Verification method for rationality of state control of autonomous driving system based on functional safety

Abstract

The present invention discloses a method for verifying the rationality of state control of an automatic driving system based on functional safety, including: S1, system activation; S2, real-time monitoring of the state of the main function module; S3, judging whether the fault is established, if so, entering S4, if not, returning to S2; S4, reading whether the main function module sends a takeover alarm signal, if so, entering S5, if not, entering S6; S5, setting the system state control rationality verification mark position to "pass"; S6, setting the system state control rationality verification mark position to "fail"; S7, confirming whether the verification is passed, if so, entering S8, if not, entering S9; S8, outputting the takeover alarm signal of the main function module; S9, supplementing the output of the takeover alarm signal; S10, the HMI alarm module performs a takeover alarm; S11, if the vehicle is not taken over, returning to S10, if the vehicle is taken over, entering S12, S12, the automatic driving system exits. The present invention can accurately verify the rationality of the state control of the automatic driving system.

Description

Technical Field

[0001] The present invention relates to the technical field of autonomous driving systems, and in particular to a method for verifying the rationality of state control of an autonomous driving system based on functional safety. Background Art

[0002] At present, the autonomous driving system is one of the most important innovation areas of automotive technology. New technologies and products in this field continue to emerge, playing an important role in improving the comfort of car rides and reducing the burden on drivers. However, as an automotive electronic and electrical system, the autonomous driving system is closely related to safety. The possible systematic failures and random hardware failures in it have the risk of causing automobile safety accidents. The complexity and integration of automotive electronic and electrical systems are constantly increasing, and this risk is also increasing.

[0003] With the continuous innovation of autonomous driving technology, its particularity makes the application of functional safety in autonomous driving technology pay attention to various OEMs and parts manufacturers. At present, the research on autonomous driving technology in the domestic automobile industry is mainly focused on the L2-L3 level, that is, autonomous driving can be achieved under limited conditions. When the driver needs to take over, the system should be able to issue an alarm in time and have a certain degradation strategy to allow the user to take over the vehicle in time. The current mainstream autonomous driving solution in the industry adopts a fully redundant or partially redundant design for perception, control, and execution.

[0004] As the decision-making and control center of the entire autonomous driving system, the autonomous driving control part has its own system functional safety design, which is very important. In addition to the safety monitoring of conventional lateral control and longitudinal control, the rationality of the system's state transition should also be monitored.

[0005] For example: Patent document CN111717031A discloses a torque function safety monitoring method, system and vehicle for pure electric vehicles. This method uses functional safety analysis to obtain a torque function monitoring scheme for the entire vehicle, and compares the torque values ​​obtained by torque control and torque monitoring calculations to determine whether the motor torque control is within a safe range. This method is a typical safety design method for longitudinal control, which avoids failure modes such as excessive torque and insufficient torque caused by systemic failures, ensuring the safety of the entire vehicle.

[0006] Another example is the patent document CN112298208A which discloses an automatic driving lateral assistance control method and lateral assistance system. This method realizes redundant control through the main control unit and the auxiliary control unit, and adopts redundant communication to enable the entire system to avoid the harm caused by abnormal lateral control and improve the safety of the automatic driving system.

[0007] There are many studies on the functional safety design methods of lateral and longitudinal control of autonomous driving in the industry. However, there is no suitable design method for the rationality of system state control. Based on this situation, it is necessary to develop a verification method for the rationality of state control of autonomous driving systems based on functional safety. Summary of the invention

[0008] The purpose of the present invention is to provide a method for verifying the rationality of the state control of an autonomous driving system based on functional safety, which can accurately verify the rationality of the state control of the autonomous driving system.

[0009] The present invention discloses a method for verifying the rationality of state control of an autonomous driving system based on functional safety. The verification system used includes a main function module, a monitoring module, an HMI arbitration module and an HMI alarm module. The monitoring module is connected to the main function module and the HMI arbitration module respectively, and the HMI alarm module is connected to the HMI arbitration module. The verification method includes the following steps:

[0010] Step S1, system activation;

[0011] Step S2, the main function module and the monitoring module operate independently, and the monitoring module monitors the status of the main function module in real time;

[0012] Step S3, the monitoring module determines whether the fault is established, if so, it goes to step S4, if not, it returns to step S2;

[0013] Step S4, the monitoring module reads whether the main function module sends out a takeover alarm signal, if so, it goes to step S5, if not, it goes to step S6;

[0014] Step S5, the monitoring module sets the system state control rationality verification flag position to "pass" and proceeds to step S7;

[0015] Step S6, the monitoring module sets the system state control rationality check flag position to "failed" and proceeds to step S7;

