A design method and device for automotive communication middleware DDS

Abstract

The present invention discloses a design method and device for automotive communication middleware DDS, which relates to the field of automotive communication, including: determining the functional anomalies that occur in the DDS communication middleware during vehicle communication, and the hazardous events caused by the functional anomalies; conducting risk assessment on the hazardous events caused by the functional anomalies, and determining the highest risk level of the hazardous events caused by the functional anomalies; if the system needs to be analyzed according to the functional safety standard according to the highest risk level, the functional anomalies are classified according to the functional type to obtain various functional anomalies, and the top-level security requirements of various functional anomalies are determined; based on the top-level security requirements and various functional anomalies, a security mechanism is formulated, and the security state that the DDS communication middleware enters when various functional anomalies are detected is determined; based on the security mechanism and the security state, the design of the DDS communication middleware that meets the functional safety requirements is completed. By applying the technical solution of the present application, it can be ensured that the designed DDS communication middleware meets the functional safety requirements.

Description

Technical Field

[0001] The present invention relates to the field of automobile communication, and in particular to a design method and device for automobile communication middleware DDS. Background Art

[0002] In intelligent connected vehicles, the amount of information received and processed by the vehicles far exceeds that of traditional vehicles. In order to achieve fast communication between nodes, various manufacturers have begun to deploy DDS (Data Distribution Service) communication middleware in vehicles.

[0003] Currently, existing technologies focus more on deploying DDS communication middleware in the electronic / electrical system of the vehicle to control, manage and optimize the data flow transmitted in the network. However, once the DDS communication middleware malfunctions, the vehicle data will not be able to interact correctly, thus causing uncontrollable vehicle risks. Summary of the invention

[0004] The present invention provides a design method and device for automotive communication middleware DDS, which are mainly capable of ensuring that the designed DDS communication middleware meets functional safety requirements, thereby being able to control risks within a reasonable range.

[0005] According to a first aspect of an embodiment of the present invention, a design method for a vehicle communication middleware DDS is provided, comprising:

[0006] Determine the functional anomalies of the DDS communication middleware during vehicle communication and the harmful events caused by the functional anomalies in different driving scenarios;

[0007] Performing risk assessment on hazardous events caused by the functional abnormality in different driving scenarios to determine the highest risk level of hazardous events caused by the functional abnormality;

[0008] If it is determined according to the highest risk level that the system needs to be analyzed according to the functional safety standard, the functional anomalies are classified according to the functional type to obtain various functional anomalies, and the top-level safety requirements corresponding to the various functional anomalies are determined;

[0009] Based on the top-level security requirements and the various functional anomalies, formulate corresponding security mechanisms, and determine the security state that the DDS communication middleware enters when the various functional anomalies are detected;

[0010] Based on the safety mechanism and the safety status, the design of DDS communication middleware that meets the functional safety requirements is completed.

[0011] According to a second aspect of an embodiment of the present invention, a design device for a vehicle communication middleware DDS is provided, comprising:

[0012] A determination unit, used to determine functional anomalies of the DDS communication middleware during vehicle communication, and harmful events caused by the functional anomalies in different driving scenarios;

[0013] An evaluation unit, configured to perform risk evaluation on hazardous events caused by the functional abnormality in different driving scenarios, and determine the highest risk level of the hazardous events caused by the functional abnormality;

[0014] The determining unit is further configured to classify the functional anomalies according to functional types to obtain various functional anomalies, and determine top-level safety requirements corresponding to the various functional anomalies if it is determined according to the highest risk level that the system needs to be analyzed according to the functional safety standard;

[0015] A formulation unit, configured to formulate a corresponding security mechanism based on the top-level security requirements and the various functional anomalies, and determine a security state that the DDS communication middleware enters when the various functional anomalies are detected;

[0016] The design unit is used to complete the design of DDS communication middleware that meets the functional safety requirements based on the safety mechanism and the safety state.

[0017] According to a third aspect of an embodiment of the present invention, there is provided a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the following steps:

[0018] Determine the functional anomalies of the DDS communication middleware during vehicle communication and the harmful events caused by the functional anomalies in different driving scenarios;

[0019] Performing risk assessment on hazardous events caused by the functional abnormality in different driving scenarios to determine the highest risk level of hazardous events caused by the functional abnormality;

[0020] If it is determined according to the highest risk level that the system needs to be analyzed according to the functional safety standard, the functional anomalies are classified according to the functional type to obtain various functional anomalies, and the top-level safety requirements corresponding to the various functional anomalies are determined;

[0021] Based on the top-level security requirements and the various functional anomalies, formulate corresponding security mechanisms, and determine the security state that the DDS communication middleware enters when the various functional anomalies are detected;

[0022] Based on the safety mechanism and the safety status, the design of DDS communication middleware that meets the functional safety requirements is completed.

