property. Other than Section 823 paragraph 1 of the German Civil Code, Section 1 paragraph 1 of the Product Liability Act provides for a system of strict liability, as in liability without requiring fault. Without the fault requirement, liability claims cannot be restricted by the concept of individual responsibility, as it would be the case for tortious liability. Therefore, the material scope of Section 1 paragraph 1 of the Product Liability Act needs to be limited in order to shield the addressees from boundless liability claims. This is achieved by specifying the nature of the defect product in the means of Section 1 paragraph 1 of the Product Liability Act. Regarding damages done to items of property, the producer can only be held liable for damages which occurred to items not identical with the defect product itself, as their compensation is a matter of contractual law. Compensation for property damages caused by products intended for commercial use is excluded from the scope of Section 1 paragraph 1 of the Product Liability Act. Section 1 paragraph 2 of the Product Liability Act has limiting purposes as well. For example, the producer is excluded from liability, if the defect, which later caused any damages, either did not exist at the time the product was placed on the market or if it was impossible to discover such malfunction, given the scientific and technical knowledge at that time.
Moving on to the central prerequisite of the claim -the defect of the product. In the means of Section 3 paragraph 1 of the Product Liability Act a product has a defect, if it does not provide the safety, which reasonably can be expected of such products. Whether or not expectations are considered reasonable, depends on the given circumstances, especially the presentation of the product, its intended and foreseeable usage, as well as the time, it was distributed. However, it is noted, that identifying security obligations on the basis of these criteria can be difficult for producing companies. Therefore, it is generally accepted to utilize the categories of safety Applied Mechanics and Materials Vol. 885 obligations, distinguished by German courts when applying Section 823 paragraph 1 of the German Civil Code, to identify the defect of the product (containing further references [13]). With one exemption. Since the defect needs to be implemented at the time the product is placed on the market, there can be no obligation to monitor the product throughout its lifecycle. Any defect, that is caused or detected during the course of usage and could not be foreseen by the producer, can only fall within the scope of Section 823 paragraph 1 of the German Civil Code and will not cause any liability concerning the Product Liability Act.
Liability in respect of the Product Safety Act. Another source of law to be mentioned is the Product Safety Act. Generally speaking, this act of public law prohibits introducing products into the market, which are a source of risk for a person's life, body and health. The regulatory purpose of this act is of preventive character and applies only to non-food products. It differentiates between those safety requirements necessary if the product is intended to be used by consumers and requirements that apply for an intended usage only by professionals. It is worth mentioning, that the violation of the mandatory security provisions stated in the Product Safety Act are a strong indication for a lack of security in the means of Section 823 paragraph 1 of the German Civil Code and Section 1 paragraph 1 of the Product Liability Act. Vice versa, compliance with the security provisions does not per se exclude liability claims. [16, recital 56] In order to ensure compliance with the Product Safety Act, surveillance authorities are established. In cases of reasonable doubt, whether or not provisions of the Product Safety Act, ensuring the safety of product users, are met, they are authorized to take appropriate measures. Such measures include ordering the producer of any unsafe product to withdraw or recall his product from the market.
The act itself does not regulate any liability claims, only provisions on penalties and regulatory fines. Nevertheless, due to the legal concept of protecting the individual user, Section 3 paragraph 1 and 2 of the Product Security Act are considered a Protection Law within the means of Section 823 paragraph 2 of the German Civil Code. Objects of protection are safety and security of users or third parties. Any violation of Section 3 paragraph 1 and 2 of the Product Security Act can then result in liability claims according to Section 823 paragraph 2 of the German Civil Code. [16, recital 55]. However, these claims barely apply in jurisdiction and are therefore not considered in this paper.

