A responsibility division method based on the safety integrity level of autonomous driving vehicles

Abstract

The present invention provides a method for dividing responsibilities of multi-agent autonomous driving vehicles based on AASIL, including: step S1: defining and obtaining the value of AASIL based on the level of the autonomous driving vehicle; and step S2: dividing the responsibilities of safety accidents of n autonomous driving vehicles according to the value of AASIL obtained in step S1, where n≥2. This method combines SOTIF, functional safety and multi-agent safety for the first time to define AASIL, and provides a quantitative algorithm to divide the responsibilities of autonomous driving vehicle collisions. This method is of great significance to the analysis and theoretical development of autonomous driving safety assessment.

Description

Technical Field

[0001] The present invention relates to the field of autonomous driving vehicle safety, and more specifically, to a method for allocating responsibilities in autonomous driving vehicle safety accidents. Background Art

[0002] Currently, the functional safety of vehicles is a top priority for the entire industry. To address this issue, suppliers in the automotive industry chain follow the ISO 26262 standard. However, the standard still lacks detailed regulations on the development of autonomous vehicles. This missing topic has now appeared in ISO / PAS 21448, and this new standard is often referred to as SOTIF, which means "Safety of the Intended Functionality."

[0003] Although some attempts have been made to define safety distances in the field of autonomous driving, this still cannot serve as a measurement framework for the safety of autonomous vehicles. Therefore, a new quantifiable responsibility allocation method is needed, which can establish a new evaluation framework for collision accidents involving autonomous vehicles. Summary of the invention

[0004] 1. Technical issues to be resolved

[0005] The purpose of the present invention is to provide a method for dividing responsibilities based on AASIL for multi-agent autonomous driving vehicles, so as to divide responsibilities when n (n≥2) autonomous driving level vehicles collide.

[0006] (II) Technical solution

[0007] In order to solve the above technical problems, the present invention provides a method for dividing responsibilities based on the Automated Automotive Safety Integrity Level (AASIL) of a multi-agent autonomous driving vehicle, including: step S1: defining and obtaining the AASIL value based on the level of the autonomous driving vehicle; and step S2: dividing responsibilities for safety accidents of n autonomous driving vehicles according to the AASIL value obtained in step S1, where n≥2.

[0008] Optionally, step S1 further includes: step S110: defining and obtaining the value of the controllability (Automated Automotive Control, abbreviation: AAC) of the autonomous driving vehicle based on the level of the autonomous driving vehicle; step S120: defining and obtaining the value of the exposure (Automated Automotive Exposure, abbreviation: AAE) of the autonomous driving vehicle based on the level of the autonomous driving vehicle; step S130: defining and obtaining the value of the severity (Automated Automotive Severity, abbreviation: AAS) of the autonomous driving vehicle based on the level of the autonomous driving vehicle; and step S140: defining and obtaining the value of AASIL based on the obtained value of AAC, value of AAE and value of AAS.

[0009] Optionally, the value of AAS is defined and obtained based on different methods for the case of two autonomous driving vehicles and for the case of more than two autonomous driving vehicles.

[0010] Optionally, in step S140, the responsibility percentage of vehicle i among the n autonomous driving vehicles is as follows:

[0011] Vehicle i liability = ((AASIL_V i )^2 / ((AASIL_V1)^2+(AASIL_V2)^2+…+

[0012] (AASIL_V i )^2)+…+(AASIL_V n )^2))*100%,

[0013] Among them, n≥2, n≥i≥1.

[0014] Optionally, in step S2, the larger the value of AASIL, the greater the responsibility of the autonomous driving vehicle corresponding to the value of AASIL.

[0015] Optionally, in step S1, when the L4 autonomous driving vehicle operates beyond the operational design domain (ODD), the value of AAC, the value of AAE, and the value of AAS are respectively increased by at least 1.

[0016] Optionally, in step S1, when the L3 autonomous driving vehicle is not driven by a user who has sufficient ability or time to obtain control of the autonomous driving vehicle, the values ​​of AAC, AAE, and AAS are each increased by at least 1.

[0017] Optionally, in step S1, when a cyber attack or security issue causes the control of the autonomous driving vehicle to deteriorate, the value of AAC, the value of AAE, and the value of AAS are each increased by at least 1.

[0018] Optionally, for the case of two autonomous driving vehicles, when the distance between the two autonomous driving vehicles is less than the safe distance and there is no appropriate response, the value of AAS is increased by 1.

[0019] (III) Beneficial effects

[0020] The present invention provides a method for dividing responsibilities of multi-agent autonomous driving vehicles based on AASIL, including: step S1: defining and obtaining the value of AASIL based on the level of the autonomous driving vehicle; and step S2: dividing the responsibilities of safety accidents of n autonomous driving vehicles according to the value of AASIL obtained in step S1, where n≥2. This method combines SOTIF, functional safety and multi-agent safety for the first time to define AASIL, and provides a quantitative algorithm to divide the responsibilities of autonomous driving vehicle collisions. This method is of great significance to the analysis and theoretical development of autonomous driving safety assessment. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 1 is a schematic diagram showing a situation 1 in which two vehicles on two routes of different shapes meet in an embodiment of the present invention.

[0022] Figure 2 2 is a schematic diagram showing a situation 2 in which two vehicles on two routes of different shapes meet in an embodiment of the present invention.

[0023] Figure 3 3 is a schematic diagram showing a situation 3 in which two vehicles meet at two intersecting sections according to an embodiment of the present invention.

[0024] Figure 4 Schematic diagram showing a “cut-in” situation of two vehicles according to an embodiment of the present invention.

[0025] Figure 5 2 is a schematic diagram showing a speed decomposition of an automatic driving vehicle 2 according to an embodiment of the present invention.

[0026] Figure 6 is a schematic diagram showing an accident involving four autonomous driving vehicles in another embodiment of the present invention.