[0023] According to a fourth aspect of an embodiment of the present invention, there is provided an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the following steps are implemented:

[0024] Determine the functional anomalies of the DDS communication middleware during vehicle communication and the harmful events caused by the functional anomalies in different driving scenarios;

[0025] Performing risk assessment on hazardous events caused by the functional abnormality in different driving scenarios to determine the highest risk level of hazardous events caused by the functional abnormality;

[0026] If it is determined according to the highest risk level that the system needs to be analyzed according to the functional safety standard, the functional anomalies are classified according to the functional type to obtain various functional anomalies, and the top-level safety requirements corresponding to the various functional anomalies are determined;

[0027] Based on the top-level security requirements and the various functional anomalies, formulate corresponding security mechanisms, and determine the security state that the DDS communication middleware enters when the various functional anomalies are detected;

[0028] Based on the safety mechanism and the safety status, the design of DDS communication middleware that meets the functional safety requirements is completed.

[0029] The innovative features of the embodiments of the present invention include:

[0030] 1. One of the innovations of the embodiment of the present invention is to use common errors in industrial communication to assume functional abnormalities of the DDS communication middleware.

[0031] 2. One of the innovations of the embodiment of the present invention is to perform functional safety analysis on assumed functional anomalies based on functional safety standards and propose a safety mechanism to ensure that the designed DDS communication middleware meets the functional safety requirements.

[0032] The present invention provides a design method and device for automotive communication middleware DDS. Compared with the prior art, the present invention can determine the functional anomalies of the DDS communication middleware during vehicle communication, as well as the hazardous events caused by the functional anomalies in different driving scenarios, and perform risk assessment on the hazardous events caused by the functional anomalies in different driving scenarios to determine the highest risk level of the hazardous events caused by the functional anomalies. If it is determined that the system needs to be analyzed according to the functional safety standard based on the highest risk level, the functional anomalies are classified according to the functional type to obtain various functional anomalies, and the top-level security requirements corresponding to the various functional anomalies are determined. At the same time, based on the top-level security requirements and the various functional anomalies, corresponding security mechanisms are formulated, and the security state that the DDS communication middleware enters when the various functional anomalies are detected is determined. Finally, based on the security mechanism and the security state, the design of the DDS communication middleware that meets the functional safety requirements is completed. It can be seen that the present invention assumes functional anomalies in the DDS communication process and conducts risk assessment on hazardous events caused by the functional anomalies. It can derive top-level security requirements for hazardous events with ASIL levels after risk assessment and propose corresponding security mechanisms, so that errors can be detected at the root and the communication middleware can be ensured to enter a safe state. The designed DDS communication middleware can meet the functional safety requirements and control risks within a reasonable range.

[0033] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0035] Figure 1 A schematic diagram of a design method flow of a vehicle communication middleware DDS provided by an embodiment of the present invention is shown;

[0036] Figure 2 A schematic diagram showing the structure of a design device for a vehicle communication middleware DDS provided by an embodiment of the present invention;

[0037] Figure 3A schematic diagram showing the structure of another design device for automotive communication middleware DDS provided by an embodiment of the present invention;

[0038] Figure 4 A schematic diagram of the physical structure of an electronic device provided by an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0039] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0040] It should be noted that the terms "including" and "having" and any variations thereof in the embodiments of the present invention and the accompanying drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device including a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products or devices.

[0041] In the prior art, once the DDS communication middleware malfunctions, vehicle data will not be able to interact correctly, thus causing uncontrollable vehicle risks.

[0042] In order to overcome the above defects, an embodiment of the present invention provides a design method of a vehicle communication middleware DDS, such as Figure 1 As shown, the method includes:

[0043] Step 101: Determine the functional anomalies of the DDS communication middleware during vehicle communication, and the hazardous events caused by the functional anomalies in different driving scenarios.

[0044] Among them, functional anomalies include corruption, accidental repetition, missequencing, loss, unacceptable delay, insertion, masquerade and addressing errors. Different driving scenarios include autonomous driving at high speed on the highway and the vehicle just starting.

[0045] The embodiment of the present invention is mainly applicable to the scenario of conceptual design of DDS communication middleware. The execution subject of the embodiment of the present invention is a device or equipment capable of conceptual design of DDS communication middleware based on the SEooC method.

[0046] For the embodiments of the present invention, in order to design a DDS communication middleware that meets the functional safety requirements, it is necessary to make assumptions about common functional anomalies of the DDS communication middleware. The assumed functional anomalies specifically include corruption, unexpected repetition, misordering, loss, unacceptable delay, insertion, spoofing, and addressing errors. Among them, corruption refers to the possibility that a message may be damaged due to errors within the bus communication participants, errors on the transmission medium, or message interference; accidental repetition refers to the possibility that an old, unupdated message is repeated at an incorrect time point due to errors or interference; out-of-sequence refers to the possibility that a predetermined sequence (such as natural numbers, time reference) associated with a specific source point message is incorrect due to errors or interference; loss refers to the possibility that a message or confirmation is not received due to errors or interference; unacceptable delay means that a message may be delayed beyond its allowed arrival window, for example, due to errors on the transmission medium, congested transmission routes, interference, or because the sender is in a delayed or denied service mode; insertion refers to the possibility that a message associated with an unexpected or unknown source point entity is received due to errors or interference; spoofing refers to the possibility that a message associated with an apparently valid source point entity is inserted due to errors or interference, so that a non-safety-related message may be received by a safety-related communication participant and processed as a safety-related message.

