A method, device, electronic device and storage medium for selecting a solution

Abstract

The embodiment of the present invention provides a scheme screening method, device, electronic device and storage medium, the method comprising: obtaining the single average failure probability of each expected functional safety SOTIF design scheme obtained by testing under a preset unknown unsafe scenario; according to the single average failure probability of each SOTIF design scheme, obtaining the evaluation value of each SOTIF design scheme under the preset unknown unsafe scenario; wherein the evaluation value includes at least two of the average number of failures, failure discreteness and total failure rate of the SOTIF design scheme; according to the evaluation value of each SOTIF design scheme, determining the target design scheme under the preset unknown unsafe scenario. Therefore, in an embodiment of the present invention, calculating the evaluation value can more quantitatively represent the failure probability distribution and confidence of each expected functional safety design scheme under an unknown unsafe scenario, thereby determining the screening principle of the SOTIF design scheme.

Description

Technical Field

[0001] The present invention relates to the field of vehicle automatic driving technology, and in particular to a solution screening method, device, electronic equipment and storage medium. Background Art

[0002] At present, 99% of the safety issues caused by autonomous vehicles are caused by intended functional safety, that is, when all functions of autonomous vehicles are not failed, driving safety issues that still occur are classified as intended functional safety. In order to improve the safety of autonomous vehicles, the intended functional safety SOTIF design scheme is designed with reference to the international standard ISO 21448 for autonomous driving safety. The SOTIF design scheme is developed to avoid hazards caused by insufficient expected functions at the vehicle level, performance limitations of electronic and electrical system elements, and misuse by vehicle drivers.

[0003] Among the various existing SOTIF design schemes, the SOTIF design scheme cannot determine which SOTIF design scheme is the most preferred design scheme from known and unknown scenario tests, and thus cannot provide clear expected functional information of vehicle driving in vehicle autonomous driving, which may lead to danger. Summary of the invention

[0004] In view of the above problems, embodiments of the present invention are proposed to provide a solution screening method and a corresponding solution screening device that overcome the above problems or at least partially solve the above problems.

[0005] In order to solve the above problem, an embodiment of the present invention discloses a solution screening method, which includes:

[0006] Obtain the single average failure probability of each expected functional safety SOTIF design solution tested under a preset unknown unsafe scenario;

[0007] According to the single average failure probability of each SOTIF design scheme, obtaining an evaluation value of each SOTIF design scheme in the preset unknown unsafe scenario; wherein the evaluation value includes at least two of the average number of failures, failure discreteness and total failure rate of the SOTIF design scheme;

[0008] According to the evaluation value of each SOTIF design solution, a target design solution under the preset unknown unsafe scenario is determined.

[0009] The embodiments of the present invention include the following advantages:

[0010] In an embodiment of the present invention, the single average failure probability of each expected functional safety SOTIF design scheme obtained by testing under a preset unknown unsafe scenario is obtained; according to the single average failure probability of each SOTIF design scheme, the evaluation value of each SOTIF design scheme under the preset unknown unsafe scenario is obtained; wherein, the evaluation value includes at least two of the average number of failures, failure discreteness and total failure rate of the SOTIF design scheme; according to the evaluation value of each SOTIF design scheme, the target design scheme under the preset unknown unsafe scenario is determined. In an embodiment of the present invention, according to the evaluation value of each SOTIF design scheme under the preset unknown unsafe scenario obtained by calculation, the failure probability distribution and confidence of the SOTIF design scheme under the preset unknown unsafe scenario can be more quantitatively represented. Therefore, in an embodiment of the present invention, after comparing the evaluation values ​​of multiple SOTIF design schemes under the preset unknown unsafe scenario of the unknown scenario, a mature screening principle of the SOTIF design scheme can be given, which provides a guiding criterion for the SOTIF design scheme based on the risk state of the preset unknown unsafe scenario of the unknown scenario.

