Method, device and equipment for allocating functional safety requirements of vehicle and medium

Abstract

Embodiments of the present application disclose a functional safety requirement allocation method, device, equipment and medium for a vehicle. The method comprises: obtaining at least one optional functional safety target of each to-be-allocated function in a vehicle; determining a partial function architecture and a whole-vehicle function architecture of the vehicle according to each to-be-allocated function; determining a target functional safety requirement according to the partial function architecture, the whole-vehicle function architecture and the optional functional safety target; and determining a device functional safety requirement of a corresponding functional device of the to-be-allocated function in the vehicle according to the target functional safety requirement. The above scheme improves the accuracy of the determined target functional safety requirement, and further improves the accuracy of the device functional safety requirement.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of vehicle development technology, and in particular to a method, apparatus, device and medium for allocating functional safety requirements for vehicles. Background Technology

[0002] With the rapid advancement of technology, humanity's desire for intelligent driving vehicles is becoming increasingly urgent. Existing intelligent driving functions are becoming increasingly sophisticated, involving more and more components. Faced with such complex intelligent driving systems, safety has become an unavoidable issue. Among these, functional safety, as a overarching methodology, has received widespread attention. Therefore, how to effectively conduct functional safety conceptual design has become a key technical challenge.

[0003] In existing technologies, functional safety requirements are typically allocated based only on basic information about system components or only for a single function. These methods suffer from low accuracy in determining functional safety requirements. Summary of the Invention

[0004] This invention provides a method, apparatus, device, and medium for allocating functional safety requirements for vehicles, in order to improve the accuracy of the determined functional safety requirements.

[0005] According to one aspect of the present invention, a method for allocating functional safety requirements for a vehicle is provided, comprising:

[0006] Obtain at least one optional functional safety objective for each function to be assigned in the vehicle;

[0007] Based on the functions to be assigned, determine the partial functional architecture and the overall vehicle functional architecture;

[0008] Based on the partial functional architecture, the vehicle functional architecture, and the optional functional safety objectives, the target functional safety requirements are determined.

[0009] Based on the target functional safety requirements, determine the device functional safety requirements of the functional devices corresponding to the functions to be assigned in the vehicle.

[0010] According to another aspect of the present invention, a functional safety requirement allocation device for a vehicle is provided, characterized in that it comprises:

[0011] The safety target acquisition module is used to acquire at least one optional functional safety target for each function to be assigned in the vehicle.

[0012] The functional architecture determination module is used to determine the partial functional architecture and the overall vehicle functional architecture based on the functions to be assigned.

[0013] The functional safety requirement determination module is used to determine the target functional safety requirements based on the partial functional architecture, the vehicle functional architecture, and the optional functional safety objectives.

[0014] The functional safety requirement allocation module is used to determine the device functional safety requirements of the functional devices corresponding to the functions to be allocated in the vehicle based on the target functional safety requirements.

[0015] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0016] At least one processor; and

[0017] A memory communicatively connected to the at least one processor; wherein,

[0018] The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to execute the functional safety requirement allocation method for vehicles according to any embodiment of the present invention.

[0019] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement the functional safety requirement allocation method for a vehicle according to any embodiment of the present invention.

[0020] This invention provides a functional safety requirement allocation scheme for vehicles, which involves obtaining at least one optional functional safety target for each function to be allocated in the vehicle; determining a partial functional architecture and a complete vehicle functional architecture based on each function to be allocated; determining target functional safety requirements based on the partial functional architecture, the complete vehicle functional architecture, and the optional functional safety target; and determining the device functional safety requirements of the functional devices corresponding to the functions to be allocated in the vehicle based on the target functional safety requirements. The above-described solution, by introducing the functions to be assigned, optional functional safety targets, the overall vehicle functional architecture, and partial functional architecture, achieves the determination of target functional safety requirements from multiple dimensions, improving the accuracy and comprehensiveness of the determination of target functional safety requirements, and thus improving the accuracy of device functional safety requirements. Furthermore, in this embodiment of the invention, by using the overall vehicle functional architecture, the target functional safety requirements are determined based on consideration of multiple functions to be assigned, improving the accuracy of the determined target functional safety requirements, and thus improving the accuracy of device functional safety requirements. Moreover, in this embodiment of the invention, by determining the target functional safety requirements based on partial functional architecture, overall vehicle functional architecture, and optional functional safety targets, the target functional safety requirements are determined based on a comprehensive consideration of both individual functions to be assigned and the overall set of functions to be assigned, improving the accuracy of the determined target functional safety requirements, and thus improving the accuracy of device functional safety requirements.

