Automobile safety integrity grade decomposition device and method

Abstract

The invention provides an automobile safety integrity grade decomposition device and method, and the device comprises a first function layer which obtains a second signal through calculation according to a first signal of a first grade; the second functional layer calculates a third signal according to the first signal; the merging module is used for merging the second signal and the third signal to obtain a fourth signal of a second level; wherein the first function layer and the second function layer are used for calculating the same physical quantity, the calculation modes are different, the first signal is utilized in a time-sharing mode, the first function layer and the second function layer are developed according to the first level, and the safety level of the second level is higher than that of the first level. The common cause failure is avoided by using the first signal in a time-sharing manner, so that the safety levels of the second signal and the third signal obtained by processing the two functional layers are the same as those of the first signal, and then the second signal and the third signal are combined, so that a fourth signal with a higher safety level can be obtained according to an ASIL decomposition method; and a higher ASIL function security target is realized by ingeniously utilizing low development cost.

Description

Technical Field

[0001] The present invention relates to the field of automobile safety technology, and in particular to an automobile safety integrity level decomposition device and method. Background Art

[0002] Automotive Safety Integrity Level (ASIL) is a key indicator used to measure the safety risk of automotive electronic systems or functions. The purpose of ASIL decomposition is not to reduce random hardware failures by assigning ASIL to hardware elements, but to focus on functions and requirements in the event of systematic failures.

[0003] ASIL decomposition primarily involves distributing safety requirements across multiple subsystems or components through a rational decomposition strategy during system development, when a function or component struggles to meet higher ASIL requirements. This allows the entire system to meet functional safety objectives while reducing the development difficulty and cost of individual components. Decomposition principles include independence and allocability. The independence principle states that the decomposed subsystems or components should be independent of each other in terms of failure modes, while the allocability principle states that safety requirements can be reasonably distributed across each subsystem or component. Decomposition methods include architecture-based decomposition, which performs ASIL decomposition based on the system's physical architecture, and function-based decomposition, which decomposes ASILs based on different functions.

[0004] The essential concept of ASIL decomposition is redundancy. Redundancy requires that there are no common cause failures or cascading failures that would cause redundant elements to fail simultaneously. ASIL decomposition involves redundantly assigning safety requirements to sufficiently independent elements (here, system components, i.e., hardware components or software units) with the goal of reducing the ASIL level of the redundant safety requirements assigned to these elements. If a safety requirement is decomposed into two redundant safety requirements, the ASIL level of the original safety requirement can be decomposed into the two redundant safety requirements. Because system failure only occurs when both safety requirements are not met simultaneously, the ASIL level of the redundant safety requirement can be lower than that of the original safety requirement. This is the reason why ASIL decomposition can reduce development complexity: because redundant safety requirements can reduce the ASIL level.

[0005] Two potential reasons for using ASIL levels include the need for OEMs to segment the system and specify subsystem requirements to suppliers, and the need for designers to build systems from the bottom up. The goal of bottom-up system building is to achieve a target system-level ASIL from existing ASIL concept component elements. Currently, fixed ASIL decomposition is often used during project development, such as ASIL B before decomposition and ASIL A(B) + ASIL A(B) after decomposition. The ASIL level after decomposition remains fixed in the system and does not change.

[0006] When faced with system requirements for high ASIL functional safety targets while maintaining low development costs, a fixed ASIL classification approach cannot meet these requirements. For example, if a vehicle only provides ASIL A wheel speed signals but requires the electric drive system to provide ASIL B torque functional safety, this requirement cannot be met. Summary of the Invention

[0007] In view of the above-mentioned defects of the prior art, the present invention provides an automotive safety integrity level decomposition device and method to solve the technical problem that low-development-cost systems cannot meet high functional safety target requirements.

[0008] To achieve the above-mentioned purpose and other related purposes, the present invention provides an automobile safety integrity level decomposition device, comprising: a first functional layer, for calculating a second signal of the first level based on a first signal of the first level; a second functional layer, for calculating a third signal of the first level based on the first signal; and a merging module, for merging the second signal and the third signal to obtain a fourth signal of the second level; wherein the first functional layer and the second functional layer are used to calculate the same physical quantity, and have different calculation methods, and use the first signal in a time-sharing manner, and are both developed according to the first level, and the safety level of the second level is higher than that of the first level.