[0047] Furthermore, when the above-mentioned functional anomaly of the DDS communication middleware occurs, the vehicle will not be able to receive real data, so that the vehicle cannot correctly judge its situation, causing harm. In a specific driving scenario, such harm will directly cause a harmful event, causing damage to passengers in the vehicle and pedestrians outside the vehicle, that is, causing harmful consequences. For example, a specific driving scenario is that the vehicle is driving at high speed on a highway. At this time, if the above-mentioned functional anomaly of the DDS communication middleware occurs, the harm caused, the harmful event and the harmful consequences are shown in Table 1.

[0048] Table 1

[0049]

[0050]

[0051] Step 102: Perform risk assessment on hazardous events caused by the functional abnormality in different driving scenarios to determine the highest risk level of hazardous events caused by the functional abnormality.

[0052] For the embodiments of the present invention, after determining the hazardous events caused by functional abnormalities in different driving scenarios, risk assessment can be performed on the hazardous events caused by abnormal functions in different driving scenarios from three dimensions: severity, controllability, and exposure rate, to obtain the risk levels corresponding to each type of hazardous event. Then, based on the risk levels corresponding to each type of hazardous event, the highest risk level of the hazardous events caused by the functional abnormality can be determined.

[0053] It should be noted that since the DDS communication middleware designed in the embodiment of the present invention is oriented to the automotive industry, the entire vehicle includes many ECU units, and the harmful events caused by the same communication function abnormality in different ECU units are likely to be different, so the resulting risk levels are also different.

[0054] Step 103: If it is determined according to the highest risk level that the system needs to be analyzed according to the functional safety standard, the functional anomalies are classified according to the functional type to obtain various functional anomalies, and the top-level safety requirements corresponding to the various functional anomalies are determined.

[0055] For the embodiment of the present invention, if the highest risk level analyzed is QM, it means that the hazardous events caused by functional abnormalities are within an acceptable range, and no additional functional safety requirements are required to detect functional abnormalities, that is, no subsequent analysis is required according to functional safety standards; on the contrary, if the highest risk level analyzed is not QM, it is necessary to avoid the occurrence of hazardous events. At this time, the DDS communication middleware is required to detect functional abnormalities and control hazardous events within a reasonable range. If necessary, the functional safety abnormalities are classified and integrated, and the top-level safety requirements corresponding to the functional abnormalities are determined, as shown in Table 2.

[0056] Table 2

[0057]

[0058] Among them, data integrity refers to the fact that for security-related applications, data integrity guarantees should be provided to detect and handle data corruption caused by external errors or interference; sequence integrity refers to the fact that for security-related applications, sequence integrity guarantees should be provided to detect and handle hazardous events such as accidental duplication, misordering, loss and insertion; time integrity refers to the fact that for security-related applications, time integrity guarantees should be provided to detect and handle whether the delay of data is within a predefined range; source integrity refers to the fact that for security-related applications, source integrity guarantees should be provided to ensure that data is delivered to the correct communication participants and that the data comes from the correct source.

[0059] Step 104: Based on the top-level security requirements and the various functional anomalies, a corresponding security mechanism is formulated, and the security state that the DDS communication middleware enters when the various functional anomalies are detected is determined.

[0060] For the embodiment of the present invention, since the harmful event is caused by the functional anomaly of the DDS communication middleware, it is necessary to define a security mechanism to detect the assumed functional anomaly in the communication, so as to ensure the realization of the top-level requirements. At the same time, it is also necessary to set a corresponding security state for the functional anomaly, so that when the assumed functional anomaly in the communication is detected, the DDS communication middleware can enter a safe state, thereby controlling the harm caused by the harmful event within a reasonable range.

[0061] Step 105: Based on the security mechanism and the security state, complete the design of the DDS communication middleware that meets the functional safety requirements.

[0062] For an optional implementation of the present disclosure, the risk assessment of hazardous events caused by the functional abnormality in different driving scenarios and determining the highest risk level of hazardous events caused by the functional abnormality include: performing a risk assessment on hazardous events caused by the functional abnormality in different driving scenarios to obtain the risk level of hazardous events caused by the functional abnormality in different driving scenarios; and determining the highest risk level of hazardous events caused by the functional abnormality according to the risk level of hazardous events caused by the functional abnormality in different driving scenarios.

[0063] Furthermore, the risk assessment of the hazardous events caused by the functional abnormality in different driving scenarios is performed to obtain the risk level of the hazardous events caused by the functional abnormality in different driving scenarios, including: determining the severity of the hazardous event according to the hazardous consequences corresponding to the hazardous event; determining the controllability of the hazardous event according to the driver's control ability over the hazardous event when the hazardous event occurs; determining the exposure rate of the driving scenario when the hazardous event occurs; and determining the risk level corresponding to the hazardous event based on the severity, the controllability, and the exposure rate.