[0011] Therefore, in an embodiment of the present invention, the most preferred SOTIF design scheme that meets the risk status of unknown unsafe scenarios preset in unknown scenarios is screened out to deal with the hazards caused by insufficient expected functions at the vehicle level, performance limitations of electronic and electrical system elements, and misuse by vehicle drivers, and to provide clear expected function information for vehicle driving during vehicle automatic driving, thereby controlling the hazards within a reasonably acceptable range. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0013] Figure 1 is a schematic diagram of a solution screening method provided by an embodiment of the present invention;

[0014] Figure 2 is a schematic diagram of another solution screening method provided by an embodiment of the present invention;

[0015] Figure 3 It is a schematic diagram of a method for calculating an evaluation value of a SOTIF design solution provided by an embodiment of the present invention;

[0016] Figure 4 Schematic diagram of a screening method of a SOTIF design scheme provided by an embodiment of the present invention;

[0017] Figure 5 is a structural block diagram of a solution screening device provided by an embodiment of the present invention;

[0018] Figure 6 is a structural block diagram of another screening device provided by an embodiment of the present invention;

[0019] Figure 7 is a structural block diagram of an evaluation value acquisition module provided by an embodiment of the present invention;

[0020] Figure 8 It is a structural block diagram of a first screening module provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0021] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0022] ISO 21448, the international standard for autonomous driving safety, "Road Vehicles-Safety of the Intended Functionality", is based on the non-fault safety field that has a wider impact on autonomous driving safety, focusing on the behavioral safety of autonomous vehicles, and solving the vehicle behavior hazards caused by insufficient design of the autonomous driving system or performance limitations when encountering certain triggering conditions (such as environmental interference or human misuse). It provides a fundamental guarantee for ensuring the safe operation of autonomous driving vehicles in both fault and non-fault situations.

[0023] The Safety of The Intended Functionality (SOTIF) design scheme is designed with reference to the international standard for autonomous driving safety ISO 21448. This design scheme is used to control the risks caused by insufficient design and performance limitations of the autonomous driving system within a reasonably acceptable range.

[0024] Due to the complexity and randomness of vehicle autonomous driving scenarios, there are uncertain safety issues in autonomous driving systems. Currently, from the perspective of safety and knownness, vehicle operation scenarios are divided into known safe scenarios, known unsafe scenarios, unknown unsafe scenarios, and unknown safe scenarios.

[0025] Among them, unknown unsafe scenarios refer to scenarios that actual autonomous driving vehicles encounter during their driving life cycle, in addition to all unmanned driving scenarios that can be anticipated and designed by the design and development personnel, and the unreasonable risks of such scenarios have not been eliminated. For example, the smart camera on the vehicle has a high resolution during the day and has good accuracy in capturing dynamically changing objects; but at night, in rainy scenes, because it is not defined that the smart camera will continue to maintain high resolution as the environment changes, its resolution is significantly reduced, and the accuracy of capturing dynamically changing objects is significantly reduced. At this time, the reliability of the information it provides becomes worse. Therefore, the vehicle's autonomous driving system will have unsafe behaviors in scenes such as night and rain.

[0026] At the same time, the safety risks of vehicle autonomous driving systems mainly come from unknown and unsafe scenarios. At present, in order to reduce the probability of risks in vehicle autonomous driving in unknown and unsafe scenarios, a variety of SOTIF design solutions have been designed.

[0027] For example, in the case of emergency braking of an AEB system, a SOTIF design review process for implementing the expected functions of the system in this case is as follows:

[0028] First, confirm the AEB system function specifications. This function uses radar to scan the distance of obstacles ahead. If a nearby obstacle is detected, the AEB system will trigger an alarm and take emergency braking measures;

[0029] The SOTIF design scheme conducts relevant hazard identification and risk assessment, and obtains the vehicle driving scenario as a busy traffic area. Among them, the potential hazard is unexpected emergency braking, which may cause the rear vehicle to rear-end.

[0030] Determine whether the risk is acceptable. If so, end the review and confirm that this SOTIF design is the expected verification standard for the system function. If not, re-perform hazard identification and risk assessment to confirm that the potential hazard depends on the distance between vehicles and that the driver cannot control the hazard.

[0031] Based on the identified hazardous events, identify the events that trigger potential hazards and find out the causes of the hazardous events. For example, if there are foreign objects such as cans or ice cream cones on the road, the radar may identify them as potential obstacles. Determine whether the cause of the hazardous event is acceptable. If it is acceptable, the review ends. Among them, the cause of the hazard is caused by the functional limitations of the AEB system, so it is judged as unacceptable.