[0009] In one embodiment of the present invention, the first functional layer includes: a first calculation model, which calculates the initial value of the first intermediate variable based on the first signal, and continues to calculate the first intermediate variable through a closed-loop estimation algorithm to obtain the first intermediate variable of the first level; and a second calculation model, which calculates the second signal of the first level based on the first intermediate variable.

[0010] In one embodiment of the present invention, the second functional layer includes: a third calculation model, which uses the first signal in a time-sharing manner to calculate a second intermediate variable of the first level; and a monitoring model, which obtains the third signal of the first level based on the second intermediate variable and the second signal.

[0011] In one embodiment of the present invention, the first signal is a wheel speed signal, and the second signal is a first torque signal; the first functional layer includes: an angle observation model, which calculates the initial value of the motor rotor position based on the wheel speed signal, and continues to calculate the motor rotor position through a closed-loop estimation algorithm to obtain the first level of the motor rotor position; and a current angle torque calculation model, which calculates the first level of the first torque signal based on the motor rotor position.

[0012] In one embodiment of the present invention, the third signal is a second torque signal; the second functional layer includes: a power torque calculation model, which uses the wheel speed signal in a time-sharing manner to calculate a first-level fourth torque signal; and a torque monitoring model, which obtains the first-level second torque signal based on the first torque signal and the fourth torque signal.

[0013] To achieve the above-mentioned purpose and other related purposes, the present invention also provides a method for decomposing an automobile safety integrity level, comprising: obtaining a first signal of a first level; based on the first signal, using a first functional layer to calculate a second signal of a first level, and using a second functional layer to calculate a third signal of a first level; merging the second signal and the third signal to obtain a fourth signal of a second level; wherein the first functional layer and the second functional layer are used to calculate the same physical quantity, and have different calculation methods, and use the first signal in a time-sharing manner, and are both developed according to the first level, and the safety level of the second level is higher than that of the first level.

[0014] In one embodiment of the present invention, based on the first signal, the first functional layer is used to calculate the second signal of the first level, and the second functional layer is used to calculate the third signal of the first level, including: the first functional layer calculates the initial value of the second signal based on the first signal, and continues to calculate the second signal through a closed-loop estimation algorithm to obtain the second signal of the first level; the second functional layer uses the first signal in a time-sharing manner to calculate the third signal of the first level.

[0015] In one embodiment of the present invention, based on the first signal, a first functional layer is used to calculate a second signal of a first level, and a second functional layer is used to calculate a third signal of a first level, including: in a first time period, the first functional layer calculates an initial value of the second signal based on the first signal; in a second time period, the first functional layer continues to calculate the second signal of the first level through a closed-loop estimation algorithm, and the second functional layer calculates the third signal of the first level based on the first signal; in a third time period, the first functional layer calculates the second signal of the first level based on the first signal, and the second functional layer continues to calculate the third signal of the first level through a closed-loop estimation algorithm; repeat the above second and third time periods to utilize the first signal in a time-sharing manner.

[0016] In one embodiment of the present invention, the first signal is a wheel speed signal, the second signal is a first torque signal, and the third signal is a second torque signal; based on the first signal, the first functional layer is used to calculate the second signal of the first level, and the second functional layer is used to calculate the third signal of the first level, including: based on the wheel speed signal, the angle observation model is used to calculate the initial value of the motor rotor position, and the motor rotor position is continued to be calculated through a closed-loop estimation algorithm to obtain the motor rotor position of the first level; based on the motor rotor position, the current angle torque calculation model is used to calculate the first torque signal of the first level; the wheel speed signal is used in a time-sharing manner, and the power torque calculation model is used to calculate the fourth torque signal of the first level; the torque monitoring model is used to compare the first torque signal and the fourth torque signal to obtain the second torque signal of the first level.

