Vehicle hardware fault tree analysis method and device, medium and program product

Abstract

The embodiment of the invention discloses a vehicle hardware fault tree analysis method and device, a medium and a program product. The method comprises the steps of determining a safety target for fault analysis of a vehicle based on a vehicle safety integrity level defined in a vehicle safety standard; taking the event violating the safety target as a top event, tracing at least one causal hardware chain between the hardware modules forming the top event, and constructing a fault tree; wherein a top end module of the causal hardware chain is an execution module which directly causes a top event, a middle module is a control module, and a bottom end module is a sensing module; and performing layer-by-layer detection on each causal hardware chain in the fault tree along the direction from the top end to the bottom end, and determining a minimum cut set causing a top event. According to the scheme, the fault tree can be constructed based on the causal hardware chain, and layer-by-layer detection is performed, so that the hardware modules are detected more logically and orderly, and the minimum cut set which may cause the occurrence of the top event is searched more comprehensively.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of vehicle hardware analysis, and in particular to a vehicle hardware fault tree analysis method, device, medium and program product. BACKGROUND

[0002] The technical background of vehicle fault analysis is derived from the deep integration of system engineering and reliability theory, especially the methodology of high safety fields such as aerospace. With the development of complex automotive electronic and electrical architecture (such as domain controllers, drive-by-wire technology) and intelligent driving functions (L3+), traditional experience-based fault mode analysis has been unable to meet the demand, prompting quantitative methods such as Bayesian networks to become mainstream. The modern technical framework integrates the ISO 26262 functional safety standard and the SOTIF safety concept, builds a dynamic fault model through multi-source data fusion (vehicle sensor logs, remote diagnostic data), and realizes fault chain prediction and root cause tracing combined with AI algorithms, ultimately supporting full life cycle safety management from component-level failure prevention to system-level redundancy design.

[0003] However, the current fault analysis method fails to achieve a more logical and comprehensive analysis method, and it is difficult to achieve efficient and comprehensive analysis of complex and interrelated hardware modules. SUMMARY

[0004] The embodiments of the present application provide a vehicle hardware fault tree analysis method, device, medium and program product to analyze the hardware faults of the vehicle more orderly and comprehensively.

[0005] According to an aspect of the present application, a vehicle hardware fault tree analysis method is provided, which comprises:

[0006] Based on the automotive safety integrity level defined in the vehicle safety standard, a safety target for fault analysis of the vehicle is determined;

[0007] An event that violates the safety target is taken as a top event, and at least one causal hardware chain between hardware modules forming the top event is traced back to construct a fault tree; wherein the top module of the causal hardware chain is an execution module directly leading to the top event, the intermediate module is a control module, and the bottom module is a sensing module;

[0008] Each causal hardware chain in the fault tree is detected layer by layer in the direction from the top to the bottom to determine the minimum cut set leading to the top event; wherein the minimum cut set is the most basic module combination leading to the occurrence of the top event.

[0009] According to an aspect of the present application, a vehicle hardware fault tree analysis device is provided, which comprises:

[0010] a safety target determination module configured to determine a safety target for performing the fault analysis on the vehicle based on an automotive safety integrity level defined in a vehicle safety standard;

[0011] a fault tree construction module configured to construct a fault tree by taking the event violating the safety target as a top event and tracing at least one causal hardware chain between hardware modules forming the top event, wherein a top-end module of the causal hardware chain is an execution module directly leading to the top event, an intermediate module is a control module, and a bottom-end module is a sensing module;

[0012] a minimal cut set determination module configured to determine a minimal cut set leading to the top event by layer-by-layer detecting each of the causal hardware chains in the fault tree in a direction from the top-end to the bottom-end, wherein the minimal cut set is a most basic module combination leading to the top event.

[0013] According to another aspect of the present disclosure, there is provided an electronic device comprising:

[0014] at least one processor; and

[0015] a memory communicatively connected to the at least one processor; wherein

[0016] the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to perform a vehicle hardware fault tree analysis method according to any one of the embodiments of the present disclosure.

[0017] According to another aspect of the present disclosure, there is provided a computer readable storage medium storing computer instructions for causing a processor to perform a vehicle hardware fault tree analysis method according to any one of the embodiments of the present disclosure when the computer instructions are executed by the processor.

[0018] According to another aspect of the present disclosure, there is provided a computer program product comprising a computer program for causing a processor to perform a vehicle hardware fault tree analysis method according to any one of the embodiments of the present disclosure when the computer program is executed by the processor.