Automated Deep Drawing
In order to evaluate product liability in relation to autonomous production processes, it is important to first examine current state-of-the-art controlled processes.
Varying raw materials, new material, product and batch size requirements challenge todays sheet metal forming processes [17]. For instance, sharper corner radii, reduced wall thicknesses and increased drawing ratios enlarge the risk of tearing and wrinkling failures in deep drawing [18]. The desire to incorporate stronger and thinner materials, e.g., high strength steels [19], aluminum or magnesium alloys, enhances this effect and therefore a feasible process window shrinks [20]. As forming processes are affected by uncertainty, e.g. variations in sheet thickness, tensile strength, elongation at break, a robust distance to the shrinking process window must be complied. Therefore, advanced process control is required to achieve the desired final product properties, e.g., geometry, desired work hardening, even when facing disturbances. This will additionally allow to expand tolerances and to procure cheaper materials.
Closed-loop control in metal forming has been intensively investigated to control a limited amount of product properties, mainly geometrical features [8]. Nevertheless, state-of-the-art controls focus on one product property but neglect many implicit requirements like surface quality, predefined sheet thickness that may be altered along with the controlled property.

Uncertainty in Mechanical Engineering III
In classical deep-drawing the necking failure can be reliably predicted with a forming limit curve and a numerical simulation. But in closed-loop deep-drawing, the controller continuously varies the blank-holder force or punch movement which ends in arbitrary deformation-paths. To guarantee a reliable closed-loop process would require to test each possible variation of blank-holder and punch trajectories in numerical simulations and trials.
Besides tearing failure, wrinkling failure is also a concern and its predictability similarly suffers from process adaptations caused by closed-loop control. While tearing and wrinkling are the prevalent failures, many other properties decide the final product quality.
The benefit of closed-loop control systems in deep drawing has been shown in multiple scientific studies at laboratory scale [8]. To control the process, a couple of online monitoring and control systems have been tested, e. g., online monitoring of the draw-in [17], blank-holder and punch forces [8; 21; 22]. But those monitoring systems are not able to witness the final product properties and therefore to learn. For other forming processes, measuring final product properties is much more feasible. A learning closed-loop controller has been shown for a blanking and bending process chain that simultaneously controls a product angle under varying material conditions while continuously adapting its process model [23]. However, other product properties like surface quality or residual stresses have not been considered. Controlling only one selected product property can impair the other properties.

Case Example: Car Body Components
It has been shown that the deep-drawing process is well-advanced in terms of automation and control. The automotive industry uses this process to produce various body parts made of different materials (see Fig. 2). Modern manufacturing plants like the Volkswagen commercial vehicle production in Wrzesnia, Poland, are equipped with an inline quality control, in this case a 3D inline optical quality control for the production of the driver door [24]. As the quality control is foreseeable to play a major role for further automation of manufacturing processes, the production of a car body part serves as an example for the subsequent discussion of autonomous processes in forming technology. Moreover, in addition to optical surface requirements, the door should also fulfill load-bearing safety functions. The manufacturing process has basic prerequisites which are necessary for an autonomous process. This case example assumes that the individual autonomous processes are linked to form an entire autonomous process. The process chain begins with the goods receipt of the coil and is considered up to the quality assurance of the driver door. The production of a door takes place in several process steps. It starts with the production of a blank which is cut from the supplied coil material, followed by deep-drawing and quality control. The quality control is carried out optically and by destructive testing procedures in random samples.

Fig. 3.
Process window for deep-drawing following [26] Already in the first process step, the blank production, there are several possibilities to produce the geometry. In this case, we assume that a solid-state laser cuts the desired blank geometry. The laser process can be adapted through the cutting speed, power, gas type, gas pressure and focal position [27]. Therefore, a highly automated cutting process is not only able to adapt to new geometries but also to take into account the data transmitted by the supplier, such as material data, and combine it with data from the shop floor like machine data from the previous production. Vice versa, it can forward its process data to the subsequent deep-drawing process.
Disturbances coming from previous process steps or material variations, become effective during deep drawing. In this process step, current automated deep-drawing processes are able to measure the material flow as well as the final part quality and adapt the blank-holder force according to a predefined model. State-of-the-art forming models for deep-drawing aim to exploit the process limits shown in Fig. 3. As the wrinkling and cracking limits depend on the material and vary from batch to batch, the actual limit drawing ratio is related to high risk and therefore the drawing ratio is reduced to a more robust operating point. Achieving a maximum drawing ratio is very desirable, as it enables the forming of more demanding geometries, higher strain hardening and better material utilization. Knowing the actual material properties, e. g. from upstream process data, the process limits can be determined with more certainty and therefore a maximum drawing ratio is more likely be achieved.
A subsequent quality control is carried out in random samples to check the requirements for the door. These include, for example, optical measurement of the component for geometrical properties and destructive testing for strength. Real-time sensors in deep-drawing tools are able to measure the blank-holder force, draw-in of the blank, wrinkling and tearing. While wrinkling and tearing are important product properties, it is so far infeasible to detect thinning of sheet metal or microscopic cracks online.
Due to the fact that current automated deep-drawing processes react independently to material fluctuations by adapting the blank-holder force, a constant geometrical quality can be produced. Nevertheless, it is possible that parts are manufactured that meet the explicit geometry requirements but do not meet requirements that were previously unproblematic and therefore not explicitly defined and controlled. Such implicit requirements can be, for example, residual stresses in the component. High residual stresses cause the material to exceed the yield or tensile stress even at low loads and to fail early at higher loads. Then, failure during a crash cannot be ruled out. Unfortunately, residual stress is a property that cannot yet be measured non-destructively. Other possible defects are the appearance of microscopic cracks, material thinning, wrinkles. Using