[0017] In one embodiment of the present invention, a power-torque calculation model is used to calculate the first-level fourth torque signal, including: obtaining the power loss of the motor based on the current amplitude, efficiency, and temperature change value of the motor; and obtaining the fourth torque signal based on the power loss of the motor, the phase voltage and phase current of the three phases of the motor, and the motor speed obtained by converting the wheel speed signal. Where,

[0018] Beneficial effects of the present invention: The present invention proposes a vehicle safety integrity level decomposition device and method, which sets two functional layers and performs calculations based on the same physical quantity. However, unlike the traditional fixed decomposition method, the present invention avoids common cause failures by using the first signal in a time-sharing manner, so that the second signal and the third signal obtained after processing by the two functional layers have the same safety level as the first signal. By merging the second signal and the third signal, according to the ASIL decomposition method, a fourth signal with a higher safety level can be obtained, which cleverly uses low development costs to achieve higher ASIL functional safety goals. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0020] Figure 1 A block diagram of the principle of a decomposition device provided in one embodiment of the present invention;

[0021] Figure 2 A schematic diagram of the decomposition process of a decomposition device provided in one embodiment of the present invention;

[0022] Figure 3 A flowchart of a decomposition method provided in one embodiment of the present invention;

[0023] Figure 4 A first flow chart of step S200 provided in one embodiment of the present invention;

[0024] Figure 5 A second flow chart of step S200 provided in one embodiment of the present invention;

[0025] Figure 6 This is a third flow chart of step S200 provided in an embodiment of the present invention.

[0026] Explanation of the accompanying drawings: 100, first functional layer; 101, first calculation model; 102, second calculation model; 200, second functional layer; 201, third calculation model; 202, monitoring model; 300, merging module. DETAILED DESCRIPTION

[0027] The following describes the embodiments of the present invention through specific embodiments. Those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. It should be noted that the following embodiments and the features in the embodiments can be combined with each other unless they conflict. In addition to the specific methods, equipment, and materials used in the embodiments, based on the understanding of the prior art by those skilled in the art and the description of the present invention, any methods, equipment, and materials of the prior art that are similar or equivalent to the methods, equipment, and materials described in the embodiments of the present invention can also be used to implement the present invention.

[0028] It should be understood that the terms used in the examples of the present invention are for describing specific embodiments rather than for limiting the scope of protection of the present invention. Unless otherwise defined, all technical and scientific terms used in the present invention have the same meaning as those generally understood by those skilled in the art.

[0029] The structures, proportions, sizes, etc. illustrated in the drawings of this specification are only used to match the contents disclosed in the specification for people familiar with this technology to understand and read. They are not used to limit the conditions under which the present invention can be implemented, and therefore have no substantive technical significance. Any modification of the structure, change in the proportional relationship, or adjustment of the size should still fall within the scope of the technical content disclosed by the present invention without affecting the efficacy and purpose that can be achieved by the present invention. In addition, the drawings only show components related to the present invention rather than being drawn according to the number, shape, and size of components in actual implementation. In actual implementation, the type, quantity, and proportion of each component can be changed at will, and the component layout type may also be more complex.

[0030] In the following description, numerous details are discussed to provide a more thorough explanation of the embodiments of the present invention. However, it is obvious to those skilled in the art that the embodiments of the present invention can be implemented without these specific details. In some of the embodiments, well-known structures and devices are shown in block diagram form rather than in detail to avoid obscuring the embodiments of the present invention.

[0031] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functions and operations that may be implemented by the methods and computer program products of various embodiments disclosed in the present invention. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the module, program segment, or a part of code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0032] To facilitate the subsequent understanding of ASIL decomposition, the fixed decomposition scheme in the existing technology is as follows:

[0033]

[0034]

[0035] The "QM" mentioned in the table above stands for "Quality Management," meaning that development in accordance with the company's quality management process will meet the requirements, without any special functional safety requirements. The ASIL safety integrity rating for automobiles is divided into four levels: ASIL A, ASIL B, ASIL C, and ASIL D, increasing in order from A to D. The ASIL level is determined based on severity, exposure, and controllability.