[0019] The technical scheme of the embodiment of the application determines the safety target for fault analysis of the vehicle based on the vehicle safety integrity level defined in the vehicle safety standard, so as to determine the safety target that needs to be paid attention to according to the industry standard and the specific application scene, that is, the event that may occur and threatens the safety of the vehicle and the personnel, take the event that violates the safety target as the top event, and trace at least one causal hardware chain between the hardware modules that form the top event to construct a fault tree; wherein, the top module of the causal hardware chain is an execution module that directly leads to the top event, the intermediate module is a control module, and the bottom module is a sensing module, so that by constructing the causal hardware chain, the various hardware modules that finally lead to the top event and the influence relationship therebetween are explicitly determined layer by layer, and the fault tree can more clearly and intuitively present the influence relationship between the various hardware modules and the influence on the top event. The minimum cut set that leads to the top event is determined by layer-by-layer detection in the direction from the top to the bottom of each causal hardware chain in the fault tree; wherein, the minimum cut set is the most basic module combination that leads to the occurrence of the top event, can perform carpeted and ordered search on the fault tree constructed by the causal hardware chain, and more comprehensively searches for the minimum cut set that leads to the top event.

[0020] It should be understood that the content described in this part is not intended to identify the key or important features of the embodiments of the application, nor is it used to limit the scope of the application. Other features of the application will become apparent from the following description. BRIEF DESCRIPTION OF DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the application, the drawings needed in the embodiment description will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the application, and other drawings can also be obtained by those skilled in the art without creative labor.

[0022] Figure 1 A flowchart of a vehicle hardware fault tree analysis method provided by an embodiment of the application;

[0023] Figure 2 A causal hardware chain diagram provided by an embodiment of the application;

[0024] Figure 3 A flowchart of a vehicle hardware fault tree analysis method provided by another embodiment of the application;

[0025] Figure 4 A flowchart of a vehicle hardware fault tree analysis method provided by still another embodiment of the application;

[0026] Figure 5 A structural schematic diagram of a vehicle hardware fault tree analysis device provided by an embodiment of the application;

[0027] Figure 6 A structural schematic diagram of an electronic device is provided for an embodiment of the present application. DETAILED DESCRIPTION

[0028] In order to enable persons skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by persons skilled in the art without creative work should fall within the scope of protection of the present application.

[0029] It should be noted that the terms “first”, “second”, “third”, “fourth”, “actual”, “preset” and the like in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and do not necessarily have to describe a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms “include” and “have” and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device that includes a series of steps or units does not have to be limited to only those steps or units clearly listed, but can include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0030] Figure 1 A flowchart of a vehicle hardware fault tree analysis method is provided for an embodiment of the present application. The embodiment of the present application can be applicable to failure analysis of vehicle hardware to determine the minimum cut set of the top event. The method can be performed by a vehicle hardware fault tree analysis device, which can be realized in the form of hardware and / or software, and can be configured in an electronic device. As shown in the figure, the method comprises: Figure 1

[0031] S110, based on the automotive safety integrity level defined in the vehicle safety standard, determining a safety target for fault analysis of the vehicle.

[0032] ​Among them, the vehicle safety standard is a technical specification formulated to ensure that the automobile reduces the risk in the process of design, production and use, mainly covering the dimensions of functional safety (such as ISO 26262 for electronic system failure), expected functional safety (such as ISO 21448 / SOTIF for non-failure scenarios), passive safety (such as crash test standards) and the like. These standards, through systematic risk assessment, test verification and process control, constrain the hardware reliability, software logic, human-computer interaction and other links of the whole vehicle and component manufacturers to achieve a certain safety level, and ultimately reduce the personal injury accidents caused by design defects or performance limitations. Automotive Safety Integrity Level (ASIL, Automotive Safety Integrity Level) is a key indicator in the ISO 26262 standard for evaluating the functional safety risk of automotive electronic and electrical systems. According to the severity of the harm that may be caused by system failure, the probability of exposure and controllability, it is comprehensively quantified and classified. ASIL A (lowest risk): minor injury risk, such as in-vehicle entertainment system failure. ASIL B (medium risk): may cause minor injuries, such as partial failure of some advanced driver assistance system functions. ASIL C (high risk): may cause serious injuries, such as partial failure of the braking system. ASIL D (highest risk): life-threatening extreme cases, such as failure of the steering system for high-speed automatic driving. QM (quality management level): no safety risk, such as non-safety-related functions such as windshield wiper control.

[0033] In the embodiments of the present application, the safety target can be a safety event that needs to be concerned according to the automotive safety integrity level and the application scene of the aggregation, for example, the safety target that needs to be concerned in general is ASIL C and ASIL D, for example, the safety target that includes the electric brake control system, the cruise control system and other systems that have a significant impact on safety of ASIL C, and the safety target that includes the airbag, the anti-lock braking system, the steer-by-wire system and other functions that are critical to safety of ASIL D, while the functions of ASILA and ASIL B can not be safety targets, or can be safety targets.