[0064] Specifically, after determining the hazardous events caused by abnormal functions in different driving scenarios, a risk assessment of the hazardous events is conducted from three dimensions: severity S, controllability C, and exposure rate E. The hazardous events are then classified based on the risk assessment results (SEC). If the same hazardous events have the same ASIL level, they can be merged; if the same hazardous events have different ASIL levels, subsequent analysis will be conducted based on the highest ASIL level.

[0065] Among them, severity includes four levels, namely S0, S1, S2 and S3, S0 represents no injury, S1 represents mild and moderate injury, S2 represents serious injury (with possibility of survival), S3 represents fatal injury; exposure rate includes four levels, namely E1, E2, E3 and E4, E1 represents very low probability, E2 represents low probability, E3 represents moderate probability, E4 represents high probability; controllability includes four levels, namely C0, C1, C2 and C3, C0 represents fully controllable, C1 represents simply controllable, C2 represents generally controllable, C3 represents very difficult to control.

[0066] Through this evaluation, we can obtain the levels of various types of hazardous events in the three dimensions of severity, controllability and exposure rate. Then, based on the levels of various types of hazardous events in these three dimensions, we can determine the final risk level corresponding to each type of hazardous event, as shown in Table 3. The risk levels include ASIL A, ASIL B, ASIL C, ASIL D and QM. Among them, ASILA, ASIL B, ASIL C, and ASIL D all mean that the risk of hazardous events is not within a reasonable range, and additional requirements are required to detect functional abnormalities, that is, subsequent analysis is required according to functional safety standards. ASIL D has the highest level and ASIL A has the lowest level. The higher the level, the greater the hazard; QM means that the risk of hazardous events is within a reasonable range.

[0067] Table 3

[0068]

[0069]

[0070] For example, when a vehicle encounters a hazardous event listed in Table 1 and Table 2 during autonomous driving, and the vehicle is often traveling on a highway, the exposure rate can be determined to be E4. If the driver does not participate in driving, the driver's controllability over the hazardous event is low, and the controllability can be determined to be C3. At the same time, the severity of the hazardous event to passengers and pedestrians can be determined to be S3. In this case, the risk level corresponding to the hazardous event can be determined to be ASIL D.

[0071] It should be noted that since the DDS communication middleware designed in the embodiment of the present invention is oriented to the automotive industry, the whole vehicle includes many ECU units, and the same communication function anomaly may cause different harmful events in different ECU units, so the resulting risk levels are also different. For example, for the vehicle body domain, if the same communication function anomaly occurs during the communication process, the harmful events caused are different from those in the autonomous driving domain, and different ASIL levels or QMs will be obtained through evaluation. Since the product designed in the embodiment of the present invention belongs to the communication middleware, it can be applied to any communication node (ECU) in the vehicle.

[0072] Furthermore, for the compatibility and safety of the product, the embodiment of the present invention will develop DDS communication middleware in accordance with the requirements of the highest level ASIL D in the functional safety standard, so it can meet the requirements of QM, ASIL D, ASIL C, ASIL B and ASIL A. In addition, since the top-level demand goal derived from this product is to detect functional anomalies in communication and control the hazards caused by hazardous events within a reasonable range, and this product is developed at the highest level, this product can be used as long as the functional anomaly assumed by this product is the same as the communication functional anomaly of any ECU in the vehicle.

[0073] For an optional implementation of the present disclosure, after analyzing the highest risk level of the hazardous event caused by the functional abnormality, it can be determined whether the system currently needs to perform subsequent analysis according to the functional safety standard based on the highest risk level. Based on this, the method also includes: if the highest risk level is the ASIL level, determining that the system currently needs additional requirements to detect or avoid functional safety abnormalities, that is, the system currently needs to perform subsequent analysis according to the functional safety standard; if the highest risk level is the QM level, determining that the system currently does not need to perform subsequent analysis according to the functional safety standard.

[0074] Specifically, if the highest risk level is any one of ASIL D, ASIL C, ASIL B and ASIL A, it means that the system currently needs to perform subsequent analysis based on the functional safety standards, that is, it is necessary to avoid the occurrence of hazardous events and control the risks within a reasonable range; if the highest risk level is the QM level, it means that the system currently does not need to perform subsequent analysis based on the functional safety standards.