[0036] See Figure 1 , Figure 1 An embodiment of the present invention provides an automobile safety integrity level decomposition device, including a first functional layer 100, a second functional layer 200 and a merging module 300, wherein the first functional layer 100 calculates a first-level second signal based on a first-level first signal; the second functional layer 200 calculates a first-level third signal based on the first signal; the merging module 300 is used to merge the second signal and the third signal to obtain a second-level fourth signal; wherein the first functional layer 100 and the second functional layer 200 are used to calculate the same physical quantity, and have different calculation methods, and use the first signal in a time-sharing manner, and are both developed according to the first level, and the safety level of the second level is higher than the first level.

[0037] In this embodiment, for example, if the safety level of the first signal is ASIL A, the first functional layer 100 calculates the second signal based on the first signal to have an ASIL A safety level. Similarly, the second functional layer 200 calculates the third signal to have an ASIL A safety level. However, if the first and second functional layers 100 and 200 share the same first signal, a common cause failure will occur. In this case, the first and second functional layers 100 and 200 cannot simultaneously output signals with an ASIL A safety level. If the safety level of the signal output by one functional layer is ASIL A, the signal output by the other functional layer has no safety level, which can be denoted as QM. The combined output signals of these two functional layers still have an ASIL A safety level, namely: ASIL A = LV1 ASIL A(A) + LV2 QM(A). Where LV1 represents the first functional layer 100, LV2 represents the second functional layer 200, ASIL A in ASIL A(A) represents the safety level, and (A) represents the combined safety level. This is why traditional methods cannot achieve higher safety levels.

[0038] However, the present invention is different. Through its innovative time-sharing approach, the first signal can be utilized to avoid common cause failures, ensuring that the safety level of the output signals of the first functional layer 100 and the second functional layer 200 are both ASIL A. In this case, after merging, a fourth signal with a safety level of ASIL B can be obtained, namely: ASIL B = LV1 ASIL A(B) + LV2 ASIL A(B). Furthermore, based on this concept, if the safety level of the input first signal is ASIL B, then the method of the present invention can be used to obtain a fourth signal with a safety level of ASIL D, namely: ASIL D = LV1 ASIL B(D) + LV2 ASIL B(D).

[0039] In addition to time-sharing the use of the first signal, the first functional layer 100 and the second functional layer 200 must calculate the same physical quantity to facilitate subsequent merging. Furthermore, their calculation methods must differ, i.e., employ different approaches. Furthermore, the development of both the first functional layer 100 and the second functional layer 200 must be based on the first security level.

[0040] In one embodiment of the present invention, the first functional layer 100 includes a first calculation model 101 and a second calculation model 102. First calculation model 101 calculates the initial value of a first intermediate variable based on a first signal and continues to calculate the first intermediate variable using a closed-loop estimation algorithm to obtain a first-level first intermediate variable. Second calculation model 102 calculates a first-level second signal based on the first intermediate variable. First functional layer 100 needs to calculate the second signal based on the first signal. In a specific implementation, it may include two modules: first, calculating the first intermediate variable based on the first signal, and then calculating the second signal based on the first intermediate variable. Of course, more modules may be provided to implement the calculation of the second signal.

[0041] In this embodiment, the first functional layer 100 uses the first signal to calculate the initial value of the first intermediate variable only at the beginning. When the first intermediate variable is continued to be calculated through the closed-loop estimation algorithm, the first signal is no longer used, thereby conveniently realizing the time-sharing use of the first signal with the second functional layer 200.

[0042] It should be noted that if the safety level of the first signal is ASIL A, then the safety level of the first intermediate variable calculated using the first calculation model 101 is also ASIL A, and the safety level of the second signal calculated thereby is naturally also ASIL A. In this embodiment, regardless of the number of modules included in the first functional layer 100, the safety level of the second signal calculated thereby remains unchanged and remains consistent with the safety level of the first signal.