[0034] S120, the event that violates the safety target is taken as a top event, and at least one causal hardware chain between hardware modules forming the top event is traced back to construct a fault tree; wherein, the top module of the causal hardware chain is an execution module directly leading to the top event, the intermediate module is a control module, and the bottom module is a sensing module.

[0035] Among them, the top event refers to the event at the top level of the fault tree, which represents the failure or accident state that the system ultimately does not want to occur. In the embodiment of the present application, the event that violates the safety goal can be regarded as the top event. The causal hardware chain can be a chain formed based on the causal relationship of the hardware modules that have an impact on the generation of the top event. The directional relationship in the causal hardware chain can reflect the transmission direction of data or information in each hardware module, as well as the influence relationship between each hardware module. In the causal hardware chain, the top module directly causes the top event to occur. The execution module is taken as the top module, and the execution module can directly cause the top event to occur. For example, the top event can be the unexpected execution of the valve. The corresponding execution module can include a high-side drive and a low-side drive. The fast dynamic response of the high-side drive may cause the valve to overshoot due to inertia or delay during the adjustment process (such as the valve opening instantly exceeds the set value), or even cause continuous oscillation (such as the spring fatigue fracture of the steering gear electro-hydraulic reversing valve due to repeated callback in the dual pump follow-up mode). The slow response of the low-side drive may make the valve unable to track the working condition changes in time (such as when the fan pressure suddenly changes, the valve opening adjustment is delayed, resulting in pipeline pressure fluctuations). The control module, which transmits data or information to the execution module to control it, is called the middle module. The sensor module, which acquires sensor data at the front end, is called the bottom module. The bottom module sensor module acquires sensor data and transmits it to the control module. The control module generates corresponding control signals based on the sensor data and transmits the control signals to the execution module. The execution module then executes the corresponding steps based on the control signals.

[0036] In the embodiment of the present application, the event that violates the safety goal is regarded as the top event. Based on the top event, the execution module that directly causes the top event is traced back. Based on the execution module, the control module that affects the execution module is traced back. Based on the control module, the sensor module that affects the control module is traced back. The traced execution module is regarded as the top module, the control module is regarded as the middle module, and the sensor module is regarded as the bottom module to form a causal hardware chain. Based on the multiple causal hardware chains obtained by tracing the top event, a fault tree is formed, such as Figure 2 shown.

[0037] S130 , performing layer-by-layer detection on each causal hardware chain in the fault tree from the top to the bottom, and determining a minimum cut set that causes a top event; wherein the minimum cut set is the most basic module combination that causes the top event to occur.

[0038] The minimum cut set is the minimum and necessary combination of bottom events (hardware modules) that causes the top event of the system to occur. If any event in this combination is removed, the top event will no longer occur. In the embodiment of the present application, it is the set of hardware modules that causes the top event to occur.

[0039] In the embodiment of the present application, the hardware modules are detected layer by layer in the direction from the top end to the bottom end along the causal hardware chain, that is, in the order of the execution module, the control module and the sensing module. During the detection, if it is detected that the hardware module is safe and there is no failure or the possibility of failure and timely detection and repair, the next hardware module is detected in the direction from the top end to the bottom end along the causal hardware chain. If the current detected hardware module has a failure or the possibility of failure and there is no corresponding detection method and repair method, it is determined that the hardware module belongs to the minimal cut set which will cause the occurrence of the top event.

[0040] The technical scheme of the embodiment of the present application determines the safety target for fault analysis of the vehicle based on the automotive safety integrity level defined in the vehicle safety standard, so as to determine the safety target that needs to be concerned according to the industry standard and the specific application scene, that is, the event that may occur and threatens the safety of the vehicle and the personnel, take the event that violates the safety target as the top event, and trace at least one causal hardware chain between the hardware modules that form the top event to construct a fault tree. The top end module of the causal hardware chain is the execution module that directly causes the top event, the intermediate module is the control module, and the bottom end module is the sensing module. Therefore, by constructing the causal hardware chain, the various hardware modules that finally cause the top event and the influence relationship therebetween are determined layer by layer, and the fault tree can more clearly and intuitively present the influence relationship between the various hardware modules and the influence on the top event. The various causal hardware chains in the fault tree are detected layer by layer in the direction from the top end to the bottom end, and the minimal cut set that causes the top event is determined. The minimal cut set is the most basic module combination that causes the occurrence of the top event, can perform carpeted and ordered search on the fault tree constructed by the causal hardware chain, and more comprehensively searches for the minimal cut set that causes the top event.