232
Uncertainty in Mechanical Engineering III optical metrology, wrinkling might be observable in a 100 % control. Microscopic cracks require a high optical resolution and data processing or a fluorescent penetrant inspection all of which are very expensive and therefore currently do only allow for a control based on a sample. Nevertheless, the functionality of the door has to be assured. One of its safety related functions is the ability to resist a side wall crash. To specify a safety function especially in case of a side impact or roll over, a maximum allowed displacement for a given side or roof load is defined. Complying with this specification should minimize the injuries to the occupant in case of a crash. Augenstein et al. [28] concluded that sidewall crashes cause even more deaths than front crashes. Major injuries can most likely affect the front passenger on the crash side, to the thorax, abdomen and pelvis. A study by the Insurance Institute for Highway Safety [29] has shown the effect of a side impact with different forces and speeds on the displacements of doors as well as on passenger dummies. To measure the injuries on the dummies, different acceleration, displacement, force and moment sensors have been integrated into the dummies and standardized injury criterions have been evaluated. The speed of the crashing car has been identified as one of the most important factors for injuries. Knowing the effect of speed and crash impact, an optimal design and production of the door is possible.
However, only preventing wrinkling and tearing or controlling a geometry may cause other properties to drift away that have not been explicitly specified because they have never been a trouble before. Increasing the blank-holder force will affect the surface which can worsen the adhesion of anticorrosive coating and in consequence can lead to a premature product failure.
State-of-the-art deep-drawing processes are able to influence the material draw-in to prevent wrinkling, cracks and to achieve a desired geometry. Their closed-loop control bases on a defined rule to adapt the blank-holder force that allows to realize tough geometries and to compensate process variations. Geometry data from the quality control or even crash data are not yet fed back into the deep-drawing process. Based on other offline closed-loop forming processes, feeding back the geometry data and adapting the online closed-loop control is the inevitable next step. This step involves learning but must also take into account other product properties, e. g. the strength, which is currently infeasible to measure inline. Only learning from geometry data might cause the closedloop forming process to achieve the geometry without cracks or wrinkles but necking might be unseen. So far, measuring the strength takes place during a run-in phase at the start of production and on a random basis. A learning process might guarantee a constant strength which involves a higher measuring effort. Measuring the strength more frequently, e. g. every 100 parts, would be vital.

Outlook on Future Autonomous Processes
For an autonomous production process, crash data of and the effect on the parts being produced should be available. On the other hand, other engineering specifications describing the design of a door also are part of the autonomous production, e. g. a minimum weight. Currently, the choice of the optimal light-weight material is part of the engineer's field of responsibility. However, the supply chain for production processes is increasingly automated without impacting the final product processes. Having a defined material and supplier in an enterprise resource planning (ERP) software allows automatically reordering a new batch for the production. In contrast to an automated production, we assume that an autonomous production is able to define the material to be ordered for the production of the next batch and therefore material properties may vary from batch to batch without human interaction. One important feature of learning is generalization, i.e. the ability to learn from one material and transfer the results to a new material. Therefore, an autonomous process may choose new alloys. Anyhow, if the autonomous process tries to fully exploit the process window with a new material type, e. g. a brittle material, microscopic cracks may occur. As such cracks are not yet part of a 100 % control, faulty parts may be produced undetected and integrated into cars. Experiencing a side crash with such a door leads to a displacement beyond the specifications and to injuries beyond the average. This scenario could be prevented if the process boundaries were fixed to known and tested materials but this approach contradicts autonomy. Another approach would be to only allow the autonomous process an exploration of new materials or process parameters if the outcome is fully tested.
These problems also exist with non-autonomous processes. Today's processes are therefore evaluated with the help of process safety methods. The disadvantage of this process is that upstream processes must achieve smaller tolerances to ensure process reliability of the end product, which is reflected in the costs of the product. Autonomous processes can counteract the tolerances and thus the associated costs by their ability to learn. Furthermore, it is possible to counteract the uncertainties of semi-finished product variations and delivery times caused, for example, by natural catastrophes or international market fluctuations.