[0032] Depending on the cause of the hazard, modify system functionality (e.g., limit the duration or force of AEB braking or add a function to limit brake intervention) to minimize or prevent injuries caused by unintended emergency braking;

[0033] Select design-related test cases to address known or unknown unsafe scenarios related to the AEB system;

[0034] Conduct tracking tests, simulation tests, and durability tests for known AEB scenarios to verify that the SOTIF design is sufficient to cover known scenarios and that the system and components perform as expected;

[0035] Select test cases, conduct vehicle-level tests, and compile statistics on long-term test results to confirm that this SOTIF design solution is sufficient to cover known scenarios, and that the systems and components perform as expected; the vehicle functional systems and components will not cause unreasonable risks in real scenarios.

[0036] At the same time, with the continuous development of SOTIF design, there may be multiple SOTIF design solutions to test whether the performance of vehicle system functions meets expectations in unknown unsafe scenarios. At present, the best solution screening method for multiple SOTIF design solutions is to compare the total failure probability of each SOTIF design solution after multiple tests. The SOTIF design solution with the lowest total failure probability is the best design solution that meets the risks of unknown unsafe scenarios. However, this screening method cannot quantitatively represent the failure probability distribution and confidence of the SOTIF design solution.

[0037] Therefore, the present invention provides a scheme screening method, device, electronic device and storage medium, which can quantitatively represent the failure probability distribution and confidence of each SOTIF design scheme under a preset unknown unsafe scenario, so as to determine the screening principle of the scheme and provide guidance for SOTIF design based on the risk status of unknown unsafe scenarios.

[0038] like Figure 1 , which is a schematic diagram of a scheme screening method according to an embodiment of the present invention.

[0039] The method may include:

[0040] Step 101, obtaining the single average failure probability of each SOTIF design solution tested under a preset unknown unsafe scenario.

[0041] Among them, the single average failure probability is the average failure rate of multiple tests obtained by a single SOTIF design scheme under a preset unknown unsafe scenario. The single average failure probability is expressed by the ratio of the total number of tests to the number of failures.

[0042] In addition, there are two ways to obtain the single average failure probability of each SOTIF design solution:

[0043] Method 1: When executing step 101, the single average failure probability of each SOTIF design scheme is calculated and obtained;

[0044] Method 2: Pre-store the single average failure probability of each SOTIF design solution calculated under the preset unknown unsafe scenario. When executing step 101, directly obtain the single average failure probability corresponding to each SOTIF design solution.

[0045] Step 102 : obtaining an evaluation value of each SOTIF design solution in a preset unknown unsafe scenario according to the single average failure probability of each SOTIF design solution.

[0046] The evaluation value includes at least two of the average number of failures, the failure dispersion and the total failure rate of the SOTIF design scheme.

[0047] In an embodiment of the present invention, the average number of failures is used to count the average number of failures of each SOTIF design scheme after multiple tests in the test of a preset unknown unsafe scenario; the failure discreteness is used to observe the difference between the number of failures of each SOTIF design scheme tested under a preset unknown unsafe scenario, and is an indicator for measuring the size of the risk; the total failure probability is the total failure probability of each SOTIF design scheme after multiple tests in the test of a preset unknown unsafe scenario, and is used to represent the total probability of failure or risk after multiple tests.

[0048] In addition, there are many specific methods for obtaining the above evaluation value according to the single average failure probability, and reference may be made to the description of the subsequent embodiments.

[0049] Step 103: Determine a target design solution under a preset unknown unsafe scenario according to the evaluation value of each SOTIF design solution.

[0050] Among them, based on the comparison of the two numerical values ​​of average failure times, failure discreteness and total failure rate in the evaluation values, the failure probability distribution and confidence level of the SOTIF design scheme under the preset unknown unsafe scenario can be more quantitatively expressed, thereby determining the screening principles of the target SOTIF design scheme and providing guidance for the SOTIF design based on the preset unknown unsafe scenario risk status.

[0051] It can be seen from the above steps 101 to 103 that, in an embodiment of the present invention, the single average failure probability of each expected functional safety SOTIF design scheme obtained by testing under a preset unknown unsafe scenario is obtained; according to the single average failure probability of each SOTIF design scheme, the evaluation value of each SOTIF design scheme under the preset unknown unsafe scenario is obtained; wherein, the evaluation value includes at least two of the average number of failures, failure discreteness and total failure rate of the SOTIF design scheme; according to the evaluation value of each SOTIF design scheme, the target design scheme under the preset unknown unsafe scenario is determined. In an embodiment of the present invention, according to the evaluation value of each SOTIF design scheme under the preset unknown unsafe scenario obtained by calculation, the failure probability distribution and confidence of the SOTIF design scheme under the preset unknown unsafe scenario can be more quantitatively represented. Therefore, in an embodiment of the present invention, after comparing the evaluation values ​​of multiple SOTIF design schemes under the preset unknown unsafe scenario of the unknown scenario, a mature screening principle of the SOTIF design scheme can be given, and a guiding criterion is provided for the SOTIF design scheme based on the risk state of the preset unknown unsafe scenario of the unknown scenario.

