An analysis method for unknown hazards of expected functional safety of vehicle digital twins based on Bayesian model

Abstract

The present invention proposes a method for analyzing unknown hazards of the expected functional safety of in-vehicle digital twins based on a Bayesian model, which includes four steps. Step 1: First, a digital twin of the autonomous driving vehicle to be evaluated is constructed using CARLA, and an autonomous driving scenario is constructed using CARLA, including a map, other traffic participants, etc. The twin scenario is repeatedly run, and the driving data of the vehicle to be evaluated and the probability of being exposed to risks are recorded; Step 2: A risk map is constructed based on the driving data of the vehicle to be evaluated, and the risk map is converted into a Bayesian risk map; Step 3: Based on the Bayesian risk map and combined with the Noisy-OR and Noisy-AND structures, a conditional probability table of triggering events of each node is calculated; Step 4: According to the conditional probability table obtained in step 3 and combined with the CVSS universal vulnerability scoring system, the expected functional safety with unknown triggering events is comprehensively evaluated, and a safety evaluation score is given.

Description

Technical Field

[0001] The present invention relates to the field of expected functional safety of autonomous driving technology, and in particular to a method for analyzing unknown hazards of the expected functional safety of vehicle-mounted digital twins based on a Bayesian model. Background Art

[0002] In safety of intended functions (SOTIF) risk assessments, the test scenarios constructed through hardware-in-the-loop (HIL) testing or vehicle road testing are limited, and therefore the test data obtained is also limited. Limited test data cannot address the unknown nature of certain triggering events in SOTIF. As a new simulation technology, digital twin technology creates a mirror image of the physical vehicle based on the virtual world, called a digital twin. Digital twins have three characteristics: full lifecycle, real-time, and scalability. Performing safety of intended functions risk assessments based on digital twins can break through the limitations of traditional scenarios and can change the weather, road conditions, and traffic participant status at any time. It can effectively reproduce risk scenarios, discover unknown risk scenarios, and record test data at a low cost.

[0003] The Bayesian network contains the probability of risk occurring at each node. Based on the driving data and risk occurrence recorded by the digital twin model, the conditional probability table of the Bayesian network can be calculated to conduct a risk assessment of the expected functional safety. Summary of the Invention

[0004] This paper proposes a Bayesian model-based method for analyzing unknown hazards of the expected functional safety of vehicle digital twins, which specifically includes the following four steps:

[0005] Step 1: Build a digital twin scenario. The first step is to use the CARLA simulator to build a digital twin of the autonomous driving vehicle to be evaluated, and use the CARLA simulator to simulate the digital twin scenario of autonomous driving, including maps, other traffic participants, etc. The digital twin runs on a predefined map, and uses the scenario generation tool in the CARLA simulator to dynamically adjust environmental factors such as weather, roads, and light to create dangerous scenarios. Use the CARLA simulator recorder tool to record all traffic participants in the simulation process, including vehicles, pedestrians, traffic lights, etc., run the twin scenario at least once, and use the Python API to output the simulation data of the vehicle to be evaluated during operation, record the driving data of the vehicle to be evaluated, and the probability of being exposed to risks, that is, the risk trigger probability;

[0006] Step 2: Construct a Bayesian risk map. First, construct a risk map based on the driving simulation data of the vehicle to be evaluated recorded in Step 1. Add the risk trigger probability to the risk map to convert it into a Bayesian risk map.

[0007] Step 3: Calculate the conditional probability table. In the Bayesian risk graph, the topology, connectivity, accessibility, and vulnerability of the triggering events can be analyzed. Although the probability of the post-triggering event is not considered when the pre-triggering event is not triggered, the state of each triggering event is independent, so the state of the pre-triggering event does not affect the state of the post-triggering event. Based on this characteristic, the prior probability table and conditional probability table of the Bayesian risk graph are calculated based on the risk triggering probability calculated in step 1 and combined with the Noisy-OR and Noisy-AND models to consider unknown risks.

[0008] Step 4: Comprehensively assess the safety of the intended function. In the actual data model of the digital twin, sequence structures, OR structures, and AND structures are often intertwined, ultimately leading to danger. When conducting a hazard assessment, in addition to considering the conditional probability of each single unknown triggering event based on the conditional probability table derived in Step 3 and the CVSS Common Vulnerability Scoring System, it is also necessary to integrate sequence structures, OR structures, and AND structures to comprehensively assess the safety of the intended function with unknown triggering events (SOTIF). This will determine the probability of the hazard ultimately occurring and provide a safety evaluation score.

