A method for verifying linkage between intelligent networked vehicle function safety and intended function safety

Abstract

The application discloses a kind of intelligent network connection car function safety and expected function safety linkage verification method, comprising: extracting intelligent network connection car control function item set, screening obtains the vehicle body control function item set F related to driving task, confirms potential abnormal mode set S;Filter out function item abnormal behavior, induce whole vehicle level hazard and accident;Confirm the integrity level and safety target of each element in F;Extract the vehicle body core control behavior of intelligent network connection car control level, clean up and obtain the control behavior set E related to current driving, confirm potential error mode set K;Screen unsafe control behavior, induce whole vehicle level hazard and safety constraint;Cause analysis is carried out to unsafe control behavior;With whole vehicle level hazard as anchor point, linkage function item abnormality and unsafe control behavior, carry out linkage verification.The application combines function safety and expected function safety, provides the evaluation method that latter is mapped to former, provides basis for safety strategy design.

Description

Technical Field

[0001] This invention belongs to the field of automotive safety technology, and in particular relates to a method for linking the functional safety and expected functional safety of intelligent connected vehicles for verification. Background Technology

[0002] With the development of autonomous driving technology and intelligent connected vehicles, ensuring vehicle safety remains paramount. Complex road conditions and ever-changing traffic environments mean that functional safety measures for vehicle electronic and electrical architecture are increasingly insufficient, giving rise to research on anticipated functional safety that focuses on design flaws and functional limitations. Anticipated functional safety analysis, assessment, and requirement output have become important research directions in vehicle safety. Summary of the Invention

[0003] To address the shortcomings of existing technologies, the present invention proposes a method for linking functional safety and expected functional safety verification in intelligent connected vehicles. Compared to expected functional safety, vehicle functional safety is more mature. By mapping unsafe behaviors defined under the expected functional safety research to functional item failures defined under functional safety, this method can improve the usability of safety assessment and reduce the difficulty of safety verification.

[0004] The usability of a security assessment refers to the effectiveness and completeness of the assessment results, reflecting the usability of the security assessment process.

[0005] Intelligent connected vehicles rely on functional items defined by the vehicle's electronic and electrical architecture to perform driving tasks. Some functional items unrelated to body control do not cause any impact, necessitating the selection of functional items based on their relevance to body control. Different functional item error patterns can lead to varying degrees of vehicle-level hazards, thus requiring the filtering of abnormal behaviors in driving scenarios. Next, the integrity level and corresponding safety objectives of the functional items are analyzed. For selected functional items, the vehicle-level hazards and safety constraints caused by their unsafe control behaviors are screened and evaluated, and the safety attribution under the expected functional safety definition is analyzed. Using vehicle-level hazards as an anchor point, a linkage verification method model is obtained.

[0006] This invention combines functional safety and expected functional safety, providing an evaluation method that maps the latter to the former, thus providing a basis for safety strategy design.

[0007] This invention achieves a method for verifying the expected functional safety and functional safety linkage of intelligent connected vehicles by adopting the following technical solutions:

[0008] Step 1: Extract the set of control function items under the electronic and electrical architecture of intelligent connected vehicles, clean up to obtain the set F of body control function items related to the current driving task, and identify the set S of potential abnormal modes of function items;

[0009] The cleanup refers to filtering all control function items under the electronic and electrical architecture of intelligent connected vehicles and removing function items that are irrelevant to the current driving task; the abnormal mode set S contains 6 elements, namely S1, S2, S3, S4, S5, and S6; where S1 indicates that the provided function item is greater than the value required to perform the driving task, S2 indicates that the provided function item is less than the value required to perform the driving task, S3 indicates that the provided function item is earlier than the required time point, S4 indicates that the provided function item is later than the required time point, S5 indicates that the required function is not provided, and S6 indicates that an unnecessary function is provided;

[0010] Step 2: Filter out abnormal behaviors of vehicle functions, summarize the corresponding vehicle-level hazards and accidents, and the specific steps are as follows:

[0011] Step 2.1: Take the Cartesian product of the set of body control functions F related to the current driving task and the set of potential abnormal patterns S to obtain the set of potential abnormal behavior functions U: U = F × S = {(F i ,S j )|i∈[1,|F|],j∈[1,6], where F is the set of vehicle control function items related to the current driving task, S is the set of potential abnormal patterns, and |F| represents the number of elements in set F; the potential abnormal behavior function set U refers to the set of functions with potential abnormalities, and the elements in this set may cause abnormalities in the vehicle control of the current driving task.