[0041] Figure 3 A flowchart of a vehicle hardware fault tree analysis method provided for another embodiment of the present application is based on the above-described embodiment and is optimized. The schemes not described in detail in the embodiment of the present application are described in the above-described embodiment. As shown in Figure 3 The method of the embodiment of the present application specifically includes the following steps:

[0042] S210, determining the safety target for fault analysis of the vehicle based on the automotive safety integrity level defined in the vehicle safety standard.

[0043] S220, taking the event that violates the safety target as the top event, and tracing at least one causal hardware chain between the hardware modules that form the top event to construct a fault tree. The top end module of the causal hardware chain is the execution module that directly causes the top event, the intermediate module is the control module, and the bottom end module is the sensing module.

[0044] S230, detecting the self-failure, input failure and module working environment of each target module in the causal hardware chain.

[0045] For example, in the process of detecting the causal hardware chain in the order from top to bottom, the hardware module being detected is taken as a target module, and for each target module, the self-failure, input failure and module working environment of the target module are detected in the detection process, so that the possible failure causing the top event is comprehensively detected.

[0046] The self-failure of the target module is the failure of the hardware itself, and for the MCU (micro processing unit) in the control module, the self-failure includes the failure of the crystal oscillator and the failure of the external memory. In the detection process, the self-failure mode of the component is tried to be exhausted, and it is needed to consider whether the safety mechanism can cover the relevant failure mode. If the safety mechanism can cover the relevant failure mode, the safety mechanism and the corresponding failure mode are connected by an AND gate. The input failure is the output failure of the previous hardware module, for example, for the execution module, one of the input failures is the failure of the SPI data or IO port (input output port) of the controller module. The module working environment not meeting the requirements includes that the power supply voltage does not meet the requirements, the environmental temperature, humidity, salt fog and electromagnetic interference, etc.

[0047] S240, determining the minimal cut set causing the top event according to the detection result.

[0048] For example, after detecting the target module, the minimal cut set causing the top event is determined according to the detection result, that is, the minimal cut set causing the top event is determined according to the target module causing the top event.

[0049] In the embodiment of the present application, the minimal cut set causing the top event is determined according to the detection result, including:

[0050] For the target module, all failure modes and safety mechanisms of the target module are determined in the self-failure detection process.

[0051] If there is a missing failure mode covered by the corresponding safety mechanism, the module is taken as the minimal cut set causing the top event.

[0052] The failure mode refers to the failure mode of the hardware module under certain conditions, such as short circuit, fracture, wear and tear, etc. The specific way and consequence of the failure are described, which is the core concept of reliability analysis and failure prevention. By analyzing the failure mode, the design or maintenance strategy can be improved. The security mechanism refers to the technology or management measures designed to prevent, detect or respond to potential threats to the system, such as encryption algorithms, access control, firewalls, etc., which aims to protect the system from attacks, failures or misoperations, and ensure the confidentiality, integrity and availability of data. In the embodiments of the present application, all failure modes of the target module and the security mechanism are determined in the fault detection process of the present application, that is, the failure modes and the security mechanism are exhaustively analyzed, and all possible failure modes of the hardware components (such as sensors, processors, power supplies, etc.) are systematically identified, including: physical failure: short circuit, open circuit, parameter drift, etc.; functional failure: signal distortion, timing error, communication interruption, etc.; environment-related failure: abnormality caused by temperature, vibration, EMC interference. The component failure modes are listed one by one through FMEA (Failure Mode and Effects Analysis). Combined with historical data, simulation testing and industry standards (such as ISO 26262 Appendix D), the missing failure modes are found and filled. Whether the security mechanism covers the failure mode needs to be determined through a systematic analysis method: all potential failure modes (such as hardware failure, software error, etc.) are identified, and the effectiveness of each security mechanism (such as redundant design, ECC check, timeout monitoring, etc.) in detecting or mitigating the corresponding failure mode is evaluated, and finally the effectiveness is quantified through diagnostic coverage (DC). For example, for sensor failure, if dual-sensor redundancy and periodic self-check mechanism are used, it needs to be verified whether the combination can cover specific failure scenarios such as short circuit and drift, and the coverage is evaluated according to ISO 26262 and other standards. If there are multiple security mechanisms stacked, it also needs to analyze whether the synergy eliminates the coverage blind area.