[0027] Figure 7 2 is a schematic diagram showing a speed decomposition of four autonomous driving vehicles when an accident occurs according to another embodiment of the present invention. DETAILED DESCRIPTION

[0028] The specific implementation of the present invention is further described in detail below in conjunction with the accompanying drawings and examples. The following examples are only used to illustrate the present invention and are not intended to limit the scope of the present invention.

[0029] According to an embodiment of the present invention, a method for dividing responsibilities based on AASIL for multi-agent autonomous driving vehicles is provided, including: step S1: defining and obtaining the AASIL value based on the level of the autonomous driving vehicle; and step S2: dividing responsibilities for safety accidents of n autonomous driving vehicles according to the AASIL value obtained in step S1, where n≥2.

[0030] The levels of autonomous driving vehicles may include 6 levels, namely: Level L0, i.e. non-autonomous driving, the driver performs the entire dynamic driving task, even with the support of active safety systems; Level L1, i.e. driving assistance, the autonomous driving system performs the lateral or longitudinal vehicle motion control subtask of the dynamic driving task (but not at the same time), and the driver is expected to perform the rest of the dynamic driving task; Level L2, i.e. partial autonomous driving, the autonomous driving system performs the lateral and longitudinal vehicle motion control subtasks of the dynamic driving task within a specific and continuous designed operating area, and the driver is expected to complete the target and event detection and response subtasks and supervise the driving automation system; Level L3, i.e. conditional autonomous driving, the autonomous driving system performs all dynamic driving tasks within a specific and continuous designed operating area. It is required that the dynamic driving task backup is ready and can accept intervention requests issued by the autonomous driving system, as well as properly handle system failures related to the dynamic driving task performance in other vehicle systems; at Level L4, i.e. highly autonomous driving, the autonomous driving system performs all dynamic driving tasks and dynamic driving task backups in a specific and continuous designed operating area, and does not require any user to respond to intervention requests; and at Level L5, i.e. fully autonomous driving, the autonomous driving system performs all dynamic driving tasks and dynamic driving task backups, and does not require any user to respond to intervention requests.

[0031] Step S1 of the present invention may further include: step S110 of defining and acquiring the value of AAC based on the level of the autonomous driving vehicle; step S120 of defining and acquiring the value of AAE based on the level of the autonomous driving vehicle; step S130 of defining and acquiring the value of AAS based on the level of the autonomous driving vehicle; and step S140 of defining and acquiring the value of AASIL based on the acquired value of AAC, value of AAE and value of AAS.

[0032] Further, in step S110 of defining and obtaining the value of AAC based on the level of the autonomous driving vehicle according to the present invention, AAC is defined as: the ability to avoid specific vehicle dangerous events or collision risks through timely response of the autonomous driving vehicles involved, possibly with the support of external intelligent services or infrastructure.

[0033] The values ​​of AAC may include 0, 1, 2, and 3. Specifically, 0 is usually controllable; 1 is simply controllable, and more than 99% of autonomous driving vehicles or other traffic participants can avoid harm; 2 is normally controllable, and 90% to 99% of autonomous driving vehicles or other traffic participants can avoid harm; 3 is difficult to control or uncontrollable, and less than 90% of autonomous driving vehicles or other traffic participants can avoid harm.

[0034] Among them, when AAC is 0, that is, usually controllable, the danger control of vehicles at each level of autonomous driving is as follows:

[0035] (1) In L0-L2 autonomous driving vehicles: people can usually control the hazard;

[0036] (2) In L3 autonomous driving vehicles: the machine is usually able to control the hazard. Although the vehicle's operation control is taken over by a user with sufficient ability or time, the user can generally control the hazard to the minimum risk level;

[0037] (3) In Level 4 autonomous driving vehicles: generally controllable in limited situations or within their designed operating area;

[0038] (4) In Level 5 autonomous driving vehicles: Generally controllable under all conditions.

[0039] When AAC is 1, that is, more than 99% of autonomous driving vehicles can avoid harm, the risk control of vehicles at each level of autonomous driving is as follows:

[0040] (1) In L0-L2 autonomous driving vehicles: the hazard can be easily controlled by humans;

[0041] (2) In L3 autonomous driving vehicles: the machine can easily control the danger. Although the vehicle's operation control is taken over by a user with sufficient ability or time, the user can easily control the danger to the minimum risk state;

[0042] (3) In Level 4 autonomous driving vehicles: simply controllable in limited situations or within their designed operating area;

[0043] (4) In Level 5 autonomous driving vehicles: easily controllable under all conditions.

[0044] When AAC is 2, that is, 90% to 99% of autonomous driving vehicles can avoid injuries, the risk control of vehicles at each level of autonomous driving is as follows:

[0045] (1) In L0-L2 autonomous driving vehicles: humans can normally control the hazard;

[0046] (2) In L3 autonomous driving vehicles: the machine is normally able to control the hazard. Although the vehicle's control is taken over by a user with sufficient ability or time, the user can simply control the hazard to the minimum risk level;

[0047] (3) In Level 4 autonomous driving vehicles: Normally controllable in limited situations or within their designed operating area;

[0048] (4) In Level 5 autonomous driving vehicles: Normal and controllable under all conditions.

[0049] When AAC is 3, that is, less than 90% of autonomous vehicles can avoid injuries, the risk control of vehicles at each level of autonomous driving is as follows:

[0050] (1) In L0-L2 autonomous driving vehicles: the hazard is difficult or impossible for humans to control;

[0051] (2) In Level 3 autonomous driving vehicles: the machine has difficulty or no control over the hazard. Although the vehicle's operating control is taken over by a user with sufficient ability or time, the user generally has difficulty or no control over the hazard.

[0052] (3) In Level 4 autonomous driving vehicles: difficult or impossible to control in limited situations or within their designed operating areas;

[0053] (4) In Level 5 autonomous driving vehicles: difficult or uncontrollable under all conditions.