[0012] Step 2.2: Determine whether the elements in the abnormal behavior function set U in driving scenario P will cause vehicle-level hazards. The criterion is whether the vehicle behavior caused by the abnormal behavior belongs to vehicle-level hazards. For example, if the vehicle's active braking function fails, causing the vehicle to be unable to decelerate and brake, and the active braking system provides an unnecessary function that allows the vehicle to stop at an unnecessary time without causing actual harm, the abnormal behavior that will cause vehicle-level hazards will be classified into set R. Abnormal behaviors included in set R include, for example, active braking function failure, steering system providing unnecessary function, and power system providing more function than expected. The vehicle-level hazard mentioned in this step refers to when the abnormal behavior of vehicle functions causes physical injury to passengers or other human traffic participants, or when it collides with traffic participants or static facilities, causing physical damage. The occurrence of the above situations is considered to have vehicle-level hazards.

[0013] Step 2.3: The i-th element R in R i The corresponding vehicle-level hazard caused is denoted as M. k By combining the static snapshot in the current driving scenario P with the situation of other dynamic traffic participants, we can identify the corresponding accidents that the hazard may subsequently cause. A single combination of abnormal behaviors may correspond to multiple different accidents, and the accidents are added to the accident set H.

[0014] The static snapshot mentioned in this step refers to static elements in the geographic space around the vehicle, including road location, road surface conditions, obstacles, and weather conditions;

[0015] Step 3: Confirm the integrity level and safety objectives of each element in the set F of body control functions related to the current driving task. The specific steps are as follows:

[0016] Step 3.1: Based on the static snapshot in driving scenario P, the distribution of other traffic participants and vehicle physical states, and the domain knowledge of the step executor and the existing database, determine the probability of the driving scenario occurring. This step uses frequency as the measurement dimension, that is, the probability that unsafe behavior has occurred before or when entering the driving scenario. The probability of occurrence is divided into 5 levels from negligible to high probability (E0 negligible, E1 low, E2 low, E3 medium, E4 high), that is, E0 is almost impossible to occur, and E4 is relatively likely to occur.

[0017] Step 3.2: In driving scenario P, determine the level of hazard M for each vehicle level from the perspective of the driver inside the vehicle. j The level of controllability is divided into four levels, from fully controllable to uncontrollable (C0: all drivers can control the vehicle; C1: 99% of drivers can take over; C2: 90% of drivers can take over; C3: uncontrollable). The higher the level, the worse the controllability. In this step, it is assumed that the driver is of sound mind and has the corresponding driving ability, possesses a valid local driver's license, and is capable of taking over the autonomous vehicle. The percentage of drivers capable of taking over in this step is determined by combining the domain knowledge of the step executor with local accident data.

[0018] Step 3.3: Determine the severity of each accident in the accident set H. The determination is based on the degree of physical injury to passengers inside the vehicle and human traffic participants outside the vehicle. Combining the domain knowledge of the person performing this step, the vehicle speed and the accident scenario, the accident is divided into four levels from no injury to fatal injury (S0 no injury, S1 minor injury, S2 serious injury but not life-threatening, S3 fatal injury). The higher the level, the more serious the injury.

[0019] The physical injury assessment in this step follows the Simplified Injury Scale (AIS), where AIS 1 corresponds to no injury, AIS 2 and AIS 3 correspond to minor injury, AIS 4 corresponds to serious injury but not life-threatening, and AIS 5 and AIS 6 correspond to fatal injury.

[0020] Step 3.4: Based on the above three indicators (probability of occurrence of driving scenario, vehicle-level hazard M) j The degree of controllability and the degree of physical harm to passengers and other human traffic participants outside the vehicle in the accident are used to obtain the abnormality R of the t-th functional item under the driving scenario P.t The safety integrity level is determined, and safety objectives are proposed accordingly. These safety objectives refer to the safety requirements for vehicle functions, used to avoid vehicle-wide hazards, and are distinct from technical solutions. The safety objectives are expressed as functional purposes. The safety integrity level evaluation criteria are shown in Table 1, following the fixed implementation in standard ISO 26262. QM represents quality inspection, meaning no specific safety objective needs to be proposed. Safety integrity level requirements increase sequentially from A to D. For situations with a severity of injury of S0, a probability of occurrence of E0, or a controllability of C0, since they will not cause an accident or their probability is negligible, they do not need to appear in Table 1.

[0021] Table 1. Security Integrity Level Determination

[0022]

[0023] Step 3.5: Perform steps 3.1 to 3.4 on all elements in the set R of abnormal behaviors of functional items that can cause vehicle-wide hazards to obtain the safety target of each element in the set F of body control functional items related to the current driving task.