[0075] For an optional implementation of the present disclosure, abnormal functions can be divided into four categories, wherein the first category of functional anomalies includes corruption, the second category of functional anomalies includes unacceptable delays, the third category of functional anomalies includes addressing errors, insertions and spoofing, and the fourth category of functional anomalies includes unexpected duplications, misorders, temporary losses and permanent losses. For each category of functional anomalies, top-level requirements can be derived and corresponding security mechanisms can be formulated. Based on this, the corresponding security mechanisms are formulated based on the top-level security requirements and the various types of functional anomalies, including: when the top-level security requirement is data integrity, the CRC checksums of the publisher and subscriber are calculated respectively. If the CRC checksum of the publisher is inconsistent with the CRC checksum of the subscriber, it is determined that the first category of functional anomalies has occurred, and the DDS communication middleware is controlled to enter a secure state; when the top-level security requirement is time integrity, the first time interval between messages continuously sent by the publisher and the second time interval between messages continuously received by the subscriber are detected respectively. If the first time interval or the second time interval is greater than the maximum If the time interval is too long, it is determined that the second type of functional anomaly has occurred, and the DDS communication middleware is controlled to enter a safe state; when the top-level security requirement is source integrity, the received data is detected based on the source identifier at the subscriber end. If the received data comes from an incorrect source, it is determined that the third type of functional anomaly has occurred, and the DDS communication middleware is controlled to enter a safe state; when the top-level security requirement is timing integrity, the subscriber end detects the data sent by the publisher based on the timestamp and sequence number. If the subscriber end does not receive the data in the correct timing, it is determined that the fourth type of functional anomaly has occurred, and the DDS communication middleware is controlled to enter a safe state.

[0076] The top-level security requirement corresponding to the first type of functional anomaly (error) is data integrity. When formulating a security mechanism for the first type of functional anomaly (error), the designed DDS communication middleware must ensure that the data on the publishing end and the subscribing end are consistent, and prevent data corruption during transmission, thereby ensuring data integrity. Specifically, the published data can be CRC-checked at the publishing end, and the CRC check code can be added to the data. The CRC check code is calculated for the received data in the same way at the subscribing end, and compared with the CRC check code at the publishing end. If the CRC check codes of the two are inconsistent, the DDS communication middleware reports the fault information to the user and waits for the user to handle it.

[0077] Furthermore, the top-level security requirement corresponding to the second type of functional anomaly (unacceptable delay) is time integrity. When formulating a security mechanism for the second type of functional anomaly (unacceptable delay), the designed DDS communication middleware must ensure that the publisher sends data within the deadline of each data cycle and the subscriber receives data within the deadline of each data cycle, preventing delays in sending and receiving data, thereby ensuring time integrity. Specifically, a timestamp can be added when the publisher publishes a message, that is, the time when the message is sent, and the maximum time interval between two consecutive messages is defined. After that, the publisher will detect the timestamp between consecutive messages. If the maximum time interval is exceeded, the DDS communication middleware will report the fault information to the user and wait for the user to process it. Similarly, a timestamp can be added when the subscriber receives a message, that is, the time when the message is received, and the maximum time interval between two consecutive messages is defined. After that, the subscriber will detect the timestamp between consecutive received messages. If the maximum time interval is exceeded, the DDS communication middleware will report the fault information to the user and wait for the user to process it.

[0078] Furthermore, the top-level security requirement corresponding to the third type of functional anomalies (addressing errors, insertions, and masquerades) is source integrity. When formulating security mechanisms for the third type of functional anomalies (addressing errors, insertions, and masquerades), the designed DDS communication middleware must ensure that all messages published by the publisher are received by the matching subscriber and are from the correct source, thereby ensuring source integrity. Specifically, at the publisher, a source identifier can be added to each piece of data to be published. At the subscriber, a source integrity check is performed on the received data based on the source identifier to ensure that the data comes from the correct source, thereby preventing vehicle hazards caused by addressing errors, masquerades, and insertions. If the subscriber finds that the received data comes from an unexpected source, the DDS communication middleware will report the fault information to the user and wait for the user to process it.

[0079] Furthermore, the top-level security requirement corresponding to the fourth type of functional anomaly (accidental duplication, misorder, temporary loss and permanent loss) is time sequence integrity. When formulating a security mechanism for the fourth type of functional anomaly (accidental duplication, misorder, temporary loss and permanent loss), the designed DDS communication middleware must ensure that all messages published by the publisher are received by the matching subscriber and received in the correct time sequence, thereby ensuring time sequence integrity. Specifically, at the publisher, a sequence number can be added to each piece of data to be published, and a sequence integrity check can be performed on the received data based on the sequence number at the subscriber to ensure that the order of the received data is consistent with the order published by the publisher, wherein the sequence number is generated in an arithmetic progression, the maximum value of the sequence number is the maximum value of the number of data sent each time, and the minimum value of the sequence number is 1. In addition, the timestamp added when the publisher publishes the message and the sequence number added when the message is published are incremented in the same direction, ensuring that the order of the sequence number is incremented in time. At the subscriber, a time sequence integrity check can be performed on the received data based on the timestamp and sequence number to ensure that the data is received in the correct time sequence, thereby preventing accidental duplication, misorder and loss. Among them, the loss can be divided into temporary loss and permanent loss. Temporary loss refers to packet loss during the transmission process, which can be retransmitted twice; permanent loss refers to packet loss at the publishing end, and the message cannot be retransmitted.

[0080] Furthermore, if the subscriber finds that there is a problem with the received data, and the problem is out of order, accidental duplication, or temporary loss, the DDS communication middleware can fix the fault by itself, that is, notify the publisher to resend the data, and do not report the error information to the user. If continuous resending of data does not work, the error information needs to be reported to the user. Furthermore, if the subscriber finds that there is a problem with the received data, and the problem is permanent loss, the DDS communication middleware will report the fault information to the user and wait for the user to handle it.