[0053] In the embodiments of the present application, if there is a failure mode that is not covered by the corresponding security mechanism, the module is regarded as a minimal cut set that causes the top event. Specifically, if the failure mode of the target module is not covered by any security mechanism (such as no redundancy, no detection means), a single failure of the target module can directly cause the top event, and at this time the target module itself constitutes a minimal cut set, which is the most basic and independent factor that causes system failure. For example, if the control module without watchdog timer occurs deadlock, its failure will directly cause system crash due to the lack of timeout reset mechanism, and the module is a minimal cut set.

[0054] In the embodiments of the present application, the minimal cut set causing the top event is determined according to the detection result, including:

[0055] For the target module, if it is determined that the abnormal input of information to the target module causes the top event to occur in the input fault detection process, the hardware module causing the abnormal input of the target module is determined as the minimal cut set causing the top event.

[0056] The input fault of a module refers to the input module responsible for signal collection in the target module failing to correctly receive or process the signals sent by external devices (such as sensors, switches, etc.) due to line abnormality, hardware damage or parameter error, or the output fault of the adjacent hardware module. Typical manifestations include signal open / short circuit causing no feedback, interference voltage at the feedback end causing false alarm, communication interruption between the module and the host (such as coding error or insufficient bus voltage), and internal power failure causing abnormal indicator light. For example, one of the input faults of the execution module is the SPI data or IO port (input / output port) of the controller module. In the embodiments of the present application, if the abnormal input of information causes the top event to occur, the hardware module causing the abnormal input of the target module is determined as the minimal cut set causing the top event. For example, in system fault analysis, if it is determined that the abnormal input of the target module directly causes the top event, the source hardware module (such as a sensor, a signal converter or a transmission line) of the input abnormality is determined as the minimal cut set, that is, the simplest element that can cause the system to crash due to the failure of the hardware alone. For example, the temperature sensor signal drift is not corrected by the filter circuit, causing the controller to trigger the shutdown, and at this time, the sensor constitutes the minimal cut set.

[0057] In the embodiments of the present application, the minimal cut set causing the top event is determined according to the detection result, which includes:

[0058] For the target module, if it is determined that the index of the working environment of the target module does not meet the preset requirement index, causing the top event to occur in the module working environment process, the target module is determined as the minimal cut set causing the top event.

[0059] The working environment of the module not meeting the preset requirement index includes that the power supply voltage does not meet the requirement, the environmental temperature, humidity, salt mist, electromagnetic interference, etc. For example, the temperature requirement is 25±5℃, but the actual measurement reaches 35℃, which is determined as the working environment index not meeting the preset requirement index. For example, in system reliability analysis, if the target module directly causes the top event due to the working environment parameter (such as temperature / humidity / voltage) exceeding the standard, the module is determined as the minimal cut set, that is, the simplest element that can trigger the system crash due to the environmental adaptability defect itself, for example, high temperature causes the module to operate incorrectly, causing the production line to stop, at this time, the module constitutes the minimal cut set, and the single-point failure risk needs to be eliminated by environmental regulation or module replacement.

[0060] The embodiment of the application provides a vehicle hardware fault tree analysis method, determines a safety target for performing fault analysis on a vehicle based on an automobile safety integrity level defined in a vehicle safety standard; takes an event violating the safety target as a top event, traces at least one causal hardware chain between hardware modules forming the top event, and constructs a fault tree; wherein, a top end module of the causal hardware chain is an execution module directly causing the top event, an intermediate module is a control module, and a bottom end module is a sensing module; for each target module in the causal hardware chain, detects self-failure, input failure and module working environment of the target module; and determines a minimal cut set causing the top event according to a detection result. By detecting self-failure, input failure and module working environment of the target module in the detection process, the possible faults of each target module are more comprehensively analyzed, and the minimal cut set causing the top event is efficiently and accurately analyzed.

[0061] Figure 4 A flowchart of a vehicle hardware fault tree analysis method provided by another embodiment of the application is shown in the figure. The embodiment of the application is optimized based on the above-described embodiment, and the solutions not described in detail in the embodiment of the application are described in the above-described embodiment. As shown in the figure, the method of the embodiment of the application specifically includes the following steps: Figure 4

[0062] S310, determining a safety target for performing fault analysis on a vehicle based on an automobile safety integrity level defined in a vehicle safety standard.

[0063] S320, taking an event violating the safety target as a top event, tracing at least one causal hardware chain between hardware modules forming the top event, and constructing a fault tree; wherein, a top end module of the causal hardware chain is an execution module directly causing the top event, an intermediate module is a control module, and a bottom end module is a sensing module.

[0064] S330, performing layer-by-layer detection on each causal hardware chain in the fault tree in a direction from a top end to a bottom end, and determining a minimal cut set causing the top event; wherein, the minimal cut set is a most basic module combination causing the top event.