[0024] Step 4: Extract the core control behaviors of the intelligent connected vehicle control layer, clean up the control behaviors related to the current driving to obtain the set E, and confirm the error mode set K;

[0025] The cleanup refers to filtering all control behaviors under the control level of the intelligent connected vehicle and eliminating behaviors that do not affect the driving task; the error mode set K contains 6 elements, namely K1, K2, K3, K4, K5, and K6; where K1 indicates that an unnecessary control behavior is provided, K2 indicates that a necessary control behavior is not provided, K3 indicates that the control behavior is provided earlier than the required time point, K4 indicates that the control behavior is provided later than the required time point, K5 indicates that the control behavior provided does not meet the expected requirements, and K6 indicates that the control behavior provided exceeds the expected requirements;

[0026] Step 5: Filter unsafe control behaviors that affect driving tasks, and summarize vehicle-level hazards and safety constraints. The specific steps are as follows:

[0027] Step 5.1: Perform a Cartesian product on the set of control behaviors E and the set of error modes K related to the current driving to obtain the set of potential abnormal control behaviors V: V = E × K = {(E i ,K j)|i∈[1,|E|],j∈[1,6]}, where E represents the set of control behaviors related to the current driving task, K represents the set of error patterns of control behaviors, and |E| represents the number of elements in the set E; the potential abnormal control behavior set V refers to the set of control behaviors with potential abnormalities, and the elements in this set may cause abnormalities in the vehicle body control in the current driving task.

[0028] Step 5.2: Determine the i-th abnormal control behavior V in driving scenario P. i Will it cause damage to the entire vehicle? If it will cause damage, what abnormal control behavior will be implemented? i The j-th element of set W is included in the set W. j Corresponding vehicle-level hazard M k The set W contains anomalous behaviors such as outputting an excessively high expected speed, not outputting the expected speed, or failing to provide the required lateral body control; different anomalous control behaviors may correspond to the same vehicle-level hazard.

[0029] The criteria for determining whether a vehicle-level hazard exists are consistent with those in step 2.2; that is, situations in which unsafe vehicle control behavior causes physical injury to passengers or other human traffic participants, or causes physical damage by colliding with traffic participants or static facilities, are considered to constitute a vehicle-level hazard.

[0030] Step 5.3: Based on the current driving task and local traffic regulations, obtain the safety constraints violated by each unsafe control behavior in set W, and denote the set of safety constraints as CO;

[0031] The safety constraints mentioned in this step refer to the conditions and regulations that a vehicle must follow to safely perform its current driving task;

[0032] Step 5.4: Perform steps 5.2 to 5.3 on each element in the set of unsafe control behaviors W to obtain the vehicle-level hazards caused by all unsafe control behaviors and the safety constraints they violate.

[0033] Step 6: Perform causal analysis on non-functional item anomalies related to unsafe control behaviors. The specific steps are as follows:

[0034] Step 6.1: Based on the decision-making time point, the potential causes of unsafe control behavior are divided into three categories: CT 1 (accurate and necessary environmental data were not obtained before the decision), CT 2 (vehicle information was not obtained before the decision), and CT 3 (problems exist in the decision-making system itself).

[0035] Step 6.2: From the perspectives of poor perception, hardware limitations, transmission failures, and design defects, refine each cause category and assess the specific expected functional cause categories that lead to unsafe control behavior;

[0036] The perception failures mentioned in this step include the inability of the perception layer to accurately obtain necessary environmental data due to external environmental factors; hardware limitations, which refer to blind spots in the sensors installed on the vehicle; transmission failures, which refer to obstacles in data transmission between or within the vehicle's perception system, decision-making system, and execution system (such as a failure in the vehicle's transmission bus); and design defects, which refer to defects in the system's algorithm design or unreasonable internal parameter design.

[0037] The reasons for completing this step are: poor perception of the pre-decision cause and failure to obtain real and effective environmental data; hardware limitations of the pre-decision cause and failure to obtain real and effective vehicle information; transmission failure of the pre-decision cause and failure to obtain accurate environmental data; transmission failure of the pre-decision cause and failure of the decision system to obtain accurate vehicle information; decision result failure to be successfully transmitted to the vehicle execution system due to transmission failure; defective algorithm design of the decision system and making wrong decisions; unreasonable internal parameter design of the decision system and making wrong decisions.

[0038] Step 6.3: For each element in the set of unsafe control behaviors W, combine the control behavior and the corresponding safety constraints to identify the category of cause of the unsafe control behavior; combine the physical characteristics of the driving scenario P and the current driving task to identify the specific cause of the unsafe control behavior.

[0039] Step 7: Using vehicle-level hazards as the anchor point, verify the linkage between abnormal functional items and unsafe control behaviors. The specific steps are as follows:

[0040] Step 7.1: Match the elements in the functional item exception set R with the elements in the unsafe control behavior set W. If a specific functional item exception R... m The resulting vehicle safety hazards M i With specific unsafe control behaviors W n The overall vehicle safety hazards Mj are the same (i=j), that is, they form unsafe control behaviors R under the definition of expected functional safety. m Vehicle function item abnormality W n One-to-one mapping;

[0041] If a mapping cannot be formed, it means that the current function item and the extracted control behavior cannot match the unsafe control behavior R. m With functional item exception W n No further steps will be executed.

[0042] Step 7.2: Based on the function item exception R m The corresponding accident severity and safety objectives, combined with the mapping results from step 7.1, yield the corresponding unsafe control behavior W. n The severity of the accident and the safety objectives. Based on the integrity level in step 3.4, the corresponding unsafe control behavior W is obtained. nSafety constraint priority.