[0052] Therefore, in an embodiment of the present invention, the most preferred SOTIF design scheme that meets the risk status of unknown unsafe scenarios preset in unknown scenarios is screened out to deal with the hazards caused by insufficient expected functions at the vehicle level, performance limitations of electronic and electrical system elements, and misuse by vehicle drivers, and to provide clear expected function information for vehicle driving during vehicle automatic driving, thereby controlling the hazards within a reasonably acceptable range.

[0053] In another embodiment of the present invention, Figure 2 As shown, a schematic diagram of another solution screening method is also provided.

[0054] The method may include:

[0055] Step 201, establishing a corresponding relationship between the preset unknown unsafe scenario and the single average failure probability of each SOTIF design scheme;

[0056] The process of establishing the corresponding relationship includes steps H1 to H4:

[0057] H1: Test each SOTIF design solution under the preset unknown unsafe scenario;

[0058] H2: Obtain the number of test failures for each SOTIF design solution described in the test;

[0059] H3: Calculate the ratio of the number of test failures to the first total number of tests as the single average failure probability of each SOTIF design scheme;

[0060] From H1 to H3, it can be seen that under the preset unknown unsafe scenario, the calculation principle of the single average failure probability of a given SOTIF design scheme is shown in Table 1.

[0061] Table 1 Principles for calculating the average probability of single failure

[0062]

[0063] In addition, the first total number of tests is m test cases, which is the total number of times a single SOTIF design solution is tested in a preset unknown unsafe scenario.

[0064] H4: Establish a corresponding relationship between the preset unknown unsafe scenario and the single average failure probability of each SOTIF design scheme.

[0065] After obtaining the single average failure probability corresponding to different SOTIF design schemes according to the above H3, a corresponding relationship table between multiple SOTIF design schemes and single average failure probability can be established.

[0066] Step 202: searching, according to the corresponding relationship, the single average failure probability of the preset unknown unsafe scenario and each SOTIF design solution.

[0067] In an embodiment of the present invention, under a preset unknown unsafe scenario, the single average failure probability of each SOTIF design solution can be directly found.

[0068] Step 203, obtaining an evaluation value of each SOTIF design scheme in the preset unknown unsafe scenario according to the single average failure probability of each SOTIF design scheme; wherein the evaluation value includes at least two of the average failure number, failure discreteness and total failure rate of the SOTIF design scheme;

[0069] Step 204: Determine a target design solution under the preset unknown unsafe scenario according to the evaluation value of each SOTIF design solution.

[0070] In the embodiment of the present invention, when executing steps 207 to 208, reference may be made to the description of steps 102 to 103 in the above embodiment of the invention.

[0071] It can be seen that in the embodiment of the present invention, by pre-storing the corresponding relationship between the preset unknown unsafe scenarios and the single average failure probability of each SOTIF design scheme, the single average failure probability of each SOTIF design scheme can be directly obtained before executing step 203, thereby improving work efficiency.

[0072] In another embodiment of the present invention, Figure 3 As shown, when executing the above step 102, a schematic diagram of a method for calculating the evaluation value of a SOTIF design solution is also provided.

[0073] The method may include:

[0074] Step 301, determining the average number of failures of each SOTIF design scheme according to the product of the second total number of tests of each SOTIF design scheme under the preset condition and the single average failure probability of the SOTIF design scheme;

[0075] In the embodiment of the present invention, the average failure times of the first formula is: E(x)=n×p i

[0076] Among them, n is the total number of second tests, p i is the average single failure probability of a certain SOTIF design solution.

[0077] In addition, the second total number of tests is the total number of times used to test each SOTIF design solution under the preset unknown unsafe scenario.

[0078] Step 302, determining the failure discreteness of each SOTIF design scheme according to the average number of failures of each SOTIF design scheme and the single average failure probability of the SOTIF design scheme;

[0079] In an embodiment of the present invention, the failure discrete degree of the second formula is:

[0080] D(x)=n×p i -(1-p i )

[0081] Among them, n is the total number of second tests, p i is the average single failure probability of a certain SOTIF design solution.

