UL4600
UL4600 Scope
The Standard’s scope includes safety principles and processes for evaluating autonomous products with no human driver supervision, meaning that the vehicle is to be fully autonomous. It requires a safety argument along with topics including risk analysis and safety-relevant aspects of design process, testing, tool qualification, autonomy validation, data integrity and human-machine interaction for non drivers, among others. UL 4600 is technology neutral, meaning that it does not mandate the use of any specific technology in creating the autonomous system, and it also permits design process flexibility. […] UL 4600 does not define performance or pass/fail criteria for safety, nor does it cover road testing or acceptable risk levels. Furthermore, the Standard does not set forth requirements for ethical product release decisions or any ethical aspects of product behavior.
Assesment
Self-certification vs. Independent certification source
The big controversy that broke out at UL 4600 STP was about who will certify final products. “That wasn’t a surprise, though,” said Koopman. He had all along anticipated this as a sticking point.
Obviously, there is a group of companies who advocate “self-certification.” Another faction insists on “a completely external, bullet-proof certification.”
The automotive industry, traditionally accustomed to self-certification, has balked at the prospect of subjecting designs and systems to external certification bodies.
However, many industry experts have been shaken by the Boeing 737 Max fiasco, which cast doubt on the FAA’s oversight of the certification process. Central to the question was the dubious notion of using company-paid employees to inspect their own aircraft for FAA certification. This example bolstered the argument within the UL 4600 STP for requiring an external, third-party body to certify the safety of autonomous products.
The certification issue could have been a deal breaker, but the group averted that risk by asking everyone to offer their own proposals. The STP debated pros and cons, and hashed it out, according to Koopman. A compromise was struck, opting for an “independent assessor” instead of requiring companies to use an external certification body. An independent assessor is not necessarily an external party. It could be a person working for the same organization designing autonomous products. UL 4600, however, stipulates that the company must make a credible argument for the independence of the assessor, by disclosing how and why that person is allowed to make assessments independent of the employing company.
Acknowledging the compromise, Koopman called it a “first step” that can be scrutinized in practice. “If it doesn’t work, we can fix it next year,” he added.