[0043] At this point, the method for verifying the expected functional safety of intelligent connected vehicles in conjunction with functional safety has been completed.

[0044] The present invention also provides an application of the above-mentioned linkage verification method in assessing the severity of unsafe control behaviors under the expected functional safety definition, providing an accident hierarchy reference, and forming a safety constraint priority.

[0045] The beneficial effects of this invention include:

[0046] The linkage verification method implemented in this invention is applicable to the requirements analysis stage of the design phase of intelligent connected vehicle systems. It is used to assess the severity of unsafe control behaviors under the expected functional safety definition, provide accident level reference, and form safety constraint priority.

[0047] Compared to traditional HARA analysis results that only consider functional safety, this invention expands the causes of vehicle-level hazards from the perspective of control behavior, extending from the safety of a single vehicle functional item to the abnormal hazards of non-functional items, which meets the expected functional safety requirements. Compared to the STPA analysis method, this invention combines safety integrity level to assess the hazard level of unsafe control behavior, which is in line with the pattern of designing safety strategies according to priorities in the requirements analysis phase.

[0048] This method, by considering vehicle-level hazards and integrating the advantages of existing safety assessment methods, constructs a linkage between existing expected functional safety and functional safety, thus filling the gaps in existing analysis methods. Attached Figure Description

[0049] Figure 1 This is a flowchart illustrating the method for linking functional safety and expected functional safety of intelligent connected vehicles according to the present invention. Detailed Implementation

[0050] The invention will be further described in detail below with reference to the specific embodiments and accompanying drawings. Except for the contents specifically mentioned below, the processes, conditions, and experimental methods for implementing the invention are all common knowledge and general knowledge in the art, and the invention does not have any particular limitations.

[0051] Example 1: Analysis of the linkage between functional safety and expected functional safety of intelligent connected vehicles in urban highway following-vehicle driving

[0052] This example illustrates a scenario where, during a clear day with high visibility, a flat, water-free surface, and no wind or light breeze, and without glare, an intelligent connected vehicle follows the vehicle in front at a limited speed on a straight, one-way urban road. The primary driving task in this scenario is to follow the vehicle in front and maintain a safe following distance.

[0053] The functional items under the vehicle's electronic and electrical architecture are filtered to obtain a set of functional items F related to the driving task (F1 represents the active braking system; F2 represents the lane keeping system; F3 represents the power system). Potential abnormal modes S of the functional items are identified (S1 indicates that the functional item is greater than the value required to perform the driving task, S2 indicates that the functional item is less than the value required to perform the driving task, S3 indicates that the functional item is earlier than the required time point, S4 indicates that the functional item is later than the required time point, S5 indicates that the required function is not provided, and S6 indicates that the unnecessary function is provided).

[0054] Taking the Cartesian product of the set of functional items F and the set of potential abnormal patterns S, we obtain the set of potential abnormal functions U: U = F × S = {(F i ,S j )|i∈[1,3],j∈[1,6], based on whether it will cause vehicle-level hazards, the potential abnormal function set is analyzed. The vehicle-level hazard set is denoted as M, and the accident set caused by the hazard is denoted as H. The results are shown in Table 2.

[0055] Table 2 Description of Functional Abnormalities, Vehicle-Level Hazards, and Accidents Related to Following Vehicle Driving

[0056]

[0057]

[0058] Intelligent connected vehicles frequently engage in following other vehicles on straight roads, therefore the probability of such an accident is assessed as E4. Based on vehicle speed and driving scenario, the overall vehicle-level hazards and the likelihood of accidents are analyzed. The analysis results and reasons are shown in Tables 3 and 4.

[0059] Table 3. Analysis of the controllability of following other vehicles.

[0060] Whole vehicle level hazards Controllability reason <![CDATA[The active braking speed of M1 is too slow]]> C2 Most drivers are able to quickly apply the brakes manually. <![CDATA[The braking distance of vehicle M2 is insufficient]]> C2 Most drivers are able to apply braking force manually. <![CDATA[The active braking function of M3 fails]]> C3 Most drivers are unable to handle brake failure. <![CDATA[Lateral yaw occurs in M4]]> C2 Most drivers are able to manually apply steering control. <![CDATA[The M5 vehicle is unable to adjust its course]]> C3 Most drivers are unable to handle lateral loss of control. <![CDATA[The speed of M6 is too high]]> C2 Most drivers can react by manually slowing down.

[0061] Table 4. Analysis of the severity of accidents involving following vehicles.

[0062]

[0063] Based on the three indicators, the ASIL level of the functional item abnormality was obtained, and the results are shown in Table 5:

[0064] Table 5 ASIL Levels for Abnormal Following Function Items

[0065]

[0066]

[0067] Based on the ASIL level, the following safety objectives are proposed for each function in this scenario: avoid the active braking system failing to provide the expected service (high priority); avoid the active braking system providing less or later than expected functions (relatively high priority); avoid the lane keeping system providing unnecessary functions, providing fewer or earlier than expected functions (extremely high priority); avoid the powertrain system providing more or more unnecessary functions (relatively high priority).