[0054] In addition, in the responsibility division method according to the present invention, in the following cases, the corresponding AAC value should be increased by at least 1:

[0055] (1) Level 4 autonomous driving vehicles operate beyond their designed operating area;

[0056] (2) The L3 autonomous driving vehicle is not operated by a user who has sufficient ability or time to take control of the vehicle;

[0057] (3) Cyber ​​attacks or security issues leading to deterioration of control of the autonomous vehicle.

[0058] Further, in step S120 of obtaining the value of AAE based on the level definition of the autonomous driving vehicle according to the present invention, AAE refers to the ratio of the duration of the event or fault to the average operating duration of the autonomous driving vehicle, or the ratio of the frequency of the event or fault to the average operating frequency of the autonomous driving vehicle, and AAE is used to characterize the probability of the event or fault. The value of AAE can be 1, 2, 3, or 4. Specifically, the rules for AAE are as follows:

[0059] When the probability of an accident occurring in L0-L5 autonomous driving vehicles is very low and the accident duration or operation frequency is not specified, AAE is 1;

[0060] When the probability of an accident occurring in L0-L5 autonomous driving vehicles is low, and: ① the duration is < 1% of the average operating time; ② the vast majority of autonomous driving vehicles have several accidents each year, AAE is 2;

[0061] When the probability of an accident occurring in L0-L5 autonomous driving vehicles is medium, and: ① 1% to 10% of the average operating time; ② When the accident occurs once or more per month for autonomous driving vehicles, AAE is 3;

[0062] When the probability of an accident occurring in L0-L5 autonomous driving vehicles is high, and: ① the duration is > 10% of the average operating time; ② it occurs on average every time a car is driven, AAE is 4.

[0063] In addition, in the following cases, the corresponding AAE value should be increased by at least 1:

[0064] (1) Level 4 autonomous driving vehicles operate beyond their designed operating area;

[0065] (2) The L3 autonomous driving vehicle is not operated by a user who has sufficient ability or time to take control of the vehicle;

[0066] (3) Cyber ​​attacks or security issues leading to deterioration of control of the autonomous vehicle.

[0067] Further, in step S130 of defining and obtaining the value of AAS based on the level of the autonomous driving vehicle according to the present invention, the value of AAS can be 0, 1, 2, or 3. The premise for defining AAS is that there are only two autonomous driving vehicles within the analysis scope, and its applicability to vehicles of different levels is as follows: (1) L0 to L2 autonomous driving vehicles; (2) L3 autonomous driving vehicles: although the vehicle's operating control is taken over by a user with sufficient ability or time, the user can generally control the danger to the minimum risk condition (when AAS is 0) or the user can simply control the danger to the minimum risk condition (when AAS is 1, 2, or 3); (3) L4 autonomous driving vehicles: in limited situations or within their designed operating areas; (4) L5 autonomous driving vehicles: under all conditions.

[0068] Specifically, the value of AAS is as follows:

[0069] When the relative speed of the two vehicles is less than 4-10 km / h in a forward collision, less than 4-10 km / h in a rearward collision, or less than 2-3 km / h in a sideways collision, the AAS value is 0.

[0070] When the maximum relative speed of the two vehicles is between 4-10 and 20-50 km / h in a frontal collision, between 4-10 and 20-50 km / h in a rearward collision, or between 2-10 and 8-30 km / h in a sideways collision, the AAS value is 1.

[0071] When the maximum relative speed of the two vehicles is between 20-50 and 40-65 km / h in a frontal collision, between 20-50 and 40-60 km / h in a rearward collision, or between 8-30 and 16-40 km / h in a sideways collision, the AAS value is 2.

[0072] When the relative speed of the two vehicles is greater than 40-65km / h in a frontal collision, greater than 40-60km / h in a rearward collision, or greater than 16-40km / h in a sideways collision, the AAS value is 3.

[0073] In addition, in the following cases, the corresponding AAS value should be increased by at least 1:

[0074] (1) Level 4 autonomous driving vehicles operate beyond their designed operating area;

[0075] (2) The L3 autonomous driving vehicle is not operated by a user who has sufficient ability or time to take control of the vehicle;

[0076] (3) Cyber ​​attacks or security issues leading to deterioration of control of the autonomous vehicle.

[0077] In addition, the definition of AAS in step S130 of the method according to the present invention also needs to consider the degree of injury to the person and the vehicle. If the injury to the person is considered, the Automotive Injury Scale (AIS) needs to be considered. If the injury to the vehicle is considered, from the perspective of multi-agent safety, the definition of a safe distance exists for the autonomous driving vehicle. AIS and the safe distance will be described in further detail below.

[0078] On the one hand, the AIS model based on the ISO26262 standard includes: AIS0, no injury; AIS1, mild injury, such as deep skin injury, muscle pain, neck sprain, etc.; AIS2, moderate injury, such as deep muscle injury, concussion with coma for 15 minutes, uncomplicated long bone fracture, uncomplicated rib fracture, etc.; AIS3, severe but not life-threatening injury, such as skull fracture but no brain injury, spinal dislocation below the fourth cervical vertebra but no spinal cord injury, more than one rib fracture but no abnormal breathing, etc.; AIS4, Severe injuries (life-threatening, possible survival), such as concussion with or without skull fracture, accompanied by unconscious breathing or abnormal breathing for up to 12 hours; AIS5, critical injuries (life-threatening, uncertain survival), such as spinal fractures below the fourth cervical vertebra with spinal cord injury, intestinal laceration, heart laceration, coma for more than 12 hours and intracranial hemorrhage; and AIS6, extremely serious or fatal injuries, such as cervical fractures above the third cervical vertebra with spinal cord injury, extremely serious open wounds in the body cavity (thoracic and abdominal cavities), etc.