[0009] In step 1, during the twin creation process, a self-driving vehicle was built, equipped with sensors such as an RGB camera, lidar, radar, and collision detectors. During the simulation, the number of other autonomous vehicles and weather conditions in the generated environment were varied to generate more data for simulations in different environments.

[0010] In step 2, the risk graph is constructed. The risk graph is a binary group HG = (T∪C, R r ∪R i ), where T = T′∪T″, C = C′∪C″, T∪C is the vertex set, R r ∪R i is an edge set. For each triggering event t, R r and R i are called preconditions and postconditions related to t, using the function pre: T→2 C and post: T→2 C Representation. Where, R_r=R_r′∪{(c, t)|t∈T″∧c∈pre(t)}, R_i=R_i′∪{(t, c)|t∈T″∧c∈post(t)}.

[0011] In step 2, the Bayesian risk graph is a four-tuple BHG=(A pre ∪A post , t, τ, P), where A pre ∪A postis the set of conditional nodes in BHG, t is the set of triggering events, τ represents the set of directed edges and conditional dependencies in BHG, and P is the local conditional probability function of a set of nodes.

[0012] In step 2, the risk graph is converted into a Bayesian risk graph process, each precondition is found, and the triggering event and all postconditions corresponding to the precondition and other preconditions corresponding to this triggering event are merged into one attribute. Each initial triggering event in the BHG is triggered independently. In order to calculate the conditional probability table of all nodes (hazard sequences) in the Bayesian risk graph, the hazard sequences of different initial triggering events can be separated to form different sub-BHGs. Eliminate OR structures. When splitting BHG, it is necessary to separate all OR structures to form independent sub-BHGs.

[0013] In step 3, the probability calculation, the probability distribution of any triggering event state can be modeled as a Bernoulli distribution. Assume that the state when the triggering event is t i =1, the state when not triggered is t i = 0. Therefore, when the probability of triggering an event is Pr(t i =1) = p, the probability that the trigger event is not triggered is Pr(t i =0) = 1-p, where p∈[0,1]. Therefore, it is necessary to calculate and evaluate the trigger probability of an unknown trigger event based on the prior probability of a known trigger event. Assuming that e is the prior probability of a known trigger event and T is all trigger events in the BHG, the trigger probability of an unknown trigger event is

[0014] In step 3, the prior probability table can be used to calculate the prior probability P(t i ). Using the basic score measurement method of CVSS, we can establish a conditional probability table for trigger events known in the system, and the prior probability of the trigger event is recorded as

[0015] In step 3, the conditional probability table is in the Bayesian network. For child node Y, its parent node set X has N parent nodes x1, x2, ..., x n , then N independent conditional probability parameters are required, that is, Y = P(x1, x2, ..., x n ). The calculation methods of conditional probabilities of nodes with different structures in Bayesian networks can be divided into three categories: sequence structure, OR structure and AND structure.

[0016] In step 3, the sequence structure conditional probability calculation method is: under the sequence structure, the unknown trigger event e u The conditional probability of where e pa Indicates the parent trigger event of the trigger event, P(e pa ) represents the triggering probability of the parent triggering event, P(e u e pa ) represents the risk probability based on previous test data, which can be p data .

[0017] In step 3, the conditional probability of the OR structure is calculated as follows: in

[0018] In step 3, the AND structure conditional probability is calculated as follows: Where L represents an unknown trigger event.

[0019] In step 4, the comprehensive assessment of expected functional safety is carried out. During the operation of the autonomous vehicle, the interactions and data flows between the vehicle's electronic and electrical components, autonomous driving system components, and other components have a sequence structure. OR structures and AND structures are often intertwined, and ultimately lead to danger. When conducting risk assessment, in addition to referring to the conditional probability of each single unknown trigger event, it is also necessary to integrate the sequence structure, OR structure, and AND structure to give the probability of the danger eventually occurring. In the comprehensive case, the SOTIF risk assessment score of the advanced driver assistance system (ADAS system) can be expressed as:

[0020] The beneficial effects of the present invention are as follows: the present invention establishes a Bayesian risk graph with attributes based on the system structure and known triggering events. In the Bayesian risk graph with attributes, the existence of unknown triggering events is set in the node attributes, and the unknown risks are considered in the SOTIF evaluation, and the Bayesian principle is used to design a SOTIF evaluation algorithm based on the Bayesian risk graph. The algorithm uses the structure of the Bayesian risk graph with attributes, the known triggering events in the node attributes, the safety scores corresponding to the known triggering events obtained by CVSS, the Noisy-OR and Noisy-AND structures to comprehensively evaluate the SOTIF with the dangerousness of unknown triggering events, and give a safety evaluation score. CARLA is used to build a vehicle digital twin, and the Python API in CARLA is used to change the status of weather and other traffic participants to build an autonomous driving test scenario, and cover complex scenarios that are difficult to achieve with physical vehicles. The recorded digital twin data is sorted and imported into the SOTIF evaluation algorithm to verify the effectiveness of the evaluation algorithm proposed by the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 It is a flow chart of the safety assessment of the present invention.