[0068] Filter the core control behaviors E (E1 outputs the expected speed, E2 controls the lateral displacement of the vehicle body) of the intelligent connected vehicle in this scenario, identify the potential abnormal modes K of the functional items (K1 indicates that the unnecessary control behavior is provided, K2 indicates that the necessary control behavior is not provided, K3 indicates that the control behavior is provided earlier than the required time point, K4 indicates that the control behavior is provided later than the required time point, K5 indicates that the control behavior provided does not meet the expected requirements, K6 indicates that the control behavior provided is greater than the expected requirements), and take the Cartesian product of E and K to obtain the set of potential abnormal control behaviors V = {E}. i ×K j |i∈[1,2],j∈[1,6], analyze the set of potential abnormal behaviors based on whether they will cause harm to the whole vehicle, and analyze the safety regulations they violate. The results are shown in Table 6.

[0069] Table 6 Abnormal Behaviors, Vehicle-Level Hazards, and Safety Regulations When Following Another Vehicle

[0070]

[0071] The causal analysis of the above-mentioned unsafe control behaviors was categorized, and the results are shown in Table 7.

[0072] Table 7. Analysis of the Causes of Unsafe Control Behaviors When Following Another Vehicle

[0073]

[0074]

[0075] Based on the above analysis results, the functional safety and expected functional safety in this scenario are linked through vehicle-level hazard linkage. The formal representation of the linkage results is shown in Table 8:

[0076] Table 8. Analysis of the linkage between functional safety and expected functional safety during vehicle following.

[0077] Function item error Unsafe control behavior Whole vehicle level hazards <![CDATA[(F1,S2)]]> <![CDATA[(E1,K3)]]> <![CDATA[The braking speed of M1 is too slow]]> <![CDATA[(F1,S4)]]> <![CDATA[(E1,K4)]]> <![CDATA[The braking distance of vehicle M2 is insufficient]]> <![CDATA[(F1,S5)]]> <![CDATA[(E1,K1)]]> <![CDATA[M3 cannot decelerate or brake]]> <![CDATA[(F2,S1 / S3)]]> <![CDATA[(E2,K2 / K4 / K5)]]> <![CDATA[Lateral yaw occurs to M4]]> <![CDATA[(F2,S6)]]> <![CDATA[(E2,K1 / K3 / K6)]]> <![CDATA[The M5 vehicle is unable to adjust its course]]> <![CDATA[(F3,S1 / S6)]]> <![CDATA[(E1,K5)]]> <![CDATA[The speed of M6 is higher than expected]]>

[0078] Based on the safety analysis linkage results in Table 8, by referring to the ASIL levels in Table 5 and the safety constraints in Table 6, the priority of the safety constraints can be determined according to their levels. Referring to Table 2, the accidents and hazards caused by unsafe control behaviors under the expected functional safety definition can be obtained. Taking (F1,S2) and (E1,K3) as examples: When a connected vehicle is driving on an urban highway, its active braking system provides less functionality than expected. This abnormality is equivalent to abnormal control behavior that prematurely provides the expected speed, both of which will cause vehicle-wide hazards due to excessively slow braking speed, potentially leading to a collision with the vehicle in front. Since the ASIL level corresponding to (F1,S2) is A, the safety constraint CO2 corresponding to (E1,K3) has a higher priority.

[0079] Example 2: Functional Safety and Expected Functional Safety Linkage Analysis of Intelligent Connected Vehicles Making Right Turns at Urban Intersections

[0080] This example focuses on urban intersections with traffic lights (excluding pedestrian crossings), where vehicles follow traffic light prompts to turn right and merge into the lane. The visibility is high, the ground is flat and free of standing water, and there is no wind or a light breeze, so there is no glare. The main driving tasks are to maintain a safe distance from the vehicle in front, stay in the right-turn lane, and safely merge into the traffic flow.

[0081] The functional items under the vehicle's electronic and electrical architecture are filtered to obtain a set of functional items F related to the driving task (F1 represents the active braking system; F2 represents the electronic steering system; F3 represents the power system). Potential abnormal modes S of the functional items are identified (S1 indicates that the functional item is greater than the value required to perform the driving task; S2 indicates that the functional item is less than the value required to perform the driving task; S3 indicates that the functional item is earlier than the required time point; S4 indicates that the functional item is later than the required time point; S5 indicates that the functional item fails to provide the required function; S6 indicates that the functional item provides the unnecessary function).

[0082] Taking the Cartesian product of the set of functional items F and the set of potential abnormal patterns S, we obtain the set of potential abnormal functions U: U = F × S = {(F i ,S j )|i∈[1,3],j∈[1,6], based on whether it will cause vehicle-level hazards, the potential abnormal function set is analyzed. The vehicle-level hazard set is denoted as M, and the accident set caused by the hazard is denoted as H. The results are shown in Table 9.