Discussion
The selected example provides for an autonomous process chain. Even if the step to fully autonomous production processes in the field of deep-drawing still lies in the future, it is interesting to evaluate the legal issues, as uncertainty about the legal framework and the associated liability risks can have a negative impact on the industry's willingness to innovate.
If a person is killed or injured in an accident due to a faulty door, as described above, the question of responsibility for the damage incurred will soon arise. If a defective product is not in commercial use, both Section 823 paragraph 1 of the German Civil Code and Section 1 paragraph 1 of the Product Liability Act will apply. In the present case, the manufacturer of the end product, a motor vehicle, is equally the manufacturer of the door, therefore no special considerations need to be taken into account with regard to the opponent. However, in the event of the defective product being a supplier product, it can be assumed that the injured party would first make a claim against the manufacturer of the end product. The latter would then seek compensation for this claim from the supplier by way of recourse. In the case of producer liability, a breach of duty of care is required. Within the scope of the Product Liability Act, the existence of a defect is of importance. In both cases, there is differentiation between the areas of design, manufacture, instruction and product monitoring [13, recital 12; 30, recital 6]. If a defect can be detected in the product, it can also be assumed that there has been a breach of duty of care. We will therefore identify such defects as errors in its design, fabrication, instruction or product monitoring. Our examination of the example of the door follows this structure. Also, the category of fabrication errors will play no part. It refers to a deviation between the design of the product and the actual outcome of the production process regarding safety requirements. This category was mainly developed to protect producers from legal claims, if the defect of the product could simply be categorized as an outlier. In the example of an autonomous process chain, this categorization can no longer lead to meaningful results. Therefore, the main focus lies on construction errors and the obligation to monitor a product throughout its lifecycle.

Constructional Faults
A design error or constructional error is assumed if the safety standard required by the current state of science and technology at the time of the product placement is not achieved by the design alone. This refers to measures that appear objectively suitable, sufficient and objectively reasonable for danger to be avoided. [13, recital 15] A key duty of the producer is to first identify risks which may emanate from the product and then take these into account in the design phase. Also crucial are the safety expectations users can justifiably place on the product. These expectations are influenced by the marketing of the product, its area of application and its price. If the safety of the product is given special priority in its marketing, users will expect the safety standard promised. The same applies to market prices. If the product tends to endanger specifically protected legal interests such as life and body, higher safety standards are expected compared to a product potentially causing damage only to property. Once