[0022] Figure 2 This is an example diagram of converting the risk map of the present invention into a Bayesian risk map.

[0023] Figure 3 This is an example diagram of the digital twin created by the present invention. DETAILED DESCRIPTION

[0024] The invention is further described in detail with reference to the following specific examples and accompanying drawings. The processes, conditions, experimental methods, etc. for implementing the present invention, except for those specifically mentioned below, are common knowledge and common common sense in the art and are not particularly limited by the present invention.

[0025] Figure 1 As shown in [1], a Bayesian model-based method for analyzing unknown hazards in the intended functional safety of an in-vehicle digital twin is divided into four steps: Step 1: Constructing a digital twin scenario. The CARLA simulator was used to simulate the digital twin scenario for autonomous driving. The digital twin was run on a predefined map. The scenario generation tool in CARLA dynamically adjusted weather and other environmental factors to create hazardous scenarios. The simulator recorder tool recorded all traffic participants during the simulation, including vehicles and traffic lights, and a Python API was used to output simulation data for a specified vehicle. Step 2: Constructing a Bayesian risk map. First, a risk map was constructed based on the simulation data recorded in Step 1. The risk probability was added to the risk map to convert it into a Bayesian risk map. Step 3: Calculating the conditional probability table. The Bayesian risk map can be used to analyze the topology, connectivity, accessibility, and vulnerability of the triggering events. Although the probability of post-triggering events is not considered when the pre-triggering event is not triggered, the status of each triggering event is independent, so the status of the pre-triggering event does not affect the status of the post-triggering event. Based on this characteristic, the prior probability table and conditional probability table of the Bayesian risk graph are calculated based on the risk triggering probability calculated in step 1 and the Noisy-OR and Noisy-AND models, taking into account unknown risks. Step 4: Comprehensively evaluate the expected functional safety. In the actual data model of the digital twin, sequence structures, OR structures, and AND structures are often intertwined, ultimately leading to danger. When conducting a risk assessment, in addition to considering the conditional probability of each single unknown triggering event, it is also necessary to integrate the sequence structure, OR structure, and AND structure to determine the probability of the hazard's eventual occurrence.

[0026] Figure 1As shown in Figure 1, in step 1, during the creation of the twin, an autonomous vehicle is built and equipped with sensors such as an RGB camera, lidar, radar, and collision detectors. In simulation, the number of other autonomous vehicles in the generated environment and the weather conditions are varied multiple times to generate more data for simulations in different environments.

[0027] Figure 1 As shown in , in step 2, the risk graph is constructed. The risk graph is a two-tuple HG = (T∪C, R r ∪R i ), where T = T′∪T″, C = C′∪C″, T∪C is the vertex set, R r ∪R i is an edge set. For each triggering event t, R r and R i are called preconditions and postconditions related to t, using the function pre: T→2 C and post: T→2 C Representation. Where, R_r=R_r′∪{(c, t)|t∈T″∧c∈pre(t)}, R_i=R_i′∪{(t, c)|t∈T″∧c∈post(t)}.

[0028] Figure 1 As shown in, in step 2, the Bayesian risk graph is a four-tuple BHG=(A pre ∪A post , t, τ, P), where A pre ∪A post is the set of conditional nodes in BHG, t is the set of triggering events, τ represents the set of directed edges and conditional dependencies in BHG, and P is the local conditional probability function of a set of nodes.

[0029] Figure 1 As shown in , in step 2, the risk graph is converted to a Bayesian risk graph process, which searches for each precondition and merges the triggering event, all postconditions corresponding to the precondition, and other preconditions corresponding to the triggering event into a single attribute. Each initial triggering event in the BHG is independently triggered. To calculate the conditional probability table for the risk sequence, the risk sequences of different initial triggering events can be separated to form different sub-BHGs. To eliminate OR structures, when splitting a BHG, it is necessary to separate all OR structures to form independent sub-BHGs.