[0083] Table 9: Description of Functional Abnormalities, Vehicle-Level Hazards, and Accidents Related to Right Turning at Intersections

[0084] Function item error Whole vehicle level hazards Accident Description <![CDATA[(F1,S2)]]> <![CDATA[The deceleration of M1 is too slow]]> <![CDATA[The vehicle in front of H1 has a collision]]> <![CDATA[(F1,S4)]]> <![CDATA[The deceleration distance of M2 is insufficient]]> <![CDATA[The vehicle in front of H1 has a collision]]> <![CDATA[(F1,S5)]]> <![CDATA[The M3 cannot decelerate or brake]]> <![CDATA[H1 collided with the vehicle in front]]> <![CDATA[(F2,S1 / S4)]]> <![CDATA[M4 turns right at an excessive angle]]> <![CDATA[H2 collided with an oncoming vehicle]]> <![CDATA[(F2,S2 / S3)]]> <![CDATA[M5 turns right at too small an angle]]> <![CDATA[Collision with roadside obstacles at H3]]> <![CDATA[(F2,S6)]]> <![CDATA[Reverse driving of M6]]> <![CDATA[H2 scraped and collided with oncoming vehicles]]> <![CDATA[(F3,S1 / S6)]]> <![CDATA[M7 Speeding through a Curve]]> <![CDATA[Vehicle H4 rear-ended the vehicle in the lane to be merged]]>

[0085] Intelligent connected vehicles frequently make right turns at intersections on urban roads, therefore the probability of such an accident is assessed as E4. Based on vehicle speed and driving scenario, the overall vehicle-level hazards and the likelihood of accidents are analyzed. The results and reasons are shown in Tables 10 and 11.

[0086] Table 10: Analysis of the controllability of right turns at intersections

[0087]

[0088]

[0089] Table 11 Analysis of Accident Severity at Intersections When Turning Right

[0090]

[0091] Based on the three indicators, the ASIL level of the functional item abnormality was obtained, and the results are shown in Table 12:

[0092] Table 12 ASIL Levels for Functional Items Related to Following Vehicle Driving

[0093] Function item error ASIL <![CDATA[(F1,S2)]]> A <![CDATA[(F1,S4)]]> A <![CDATA[(F1,S5)]]> B <![CDATA[(F2,S1 / S4)]]> B <![CDATA[(F2,S2 / S3)]]> A <![CDATA[(F2,S6)]]> C <![CDATA[(F3,S1 / S6)]]> A

[0094] Based on the ASIL level, the safety objectives for each function in this scenario are proposed as follows: avoid the active braking system failing to provide the expected function (high priority); avoid the active braking system providing less or later than expected function (relatively high priority); ensure that the electronic steering provides the required service only at the appropriate time (high priority); avoid the electronic steering system providing unnecessary service (extremely high priority); and ensure that the powertrain system does not provide unnecessary or excessive expected service (relatively high priority).

[0095] Filter the core control behaviors E of the intelligent connected vehicle in this scenario (E1 outputs the expected speed, E2 controls the lateral displacement of the vehicle body), identify the potential abnormal modes K of the functional items, and obtain the set of potential abnormal control behaviors V = {E} by taking the Cartesian product of E and K. i ×K j |i∈[1,2],j∈[1,6], analyze the set of potential abnormal behaviors based on whether they will cause harm to the whole vehicle, and analyze the safety regulations they violate. The results are shown in Table 13.

[0096] Table 13 Abnormal Right Turning Behaviors, Vehicle-Level Hazards, and Safety Regulations at Intersections

[0097]

[0098]

[0099] A causal analysis was conducted on the aforementioned unsafe control behaviors, and the results are shown in Table 14.

[0100] Table 14 Analysis of the Causes of Unsafe Control Behaviors When Turning Right at Intersections

[0101]

[0102] Based on the above analysis results, the functional safety and expected functional safety in this scenario are linked through vehicle-level hazard linkage. The formal representation of the linkage results is shown in Table 15:

[0103] Table 15 Analysis of the linkage between functional safety and expected functional safety when following another vehicle.

[0104]

[0105]

[0106] Based on the safety analysis results in Table 15, by referring to the ASIL levels in Table 12 and the safety constraints in Table 6, the priority of the safety constraints can be determined according to their levels. Table 9 provides the accidents and hazards caused by unsafe control behaviors under the definition of expected functional safety. Taking (F2,S6) and (E2,K1) as examples: In a scenario where a connected vehicle is turning right at an urban intersection, if the vehicle's electronic steering system malfunctions and provides unnecessary functions, the resulting vehicle-level hazard is equivalent to the vehicle providing unnecessary lateral control behavior, both of which will cause the vehicle to travel in the opposite direction, potentially leading to a collision with oncoming vehicles. Since the ASIL level of (F2,S6) is C, the safety constraint priority level corresponding to (E2,K1) is extremely high.