234
Uncertainty in Mechanical Engineering III the producer has identified both the potential risks posed by his product and the potential users and their expectations with regard to safety standards, the product can be designed accordingly. However, 100% security cannot be expected. [31; 32; 33; 34] If product risks cannot be avoided by the design, it must be considered whether the product should be placed on the market at all. The criteria used to assess this are various. The probability of damage, as well as the ability of the user to take action to avoid it himself, must be considered amongst other things. If the manufacturer comes to the conclusion that the product may be placed on the market, but certain risks for users still remain, these must be prevented as far as is possible. The necessity for measures to avoid this residual risk depends on what can be expected of the producer. This assessment is different in every individual case. The benefit of an alternative construction is balanced against the actual increase in safety it would provide [35]. Economic factors, such as the sales opportunities for a product with the corresponding alternative design as well as production costs, can have an impact on this assessment (with further references: [12, recital 18]). However, caution is required when giving weight to such economic criteria. High costs alone do not mean that an alternative construction implies an unreasonable level of effort. In general, it can be said that the more important the protected legal right is, the greater the financial input expected from the producer [36; 30, recital 8].
The special feature of the autonomous production process considered here is that it can change and continuously adapt itself. The ability to learn from the data of previous process steps leads ideally to an improvement in the process and the parts produced. However, there can be no absolute certainty as to how the process will change over the course of its use. The parameters specified independently by the system, such as the duration of the deep-drawing process, applied blankholder forces and the choice of material, influence the critical geometry of the finished component and thus its safety in the event of a crash. Decisions that the producer would have to make in a conventional process as part of the product design are transferred to the process itself. In the question of the foreseeability of and ability to avoid a design error of the door, the product itself cannot play a decisive role. The conception of the product is developed without any input from the producer and is difficult for the producer to predict due to the learning process. In order to define the obligations of the manufacturer in a meaningful way, the concept of the autonomous process chain as a whole must be taken into account.
General usage of autonomous process chains. The important question is whether autonomous process chains may be used at all. This depends on the safety of the manufactured product produced by the process, and whether this safety corresponds to the minimum standard in state-of-the-art science [13, recital 16]. The manufacturer expects better material utilization and higher product consistency. It is particularly important for components affecting safety that consistent quality is achieved. In conventional processes, the process would be adjusted before the start of production; changes would only be made if either a deviation of the actual properties from the target properties became apparent during a random inspection, or if experienced employees detected undesired deviations during their visual inspection. The change of the process parameters would then be carried out by an employee. To carry out such operations, experienced and well-trained employees are required, but incorrect decisions and differences between the decisions taken by different employees cannot be ruled out. The automation of a process is generally considered to be more reliable than human actions. This is the reason why controlled deep-drawing processes are currently being developed. The comparison between actual and target variables is carried out by the control system implemented. The process parameters are also changed automatically on the basis of regulatory laws. If the safety of an autonomous production process is to be compared to that which is currently state of the art, the focus must therefore be on controlled processes, not on the conventional deep-drawing processes that have been widely used up to this point. The further development towards an autonomous process chain enables the manufacturer to make maximum use of the process limits and thus of geometries and material utilization that cannot be achieved with earlier processes. In principle, the quality of the door produced should also improve, but production close to the process limit also increases the risk of material thinning. This in turn Applied Mechanics and Materials Vol. 885 increases the risk of component failure in the event of an accident. The process was therefore conventionally designed to be robust. Even in the controlled process, target values are estimated conservatively in order to avoid excessive material thinning. Before using an autonomous production process, the manufacturer must be able to ensure that the component meets at least the safety level that can be achieved by current state-of-the-art standards [13, recital 16]. It is inevitably necessary to "teach-in" the process. Only when a steady-state has been reached, a comparison of the end products can take place. In the course of extensive testing, it should then be examined how the process reacts to the different influences that may arise in the course of a production process. If the error rate of the autonomous process is below the error rate of a non-autonomous process, it can be assumed that the producer may use the autonomous system. The question as to what effort is required to provide that proof can only be answered by taking into account the legal interest at risk. In the event of a failure of the door in an accident, serious injuries to the occupants or even death are to be feared. Life, body and health as legal assets worthy of special protection justify the producer being expected to expend high levels of effort and financial outlay. Even if it can be demonstrated in the test phase that the autonomous process reduces errors in the final component, a residual risk remains due to its ability to change itself. How high this risk may be, compared to the benefit that is achieved, cannot be conclusively answered at this point in time. The doctrine of permissible risk offers a suitable means of solving the problem. It therefore remains to be seen how the acceptance of autonomous systems and the associated risks will develop. However, it would be desirable to have a clear regulation for manufacturers to use as a guideline. The decision as to which risks are still permitted should not be left to the industry.
Obligations during the use of an autonomous production process. If it can be assumed on the basis of extensive tests that the process may be commissioned for series production, there must be clarification as to which duties of care the producer must fulfill during its use. The learning ability of the process excludes the possibility of guaranteeing that it works 100% error-free at any time. The producer simply cannot predict whether the process will change adversely during its use in series production. Another important feature is that the process is software-based. It is generally acknowledged that with software in particular one cannot expect it to be completely free of errors. However, this does not release the manufacturer from his liability. Precisely because the manufacturer is aware that software cannot be designed to be error-free, he must take particular care to monitor its functionality in use and he is required to rectify errors. [37] The situation is similar to independently changing systems. The producer is therefore required to monitor the functions of the process to a certain degree. Any errors that occur should then be corrected immediately. This monitoring obligation serves to compensate for the fact that the manufacturer's compliance with design obligations is less demanding due to the unpredictability of many errors. Since it is not always possible to conclude from the functionality of the process alone that the component produced is free of defects, the manufacturer is also advised to check those properties relating to the safety of the product. This option should be used if the component properties can be checked without too great an effort on the basis of data that is sensed as part of the autonomous process. Some properties, such as the wall thickness of the door, cannot yet be sensed as part of the autonomous process according to state-of-the-art science and technology, but are still highly relevant to safety. The question therefore arises as to what measures the manufacturer of the door must take in order to fulfill his monitoring obligation. One will have to focus on the exact implementation of the learning process. If the process learns from the data of each component produced, basic properties can change from one component to the next. Ultimately, the manufacturer would have to monitor component properties such as the wall thickness of the door in real time -even if that meant additional sensor data would have to be collected. This must apply at least in the initial phase of the use of autonomous systems. However, if the process only learns from the data of every hundredth component, as shown in the example, the required test frequency is reduced to this number. The process will only change as a result of a learning impulse. The first