[0079] On the other hand, there are three calculation formulas for the safety distance of the existing Responsibility-Sensitive Safety Model:

[0080] D1: Safe longitudinal distance - same direction. Cr is the car behind Cf in the longitudinal direction. The formula involves the following parameters: reaction time ρ (i.e. response period), maximum braking acceleration a max,brake , the maximum acceleration during the response period a max,accel , minimum braking acceleration a min,brake , the longitudinal speed of the two vehicles: V r 、V f Then, C r The front point and C f The minimum safe longitudinal distance between the rearmost points of is as follows, where [x] + :=max{x,0}:

[0081]

[0082] D2: Safe longitudinal distance - opposite direction. r is on the longitudinal axis with C f For an autonomous vehicle traveling in the opposite direction, V 1,ρ =V1+ρ·a max,accel , V 2,ρ =|V2|+ρ·a max,accel .

[0083] The minimum safe longitudinal distance between two vehicles is:

[0084]

[0085] D3: safe lateral distance. C1 is on the left of C2, V 1,ρ =V1+ρ·a lat max,accel , V 2,ρ =V2-ρ·a lat max,accel The minimum safe lateral distance between two vehicles is:

[0086]

[0087] Where μ is the fluctuation distance of the vehicle during lateral maneuvering.

[0088] If the distance between the two autonomous vehicles is less than the above safety distance and there is no appropriate response, the AAS value increases by 1.

[0089] In addition, the value of the AAS according to the present invention is also affected by the limited time limit of the longitudinal appropriate response, the limited time limit of the lateral appropriate response, the lateral appropriate response of two different geometric shapes of the route, and the longitudinal appropriate response of two different geometric shapes of the route. Among them, assuming that the longitudinal distance between the two vehicles C1 and C2 at time point t is unsafe, then this scene is called dangerous at time point t, and whether the longitudinal distance is dangerous is judged by referring to the above-mentioned safe distance formula. Furthermore, given a longitudinal dangerous time t, and a longitudinal dangerous threshold value t long b , the danger threshold is the earliest time point in the longitudinal danger time, that is, the time domain in [t long b In particular, if an accident is only longitudinally dangerous at time point t, in this case, the threshold time for determining the longitudinal danger of the accident is time point t.

[0090] Specifically, within the limited period of longitudinal appropriate response, if the longitudinal appropriate response of the autonomous driving vehicle is longer than the following definition, the value of AAS increases by 1, that is, let t be the longitudinal danger time of vehicles C1 and C2, t bThe time when a situation becomes dangerous, t b It is the beginning of a dangerous scene, but in t b The previous scene was not dangerous. long b is the corresponding longitudinal blame time. Then the longitudinal appropriate response of the two autonomous vehicles should meet the following acceleration restrictions, that is, to ensure that the distance between the two vehicles is greater than the longitudinal minimum safety distance of the above formula. At this time, if at the longitudinal danger threshold time, the two autonomous vehicles are traveling in the same direction, and C1 is the rear vehicle, then: 1) C1 is in the interval [t long b , t long b +ρ) shall not exceed a max,accel , and, from time t long b +ρ until a safe longitudinal position is reached, the value of the braking acceleration is at most -a min,brake After that, any non-positive acceleration is allowed; 2) The braking acceleration of C2 must be at least -a max,brake , until the safe longitudinal distance is reached. After that, any non-negative acceleration is allowed; or, if at the longitudinal danger threshold time, the two autonomous vehicles are traveling in opposite directions, and C2 is traveling at a negative speed, then: 1) C1 is within the interval time [t long b , t long b +ρ) must be at most a max,accel , from t long b +ρ until it comes to a complete stop, with an acceleration of at least a min,brake . After that, any non-negative acceleration is allowed.

[0091] Specifically, within the lateral appropriate response limited period, if the lateral appropriate response of the autonomous driving vehicle is longer than the following definition, the value of AAS increases by 1, that is, let t be the lateral danger time of vehicles C1 and C2, t b The time when a situation becomes dangerous, t lat b is the corresponding lateral threshold time, assuming that C1 is on the left side of C2 at this time. The lateral appropriate response of the two autonomous vehicles should comply with the following lateral acceleration limit, that is, to ensure that the distance between the two vehicles is greater than the minimum lateral safety distance in the above formula. 1) If t belongs to [t lat b , t lat b +ρ), then as long as the lateral acceleration a of the two autonomous vehicles satisfies |a|<=a lat max,accel, then they can make any lateral movement; 2) Otherwise, if t>=t lat b +ρ, consider a point at a lateral displacement L at time t, and its μ-lateral velocity at time t is defined as follows: Let t out >t becomes this point (lateral displacement L at time t) and reaches the lateral displacement L at the earliest at some time in the future out , whose value is L out =L-μ / 2 or L out =L+μ / 2 (If none of the above values ​​exist, define t out is infinite). If at a certain moment t' belongs to (t, t out ), at this time, the lateral displacement of the point is L, then the μ-lateral velocity is 0, otherwise the μ-lateral velocity value is (L out -L) / (t out -t). Before the μ-lateral velocity reaches zero, C1 must apply at most -a lat min,brake To brake with a lateral acceleration, C2 must apply at least a lat min,brake lateral acceleration; after the μ-lateral velocity reaches 0, C1 can have any non-positive lateral velocity and C2 can have any non-negative lateral velocity.

[0092] Specifically, in the lateral appropriate response of two routes with different geometric shapes, if the lateral appropriate response of the autonomous vehicle is longer than the following definition, then after the following more in-depth evaluation, the value of AAS is increased by 1. Let t be the lateral danger time of C1 and C2 vehicles traveling on R1 and R2 roads, and let t lat b is the corresponding lateral danger threshold time, and x1 and x2 are respectively lat b The lateral positions of C1 and C2 relative to the paths R1 and R2 at time t. The lateral appropriate response of the two autonomous vehicles should meet the following lateral acceleration limits: 1) If t belongs to [t lat b , t lat b +ρ), then as long as the lateral acceleration a of the two autonomous vehicles satisfies |a|<=a lat max,accel , they can make any lateral movement; 2) Otherwise, if t>=t lat b+ρ, for each i belonging to {1, 2}: before the μ-lateral velocity reaches 0, C i A lateral acceleration must be applied so that it moves towards x i , whose maximum acceleration is at least |a lat min,brake|; After μ-transverse velocity reaches 0, C i There can be any lateral acceleration that moves it away from the other car.