[0081] In an optional implementation of the present disclosure, the security state that the DDS communication middleware enters when the various types of functional anomalies are detected includes: when a misorder, unexpected duplication, or temporary loss occurs, the DDS communication middleware repairs itself; when corruption, delay, permanent loss, insertion, masquerade, or addressing error occurs, the DDS communication middleware reports the fault information to the user and waits for the user to process. It should be noted that if continuous resending of data does not work, it is necessary to report error information to the user. The top-level security requirements, security mechanisms, and security states formulated by the embodiments of the present invention are shown in the following table.

[0082] Table 4

[0083]

[0084]

[0085] In an optional implementation of the present disclosure, when integrating the designed DDS communication middleware into the client software, the customer needs to confirm the validity of the assumptions based on SEooC. Based on this, the method also includes: when integrating the DDS communication middleware into the client software, verifying whether the DDS communication middleware is consistent with the customer's needs. Specifically, when integrating the DDS communication middleware, it is necessary to confirm whether the functional safety anomalies assumed by the DDS communication middleware are consistent with the customer's needs, and whether the integration is performed in accordance with the requirements of the safety manual provided by the supplier. After integrating the DDS communication middleware, it is necessary to verify whether the DDS communication middleware is consistent with the customer's needs. If the above conditions are met, the integrated DDS communication middleware meets the functional safety requirements at this time.

[0086] An embodiment of the present invention provides a design method for an automotive communication middleware DDS. By assuming functional anomalies that occur during DDS communication and performing risk assessment on hazardous events caused by the functional anomalies, the method can derive top-level safety requirements for hazardous events with ASIL levels after risk assessment, and propose corresponding safety mechanisms, thereby detecting errors at the root and ensuring that the communication middleware enters a safe state. This enables the designed DDS communication middleware to meet functional safety requirements and control risks within a reasonable range.

[0087] Further, as Figure 1 The specific implementation of the present invention provides a design device for automotive communication middleware DDS, such as Figure 2 As shown, the device includes: a determination unit 31, an evaluation unit 32, a formulation unit 33 and a design unit 34.

[0088] The determination unit 31 may be used to determine functional anomalies of the DDS communication middleware during vehicle communication, and hazardous events caused by the functional anomalies in different driving scenarios.

[0089] The evaluation unit 32 may be used to perform risk evaluation on hazardous events caused by the functional abnormality in different driving scenarios, and determine the highest risk level of hazardous events caused by the functional abnormality.

[0090] The determination unit 31 may also be used to classify the functional anomalies according to functional types to obtain various functional anomalies if it is determined according to the highest risk level that the system needs to be analyzed according to the functional safety standard, and determine the top-level safety requirements corresponding to the various functional anomalies.

[0091] The formulation unit 33 may be used to formulate a corresponding security mechanism based on the top-level security requirements and the various functional anomalies, and determine the security state that the DDS communication middleware enters when the various functional anomalies are detected.

[0092] The design unit 34 may be used to complete the design of the DDS communication middleware that meets the functional safety requirements based on the safety mechanism and the safety status.

[0093] In a specific application scenario, the evaluation unit 32, such as Figure 3 As shown, it includes: an evaluation module 321 and a determination module 322.

[0094] The evaluation module 321 may be used to perform risk evaluation on hazardous events caused by the functional abnormality in different driving scenarios, and obtain risk levels of hazardous events caused by the functional abnormality in different driving scenarios.

[0095] The determination module 322 may be configured to determine the highest risk level of a hazardous event caused by the functional abnormality according to the risk level of the hazardous event caused by the functional abnormality in different driving scenarios.

[0096] Furthermore, the evaluation module 321 can be specifically used to determine the severity of the hazardous event based on the hazardous consequences corresponding to the hazardous event; determine the controllability of the hazardous event based on the driver's control ability over the hazardous event when the hazardous event occurs; determine the exposure rate of the driving scene when the hazardous event occurs; and determine the risk level corresponding to the hazardous event based on the severity, the controllability, and the exposure rate.

[0097] In a specific application scenario, the determination unit 31 can also be used to determine that if the highest risk level is the ASIL level, then the system currently needs to perform subsequent analysis according to the functional safety standard; if the highest risk level is the QM level, then the system currently does not need to perform subsequent analysis according to the functional safety standard.