[0082] Step 303, determining the total failure rate of each SOTIF design solution according to the second total number of tests of each SOTIF design solution, the number of times the test failure probability occurs, and the single average failure probability;

[0083] In an embodiment of the present invention, the failure discrete degree of the third formula is:

[0084]

[0085] Where n is the second total test number, k is the number of failure probabilities that occur in the second total test number for each SOTIF design solution under the preset unknown unsafe scenario, and p i The average probability of a single failure of a design solution for a certain expected function.

[0086] In another embodiment of the present invention, Figure 4 As shown, when executing the above step 103, a schematic diagram of a screening method for a SOTIF design solution is also provided.

[0087] The method may include:

[0088] Step 401, selecting the SOTIF design scheme with the least average number of failures and the smallest failure discreteness as the first selected design scheme in the preset unknown unsafe scenario;

[0089] In an embodiment of the present invention, a certain SOTIF design scheme has the least average number of failures and the smallest failure discreteness calculated under a preset unknown unsafe scenario, then this SOTIF design scheme is determined to be the first choice design scheme under the preset unknown unsafe scenario.

[0090] Step 402, selecting the SOTIF design scheme with the least average number of failures and the lowest total failure rate as the second selected design scheme in the preset unknown unsafe scenario;

[0091] In an embodiment of the present invention, if a certain SOTIF design scheme has the least average number of failures and the lowest total failure rate calculated under a preset unknown unsafe scenario, then this SOTIF design scheme is determined to be the second choice design scheme under the preset unknown unsafe scenario.

[0092] Step 403, selecting the SOTIF design scheme with the smallest failure discreteness and the lowest total failure rate as the third selected design scheme under the preset unknown unsafe scenario;

[0093] In an embodiment of the present invention, a certain SOTIF design scheme has the smallest failure discreteness and the lowest total failure rate calculated under a preset unknown unsafe scenario, then this SOTIF design scheme is determined to be the third choice design scheme under the preset unknown unsafe scenario.

[0094] It can be seen from steps 401 to 403 that in an embodiment of the present invention, in a preset unknown unsafe scenario, the comparison principle for screening the relatively optimal SOTIF design scheme is: screening the design schemes according to the priority selection, that is, the first-selected design scheme is the optimal scheme; if there is no first-selected design scheme that meets the screening principle, the second-selected design scheme is the optimal scheme; if there is no first-selected design scheme and the second-selected design scheme at the same time, the third-selected design scheme is the optimal scheme.

[0095] In a solution screening method of an embodiment of the present invention, the method further includes:

[0096] After obtaining the evaluation value of each SOTIF design solution, updating the second total number of tests and the number of test failure probabilities of the SOTIF design solution in the preset unknown unsafe scenario;

[0097] Recalculate the evaluation value of each SOTIF design solution according to the single average failure probability of each SOTIF design solution, the second total number of tests, and the number of times the test failure probability occurs;

[0098] According to the recalculated evaluation value, it is determined whether to update the target design solution.

[0099] Among them, repeated review is to verify whether the screening results of multiple SOTIF design schemes are correct, update the second total test times and the number of test failure probabilities under the preset unknown unsafe scenarios, and determine that the screened SOTIF design scheme is the first choice design scheme.

[0100] In a solution screening method of an embodiment of the present invention, the method further includes:

[0101] After determining the target design scheme under the preset unknown unsafe scenario according to the evaluation value of each SOTIF design scheme, the system defects corresponding to the target design scheme under the preset unknown unsafe scenario are obtained according to the safety analysis method STPA.

[0102] Among them, after screening out the first-choice design scheme under the preset unknown unsafe scenario, the STPA method is used for analysis to reversely deduce the system defects; in addition, the system defects include defects in the system or hardware, software elements or related interfaces and elements of the SOTIF design.

[0103] Figure 5 , which is a structural block diagram of a solution screening device 500 according to an embodiment of the present invention.

[0104] The solution screening device 500 comprises:

[0105] A single average failure probability acquisition module 501 is used to obtain the single average failure probability of each expected functional safety SOTIF design solution tested under a preset unknown unsafe scenario;

[0106] An evaluation value acquisition module 502 is used to acquire an evaluation value of each SOTIF design scheme in a preset unknown unsafe scenario according to the single average failure probability of each SOTIF design scheme; wherein the evaluation value includes at least two of the average number of failures, failure discreteness and total failure rate of the SOTIF design scheme tested in the preset unknown unsafe scenario;

[0107] The first screening module 503 is used to determine the target design scheme corresponding to the preset unknown unsafe scenario according to the evaluation value of each SOTIF design scheme in the preset unknown unsafe scenario.