[0093] Specifically, in the longitudinal appropriate response of two routes with different geometries, if the longitudinal appropriate response of the autonomous vehicle is longer than the following definition, the value of AAS is increased by 1 after a more in-depth evaluation. Consider C1, C2 driving on the intersecting routes R1, R2. The longitudinal distance between C1 and C2 is safe if one of the following conditions is true:

[0094] Item1—Reference Figure 1 , the two paths have no priority order, i belongs to {1, 2}, if C i In R i Apply a max,accel Accelerate, accelerate for ρ seconds, and then pass a min,brake Brake until the longitudinal speed is 0, during which time the vehicle remains on the original path and outside the other path;

[0095] Item2—Otherwise, refer to Figure 2 , if C1 is in front of C2, if C1 applies a max,brake Brake until zero speed is reached, C2 on R2 with a maximum of a max,accel Accelerate, accelerate for ρ seconds, then at least a min,brake Brake until it reaches zero speed, and then C1 remains ahead of C2, so they are at a safe longitudinal distance;

[0096] Item 3—In addition to the above, we also need to consider the situation where roads R1 and R2 intersect at point P, refer to Figure 3 , where the lateral displacement of point P on the road between R1 and R2 is defined in the range [x i,min , x i,max ], i = 1 or 2. In the initial reaction time ρ seconds, when vehicles C1 and C2 are accelerating at their respective speeds within the range [-a max,brake , a max,accel The time it takes to accelerate and travel to position P is defined as [t i,min , t i,max ], where i = 1 or 2 represents vehicle C1 or C2. After vehicles C1 and C2 both drive to point P, both vehicles brake to slow down, and the braking acceleration range is [a min,brake , a max,brake ], and this process is continued until the speed of both vehicles is zero. For the above-mentioned road intersection P scenario, if the time of vehicle C1 [t 1,min , t 1,max ] and the time of vehicle C2 [t 2,min , t 2,max]There is no overlapping area, so the longitudinal distance between the two vehicles can be determined to be a safe distance.

[0097] Assume that at time t, there is a risk of collision between two vehicles C1 and C2 traveling on different routes R1 and R2 in the longitudinal direction of the vehicle body, and the appropriate response in the longitudinal direction depends on the situation of the two vehicles before the "danger threshold time":

[0098] 1) If the scenario in Item 1 is safe: one of the two cars has the right of way, then it can pass normally; but if neither car has the right of way, the reaction time of the two cars is ρ, and both are at least a min,brake Braking acceleration braking, there is a critical danger time t b , and the time point t is greater than or equal to ρ and t b of and;

[0099] 2) If the scenario in Item 2 is safe: C1 can drive normally, and C2 must react within the reaction time ρ with at least a min,brake The braking acceleration is braking, and there is a critical danger time t b , and the time point t is greater than or equal to ρ and t b of and;

[0100] 3) If the scenario in Item 3 is safe: When there is a critical danger time t b , the reaction time of both cars is ρ, and the time point t is less than ρ and t b If the two vehicles are parallel and parallel, the two vehicles can run normally; otherwise, the two vehicles must be parallel and parallel in both the horizontal and vertical directions by at least a lat min,brake 、a min,brake The braking speed is used to decelerate the vehicle.

[0101] Therefore, the value of AAS can be obtained based on the above-mentioned safety distance.

[0102] In addition, if there are n (n≥3) autonomous vehicles that collide with the self-driving vehicle, then the total value of the AAS of the self-driving vehicle should be determined as follows, where square_root represents square root calculation and INT represents rounding down:

[0103] If both front and rear collisions occur, the total AAS value should be calculated as:

[0104] AAS=INT(square_root(AAS front ^2+AAS back ^2))+1,(AAS<=3);

[0105] In case of a frontal and side impact, the total AAS value shall be calculated as:

[0106] AAS=INT(square_root(AAS front ^2+AAS side ^2))+1,(AAS<=3);

[0107] In the event of a rear-end and side-on collision, the total AAS value shall be calculated as:

[0108] AAS=INT(square_root(AAS back ^2+AAS side ^2))+1,(AAS<=3);

[0109] If a frontal, side and rear impact occurs, the total AAS value should be calculated as:

[0110] AAS=INT(square_root(AAS front ^2+AAS side ^2+AAS back ^2))+1, (AAS<=3).

[0111] Optionally, the values ​​of the three parameters AAC, AAE and AAS in the above steps S110, S120 and S130 are all based on functional safety, SOTIF and multi-agent safety assessment, and are determined by combining STPA and CAST methods for analysis.

[0112] Further, according to step S2 of the present invention, the responsibilities for safety accidents of n autonomous driving vehicles are divided according to the values ​​of AASIL obtained in step S1, where n≥2.

[0113] The AASIL defined in the present invention mainly studies the safety metrics of different levels of autonomous driving vehicles in different scenarios and under possible harm, taking the vehicle as the object of consideration. The value of AASIL is obtained from the following matrix, and the value of AASIL is an important basis for the responsibility division method in step S2.

[0114] Table 1. AASIL value table

[0115]

[0116] In Table 1, if the assigned AASIL value is NA, it means that it is not handled in the comprehensive solution for all functional safety, SOTIF, multi-agent or cyber security attacks, and the division of responsibilities only needs to focus on one of the safety domains involved in the safety field to further investigate and deal with potential problems.

[0117] Next, step S2 of dividing responsibilities will be described in detail.

[0118] Since the AASIL value has been obtained in the above step S1, the responsibility when the autonomous driving vehicle collides can be identified based on the AASIL value.