[0065] S340, if the minimal cut set has a missing failure mode, creating a new safety mechanism to cover the minimal cut set based on the created new safety mechanism, and reducing a probability of causing the top event.

[0066] ​In vehicle safety engineering, when the minimal cut sets are identified by fault tree analysis, there are failure modes that are not covered by existing safety mechanisms. For example, if a sensor open failure is not detected by the diagnostic circuit, it may lead to the loss of control signal, which violates the safety goal, that is, it will cause the top event. Therefore, the sensor module as a minimal cut set lacks the corresponding safety mechanism to cover the failure mode, and it is necessary to increase the current monitoring or double signal comparison to cover the open failure. Typical improvement measures include increasing redundant design, such as double brake signal acquisition; strengthening environmental testing, such as 85℃ / 85%RH durability test; and deploying real-time monitoring systems, such as battery cell voltage inspection.

[0067] In the embodiments of the present application, the method further comprises:

[0068] determining whether the minimal cut set is a multiple cut set; wherein the multiple cut set is at least two cut sets that will inevitably lead to the top event when the failures occur simultaneously;

[0069] based on the relevant failure analysis method, evaluating the multiple cut set to determine whether there is a common cause failure or a cascading failure.

[0070] wherein DFA (Dependent Failure Analysis) is an analysis method for identifying and evaluating the correlation failure risk between system components in functional safety engineering, mainly solving the limitations of the traditional FMEA / FTA assumption of "independent failure". The core goals include verifying the independence of components after ASIL decomposition, identifying common cause failures (such as environmental stress leading to simultaneous failure of multiple sensors) and cascading failures (such as ECU failure causing actuator misoperation), and reducing risks through spatial isolation, diversity redundancy and other measures. This analysis is applicable to scenarios with ASIL level decomposition, redundant design or mixed safety level components, and is a mandatory requirement for ASIL D level systems in ISO 26262 standard. In fault tree analysis, multiple cut sets refer to a set of different minimal failure event combinations that can independently cause the top event to occur. Each cut set represents a specific combination of a group of basic events, and when these events occur simultaneously, it will trigger system failure. The minimal cut set is the simplest combination without redundant events, for example, there may be two minimal cut sets of {sensor failure, power anomaly} and {software vulnerability, communication interruption} for a system failure. Multiple cut set analysis identifies all possible failure paths, providing key basis for system reliability optimization (ISO 16269-6 standard requires analysis of 3-order cut sets for important systems).

[0071] In vehicle functional safety analysis, the evaluation of multiple cut sets based on relevant failure analysis (DFA) refers to identifying whether there is a common cause failure or cascading failure risk by systematically checking the relevance between each cut set in the fault tree. In the embodiments of the present application, the multiple cut sets output by the FTA analysis results are taken as input, which can provide reliable input data for DFA analysis, so that DFA can analyze the common cause failure or cascading failure of multiple cut sets with relevance.

[0072] The embodiments of the present application provide a vehicle hardware fault tree analysis method, determine the safety target for fault analysis of the vehicle based on the automotive safety integrity level defined in the vehicle safety standard; take the event violating the safety target as the top event, and trace at least one causal hardware chain between the hardware modules forming the top event to build a fault tree; wherein the top module of the causal hardware chain is the execution module directly leading to the top event, the intermediate module is the control module, and the bottom module is the sensing module; detect each causal hardware chain in the fault tree layer by layer in the direction from the top to the bottom to determine the minimum cut set leading to the top event; wherein the minimum cut set is the most basic module combination leading to the top event. If the minimum cut set has a failure mode missing, a corresponding safety mechanism is created to cover the minimum cut set, a new safety mechanism is created to cover the minimum cut set based on the created new safety mechanism, the probability of leading to the top event is reduced, and the new safety mechanism is adaptively established to cover the failure mode in the minimum cut set by determining the minimum cut set and the coverage of the safety mechanism corresponding to the minimum cut set to the failure mode, thereby reducing the possibility of failure caused by the failure mode and further reducing the probability of the top event caused by the failure of the minimum cut set.

[0073] Figure 5 A structural schematic diagram of a vehicle hardware fault tree analysis device provided by the embodiments of the present application is provided, which can execute the vehicle hardware fault tree analysis method provided by any of the embodiments of the present application, and has the corresponding function modules and beneficial effects of the execution method. As shown in Figure 5 The device comprises:

[0074] The safety target determination module 410 is configured to determine the safety target for fault analysis of the vehicle based on the automotive safety integrity level defined in the vehicle safety standard;

[0075] The fault tree construction module 420 is configured to take the event violating the safety target as the top event, and trace at least one causal hardware chain between the hardware modules forming the top event to build a fault tree; wherein the top module of the causal hardware chain is the execution module directly leading to the top event, the intermediate module is the control module, and the bottom module is the sensing module;

[0076] The minimum cut set determination module 430 is configured to determine the minimum cut set causing the top event by detecting each cause-effect hardware chain in the fault tree layer by layer in a direction from the top end to the bottom end.