[0016] Step S7, the HMI arbitration module determines whether the system state control rationality check flag confirms that the check has passed, if so, proceeds to step S8, if not, proceeds to step S9;

[0017] Step S8, the HMI arbitration module outputs a takeover alarm signal of the main function module, and enters step S10;

[0018] Step S9, the HMI arbitration module supplements the output of the takeover alarm signal and proceeds to step S10;

[0019] Step S10, the HMI alarm module takes over the alarm;

[0020] In step S11, the system continuously determines whether the vehicle has been taken over by the driver; if the vehicle has not been taken over, the system returns to step S10; if the vehicle has been taken over, the system proceeds to step S12.

[0021] Step S12, the automatic driving system exits and stops sending takeover alarm signals.

[0022] Optionally, in step 2, the main function module updates the current system status in real time and places the identification bit at the corresponding address; the monitoring module reads data from the corresponding address as a conditional basis before judgment.

[0023] Optionally, in step 2, all data are double-backed up by being stored in different address segments isolated from each other.

[0024] Optionally, in step S10, different alarm levels are set according to different faults; when the signal fault affecting lateral control and longitudinal control is judged to be established, and the system is at risk of being uncontrollable in the lateral and longitudinal directions, a takeover alarm is immediately issued to request the driver to take over the vehicle; for other faults, a low-level takeover alarm signal is issued.

[0025] Optionally, the input signal of the monitoring module and the input signal of the main function module remain independent and do not interfere with each other, and the monitoring module and the main function module use different algorithms to judge and process the input signal.

[0026] The present invention has the following advantages: the present invention monitors the system state control by means of a redundant algorithm, and can reduce the safety risk caused by state control errors to an acceptable level, meeting the requirements of functional safety standards. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 This is the architecture diagram of the intelligent driving system relied upon in this embodiment;

[0028] Figure 2 It is a functional safety decomposition method and design diagram of the control part in this embodiment;

[0029] Figure 3 is a flow chart of this embodiment. DETAILED DESCRIPTION

[0030] The present invention will be further described below in conjunction with the accompanying drawings.

[0031] like Figure 2 and Figure 3 As shown, in this embodiment, a method for verifying the rationality of state control of an autonomous driving system based on functional safety includes the following steps:

[0032] The adopted verification system includes a main function module, a monitoring module, an HMI arbitration module and an HMI alarm module. The monitoring module is connected to the main function module and the HMI arbitration module respectively, and the HMI alarm module is connected to the HMI arbitration module. The verification method includes the following steps:

[0033] Step S1, system activation;

[0034] Step S2, the main function module and the monitoring module operate independently, and the monitoring module monitors the status of the main function module in real time;

[0035] Step S3, the monitoring module determines whether the fault is established, if so, it goes to step S4, if not, it returns to step S2;

[0036] Step S4, the monitoring module reads whether the main function module sends out a takeover alarm signal, if so, it goes to step S5, if not, it goes to step S6;

[0037] Step S5, the monitoring module sets the system state control rationality verification flag position to "pass" and proceeds to step S7;

[0038] Step S6, the monitoring module sets the system state control rationality check flag position to "failed" and proceeds to step S7;

[0039] Step S7, the HMI arbitration module determines whether the system state control rationality check flag confirms that the check has passed, if so, proceeds to step S8, if not, proceeds to step S9;

[0040] Step S8, the HMI arbitration module outputs a takeover alarm signal of the main function module, and enters step S10;

[0041] Step S9, the HMI arbitration module supplements the output of the takeover alarm signal and proceeds to step S10;

[0042] Step S10, the HMI alarm module takes over the alarm;

[0043] In step S11, the system continuously determines whether the vehicle has been taken over by the driver; if the vehicle has not been taken over, the system returns to step S10; if the vehicle has been taken over, the system proceeds to step S12.

[0044] Step S12, the automatic driving system exits and stops sending takeover alarm signals.

[0045] like Figure 1As shown, in this embodiment, the autonomous driving system architecture includes a perception part, a control part and an execution part, wherein the perception part includes a right front corner millimeter wave radar, a front high-definition camera, a right rear corner millimeter wave radar, a front millimeter wave radar, a left rear corner millimeter wave radar and a left front corner millimeter wave radar. The control part includes an autonomous driving control unit. The execution part includes a braking system, a steering system and an HMI system.