[0030] Figure 1 As shown in , in step 3, the probability calculation, the probability distribution of any triggering event state can be modeled as a Bernoulli distribution. Assume that the state at the time of the triggering event is t i =1, the state when not triggered is t i= 0. Therefore, when the probability of triggering an event is Pr(t i =1) = p, the probability that the trigger event is not triggered is Pr(t i =0) = 1-p, where p∈[0,1]. Therefore, it is necessary to calculate and evaluate the trigger probability of an unknown trigger event based on the prior probability of a known trigger event. Assuming that e is the prior probability of a known trigger event and T is all trigger events in the BHG, the trigger probability of an unknown trigger event is

[0031] Figure 1 As shown in , in step 3, the prior probability table, for a known trigger event, can be used to calculate the prior probability P(t i ). Using the basic score measurement method of CVSS, we can establish a conditional probability table for trigger events known in the system, and the prior probability of the trigger event is recorded as

[0032] Figure 1 As shown in , in step 3, the conditional probability table, in the Bayesian network, for child node Y, its parent node set X has N parent nodes x1, x2, ..., x n , then N independent conditional probability parameters are required, that is, Y = P(x1, x2, ..., x n ). The calculation methods of conditional probabilities of nodes with different structures in Bayesian networks can be divided into three categories: sequence structure, OR structure and AND structure.

[0033] Figure 1 As shown in , in step 3, the sequence structure conditional probability calculation method is: under the sequence structure, the unknown trigger event e u The conditional probability of where e pa Indicates the parent trigger event of the trigger event, P(e pa ) represents the triggering probability of the parent triggering event, P(e u e pa ) represents the risk probability based on previous test data, which can be p data .

[0034] Figure 1 As shown in , in step 3, the OR structure conditional probability is calculated as follows: in

[0035] In step 3, the AND structure conditional probability is calculated as follows: Where L represents an unknown trigger event.

[0036] Figure 1 As shown in , in step 4, the comprehensive assessment of expected functional safety is carried out. During the operation of an autonomous vehicle, the interactions between components and the data flow have a sequence structure. OR structures and AND structures are often intertwined, and ultimately lead to danger. When conducting risk assessment, in addition to referring to the conditional probability of each single unknown trigger event, it is also necessary to integrate the sequence structure, OR structure, and AND structure to give the probability of the danger eventually occurring. In the comprehensive case, the SOTIF risk assessment score of the ADAS system can be expressed as:

[0037] The protection content of the present invention is not limited to the above embodiments. Without departing from the spirit and scope of the inventive concept, changes and advantages that can be thought of by those skilled in the art are included in the present invention and are protected by the appended claims.

Claims

1. A Bayesian model-based unknown hazard analysis method for the expected functional safety of vehicle digital twins, characterized by: The following steps are involved: Step 1: Build a digital twin scenario: Use the CARLA simulator to build a digital twin of the autonomous driving vehicle to be evaluated, and use the CARLA simulator to simulate the digital twin scenario of autonomous driving. The digital twin runs on a predefined map. Use the scenario generation tool in the CARLA simulator to dynamically adjust environmental factors to create dangerous scenarios. Use the CARLA simulator recorder tool to record all traffic participants during the simulation. Run the twin scenario at least once and use the Python API to output the simulated driving data of the vehicle to be evaluated during operation. Record the driving data of the vehicle to be evaluated and the risk trigger probability. Step 2: Construct a Bayesian risk map: Based on the driving simulation data of the vehicle to be evaluated recorded in step 1, construct a risk map, and add the risk occurrence probability to the risk map to convert it into a Bayesian risk map; Step 3: Calculate the conditional probability table: In the Bayesian risk graph, analyze the topology, connectivity, accessibility, and vulnerability of the triggering events. Although the probability of the post-triggering event is not considered when the pre-triggering event is not triggered, the state of each triggering event is independent. Therefore, the state of the pre-triggering event does not affect the state of the post-triggering event. Based on this characteristic, the prior probability table and conditional probability table of the Bayesian risk graph are calculated based on the risk triggering probability calculated in step 1 and combined with the Noisy-OR and Noisy-AND models to consider unknown risks. Step 4: Comprehensively evaluate the expected functional safety: In the actual data model of the digital twin, sequence structures, OR structures, and AND structures are intertwined, ultimately leading to danger; When conducting a hazard assessment, in addition to referring to the conditional probability of each single unknown triggering event, it is also necessary to integrate the sequence structure, OR structure, and AND structure to comprehensively evaluate the expected functional safety with unknown triggering events in order to give the probability of the hazard ultimately occurring and provide a safety evaluation score.

2. The Bayesian model-based unknown hazard analysis method for expected functional safety of vehicle-mounted digital twins according to claim 1 is characterized in that: In step 1, in creating a twin, an autonomous vehicle is built and equipped with sensors; in simulation, the number of other autonomous vehicles and weather conditions in the generated environment are changed at least once to output data for simulations in different environments; The digital twin scenario includes maps and other traffic participants; The sensors include RGB cameras, lidar, radar, and collision detectors; The traffic participants include vehicles, pedestrians and traffic lights; The environmental factors include weather, roads, and light; The risk trigger probability refers to the probability that the vehicle to be assessed is exposed to risk.