[0108] In another embodiment of the present invention, Figure 6 As shown, a structural block diagram of another solution screening device 600 is also provided.

[0109] The solution screening device 600 comprises:

[0110] A corresponding relationship establishing module 601 is used to establish a corresponding relationship between the preset unknown unsafe scenario and the single average failure probability of each SOTIF design solution;

[0111] The corresponding relationship establishing module 601 includes:

[0112] A testing submodule, used for testing each of the expected functional safety design solutions under the preset unknown unsafe scenario;

[0113] The failure number acquisition submodule is used to obtain the number of failures of each SOTIF design solution test described in the test;

[0114] A single average failure probability calculation submodule, used to calculate the ratio of the number of test failures to the first total number of tests, as the single average failure probability of each SOTIF design scheme;

[0115] The corresponding relationship establishing submodule is used to establish the corresponding relationship between the preset unknown unsafe scenario and the single average failure probability of each SOTIF design scheme.

[0116] A single average failure probability acquisition module 602 is used to find the single average failure probability of the preset unknown unsafe scenario and each SOTIF design scheme according to the corresponding relationship;

[0117] An evaluation value acquisition module 603 is used to acquire an evaluation value of each SOTIF design scheme in a preset unknown unsafe scenario according to the single average failure probability of each SOTIF design scheme; wherein the evaluation value includes at least two of the average number of failures, failure discreteness and total failure rate of the SOTIF design scheme tested in the preset unknown unsafe scenario;

[0118] The first screening module 604 is used to determine the target design scheme corresponding to the preset unknown unsafe scenario according to the evaluation value of each SOTIF design scheme in the preset unknown unsafe scenario.

[0119] In another embodiment of the present invention, Figure 7 As shown, a structural block diagram of an evaluation value acquisition module 700 is also provided.

[0120] The evaluation value acquisition module 700 includes:

[0121] The average failure number acquisition submodule 701 is used to determine the average failure number of each SOTIF design scheme according to the product of the second total test number of each SOTIF design scheme in the preset unknown unsafe scenario and the single average failure probability of the SOTIF design scheme;

[0122] The failure dispersion degree acquisition submodule 702 is used to determine the failure dispersion degree of each SOTIF design scheme according to the average number of failures of each SOTIF design scheme and the single average failure probability of the SOTIF design scheme;

[0123] The total failure rate acquisition submodule 703 is used to determine the total failure rate of each SOTIF design solution according to the second total test number of each SOTIF design solution, the number of test failure probability occurrences and the single average failure probability.

[0124] In another embodiment of the present invention, Figure 8 As shown, a structural block diagram of a first screening module 800 is also provided.

[0125] The first screening module 800 includes:

[0126] The first scheme screening submodule 801 is used to select the SOTIF design scheme with the least average number of failures and the smallest failure discreteness as the first selected design scheme in the preset unknown unsafe scenario.

[0127] The second scheme screening submodule 802 is used to select the SOTIF design scheme with the least average number of failures and the lowest total failure rate as the second selected design scheme in the preset unknown unsafe scenario.

[0128] The third scheme screening submodule 803 is used to select the SOTIF design scheme with the smallest failure discreteness and the lowest total failure rate as the third selected design scheme in the preset unknown unsafe scenario.

[0129] In another embodiment of the present invention, the screening method device 500 further includes:

[0130] An updating module, used for updating the second total number of tests of the SOTIF design scheme in the preset unknown unsafe scenario and the number of times the probability of test failure occurs;

[0131] A calculation module, used for recalculating the evaluation value of each SOTIF design scheme according to the single average failure probability of each SOTIF design scheme, the second total number of tests and the number of times the test failure probability occurs;

[0132] The second screening module is used to determine whether to update the target design solution according to the recalculated evaluation value.

[0133] In another embodiment of the present invention, the screening method device 500 further includes:

[0134] The system defect acquisition module is used to acquire the system defects corresponding to the target design scheme in the preset unknown unsafe scenario according to the safety analysis method STPA.