[0119] In step S2 of the responsibility division method according to the present invention, the judgment criteria are as follows:

[0120] When two autonomous vehicles collide, the responsibility is divided according to the AASIL values ​​of the two autonomous vehicles, where the higher the AASIL value, the more responsible the driver is.

[0121] When two autonomous vehicles collide, the liability allocation formula is as follows:

[0122] Vehicle 1 liability = ((AASIL_V1)^2 / ((AASIL_V1)^2+(AASIL_V2)^2))*100%;

[0123] Vehicle 2 liability = ((AASIL_V2)^2 / ((AASIL_V1)^2+(AASIL_V2)^2))*100%.

[0124] It can be seen that AASIL A=7, AASIL B=8, AASIL C=9, AASIL D=10. If AASIL x is NA, then its value is: AASIL x=AAC+AAS+AAE.

[0125] When n (n≥3) autonomous vehicles collide, the responsibility is divided into the AASIL values ​​of the n autonomous vehicles. The higher the AASIL value, the greater the responsibility. At this time, more consideration is given to the behavior of the autonomous vehicle rather than the Level of the autonomous vehicle.

[0126] When n autonomous vehicles collide, the responsibility allocation formula for vehicle i (1≤i≤n) is as follows:

[0127] Vehicle i liability = ((AASIL_V i )^2 / ((AASIL_V1)^2+(AASIL_V2)^2+…+

[0128] (AASIL_V i )^2)+…+(AASIL_V n )^2))*100%.

[0129] It can be seen that AASIL A=7, AASIL B=8, AASIL C=9, AASIL D=10. If AASIL x is NA, then its value is: AASIL x=AAC+AAS+AAE.

[0130] Figure 4 An embodiment of the responsibility division method according to the present invention is shown. The scenario of this embodiment is a straight section of a highway, and the autonomous driving levels of autonomous driving vehicle 1 and autonomous driving vehicle 2 are L2 and L4 respectively. When autonomous driving vehicle 2 turns left and cuts into the route of autonomous driving vehicle 1, the responsibility division analysis is as follows:

[0131] When facing autonomous driving vehicle 2 that is about to turn left, autonomous driving vehicle 1 can take braking measures, and there is only one action, referring to the above step S110: when L2 autonomous driving vehicles take braking measures, more than 99% of autonomous driving vehicles can avoid damage, then the AAC value AAC_V1 of autonomous driving vehicle 1 is 1, but autonomous driving vehicle 2 in this scenario should first send a signal, turn left and then accelerate, turn right and go straight, the AAC value of autonomous driving vehicle 2 will be higher than the AAC value of autonomous driving vehicle 1. Similarly, referring to the above step S110, AAC_V2 should be 2.

[0132] When autonomous driving vehicle 1 is driving straight on the road, other autonomous driving vehicles often try to cut in on its route. Based on the frequency of occurrence, for example, once or more than once a month, and referring to the above step S120, the AAE value AAE_V1 of autonomous driving vehicle 1 is 3. Assuming that autonomous driving vehicle 2 cuts in on the route of other autonomous driving vehicles every day, the AAE value of autonomous driving vehicle 1 is lower than the AAE value AAE_V2 of autonomous driving vehicle 2, and AAE_V2 is 4.

[0133] Reference Figure 5 It can be seen that the speed V2 of the autonomous driving vehicle 2 should be decomposed into V2_1 and V2_τ, and if the autonomous driving vehicle 2 wants to exceed the autonomous driving vehicle 1, V2_1>V1 must be satisfied.

[0134] According to V2=square_root((V2_1)^2+(V2_τ)^2-2*(V2_1)*(V2_τ)*cos<V2_1,V2_τ> )>>V1, thus it can be obtained that the value of AAS of autonomous driving vehicle 2>the value of AAS of autonomous driving vehicle 1, that is: AAS_V2>AAS_V1.

[0135] For the autonomous driving vehicle 1, it can basically be determined as a forward collision, and based on the driving habits of people all over the world and reasonable assumptions, the relative speed in this case is basically 10 to 45 km / h. Referring to the above step S130, the speed range that is more in line with the AAS value of 1 is: 4 to 10 to 20 to 50 km / h, and AAS_V1 takes 1.

[0136] For the autonomous driving vehicle 2, if it is hit sideways, and based on the driving habits of people all over the world and reasonable assumptions, the relative speed in this case is basically 8 to 16 km / h, then referring to the speed range in the above step S130, AAS_V2 takes 2.

[0137] As mentioned above, the conclusions are as follows:

[0138] AAC_V1=1, AAE_V1=3, AAS_V1=1; AASIL_V1=NA;

[0139] AAC_V2=2, AAE_V2=4, AAS_V2=2; AASIL_V2=AASIL B;

[0140] Vehicle 1 liability = ((AASIL_V1)^2 / ((AASIL_V1)^2+(AASIL_V2)^2))*

[0141] 100% = 28%;

[0142] Vehicle 2 liability = ((AASIL_V2)^2 / ((AASIL_V1)^2+(AASIL_V2)^2))*

[0143] 100%=72%.

[0144] Basically, if a collision occurs when Autonomous Vehicle 2 is trying to cut in on Autonomous Vehicle 1, 72% of the fault lies with Autonomous Vehicle 2 and only 28% of the fault lies with Autonomous Vehicle 1.

[0145] When n ≥ 2, Figure 6 Another embodiment of the responsibility division method according to the present invention is shown. In this embodiment, there are 4 autonomous driving vehicles. The scene is a straight section of a highway. At this time, autonomous driving vehicle 2 wants to turn left and accelerate to cut into the route of autonomous driving vehicle 1. Autonomous driving vehicle 3 wants to turn left and accelerate to overtake autonomous driving vehicle 1. Autonomous driving vehicle 4 wants to turn left and accelerate to overtake autonomous driving vehicle 2, but misjudges the behavior of autonomous driving vehicle 2. Autonomous driving vehicle 2, autonomous driving vehicle 3, and autonomous driving vehicle 4 are all likely to collide with autonomous driving vehicle 1. The responsibility division analysis is as follows:

[0146] Autonomous driving vehicle 1 only has to brake, but autonomous driving vehicle 2 needs to send a left turn signal and then turn left, accelerate, and turn right in the same direction as the straight section. If there are only autonomous driving vehicle 1 and autonomous driving vehicle 2, the AAC value AAC_V2 of autonomous driving vehicle 2 is higher than the AAC value AAC_V1 of autonomous driving vehicle 1.