[0043] In one specific embodiment of the present invention, the second functional layer 200 includes a third calculation model 201 and a monitoring model 202. The third calculation model 201 uses the first signal in a time-sharing manner to calculate a first-level second intermediate variable. The monitoring model 202 generates a first-level third signal based on the second intermediate variable and the second signal. In this invention, the first functional layer 100 is the primary calculation model, resulting in the highest accuracy of its calculation results. The third calculation model 201 in the second functional layer 200 can have a relatively lower calculation accuracy. By introducing the monitoring model 202, the second intermediate variable and the second signal are compared to output the third signal. This further reduces the development difficulty of the third calculation model 201.

[0044] See Figure 2 In a specific embodiment of the present invention, the first signal is a wheel speed signal, and the second signal is a first torque signal; the first functional layer 100 includes an angle observation model and a current angle torque calculation model, wherein the angle observation model calculates the initial value of the motor rotor position according to the wheel speed signal, and continues to calculate the motor rotor position through a closed-loop estimation algorithm to obtain a first-level motor rotor position; and the current angle torque calculation model calculates a first-level first torque signal according to the motor rotor position.

[0045] In this embodiment, the first functional layer 100 is responsible for implementing functions such as angle, current, and voltage signal monitoring, current closed-loop control, torque control, fault diagnosis, and response. It specifically includes an angle observation model and a current-angle-torque calculation model. The angle observation model primarily estimates the motor rotor position θ using an internal software algorithm when the electric drive system's motor rotor position sensor fails. This observation model requires injecting an initial speed signal at the start of the algorithm to facilitate convergence of the algorithm observer. This initial speed signal is only used for 10 to 20 ms, after which the wheel speed signal is no longer used. The initial speed signal is the wheel speed signal. Here, the design is such that when the wheel speed signal is ASIL A, the angle observation model outputs a rotor position θ of ASIL A. The current-angle-torque calculation model uses the rotor position θ generated by the angle observation model to perform current control and calculate torque T1 (ASIL A). When the wheel speed signal is QM, the angle observation model outputs a rotor position θ of QM, and the current-angle-torque calculation model calculates torque T1 of QM.

[0046] The wheel speed signal's safety level is ASIL A. To reduce development complexity and meet safety requirements, the vehicle design avoids the more expensive ASIL B wheel speed signal. Instead, a monitoring mechanism has been added to the architecture design for wheel speed information processing. Initially, the wheel speed signal's ASIL is broken down into: ASIL A = LV1 ASIL A(A) + LV2 QM(A). At time t0, the position sensor begins to fail. After a period of time, the failure is confirmed, with the moment of confirmation being t1. The time Δt1 is defined as t1 - t0. This Δt1 is less than the FTTI (Fault Tolerant Time Interval), which is the time interval from the detection of a safety-related fault to the potential loss of the system's safety function and the potential for a hazardous state.

[0047] At time t1, the angle observation model uses the decomposed wheel speed ASIL A (A) signal to activate the observer and use it as the initial observed speed. It then begins estimating the motor rotor position angle θ (ASIL A). The current angle torque calculation module uses the rotor position θ output by the angle observation model to control current and calculate torque T1, which has an ASIL A safety level. Because the wheel speed signal is no longer needed after the angle observation model is activated and is only used for 10ms to 20ms, it is no longer used after this period. Therefore, the torque T1 functional safety level remains ASIL A.

[0048] In a specific embodiment of the present invention, the third signal is the second torque signal; the second functional layer 200 includes a power torque calculation model and a torque monitoring model, wherein the power torque calculation model uses the wheel speed signal in a time-sharing manner to calculate the first-level fourth torque signal; the torque monitoring model obtains the first-level second torque signal based on the first torque signal and the fourth torque signal.

[0049] In this embodiment, the second functional layer 200 is mainly responsible for the redundant safety diagnosis functions of angle, current, voltage, and speed signals, and monitors the torque safety parameters of the electric drive system to ensure that system anomalies can be diagnosed in a timely manner and that the electric drive system enters a safe state. The second functional layer 200 includes a power torque calculation model and a torque monitoring model, wherein the function of the power torque calculation model is to calculate the power torque T2 based on the wheel speed signal when the motor rotor position sensor of the electric drive system fails. When the wheel speed signal is QM, the torque T2 output by the power torque calculation model is QM. The function of the torque monitoring model is to monitor and ensure that the torque signal of LV1 is reliable, and to compare T2 with T1, thereby ensuring the safety level of the LV1 torque function at the LV2 level.