[0046] The safety goals of the system are obtained by analyzing the functional safety process concept layer. In this embodiment, only the safety goals violated by the system state control errors obtained after analysis are listed as follows:

[0047] SG1: Avoid loss of lateral control capability, ASIL B;

[0048] SG2: Avoid loss of longitudinal control capability, ASIL B;

[0049] SG3: Avoid loss of alarms, ASIL B;

[0050] In this embodiment, the automatic driving system states are as follows:

[0051] INIT: The automatic driving system is initialized.

[0052] FAILURE: automatic driving system failure status;

[0053] OFF: The autopilot system is turned off;

[0054] ACTIVE: The automatic driving system function is activated;

[0055] In this embodiment, the state transition of the system is analyzed, and the possible jump modes of the system are obtained by enumeration. Then, it is analyzed in turn whether the relevant state transitions will violate the security goals of the system, and the analysis results in the following table are obtained:

[0056] Table 1. Safety-related system control status

[0057]

[0058] Based on the operating conditions set by the automatic driving system in this embodiment, the above analysis shows that: under the activation condition, if a certain condition is not met, the system should exit the ACTIVE state. If the system state control is abnormal at this time and does not exit normally, the driver may mistakenly believe that the system is under normal control, which may cause safety risks.

[0059] In this embodiment, in step 2, the main function module updates the current system status in real time and places the identification bit at the corresponding address; the monitoring module reads data from the corresponding address as the basis for the condition before judgment. All data is double-backed up by storing in different address segments isolated from each other to prevent data tampering. At the same time, the software layer adopts ECC functional safety mechanism and register check for storage to meet functional safety requirements.

[0060] In this embodiment, in step S10, different alarm levels are set according to different faults; when the signal fault affecting lateral control and longitudinal control is judged to be established, and the system is at risk of being uncontrollable in the lateral and longitudinal directions, a takeover alarm is immediately issued to request the driver to take over the vehicle; for other faults, such as body control, display and other non-critical (specific signals need to be determined through relevant analysis, such as FTA, FMEA, etc.) faults, a low-level takeover alarm signal is issued.

[0061] In this embodiment, the input signal of the monitoring module and the input signal of the main function module remain independent and do not interfere with each other, and the monitoring module and the main function module use different algorithms to judge and process the input signals.

Claims

1. A method for verifying the rationality of state control of an autonomous driving system based on functional safety, characterized in that: The adopted verification system includes a main function module, a monitoring module, an HMI arbitration module and an HMI alarm module, wherein the monitoring module is connected to the main function module and the HMI arbitration module respectively, and the HMI alarm module is connected to the HMI arbitration module; The verification method includes the following steps: Step S1, system activation; Step S2, the main function module and the monitoring module operate independently, and the monitoring module monitors the status of the main function module in real time; Step S3, the monitoring module determines whether the fault is established, if so, it goes to step S4, if not, it returns to step S2; Step S4, the monitoring module reads whether the main function module sends out a takeover alarm signal, if so, it goes to step S5, if not, it goes to step S6; Step S5, the monitoring module sets the system status control rationality check flag position to "pass" and proceeds to step S7; Step S6, the monitoring module sets the system state control rationality check flag position to "failed" and proceeds to step S7; Step S7, the HMI arbitration module determines whether the system state control rationality check flag confirms that the check has passed. If so, proceed to step S8, if not, proceed to step S9; Step S8, the HMI arbitration module outputs a takeover alarm signal of the main function module, and enters step S10; Step S9, the HMI arbitration module supplements the output of the takeover alarm signal and proceeds to step S10; Step S10, the HMI alarm module takes over the alarm; Step S11, the system continues to determine whether the vehicle has been taken over by the driver; if the vehicle has not been taken over, the system returns to step S10; if the vehicle has been taken over, the system proceeds to step S12; Step S12, the automatic driving system exits and stops sending the takeover alarm signal; Wherein: in step 2, the main function module updates the current system status in real time and places the identification bit at the corresponding address; the monitoring module reads data from the corresponding address as a conditional basis before judgment; The input signal of the monitoring module and the input signal of the main function module remain independent and do not interfere with each other, and the monitoring module and the main function module use different algorithms to judge and process the input signal.

2. The method for verifying the rationality of state control of an autonomous driving system based on functional safety according to claim 1, characterized in that: In step 2, all data are double-backed up by being stored in different address segments that are isolated from each other.

3. The method for verifying the rationality of state control of an automatic driving system based on functional safety according to claim 2, characterized in that: In step S10, different alarm levels are set according to different faults; when the signal fault affecting lateral control and longitudinal control is judged to be established, and the system is at risk of being uncontrollable in the lateral and longitudinal directions, a takeover alarm is immediately issued to request the driver to take over the vehicle; For other faults, a low-level takeover alarm signal is issued.

Images