236
Uncertainty in Mechanical Engineering III component after an impulse is therefore the same as the last component before the next impulse. To avoid unwanted material thinning, it is sufficient to check the component after the learning impulse. It is also worth mentioning that some product properties might not be explicitly monitored because they are not part of the requirements specified as safety relevant by the producer. Nevertheless, although this was also not the case in the conventional production process, these properties could have been detected by chance by the employee supervising the process. Therefore, these properties were at least monitored implicitly. The producer needs to ensure at least the safety standard specified by the current state of science and technology. When utilizing an autonomous production chain he then either has to take great care, when determining explicit product properties, or simply has to monitor everything a human employee could possibly detect.

Obligation to Monitor the Product
The obligation to monitor the production process must be distinguished from the obligation to monitor the product during its use phase. The aim is to detect unrecognized defects before the product is placed on the market. The manufacturer must take this information into account when developing new products. It may also be necessary to take measures to protect legal interests put at risk. Such measures can, for instance, be a warning of the dangers identified or even a product recall. In exercising his duty to monitor, the manufacturer must ensure a system of complaints management is in place [38]. Incoming complaints must be processed and the information transmitted to the relevant departments of the company. However, it is also incumbent on the manufacturer to actively inform himself about possible faults in his products. Sources for this include newspapers, trade journals [39], test reports and internet forums [40]. When using new technology, the risks for which cannot yet be fully assessed, particular care must be taken. For autonomously produced parts and especially autonomous systems, the knowledge gained from product monitoring should be used for a better understanding of the systems.

Instruction Errors
An obligation to instruct the user group arises when product risks cannot reasonably be avoided by means of the design. It must then be ensured that users have the necessary information when using the product to avoid dangers arising from this use. For example, the information can be provided in the product manual. In this example, a user instruction for the product door would make little sense, since it is installed as a component of an end product and the user's behavior cannot prevent the danger due to a lack of influence in this matter. This is why safe design is so important.

Conclusions
Autonomous production processes offer great opportunities for future processes in the metal processing industry, such as further improved material utilization, greater geometric diversity and widening of the required semi-finished product tolerances. However, these opportunities are also associated with risks that may lead to the failure of relevant functions in the future use of the products. As autonomous production processes are subject to continuous changes, which means that future process behavior cannot be predicted with sufficient certainty, even if extensive tests have been carried out within a certain period of time. This leads to two fields of action for the realization of future autonomous production processes. On the one hand, the processes must be continuously monitored as soon as safety-relevant functions of a product could be impaired by the process. This is not only fulfilled by optical testing, but also requires destruction tests in some cases. An alternative approach would be to have the process tested regularly. On the other hand, not only the explicit requirements for products are relevant. Many of the requirements are implicit because they were assumed to be universally valid in previous rigid production processes.