[0050] At time t1, the power-torque calculation model begins calculating power-torque T2 based on the decomposed wheel speed ASIL QM(A) signal. Note that the functional safety level of T2 is QM at this time. After a certain period of time, time t2 is reached, and the time Δt2 is defined as t2 - t1. Since Δt2 is ≈ 30ms, this time is much shorter than the FTTI (Failure Tolerance Time) of the undesired motor torque (typically 200ms to 300ms), and does not violate the fault tolerance time required by the torque safety objective.

[0051] At time t2, the wheel speed signal ASIL is decomposed into: ASIL A = LV1 ASIL QM(A) + LV2 ASIL A(A). At this point, the wheel speed decomposition in the LV2 monitoring layer system changes from QM(A) to wheel speed decomposition ASIL A(A). Because the wheel speed signal input to the power-torque calculation model dynamically becomes ASIL A(A), the torque T2 functional safety level output by the power-torque calculation model after time t2 is ASIL A.

[0052] The torque T1 obtained based on the current angle torque calculation model and the torque T2 obtained based on the power torque calculation model are compared within the torque monitoring model to ensure the ASIL A level of the LV2 monitoring torque.

[0053] After processing by the above models, the final functional safety target is undesired motor torque ASIL B, which is equal to LV1 ASIL A(B) + LV2 ASIL A(B). This achieves the goal of obtaining a torque signal with a higher safety level (ASIL B) based on the wheel speed signal with a safety level of ASIL A.

[0054] See Figure 3 , Figure 3 An embodiment of the present invention provides a method for decomposing automobile safety integrity levels, including steps S100 to S300.

[0055] Step S100: Acquire a first signal of a first level.

[0056] Step S200: Based on the first signal, the first functional layer 100 is used to calculate a second signal of the first level, and the second functional layer 200 is used to calculate a third signal of the first level. The first functional layer 100 and the second functional layer 200 are used to calculate the same physical quantity, but use different calculation methods, utilize the first signal in a time-sharing manner, and are both developed according to the first level. Two specific embodiments are provided below to implement time-sharing utilization of the first signal.

[0057] See Figure 4In a specific embodiment of the present invention, the first functional layer 100 is used to calculate the first-level second signal, and the second functional layer 200 is used to calculate the first-level third signal. The steps include: S211: the first functional layer 100 calculates the initial value of the second signal based on the first signal, and continues to calculate the second signal using a closed-loop estimation algorithm to obtain the first-level second signal; S212: the second functional layer 200 uses the first signal in a time-sharing manner to calculate the first-level third signal. The method used in this step corresponds to that used in the above-mentioned decomposition device: the first signal is used to calculate the initial value of the second signal, and the first signal is then no longer used. This allows for time-sharing utilization of the first signal.

[0058] See Figure 5 In a specific embodiment of the present invention, the first functional layer 100 is used to calculate the first-level second signal, and the second functional layer 200 is used to calculate the first-level third signal, including: S221, in a first time period, the first functional layer 100 calculates the initial value of the second signal based on the first signal; S222, in a second time period, the first functional layer 100 continues to calculate the first-level second signal using a closed-loop estimation algorithm, and the second functional layer 200 calculates the first-level third signal based on the first signal; S223, in a third time period, the first functional layer 100 calculates the first-level second signal based on the first signal, and the second functional layer 200 continues to calculate the first-level third signal using the closed-loop estimation algorithm; S224, repeating the second and third time periods to time-share the first signal. Unlike the previous embodiment, in this embodiment, the first functional layer 100 and the second functional layer 200 always use the first signal, but their use is staggered, thus also achieving time-shared use of the first signal.