[0147] Autonomous driving vehicle 1 is driving on a straight road. If other vehicles want to cut in, autonomous driving vehicle 1 is usually in danger of being collided. Autonomous driving vehicle 2 often cuts in on the routes of other vehicles. Then the AAE value AAE_V1 of autonomous driving vehicle 1 is lower than the AAE value AAE_V2 of autonomous driving vehicle 2.

[0148] Reference Figure 7 It can be seen that the speed V2 of the autonomous driving vehicle 2 should be decomposed into V2_1 and V2_τ, and if the autonomous driving vehicle 2 wants to exceed the autonomous driving vehicle 1, V2_1>V1 must be satisfied. According to V2=square_root((V2_1)^2+(V2_τ)^2-2*(V2_1)*(V2_τ)*cos<V2_1,V2_τ> )>>V1, thus we can get the value of AAS of autonomous driving vehicle 2>the value of AAS of autonomous driving vehicle 1, that is: AAS_V2>AAS_V1. Similarly, analyzing autonomous driving vehicles 3 and 4, we can get the value of AAS of autonomous driving vehicle 3>the value of AAS of autonomous driving vehicle 1, the value of AAS of autonomous driving vehicle 4>the value of AAS of autonomous driving vehicle 1, that is: AAS_V3>AAS_V1, AAS_V4>AAS_V1.

[0149] For autonomous vehicle 1, it is subject to a front collision with autonomous vehicle 2, a side collision with autonomous vehicle 4, and a rear collision with autonomous vehicle 3. The relative speed during the front collision is usually 4-10 to 20-50 km / h. The AAS value of autonomous vehicle 1 subjected to the front collision is AAS 1front =1; the relative speed during a side collision is usually 2-10 to 8-30 km / h, so the AAS value of the automatic driving vehicle 1 subjected to a side collision is AAS 1side =1; the relative speed during a rear-end collision is usually 4-10 to 20-50 km / h, so the AAS value of the rear-end collision of the autonomous driving vehicle 1 is AAS 1back =1; then the total value AAS1 of the AAS of the autonomous driving vehicle 1 is:

[0150] AAS1=INT(square_root(AAS 1front ^2+AAS 1side ^2+AAS 1back ^2))+1=2, (AAS<=3).

[0151] This scenario is rarely encountered, so the AAE value AAE_V1 of the autonomous driving vehicle 1 is 1; in this scenario, when the autonomous driving vehicle 1 faces three autonomous driving vehicles, the autonomous driving vehicle 1 has almost no control over the situation, so the AAC value AAC_V1 of the autonomous driving vehicle 1 is 3. According to Table 1, the AASIL value of the autonomous driving vehicle 1 is AASIL_V1=NA.

[0152] For the self-driving vehicle 2, when it is hit from the side by the self-driving vehicle 1 and from the rear by the self-driving vehicle 4, the relative speed during the side collision is usually 8-30 to 16-40 km / h. The AAS value of the self-driving vehicle 2 in the side collision is AAS 2side =2; the relative speed during a rear-end collision is usually 4-10 to 20-50 km / h, so the AAS value of the rear-end collision of the autonomous driving vehicle 2 is AAS 2back =1; then the total value AAS2 of the AAS of the autonomous driving vehicle 2 is:

[0153] AAS2 = INT (square_root (AAS 2side ^2+AAS 2back ^2))+1=3, (AAS<=3).

[0154] This scenario is very common, so the AAE value AAE_V2 of the autonomous driving vehicle 2 is 3; in this scenario, the autonomous driving vehicle 2 is normally controllable in this situation, so the AAC value AAC_V2 of the autonomous driving vehicle 2 is 2. According to Table 1, the AASIL value of the autonomous driving vehicle 2 is AASIL_V2=AASIL B=8.

[0155] For the autonomous driving vehicle 3, when it is hit by the front collision of the autonomous driving vehicle 1, the relative speed during the front collision is usually 20-50 to 40-65 km / h, then the value of AAS of the autonomous driving vehicle 3 is AAS3=AAS3front=2; this scenario is very common, then the value of AAE of the autonomous driving vehicle 3 is AAE_V3 3; in this scenario, the autonomous driving vehicle 3 is normally controllable for the situation, then the value of AAC of the autonomous driving vehicle 3 is AAC_V3 2. According to Table 1, the value of AASIL of the autonomous driving vehicle 3 is AASIL_V3=AASIL A=7.

[0156] For autonomous driving vehicle 4, it can be basically determined that it was hit by the forward collision of autonomous driving vehicle 1 and the forward collision of autonomous driving vehicle 2. The relative speed during the forward collision is usually 20-50 to 40-65 km / h. Therefore, the AAS value of autonomous driving vehicle 4 is AAS4 = AAS 4front=2; this scenario is very common, so the AAE value AAE_V4 of the autonomous driving vehicle 4 is 3; in this scenario, the autonomous driving vehicle 4 is normally controllable for this situation, so the AAC value AAC_V4 of the autonomous driving vehicle 4 is 2. According to Table 1, the AASIL value of the autonomous driving vehicle 4 is AASIL_V4=AASIL A=7.