[0135] It can be seen that in an embodiment of the present invention, the single average failure probability of each expected functional safety SOTIF design scheme obtained by testing under a preset unknown unsafe scenario is obtained; according to the single average failure probability of each SOTIF design scheme, the evaluation value of each SOTIF design scheme under the preset unknown unsafe scenario is obtained; wherein, the evaluation value includes at least two of the average number of failures, failure discreteness and total failure rate of the SOTIF design scheme; according to the evaluation value of each SOTIF design scheme, the target design scheme under the preset unknown unsafe scenario is determined. In an embodiment of the present invention, according to the evaluation value of each SOTIF design scheme under the preset unknown unsafe scenario obtained by calculation, the failure probability distribution and confidence of the SOTIF design scheme under the preset unknown unsafe scenario can be more quantitatively expressed. Therefore, in an embodiment of the present invention, after comparing the evaluation values ​​of multiple SOTIF design schemes under the preset unknown unsafe scenario, a mature screening principle of the SOTIF design scheme can be given, which provides guidance criteria for the SOTIF design scheme based on the risk state of the preset unknown unsafe scenario.

[0136] Therefore, in an embodiment of the present invention, the most preferred SOTIF design scheme that meets the preset risk state of unknown unsafe scenarios is screened out to deal with the hazards caused by insufficient expected functions at the vehicle level, performance limitations of electronic and electrical system elements, and misuse by vehicle drivers, and to provide clear expected function information for vehicle driving during vehicle automatic driving, thereby controlling the hazards within a reasonably acceptable range.

[0137] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0138] An embodiment of the present invention further provides an electronic device, including:

[0139] One or more processors; and one or more machine-readable media having instructions stored thereon, which, when executed by the one or more processors, enable the electronic device to perform the method described in the embodiment of the present invention.

[0140] The embodiment of the present invention further provides one or more machine-readable media having instructions stored thereon, which, when executed by one or more processors, enable the processors to execute the method described in the embodiment of the present invention.

[0141] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0142] It will be appreciated by those skilled in the art that the embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0143] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0144] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0145] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0146] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0147] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0148] The above is a detailed introduction to a scheme screening method and device provided by the present invention. Specific examples are used in this article to illustrate the principle and implementation mode of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation mode and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A scheme screening method, characterized in that: The method comprises: Obtain the single average failure probability of each expected functional safety SOTIF design solution tested under a preset unknown unsafe scenario; According to the single average failure probability of each SOTIF design scheme, obtaining an evaluation value of each SOTIF design scheme in the preset unknown unsafe scenario; wherein the evaluation value includes at least two of the average number of failures, failure discreteness and total failure rate of the SOTIF design scheme; Determining a target design scheme under the preset unknown unsafe scenario according to the evaluation value of each SOTIF design scheme; Determining a target design solution under the preset unknown unsafe scenario according to the evaluation value of each SOTIF design solution includes: Selecting the SOTIF design scheme with the least average number of failures and the smallest failure discreteness as the first choice design scheme in the preset unknown unsafe scenario; Selecting the SOTIF design scheme with the least average number of failures and the lowest total failure rate as the second choice design scheme under the preset unknown unsafe scenario; Selecting the SOTIF design scheme with the smallest failure discreteness and the lowest total failure rate as the third choice design scheme under the preset unknown unsafe scenario; Among them, the single average failure probability refers to the average failure rate of multiple tests obtained by a single SOTIF design scheme under a preset unknown unsafe scenario, and the single average failure probability is represented by the ratio of the total number of tests to the number of failures; the average number of failures is used to count the average number of failures of each SOTIF design scheme after multiple tests in the test of the preset unknown unsafe scenario; the failure discreteness is used to observe the difference between the number of failures of each SOTIF design scheme tested under the preset unknown unsafe scenario, which is an indicator to measure the size of the risk; the total failure probability is the total failure probability of each SOTIF design scheme after multiple tests in the test of the preset unknown unsafe scenario, which is used to represent the total probability of failure or risk after multiple tests.

2. The method according to claim 1, characterized in that Before obtaining the single average failure probability of each expected functional safety SOTIF design solution obtained by testing under a preset unknown unsafe scenario, it also includes: Establishing a corresponding relationship between the preset unknown unsafe scenario and the single average failure probability of each SOTIF design scheme; The obtaining of the single average failure probability of each SOTIF design solution obtained by testing under a preset unknown unsafe scenario includes: According to the corresponding relationship, the single average failure probability of the preset unknown unsafe scenario and each SOTIF design scheme is found.