[0059] See Figure 6 In a specific embodiment of the present invention, step S200 includes: S231, according to the wheel speed signal, using the angle observation model to calculate the initial value of the motor rotor position, and continue to calculate the motor rotor position through the closed-loop estimation algorithm to obtain the first-level motor rotor position; S232, according to the motor rotor position, using the current angle torque calculation model to calculate the first-level first torque signal; S233, using the wheel speed signal in a time-sharing manner, using the power torque calculation model to calculate the first-level fourth torque signal; S234, using the torque monitoring model to compare the first torque signal and the fourth torque signal to obtain the first-level second torque signal. This embodiment adopts Figure 4 The idea in the embodiment and the wheel speed signal as the first signal, the detailed process has been described in detail in the previous device and will not be repeated here.

[0060] In a specific embodiment of the present invention, the power-torque calculation model is used to calculate the first-level fourth torque signal, including: obtaining the motor power loss based on the motor current amplitude, efficiency, and temperature change value; and obtaining the fourth torque signal based on the motor power loss, the motor three-phase phase voltage and phase current, and the motor speed obtained by converting the wheel speed signal. The above steps can be expressed as follows:

[0061]

[0062] Where, T is the fourth torque signal, U a 、U b 、U c , I a , I b , I c are the phase voltage and phase current of the three phases of the motor, P loss is the power loss of the motor, which depends on the current amplitude |I s |, efficiency η and temperature change value ΔT, n is the motor speed obtained by converting the wheel speed signal.

[0063] Step S300: Combine the second and third signals to obtain a fourth signal of the second level, where the second level has a higher security level than the first level. After processing in step S200, the security levels of the second and third signals obtained are both the first level, and the security level of the fourth signal obtained by combining these two signals is definitely higher than the first level.

[0064] Although the above description uses the ASIL decomposition design of the functional safety of an automotive electric drive system as a specific embodiment, this decomposition concept is also applicable to the ASIL decomposition design of the functional safety of other automotive components.

[0065] It should be noted that the step division of the various methods above is only for the purpose of clear description. During implementation, they can be combined into one step or some steps can be split and decomposed into multiple steps. As long as they contain the same logical relationship, they are all within the scope of protection of this application; adding insignificant modifications to the algorithm or process or introducing insignificant designs without changing the core design of the algorithm and process are all within the scope of protection of this patent.

[0066] It should be noted that the decomposition method of this embodiment corresponds to the decomposition device described above, and the functional modules in the decomposition method correspond to the corresponding steps in the decomposition device. The decomposition method of this embodiment can be implemented in conjunction with the decomposition device. That is, the relevant technical details mentioned in the decomposition device of the above embodiment can also be applied to the decomposition method of this embodiment, unless there is any conflict.

[0067] In general, for systems that require high ASIL functional safety goals while having low development costs, the present invention aims to address the shortcomings of the background technology in that when the input signal of the system is only a low ASIL level, an ASIL dynamic decomposition method is proposed to dynamically adjust the ASIL decomposition scheme at specific time points under different system operating conditions, so that more appropriate ASIL decomposition schemes can be applied to different system levels, thereby achieving higher ASIL functional safety goals.

[0068] The above embodiments are merely illustrative of the principles and effects of the present invention and are not intended to limit the present invention. Anyone skilled in the art may modify or alter the above embodiments without departing from the spirit and scope of the present invention. Therefore, all equivalent modifications or alterations made by one of ordinary skill in the art without departing from the spirit and technical principles disclosed herein are intended to be covered by the claims of the present invention.

Claims

1. A vehicle safety integrity level decomposition device, characterized in that: include: The first functional layer calculates a first-level second signal based on the first-level first signal; a second functional layer, calculating a third signal of a first level based on the first signal; as well as a merging module, configured to merge the second signal and the third signal to obtain a fourth signal of a second level; The first functional layer and the second functional layer are used to calculate the same physical quantity in different calculation methods, and utilize the first signal in a time-sharing manner. Both are developed according to the first level, and the second level has a higher security level than the first level.

2. The vehicle safety integrity level decomposition device according to claim 1, characterized in that: The first functional layer includes: a first calculation model that calculates an initial value of a first intermediate variable according to the first signal, and continues to calculate the first intermediate variable using a closed-loop estimation algorithm to obtain the first intermediate variable of a first level; and The second calculation model calculates the second signal of the first level according to the first intermediate variable.