[0157] According to the responsibility division formula, the following conclusions can be drawn:

[0158] For autonomous vehicle 1:

[0159] Vehicle 1 liability = ((AASIL_V1)^2 / ((AASIL_V1)^2+(AASIL_V2)^2+

[0160] (AASIL_V3)^2+(AASIL_V4)^2))*100%=36 / (36+64+49+49)=18%;

[0161] Vehicle 2 liability = ((AASIL_V2)^2 / ((AASIL_V1)^2+(AASIL_V2)^2+

[0162] (AASIL_V3)^2+(AASIL_V4)^2))*100%=64 / (36+64+49+49)=32%;

[0163] Vehicle 3 liability = ((AASIL_V3)^2 / ((AASIL_V1)^2+(AASIL_V2)^2+

[0164] (AASIL_V3)^2+(AASIL_V4)^2))*100%=49 / (36+64+49+49)=25%;

[0165] Vehicle 4 liability = ((AASIL_V4)^2 / ((AASIL_V1)^2+(AASIL_V2)^2+

[0166] (AASIL_V3)^2+(AASIL_V4)^2))*100%=49 / (36+64+49+49)=25%.

[0167] For autonomous vehicle 2:

[0168] Vehicle 1 liability = ((AASIL_V1)^2 / ((AASIL_V1)^2+(AASIL_V2)^2+

[0169] (AASIL_V4)^2))*100%=36 / (36+64+49)=24%;

[0170] Vehicle 2 liability = ((AASIL_V2)^2 / ((AASIL_V1)^2+(AASIL_V2)^2+

[0171] (AASIL_V4)^2))*100%=64 / (36+64+49)=43%;

[0172] Vehicle 4 liability = ((AASIL_V4)^2 / ((AASIL_V1)^2+(AASIL_V2)^2+

[0173] (AASIL_V4)^2))*100%=49 / (36+64+49)=33%;

[0174] For autonomous vehicle 3:

[0175] Vehicle 1 liability = ((AASIL_V1)^2 / ((AASIL_V1)^2+(AASIL_V3)^2))*

[0176] 100% = 36 / (36+49) = 42%;

[0177] Vehicle 3 liability = ((AASIL_V3)^2 / ((AASIL_V1)^2+(AASIL_V3)^2))*

[0178] 100% = 49 / (36+49) = 58%;

[0179] For autonomous vehicles 4:

[0180] Vehicle 1 liability = ((AASIL_V1)^2 / ((AASIL_V1)^2+(AASIL_V2)^2+

[0181] (AASIL_V4)^2))*100%=36 / (36+64+49)=24%;

[0182] Vehicle 2 liability = ((AASIL_V2)^2 / ((AASIL_V1)^2+(AASIL_V2)^2+

[0183] (AASIL_V4)^2))*100%=64 / (36+64+49)=43%;

[0184] Vehicle 4 liability = ((AASIL_V4)^2 / ((AASIL_V1)^2+(AASIL_V2)^2+

[0185] (AASIL_V4)^2))*100%=49 / (36+64+49)=33%.

[0186] In summary, the present invention provides a method for dividing responsibilities based on AASIL for multi-agent autonomous driving vehicles, including: step S1: defining and obtaining the value of AASIL based on the level of the autonomous driving vehicle; and step S2: dividing the responsibilities for safety accidents of n autonomous driving vehicles according to the value of AASIL obtained in step S1, where n≥2. This method combines SOTIF, functional safety and multi-agent safety for the first time to define AASIL, and provides a quantitative algorithm to divide the responsibilities for autonomous driving vehicle collisions. This method is of great significance to the analysis and theoretical development of autonomous driving safety assessment.

[0187] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for dividing responsibilities of a multi-agent autonomous driving vehicle based on the autonomous driving vehicle safety integrity level AASIL, characterized in that: The responsibility division method includes: Step S1: defining and obtaining the value of AASIL based on the level of the autonomous driving vehicle; and Step S2: Based on the AASIL value obtained in step S1, responsibilities for safety accidents of n autonomous driving vehicles are divided, where n≥2. It is characterized in that The step S1 further comprises: Step S110: defining and obtaining a value of the controllability AAC of the autonomous driving vehicle based on the level of the autonomous driving vehicle; Step S120: defining and obtaining a value of the exposure rate AAE of the autonomous driving vehicle based on the level of the autonomous driving vehicle; Step S130: defining and obtaining a value of the severity AAS of the autonomous driving vehicle based on the level of the autonomous driving vehicle; and Step S140: defining and acquiring the value of the AASIL based on the acquired value of the AAC, the value of the AAE, and the value of the AAS, and It is characterized in that The value of the AAS is defined and obtained based on different methods for the case of two autonomous vehicles and the case of more than two autonomous vehicles, and In step S140, the responsibility percentage of vehicle i among the n autonomous driving vehicles is as follows: Vehicle i liability = ((AASIL_V i )^2 / ((AASIL_V1)^2+(AASIL_V2)^2+…+ (AASIL_V i )^2)+…+(AASIL_V n )^2))*100%, Among them, n≥2, n≥i≥1.

2. The responsibility division method according to claim 1, characterized in that: In step S2, the larger the value of the AASIL is, the greater the responsibility of the autonomous driving vehicle corresponding to the value of the AASIL is.

3. The responsibility division method according to claim 2, characterized in that: In step S1, when the L4 autonomous driving vehicle operates beyond the designed operating area, the value of the AAC, the value of the AAE, and the value of the AAS are each increased by at least 1.

4. The responsibility division method according to claim 3 is characterized in that: In step S1, when the L3 autonomous driving vehicle is not driven by a user who has sufficient ability or time to obtain control of the autonomous driving vehicle, the value of AAC, the value of AAE, and the value of AAS are each increased by at least 1.

5. The responsibility division method according to claim 4 is characterized in that: In step S1, when a cyber attack or security issue causes the control of the autonomous driving vehicle to deteriorate, the value of the AAC, the value of the AAE, and the value of the AAS are each increased by at least 1.

6. The responsibility division method according to claim 5, characterized in that: For the case of two autonomous driving vehicles, when the distance between the two autonomous driving vehicles is less than the safe distance and there is no appropriate response, the value of the AAS increases by 1.

Images