[0077] In the embodiment of the present application, the minimum cut set determination module 430 determines the minimum cut set causing the top event by detecting each cause-effect hardware chain in the fault tree layer by layer in a direction from the top end to the bottom end, and the determination includes:

[0078] detecting the self failure, input failure and module working environment of each target module in the cause-effect hardware chain;

[0079] determining the minimum cut set causing the top event according to the detection result.

[0080] In the embodiment of the present application, the minimum cut set determination module 430 determines the minimum cut set causing the top event according to the detection result, and the determination includes:

[0081] for the target module, determining all failure modes and safety mechanisms of the target module in the self failure detection process;

[0082] if there is a failure mode missing a corresponding safety mechanism to cover, the module is taken as the minimum cut set causing the top event.

[0083] In the embodiment of the present application, the minimum cut set determination module 430 determines the minimum cut set causing the top event according to the detection result, and the determination includes:

[0084] for the target module, if it is determined that the input information of the target module is abnormal to cause the top event in the input failure detection process, the hardware module causing the input abnormality of the target module is taken as the minimum cut set causing the top event.

[0085] In the embodiment of the present application, the minimum cut set determination module 430 determines the minimum cut set causing the top event according to the detection result, and the determination includes:

[0086] for the target module, if it is determined that the index of the working environment of the target module does not meet the preset requirement index to cause the top event in the module working environment process, the target module is taken as the minimum cut set causing the top event.

[0087] In the embodiment of the present application, after the minimum cut set causing the top event is determined, the apparatus further includes:

[0088] a safety mechanism creation module configured to, if there is a failure mode missing a corresponding safety mechanism to cover in the minimum cut set, create a new safety mechanism to cover the minimum cut set based on the created new safety mechanism, so as to reduce the probability of causing the top event.

[0089] In the embodiments of the present application, the device further comprises:

[0090] A judgment module is configured to judge whether the minimum cut set is a multiple cut set; wherein, the multiple cut set is at least two cut sets that will inevitably lead to the top event when a fault occurs simultaneously.

[0091] A related failure analysis module is configured to evaluate the multiple cut sets based on a related failure analysis method to determine whether there is a common cause failure or a cascading failure.

[0092] The vehicle hardware fault tree analysis device provided in the embodiments of the present application can execute the vehicle hardware fault tree analysis method provided in any of the embodiments of the present application, and has the corresponding function modules and beneficial effects of the execution method.

[0093] Figure 6 A structural schematic diagram of an electronic device 10 that can be used to implement the embodiments of the present application is shown. The electronic device is intended to represent various forms of digital computers, such as laptops, desktops, tablets, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular telephones, smart phones, wearable devices (e.g., headsets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions, are meant to be examples only, and are not intended to limit the implementations of the present application described and / or claimed in this document.

[0094] As shown in Figure 6 The electronic device 10 includes at least one processor 11, and a memory, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., which is communicatively connected to the at least one processor 11, wherein the memory stores a computer program that can be executed by the at least one processor. The processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 into the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0095] A plurality of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a magnetic disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network, such as the Internet, and / or various telecommunication networks.

[0096] The processor 11 can be various general and / or special purpose processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 performs various methods and processes described above, such as a vehicle hardware fault tree analysis method.

[0097] In some embodiments, a vehicle hardware fault tree analysis method can be implemented as a computer program tangibly embodied in a computer readable storage medium, such as the storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed onto the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded onto the RAM 13 and executed by the processor 11, one or more steps of a vehicle hardware fault tree analysis method described above can be performed. Alternatively, in other embodiments, the processor 11 can be configured to perform a vehicle hardware fault tree analysis method by any other appropriate means, such as by means of firmware.

[0098] Various implementations of the systems and techniques described above can be realized in digital electronic circuitry, integrated circuitry, a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on a chip (SOC), a complex programmable logic device (CPLD), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include implementation in one or more computer programs that are executable and / or interpretable on a programmable system including at least one programmable processor, which can be special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.

[0099] A computer program for implementing the methods of the present application can be written in any combination of one or more programming languages. The computer program can be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the computer program, when executed by the processor of the machine, produces an apparatus the functions / operations specified in the flowcharts and / or block diagrams. The computer program can execute entirely on a machine, partly on the machine, as a stand-alone software package, partly on the machine and partly on a remote machine or entirely on the remote machine or server.