3. The vehicle safety integrity level decomposition device according to claim 1, characterized in that: The second functional layer includes: A third calculation model uses the first signal in a time-sharing manner to calculate a second intermediate variable of a first level; and The monitoring model obtains the third signal of the first level according to the second intermediate variable and the second signal.

4. The vehicle safety integrity level decomposition device according to claim 1, characterized in that: The first signal is a wheel speed signal, and the second signal is a first torque signal; The first functional layer includes: An angle observation model calculates an initial value of the motor rotor position according to the wheel speed signal, and continues to calculate the motor rotor position through a closed-loop estimation algorithm to obtain a first-level motor rotor position; and The current angle torque calculation model calculates the first torque signal of the first level according to the motor rotor position.

5. The vehicle safety integrity level decomposition device according to claim 4, characterized in that: The third signal is a second torque signal; The second functional layer includes: a power torque calculation model, which calculates a first-level fourth torque signal by using the wheel speed signal in a time-sharing manner; and The torque monitoring model obtains the second torque signal of a first level according to the first torque signal and the fourth torque signal.

6. A method for decomposing automobile safety integrity levels, characterized in that: include: obtaining a first signal of a first level; Based on the first signal, a first-level second signal is calculated using a first functional layer, and a first-level third signal is calculated using a second functional layer; combining the second signal and the third signal to obtain a fourth signal of a second level; The first functional layer and the second functional layer are used to calculate the same physical quantity in different calculation methods, and utilize the first signal in a time-sharing manner. Both are developed according to the first level, and the second level has a higher security level than the first level.

7. The vehicle safety integrity level decomposition method according to claim 6, characterized in that: The method includes: calculating, based on the first signal, using a first functional layer to obtain a second signal of a first level; and calculating, based on the second functional layer, to obtain a third signal of a first level. The first functional layer calculates an initial value of the second signal based on the first signal, and continues to calculate the second signal through a closed-loop estimation algorithm to obtain the second signal of a first level; The second functional layer uses the first signal in a time-sharing manner to calculate and obtain a third signal of a first level.

8. The vehicle safety integrity level decomposition method according to claim 6, characterized in that: The method includes: calculating, based on the first signal, using a first functional layer to obtain a second signal of a first level; and calculating, based on the second functional layer, to obtain a third signal of a first level. In a first time period, the first functional layer calculates an initial value of the second signal according to the first signal; In the second time period, the first functional layer continues to calculate the second signal of the first level using the closed-loop estimation algorithm, and the second functional layer calculates the third signal of the first level based on the first signal; In a third time period, the first functional layer calculates the second signal of the first level based on the first signal, and the second functional layer continues to calculate the third signal of the first level using a closed-loop estimation algorithm; The second time period and the third time period are repeated to utilize the first signal in a time-sharing manner.

9. The vehicle safety integrity level decomposition method according to claim 6, characterized in that: The first signal is a wheel speed signal, the second signal is a first torque signal, and the third signal is a second torque signal; The method includes: calculating, based on the first signal, using a first functional layer to obtain a second signal of a first level; and calculating, based on the second functional layer, to obtain a third signal of a first level. Calculating an initial value of a motor rotor position using an angle observation model according to the wheel speed signal, and continuing to calculate the motor rotor position using a closed-loop estimation algorithm to obtain a first-level motor rotor position; According to the motor rotor position, the first torque signal of the first level is calculated using a current angle torque calculation model; The wheel speed signal is used in a time-sharing manner and a power torque calculation model is used to calculate a fourth torque signal of the first level; The first torque signal and the fourth torque signal are compared using a torque monitoring model to obtain the second torque signal of a first level.

10. The vehicle safety integrity level decomposition method according to claim 9, characterized in that: The fourth torque signal of the first level is calculated using the power torque calculation model, including: Obtaining the power loss of the motor according to the current amplitude, efficiency and temperature change value of the motor; The fourth torque signal is obtained according to the power loss of the motor, the phase voltage and phase current of the three phases of the motor, and the motor speed obtained by converting the wheel speed signal.

Images