[0098] In a specific application scenario, the various types of functional anomalies include a first type of functional anomaly, a second type of functional anomaly, a third type of functional anomaly and a fourth type of functional anomaly. The formulation unit 33 can be specifically used to calculate the CRC checksums of the publisher and the subscriber respectively when the top-level security requirement is data integrity. If the CRC checksum of the publisher is inconsistent with the CRC checksum of the subscriber, it is determined that the first type of functional anomaly has occurred, and the DDS communication middleware is controlled to enter a safe state, wherein the first type of functional anomaly includes corruption; when the top-level security requirement is time integrity, the first time interval between messages continuously sent by the publisher and the second time interval between messages continuously received by the subscriber are detected respectively. If the first time interval or the second time interval is greater than the maximum time interval, it is determined that the second type of functional anomaly has occurred. The DDS communication middleware is controlled to enter a safe state, wherein the second type of functional anomaly includes unacceptable delay; when the top-level security requirement is source integrity, the received data is detected based on the source identifier at the subscriber end. If the received data comes from an incorrect source, it is determined that the third type of functional anomaly has occurred, and the DDS communication middleware is controlled to enter a safe state, wherein the third type of functional anomaly includes addressing error, insertion, and masquerade; when the top-level security requirement is timing integrity, the subscriber end detects the data sent by the publisher based on the timestamp and sequence number. If the subscriber end does not receive the data in the correct timing, it is determined that the fourth type of functional anomaly has occurred, and the DDS communication middleware is controlled to enter a safe state, wherein the fourth type of functional anomaly includes accidental duplication, misorder, temporary loss, and permanent loss.

[0099] In specific application scenarios, the formulation unit 33 can also be used to enable the DDS communication middleware to repair itself when misordering, unexpected duplication, or temporary loss occurs; when corruption, delay, permanent loss, insertion, masquerade, or addressing error occurs, the DDS communication middleware reports the fault information to the user and waits for the user to process.

[0100] In a specific application scenario, the device further includes: a verification unit 35.

[0101] The verification unit 35 may be used to verify whether the DDS communication middleware is consistent with the customer's requirements when the DDS communication middleware is integrated into the customer software.

[0102] It should be noted that for other corresponding descriptions of the functional modules involved in the design device of the automotive communication middleware DDS provided in the embodiment of the present invention, reference can be made to Figure 1 The corresponding description of the method shown will not be repeated here.

[0103] Based on the above Figure 1 The method shown, accordingly, an embodiment of the present invention also provides a computer-readable storage medium, on which a computer program is stored, and when the program is executed by a processor, the following steps are implemented: determining the functional anomalies of the DDS communication middleware during vehicle communication, and the hazardous events caused by the functional anomalies in different driving scenarios; performing risk assessment on the hazardous events caused by the functional anomalies in different driving scenarios, and determining the highest risk level of the hazardous events caused by the functional anomalies; if it is determined according to the highest risk level that the system needs to be analyzed according to the functional safety standard, the functional anomalies are classified according to the functional type to obtain various types of functional anomalies, and the top-level security requirements corresponding to the various types of functional anomalies are determined; based on the top-level security requirements and the various types of functional anomalies, a corresponding security mechanism is formulated, and the security state that the DDS communication middleware enters when the various types of functional anomalies are detected is determined; based on the security mechanism and the security state, the design of the DDS communication middleware that meets the functional safety requirements is completed.

[0104] Based on the above Figure 1 The method shown and Figure 2 The embodiment of the device shown in the figure, the embodiment of the present invention also provides a physical structure diagram of an electronic device, such as Figure 4 As shown, the electronic device includes: a processor 41, a memory 42, and a computer program stored in the memory 42 and executable on the processor, wherein the memory 42 and the processor 41 are both arranged on a bus 43. When the processor 41 executes the program, the following steps are implemented: determining the functional anomalies of the DDS communication middleware during vehicle communication, and the hazardous events caused by the functional anomalies in different driving scenarios; conducting risk assessment on the hazardous events caused by the functional anomalies in different driving scenarios, and determining the highest risk level of the hazardous events caused by the functional anomalies; if it is determined according to the highest risk level that the system needs to be analyzed according to the functional safety standard, the functional anomalies are classified according to the functional type to obtain various types of functional anomalies, and the top-level security requirements corresponding to the various types of functional anomalies are determined; based on the top-level security requirements and the various types of functional anomalies, a corresponding security mechanism is formulated, and the security state entered by the DDS communication middleware when the various types of functional anomalies are detected is determined; based on the security mechanism and the security state, the design of the DDS communication middleware that meets the functional safety requirements is completed.

[0105] The embodiment of the present invention assumes functional anomalies that occur during the DDS communication process and performs risk assessment on hazardous events caused by the functional anomalies. It can derive top-level security requirements for hazardous events with ASIL levels after risk assessment and propose corresponding security mechanisms, so that errors can be detected at the root and the communication middleware can be ensured to enter a safe state. The designed DDS communication middleware can thus meet functional safety requirements and control risks within a reasonable range.

[0106] Those skilled in the art can understand that the accompanying drawings are only schematic diagrams of an embodiment, and the modules or processes in the accompanying drawings are not necessarily required to implement the present invention.

[0107] Those skilled in the art can understand that the modules in the device in the embodiment can be distributed in the device in the embodiment according to the description of the embodiment, or can be changed accordingly and located in one or more devices different from the embodiment. The modules in the above embodiment can be combined into one module, or can be further divided into multiple sub-modules.