[0100] In the context of the present application, a computer-readable storage medium can be a tangible medium that can contain or store the computer program for use by or in connection with an instruction execution system, apparatus, or device. The computer-readable storage medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. Alternatively, the computer-readable storage medium can be a machine-readable signal medium. More specific examples of the machine-readable storage medium will include one or more lines of electrical connections, portable computer disks, hard disk drives, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or Flash memory), optical fibers, portable compact disc read-only memories (CD-ROMs), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0101] To provide for interaction with a user, the systems and techniques described here can be implemented on an electronic device having a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the electronic device. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form, including acoustic, speech, or tactile input.

[0102] The systems and techniques described here can be implemented in a computing system that includes a back end component, e.g., as a data server, or that includes a middleware component, e.g., an application server, or that includes a front end component, e.g., a user computer having a graphical user interface or a Web browser through which a user can interact with an implementation of the systems and techniques described here, or any combination of such back end, middleware, or front end components. The components of the system can be interconnected by any form or medium of digital data communication, e.g., a communication network. Examples of communication networks include a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0103] The computing system can include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. A server can be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system, to solve the defects of large management difficulty and weak business scalability in traditional physical host and VPS service.

[0104] The embodiment of the present application further provides a computer program product, comprising a computer program which, when executed by a processor, implements the vehicle hardware fault tree analysis method provided in any embodiment of the present application.

[0105] The computer program code implementing the operations of the present application can be written in one or more programming languages or combinations of languages including object oriented languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0106] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in this application can be performed in parallel, sequentially, or in a different order, as long as the desired information of the technical solution of this application can be achieved. This document is not limited here.

[0107] The above specific embodiments do not constitute a limitation on the scope of protection of this application. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application shall be included within the scope of protection of this application.

Claims

1. A vehicle hardware fault tree analysis method, characterized by, The method comprises: determining a safety target for fault analysis of the vehicle based on an automotive safety integrity level defined in a vehicle safety standard; constructing a fault tree by taking an event violating the safety target as a top event and tracing at least one causal hardware chain between hardware modules forming the top event; wherein a top-end module of the causal hardware chain is an execution module directly leading to the top event, an intermediate module is a control module, and a bottom-end module is a sensing module; detecting each causal hardware chain in the fault tree in a direction from the top-end to the bottom-end to determine a minimal cut set leading to the top event; wherein the minimal cut set is a most basic module combination leading to the top event.

2. The method of claim 1, wherein, detecting each causal hardware chain in the fault tree in a direction from the top-end to the bottom-end to determine a minimal cut set leading to the top event, comprising: detecting, for each target module in the causal hardware chain, a self-fault, an input fault, and a module working environment of the target module; determining the minimal cut set leading to the top event according to the detection results.

3. The method of claim 2, wherein, determining the minimal cut set leading to the top event according to the detection results, comprising: for the target module, determining all failure modes and safety mechanisms of the target module in the self-fault detection process; if there is a failure mode missing a corresponding safety mechanism to cover, the module is taken as the minimal cut set leading to the top event.

4. The method of claim 2, wherein, determining the minimal cut set leading to the top event according to the detection results, comprising: for the target module, if it is determined that an abnormal input to the target module leads to the top event in the input fault detection process, a hardware module leading to the abnormal input of the target module is taken as the minimal cut set leading to the top event.

5. The method of claim 2, wherein, determining the minimal cut set leading to the top event according to the detection results, comprising: for the target module, if it is determined that an index of a working environment of the target module does not meet a preset requirement index leading to the top event in the module working environment process, the target module is taken as the minimal cut set leading to the top event.

6. The method of claim 1, wherein, after determining the minimal cut set leading to the top event, the method further comprises: if there is a failure mode missing a corresponding safety mechanism to cover, a new safety mechanism is created to cover the minimal cut set based on the created new safety mechanism to reduce the probability of leading to the top event.

7. The method of claim 1, wherein, the method further comprises: judging whether the minimal cut set is a multiple cut set; wherein the multiple cut set is at least two cut sets that must lead to the top event when faults occur simultaneously; based on a related failure analysis method, evaluating the multiple cut set to determine whether there is a common cause failure or a cascading failure.

8. An electronic device, comprising: The electronic device comprises: at least one processor; and a memory connected in communication with the at least one processor; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to execute the vehicle hardware fault tree analysis method of any one of claims 1-7.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer instructions for enabling the processor to execute the vehicle hardware fault tree analysis method of any one of claims 1-7 when executed.

10. A computer program product, characterised in that, A computer program comprising a computer program which, when executed by a processor, implements a method of vehicle hardware fault tree analysis according to any one of claims 1-7.

Images