[0107] The scope of protection of this invention is not limited to the above embodiments. Any variations and advantages that can be conceived by those skilled in the art without departing from the spirit and scope of the inventive concept are included in this invention and are protected by the appended claims.

Claims

1. A method for linking functional safety and expected functional safety verification of intelligent connected vehicles, characterized in that, Includes the following steps: Step 1: Extract the set of control function items under the electronic and electrical architecture of intelligent connected vehicles, clean up to obtain the set F of body control function items related to the current driving task, and identify the set S of potential abnormal modes of function items; Step 2: Filter out abnormal behaviors of vehicle functions and summarize the corresponding vehicle-level hazards and accidents; Step 3: Confirm the integrity level and safety objectives of each element in the set F of body control functions related to the current driving task; Step 4: Extract the core control behaviors of the intelligent connected vehicle control layer, clean up the control behaviors related to the current driving to obtain the set E, and identify the potential error mode set K; Step 5: Filter unsafe control behaviors that affect driving tasks and summarize vehicle-level hazards and safety constraints; The specific steps in step 5 are as follows: Step 5.1: Set of control behaviors related to the current driving situation and error mode set Performing the Cartesian product yields the set of potential abnormal control behaviors. : ,in Represents the set of control behaviors related to the current driving task. A set of error patterns representing control behavior. Representative set The number of elements in the middle; Step 5.2: Determine if the driving scenario is underway. The Middle Abnormal control behavior Will it cause damage to the entire vehicle? If it will cause damage, what abnormal control behavior should be implemented? Set , The Middle element Corresponding vehicle-level hazards Different abnormal control behaviors can correspond to the same vehicle-level hazard; situations where unsafe vehicle control behaviors cause physical injury to passengers or other human traffic participants, or cause physical damage by colliding with traffic participants or static facilities, are considered to constitute a vehicle-level hazard. Step 5.3: Based on the current driving task and local traffic regulations, obtain the set. The set of safety constraints violated by each unsafe control behavior is denoted as . ; Step 5.4: Set of unsafe control behaviors By performing steps 5.2 to 5.3 on each element, we can obtain all vehicle-level hazards caused by unsafe control behaviors and the safety constraints they violate. Step 6: Conduct causal analysis of non-functional item anomalies related to unsafe control behaviors; Step 7: Using vehicle-level hazards as anchor points, link abnormal functional items and unsafe control behaviors to perform linkage verification; The specific steps in step 7 are as follows: Step 7.1: Collect the exceptions for each function item. The set of elements and unsafe control behaviors within. Match elements within the specified range; if a specific function is abnormal... The resulting vehicle safety hazards With specific unsafe control behaviors Overall vehicle safety hazards Same, that is That is, to form unsafe control behaviors under the expected functional safety definition. Vehicle function abnormality One-to-one mapping; If a mapping cannot be formed, it means that the current function item and the extracted control behavior cannot match unsafe control behaviors. Functional item abnormality No further steps will be performed. Step 7.2: Based on the function item exception The corresponding accident severity and safety objectives, combined with the mapping results, lead to the corresponding unsafe control behaviors. The severity of the accident and the safety objectives; based on the integrity level, corresponding unsafe control behaviors are derived. Safety constraint priority.

2. The method for joint verification of functional safety and expected functional safety of intelligent connected vehicles as described in claim 1, characterized in that, In step 1, the cleaning refers to filtering all control function items under the electronic and electrical architecture of the intelligent connected vehicle and removing function items that are irrelevant to the current driving task; the abnormal mode set It contains 6 elements, namely , , , , , ;in This indicates that the provided functionalities exceed the value required to perform the driving task. This indicates that the provided functionality is less than the value required to perform the driving task. This indicates that the provided functionality is available earlier than the required time point. This indicates that the provided functionality is later than the required time point. This indicates that the required functionality could not be provided. This indicates that unnecessary functionality has been provided.

3. The method for linking functional safety and expected functional safety of intelligent connected vehicles according to claim 1, characterized in that, Step 2 further includes: Step 2.1: Set of body control functions related to the current driving task With potential abnormal pattern set By performing a Cartesian product, we obtain the potential abnormal behavior function set. : ,in This is a set of vehicle control functions related to the current driving task. A set of potential abnormal patterns Representative set The number of elements; Step 2.2: Determine the set of abnormal behaviors in driving scenario P Whether the elements in the list will cause vehicle-wide hazards, and which abnormal behaviors will cause vehicle-wide hazards will be grouped into the set. When abnormal behavior of a vehicle's functions causes physical injury to passengers or other human traffic participants, or when it collides with traffic participants or static facilities and causes physical damage, it is considered a vehicle-level hazard. Step 2.3: The Middle element The corresponding vehicle-level hazard caused is recorded as Combined with the current driving scenario By analyzing static snapshots and other dynamic traffic participant data, we can identify subsequent accidents caused by hazards. A single combination of abnormal behaviors can correspond to multiple different accidents, which are then added to an accident set. The static snapshot refers to static elements in the geographic space surrounding the vehicle, including road location, road surface conditions, obstacles, and weather conditions.