3. The method according to claim 2, characterized in that The establishing of the correspondence between the preset unknown unsafe scenario and the single average failure probability of each SOTIF design solution includes: Testing each of the SOTIF design solutions under the preset unknown unsafe scenario; Get the number of test failures for each SOTIF design solution described in the test; Calculate the ratio of the number of test failures to the first total number of tests as the single average failure probability of each SOTIF design scheme; A corresponding relationship between the preset unknown unsafe scenario and the single average failure probability of each SOTIF design scheme is established.

4. The method according to claim 1, characterized in that: The obtaining of the evaluation value of each SOTIF design solution in the preset unknown unsafe scenario includes: The average number of failures of each SOTIF design solution is determined according to the product of the second total number of tests of each SOTIF design solution in the preset unknown unsafe scenario and the single average failure probability of the SOTIF design solution.

5. The method according to claim 4, characterized in that The obtaining of the evaluation value of each SOTIF design solution in a preset unknown unsafe scenario includes: The failure discreteness of each SOTIF design scheme is determined according to the average number of failures of each SOTIF design scheme and the average single failure probability of the SOTIF design scheme.

6. The method according to claim 5, characterized in that The obtaining of the evaluation value of each SOTIF design solution in a preset unknown unsafe scenario includes: The total failure rate of each SOTIF design solution is determined according to the second total number of tests for each SOTIF design solution, the number of times the test failure probability occurs, and the single average failure probability.

7. The method according to claim 6, characterized in that After obtaining the evaluation value of each SOTIF design solution, the method further includes: Updating the second total number of tests and the number of test failure probabilities of the SOTIF design solution in the preset unknown unsafe scenario; Recalculate the evaluation value of each SOTIF design solution according to the single average failure probability of each SOTIF design solution, the second total number of tests, and the number of times the test failure probability occurs; According to the recalculated evaluation value, it is determined whether to update the target design solution.

8. The method according to claim 1, characterized in that After determining the target design scheme under the preset unknown unsafe scenario according to the evaluation value of each SOTIF design scheme, the method further includes: According to the safety analysis method STPA, the system defects corresponding to the target design scheme in the preset unknown unsafe scenario are obtained.

9. A scheme screening device, characterized in that: The device comprises: A single average failure probability acquisition module is used to obtain the single average failure probability of each expected functional safety SOTIF design solution tested under a preset unknown unsafe scenario; An evaluation value acquisition module, used to obtain the evaluation value of each SOTIF design scheme in a preset unknown unsafe scenario according to the single average failure probability of each SOTIF design scheme; wherein the evaluation value includes at least two of the average number of failures, failure discreteness and total failure rate of the SOTIF design scheme tested in the preset unknown unsafe scenario; A first screening module is used to determine a target design scheme corresponding to the preset unknown unsafe scenario according to the evaluation value of each SOTIF design scheme in the preset unknown unsafe scenario; Wherein, the first screening module includes: A first scheme screening submodule is used to select the SOTIF design scheme with the least average number of failures and the smallest failure discreteness as the first selected design scheme in the preset unknown unsafe scenario; A second scheme screening submodule is used to select the SOTIF design scheme with the least average number of failures and the lowest total failure rate as the second selected design scheme in the preset unknown unsafe scenario; A third scheme screening submodule is used to select the SOTIF design scheme with the smallest failure discreteness and the lowest total failure rate as the third selected design scheme under the preset unknown unsafe scenario; Among them, the single average failure probability refers to the average failure rate of multiple tests obtained by a single SOTIF design scheme under a preset unknown unsafe scenario, and the single average failure probability is represented by the ratio of the total number of tests to the number of failures; the average number of failures is used to count the average number of failures of each SOTIF design scheme after multiple tests in the test of the preset unknown unsafe scenario; the failure discreteness is used to observe the difference between the number of failures of each SOTIF design scheme tested under the preset unknown unsafe scenario, which is an indicator to measure the size of the risk; the total failure probability is the total failure probability of each SOTIF design scheme after multiple tests in the test of the preset unknown unsafe scenario, which is used to represent the total probability of failure or risk after multiple tests.

10. An electronic device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the computer program is executed by the processor, the steps of the solution screening method according to any one of claims 1 to 8 are implemented.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the solution screening method according to any one of claims 1 to 8 are implemented.

Images