[0108] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A design method for automotive communication middleware DDS, characterized in that: include: Determine the functional anomalies of the DDS communication middleware during vehicle communication and the harmful events caused by the functional anomalies in different driving scenarios; Performing risk assessment on hazardous events caused by the functional abnormality in different driving scenarios to determine the highest risk level of hazardous events caused by the functional abnormality; If it is determined according to the highest risk level that the system needs to be analyzed according to the functional safety standard, the functional anomalies are classified according to the functional type to obtain various functional anomalies, and the top-level safety requirements corresponding to the various functional anomalies are determined; Based on the top-level security requirements and the various functional anomalies, formulate corresponding security mechanisms, and determine the security state that the DDS communication middleware enters when the various functional anomalies are detected; Based on the safety mechanism and the safety status, the design of DDS communication middleware that meets the functional safety requirements is completed.

2. The method according to claim 1, characterized in that The risk assessment of the hazardous events caused by the functional abnormality in different driving scenarios to determine the highest risk level of the hazardous events caused by the functional abnormality includes: Performing risk assessment on hazardous events caused by the functional abnormality in different driving scenarios to obtain risk levels of hazardous events caused by the functional abnormality in different driving scenarios; According to the risk levels of hazardous events caused by the functional abnormality in different driving scenarios, the highest risk level of hazardous events caused by the functional abnormality is determined.

3. The method according to claim 2, characterized in that The risk assessment of the hazardous events caused by the functional abnormality in different driving scenarios to obtain the risk level of the hazardous events caused by the functional abnormality in different driving scenarios includes: Determine the severity of the hazardous event according to the hazardous consequences corresponding to the hazardous event; Determining the controllability of the hazardous event according to the driver's ability to control the hazardous event when the hazardous event occurs; Determine the exposure rate of the driving scenario when the hazardous event occurs; Based on the severity, the controllability, and the exposure rate, a risk level corresponding to the hazardous event is determined.

4. The method according to claim 2, characterized in that: The method further comprises: If the highest risk level is the ASIL level, determining that the system currently needs to be subsequently analyzed according to the functional safety standard; If the highest risk level is the QM level, it is determined that the system currently does not need to be subsequently analyzed according to the functional safety standard.

5. The method according to claim 1, characterized in that The various types of functional abnormalities include first type functional abnormalities, second type functional abnormalities, third type functional abnormalities and fourth type functional abnormalities. Based on the top-level security requirements and the various types of functional abnormalities, corresponding security mechanisms are formulated, including: When the top-level security requirement is data integrity, respectively calculating the CRC check codes of the publisher and the subscriber, if the CRC check code of the publisher is inconsistent with the CRC check code of the subscriber, determining that the first type of functional abnormality occurs, and controlling the DDS communication middleware to enter a safe state, wherein the first type of functional abnormality includes corruption; When the top-level security requirement is time integrity, respectively detecting a first time interval between messages continuously sent by the publisher and a second time interval between messages continuously received by the subscriber, if the first time interval or the second time interval is greater than a maximum time interval, determining that the second type of functional anomaly occurs, and controlling the DDS communication middleware to enter a safe state, wherein the second type of functional anomaly includes an unacceptable delay; When the top-level security requirement is source integrity, the received data is detected based on the source identifier at the subscriber end. If the received data comes from an incorrect source, it is determined that the third type of functional anomaly occurs, and the DDS communication middleware is controlled to enter a safe state, wherein the third type of functional anomaly includes addressing error, insertion, and masquerade; When the top-level security requirement is timing integrity, the subscriber detects the data sent by the publisher based on the timestamp and sequence number. If the subscriber does not receive the data in the correct timing, it is determined that a fourth type of functional anomaly has occurred, and the DDS communication middleware is controlled to enter a safe state, wherein the fourth type of functional anomaly includes accidental repetition, missequencing, temporary loss, and permanent loss.

6. The method according to claim 5, characterized in that The determining of the safe state that the DDS communication middleware enters when the various functional abnormalities are detected includes: When misordering, accidental duplication, or temporary loss occurs, the DDS communication middleware repairs itself; When corruption, delay, permanent loss, insertion, masquerade, or addressing error occurs, the DDS communication middleware reports the fault information to the user and waits for the user to process.

7. The method according to any one of claims 1 to 6, characterized in that: The method further comprises: When the DDS communication middleware is integrated into the client software, it is verified whether the DDS communication middleware is consistent with the client's requirements.

8. A design device for automotive communication middleware DDS, characterized in that: include: A determination unit, used to determine functional anomalies of the DDS communication middleware during vehicle communication, and harmful events caused by the functional anomalies in different driving scenarios; An evaluation unit, configured to perform risk evaluation on hazardous events caused by the functional abnormality in different driving scenarios, and determine the highest risk level of the hazardous events caused by the functional abnormality; The determining unit is further configured to classify the functional anomalies according to functional types to obtain various functional anomalies, and determine top-level safety requirements corresponding to the various functional anomalies if it is determined according to the highest risk level that the system needs to be analyzed according to the functional safety standard; A formulation unit, configured to formulate a corresponding security mechanism based on the top-level security requirements and the various functional anomalies, and determine a security state that the DDS communication middleware enters when the various functional anomalies are detected; The design unit is used to complete the design of DDS communication middleware that meets the functional safety requirements based on the safety mechanism and the safety state.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images