4. The method for linking functional safety and expected functional safety of intelligent connected vehicles according to claim 1, characterized in that, The specific steps in step 3 are as follows: Step 3.1: Based on the driving scenario The static snapshot and the distribution of the physical states of other traffic participants and vehicles in the driving scenario determine the likelihood that unsafe behaviors have occurred before or during the entry into the driving scenario. The probability of occurrence is divided into 5 levels from negligible to high probability, including: negligible, low, low, medium and high, represented by E0, E1, E2, E3 and E4 respectively; Step 3.2: In the driving scenario In the process, it is determined that, for the driver inside the vehicle, the hazards at each vehicle level are... The level of controllability is divided into four levels, from fully controllable to uncontrollable: all drivers can control it, 99% of drivers can take over the handling, 90% of drivers can take over the handling, and uncontrollable, which are represented by C0, C1, C2, and C3 respectively. Step 3.3: Determine the accident set The severity of each element is judged based on the degree of physical injury to passengers inside the vehicle and other human traffic participants outside the vehicle. Combining the vehicle speed and the accident scenario, it is divided into four levels from no injury to fatal injury, including: no injury, minor injury, serious injury but not life-threatening, and fatal injury, which are represented by S0, S1, S2, and S3 respectively. Step 3.4: Based on the probability of occurrence in the driving scenario and the overall vehicle-level hazard. The driving scenario is determined by three indicators: the degree of controllability, the degree of physical injury to passengers and other human traffic participants outside the vehicle. Next, the An abnormal control function item The security integrity level is determined, and security objectives are proposed accordingly to mitigate risks; Step 3.5: Set of abnormal behaviors of functional items that can cause vehicle-wide hazards Repeat steps 3.1 to 3.4 for all elements to obtain the set of vehicle control functions related to the current driving task. The security objectives of each element.

5. The method for linking functional safety and expected functional safety of intelligent connected vehicles according to claim 1, characterized in that, In step 4, the cleaning refers to filtering all control behaviors under the intelligent connected vehicle control level and eliminating behaviors that do not affect the driving task; the error mode set It contains 6 elements, namely , , , , , ;in This indicates that unnecessary control behaviors were provided. This indicates that the required control behavior was not provided. This indicates that the control action provided occurred earlier than the required time point. This indicates that the control action provided is later than the required time point. This indicates that the provided control behavior does not meet the expected requirements. This indicates that the control provided is greater than expected.

6. The method for linking functional safety and expected functional safety of intelligent connected vehicles according to claim 1, characterized in that, The specific steps in step 6 are as follows: Step 6.1: Using the decision-making time point, categorize the potential causes of unsafe control behavior into three types: failure to obtain accurate and necessary environmental data before the decision, failure to obtain vehicle information before the decision, and problems with the parameter settings or algorithm of the decision-making system itself. These are then further analyzed using... , , express; Step 6.2: From the perspectives of poor perception, hardware limitations, transmission failures, and design defects, refine each cause category and point out the specific expected functional cause categories that lead to unsafe control behavior; Step 6.3: For the set of unsafe control behaviors By combining the elements in the data with the control behavior and corresponding safety constraints, we can identify the cause category of unsafe control behavior; and combine this with the driving scenario. Physical characteristics and driving tasks were used to identify the specific cause of this unsafe control behavior.

7. The method for linking functional safety and expected functional safety of intelligent connected vehicles according to claim 6, characterized in that, In step 6.2, the poor perception includes the perception layer being unable to accurately obtain the necessary environmental data due to external environmental factors, hardware limitations referring to the blind spots of the sensors installed in the vehicle, transmission failure referring to the obstruction of data transmission between or among the vehicle's perception system, decision-making system and execution system, and design defects referring to defects in the system's algorithm design or unreasonable internal parameter design. The detailed categories of causes include: inadequate perception of the cause before decision-making, resulting in the failure to obtain accurate and effective environmental data; hardware limitations before decision-making, resulting in the failure to obtain accurate and effective vehicle information; transmission failure before decision-making, resulting in the failure to obtain accurate environmental data; transmission failure before decision-making, resulting in the decision system not obtaining accurate vehicle information; failure of the decision result to be successfully transmitted to the vehicle execution system due to transmission failure; defects in the algorithm design of the decision system leading to incorrect decisions; and unreasonable design of the internal parameters of the decision system leading to incorrect decisions.

8. The method for linking functional safety and expected functional safety of intelligent connected vehicles as described in any one of claims 1-7 is used to assess the severity of unsafe control behaviors under the definition of expected functional safety, provide accident hierarchy reference, and form the application in safety constraint priority.

Images