ANSI/UL 4600 FAQ

 Frequently Asked Questions for the ANSI/UL 4600 safety standard

These are unofficial answers to common questions.  Nothing here supersedes the standard itself. I have no formal relationship with Underwriters Laboratories beyond being a member of the Standards Technical Panel (voting member) for UL 4600.  (I have been a principal contributor to the content of that standard.)

A good starting point for initial information is:
     https://users.ece.cmu.edu/~koopman/ul4600/index.html

• Videos & slides explaining the standard
• Free, downloadable copy of the voting draft version (December 2019)

Q 1: Where can I get the standard?

• Free digital viewing and hard-copy purchase from Underwriters Laboratories:
  https://www.shopulstandards.com/ProductDetail.aspx?productid=UL4600
• You can see the voting draft of version 1 of the standard here as of December 2019. The differences between this and issued version 1 are important for conformance, but minor if you're just trying to get the big picture, you can find it at one of these sources:
• https://archive.org/details/191213-ul-4600-voting-version
• https://users.ece.cmu.edu/~koopman/pubs/191213_UL4600_VotingVersion.pdf
• An academic paper that summarizes the standard is here:
  Koopman, P., Ferrell, U., Fratrik, F. & Wagner, M., "A Safety Standard Approach for Fully Autonomous Vehicles," WAISE 2019, Sept. 2019.

Q 2: Does 4600 require an external assessor?

• No. An independent assessor is required, but need not be external. This assessor is primarily doing an audit on the completeness and traceability of the safety case.
• A self assessment process uses expertise within the development team to do a substantive technical assessment of the safety case.

Q 3: Does 4600 require revealing proprietary information outside the development company?

• No. There is no requirement to reveal any technical information in the safety case to the public, nor to any 3rd part unless the developer wishes to do so.
• A 4600 system-level assessment report states the degree to which requirements of the standard have been conformed to, but not the contents of the safety case itself.

Q 4: Isn't it too early for a standard? Won't it lock in outdated technology?

• No. 4600 is carefully designed to provide a way to know if a safety case (an explanation of how and why an autonomous vehicle is safe) provides a credible explanation that a vehicle is acceptably safe. It does not require any specific technology or design approach. It is also flexible in terms of permitting not addressing topics that don't apply to any specific vehicle as well as expanding the safety case when appropriate to address the unique concerns of each design team.

Q 4: How often does 4600 change?

• Underwriters Laboratories uses a continuous maintenance model. Rather than having to wait a minimum time between updates such as 5 years or more, updates can be pushed out as required. 
• The expectation is that updates will come out every year or two as the industry matures. This will permit the standard to evolve rather than locking conformance in to outdated approaches.
• The voting committee is aware that too-frequent updates can cause churn in safety cases. This is mitigated first by being very strategic in changes, including taking into account backward compatibility considerations. Second, the standard explicitly includes consideration of being able to use an older version of the standard during a reasonable transition period while still claiming conformance.
• As of August 2021 version 2 is entering review by the voting committee.

Q 5: Is this an official standard or just an academic research publication?

• ANSI/UL 4600 is an industry-issued consensus standard issued by Underwriters Laboratories (loosely: UL.org), which is an accredited non-profit Standards Development Organization (SDO). It is issued under the auspices of the American National Standards Institute (ANSI).
• The voting committee who approved 4600 included representatives from autonomous vehicle equipment developers, suppliers, consumer advocates, assessment organizations, academics, state government and the US federal government (US DOT). Voting members also span North America, Europe and Asia.

Q 6: Who are the voting members for this standard?

• You can see the current list here:
  https://csds.ul.com/Include/ViewRoster.aspx?GroupID=1862&stpNumber=4600

Q 7: Do I have to pay UL to be assessed for conformance?

• No.  Underwriters Laboratories issues the standard but does not sell conformance services. (You do have to pay to get an official copy of the standard -- just like other standards -- but not for any services.)
• There is no requirement to use UL LLC to perform assessments, nor any other 3rd party assessment service. You can do so if you wish, but there is not conformance "toll" that needs to be paid.

Q 8: How can I get involved?

• Anyone with an interest can request to be a Stakeholder by sending e-mail to: Heather.Sakellariou@ul.org and requesting UL4600 Stakeholder Status. This provides ability to participate in revision activities, but not voting rights.
• The Standards Technical Panel is the voting membership, which changes from time to time. There is a requirement for distribution of different types of stakeholders and a practical limit on group size. You can see the current STP membership here:
  https://csds.ul.com/Include/ViewRoster.aspx?GroupID=1862&stpNumber=4600

Q 9: Is UL 4600 just for SAE Level 4?

• UL 4600 covers the automated and autonomous portions of the vehicle functionality. That includes the SAE Level 3 functionality that does not involve the driver, all of SAE Level 4 functionality, all of SAE Level 5 functionality, and additional system level functionality. 
• Rather than SAE Levels, it might be better to think of the standard as covering the "Automated" and "Autonomous" operating modes
  (See: https://safeautonomy.blogspot.com/2021/04/a-driver-centric-users-guide-to-vehicle.html)

Q 10: Does UL 4600 replace ISO 26262, ISO 21148, ...?

• UL 4600 is an overall framework that other standards fit into. Most teams will use ISO 26262 or MIL-STD-882, and UL 4600 is specifically designed for compatibility with those standards. However, there is no requirement in UL 4600 to use any particular such standard. Rather, UL 4600 emphasizes making sure everything is covered that is required for system safety.
• UL 4600 is not redundant to these other standards. Rather, it provides an umbrella framework to make sure that other standards are used in a way that contributes to a holistic, acceptable system-level safety outcome.

Q 11: Is there an example safety case?

• UL 4600 provides criteria for assessing safety cases, but does not tell you what the safety case actually has to look like. Creating examples is an ongoing project. 

Q 12: What's the deal with UL.com and UL.org?

• "UL.org" is Underwriters Laboratories. They are a non-profit, accredited ANSI standards development organization (SDO) that created UL 4600. (Confusingly, they often use the UL logo and standards are "UL" due to historical reasons, but they are not actually UL.)
• "UL.com" is a related but separate company known as UL. UL does assessment against many standards. They are a for-profit company that is a member of the STP, but do not actually issue the standard.

Q 13: Where can I get more information about UL 4600-related safety ideas, such as Safety Performance Indicators?

• You can find a number of talks including slides and in many cases video here:
  https://users.ece.cmu.edu/~koopman/lectures/index.html#talks

(updated 9/2021)