3. The Bayesian model-based vehicle digital twin expected functional safety unknown hazard analysis method according to claim 1 is characterized in that: In step 2, the risk graph is constructed. The risk graph is a binary group HG = (T∪C, R r ∪R i ), where T=T'∪T", C=C'∪C", T∪C is the vertex set, R r ∪R i is an edge set; for each triggering event t, R r and R i are called preconditions and postconditions related to t, using the function pre:T→2 C and post:T→2 C Representation; where, R_r=R_r'∪{(c,t)|t∈T”∧c∈pre(t)}, R_i=R_i'∪{(t,c)|t∈T”∧c∈post(t)}.

4. The Bayesian model-based vehicle digital twin expected functional safety unknown hazard analysis method according to claim 1 is characterized in that: In step 2, the Bayesian risk graph is a four-tuple BHG=(A pre ∪A post ,t,τ,P), where A pre ∪A post is the set of conditional nodes in BHG, t is the set of triggering events, τ represents the set of directed edges and conditional dependencies in BHG, and P is the local conditional probability function of a set of nodes.

5. The Bayesian model-based vehicle digital twin expected functional safety unknown hazard analysis method according to claim 1 is characterized in that: In step 2, the process of converting the risk graph into a Bayesian risk graph includes: searching for each precondition and merging the triggering event and all postconditions corresponding to the precondition and other preconditions corresponding to the triggering event into one attribute; each initial triggering event in the BHG is triggered independently; in order to calculate the conditional probability table of all nodes in the Bayesian risk graph, the risk sequences of different initial triggering events are separated to form different sub-BHGs; and OR structures are eliminated. When splitting the BHG, all OR structures are separated to form independent sub-BHGs.

6. The Bayesian model-based vehicle digital twin expected functional safety unknown hazard analysis method according to claim 1 is characterized in that: In step 3, the probability calculation, the probability distribution of any triggering event state can be modeled as a Bernoulli distribution; assuming that the state at the time of the triggering event is t i =1, the state when not triggered is t i =0; Therefore, when the probability of triggering an event is Pr(t i =1) = p, the probability that the trigger event is not triggered is Pr(t i =0)=1-p, where p∈[0,1]; therefore, the trigger probability of the unknown trigger event is calculated and evaluated based on the prior probability of the known trigger event; Assume that e is the prior probability of a known trigger event and T is all trigger events in BHG, then the trigger probability of an unknown trigger event is 7. The Bayesian model-based vehicle digital twin expected functional safety unknown hazard analysis method according to claim 1 is characterized in that: In step 3, the prior probability table refers to the calculation of the prior probability P(t i ); Using the basic score measurement method of CVSS, a conditional probability table of trigger events is established for the known trigger events in the system, and the prior probability of the trigger event is recorded as 8. The Bayesian model-based vehicle digital twin expected functional safety unknown hazard analysis method according to claim 1 is characterized in that: In step 3, the conditional probability table means that in the Bayesian network, for a child node Y, its parent node set X has N parent nodes x1, x2, ..., x n , then N independent conditional probability parameters are required, that is, Y = P(x1, x2, ..., x n ); The calculation methods of conditional probabilities of nodes with different structures in Bayesian networks can be divided into three categories: sequence structure, OR structure and AND structure; The calculation method of the sequence structure conditional probability is: Under the sequence structure, the unknown trigger event e u The conditional probability of where e pa Indicates the parent trigger event of the trigger event, P(e pa ) represents the triggering probability of the parent triggering event, P(e u e pa ) represents the risk probability based on previous test data, which is p data ; The conditional probability calculation method of the OR structure is: in The AND structure conditional probability calculation method is: Where L represents an unknown trigger event.

9. The Bayesian model-based vehicle digital twin expected functional safety unknown hazard analysis method according to claim 1 is characterized in that: In step 4, the comprehensive assessment of expected functional safety is carried out. During the operation of the autonomous vehicle, the interactions between components and the data flow have a sequence structure, and the OR structure and the AND structure are intertwined, which eventually lead to the occurrence of danger. When conducting risk assessment, in addition to referring to the conditional probability of each single unknown trigger event, it is also necessary to integrate the sequence structure, OR structure and AND structure to give the probability of the danger eventually occurring. In the comprehensive case, the SOTIF risk assessment score of the ADAS system can be expressed as:

Images