[0021] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 This is a flowchart of a method for allocating functional safety requirements for a vehicle, provided in Embodiment 1 of the present invention;

[0024] Figure 2 This is a flowchart of a method for allocating functional safety requirements for a vehicle, provided in Embodiment 2 of the present invention;

[0025] Figure 3A This is a flowchart of a method for determining a vehicle functional safety architecture provided in Embodiment 3 of the present invention;

[0026] Figure 3B This is a schematic diagram of a vehicle functional architecture provided in Embodiment 3 of the present invention;

[0027] Figure 3C This is a schematic diagram of an updated functional architecture using functional safety measures, provided in Embodiment 3 of the present invention.

[0028] Figure 3D This is a schematic diagram of another functional safety measure adopted in Embodiment 3 of the present invention to update part of the functional architecture;

[0029] Figure 4 This is a schematic diagram of the structure of a vehicle functional safety requirement allocation device provided in Embodiment 4 of the present invention;

[0030] Figure 5 This is a schematic diagram of the structure of an electronic device for implementing a method for allocating functional safety requirements for vehicles, provided in Embodiment 5 of the present invention. Detailed Implementation

[0031] The present invention will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. Furthermore, it should be noted that, for ease of description, the accompanying drawings show only the parts relevant to the present invention, and not all of the structures.

[0032] In existing technologies, most approaches still rely on developing functional safety for key controllers separately, such as autonomous driving controllers, EPS, and ESP. This method works for controllers with simple functions, but autonomous driving controllers often handle multiple vehicle functions, such as all autonomous driving or driver assistance functions from L0 to L4 driving and parking. In this case, because each ECU is developed independently for functional safety, it's difficult to comprehensively analyze the functional safety requirements, expected inputs, and designed outputs of other systems and controllers. This can lead to overlooked safety requirements and hinder the development of overall safety measures, potentially resulting in over-design.

[0033] Another approach is to develop functional safety for each individual function separately, such as SACC and AEB. However, this approach has a large number of functions, and if only some functions are considered, safety requirements will be overlooked, making it impossible to achieve overall functional safety. If all functions are developed individually, the number of safety targets becomes large, resulting in a huge workload for safety analysis and design, leading to low efficiency.

[0034] Example 1

[0035] Figure 1 This is a flowchart of a method for allocating functional safety requirements for a vehicle according to Embodiment 1 of the present invention. This embodiment is applicable to the allocation of functional safety requirements for various functional components in a vehicle. The method can be executed by a functional safety requirement allocation device for the vehicle. The device can be implemented in hardware and / or software and can be configured in an electronic device that carries the functional safety requirement allocation function of the vehicle.

[0036] See Figure 1 The method for allocating functional safety requirements for vehicles shown includes:

[0037] S110, Obtain at least one optional functional safety objective for each function to be assigned in the vehicle.

[0038] In this context, "functions to be assigned" refers to functions that require functional safety requirement allocation. This embodiment of the invention does not limit the type and / or number of functions to be assigned; these can be set by technical personnel based on experience. In an optional embodiment, the functions to be assigned can be presented in tabular form. Specifically, the table may include the autonomous driving level, the function to be assigned, the full name of the function, and a function description.

[0039] For example, the functions to be assigned may include: Level 4 autonomous driving function (AVP, Automated Valet Parking); Level 3 autonomous driving function (NOP, Navigation on Pilot, and TJP, Traffic Jam Pilot); Level 2 autonomous driving function (NGP, Navigation Guided Pilot, HPA, Home Parking Assist, SACC, Super Adaptive Cruise Control, APA, Remote Parking Assist, and DCLC, Diver Controlled Lane Change); Level 1 autonomous driving function (AEB, Autonomous Emergency Braking, Lane Keeping Assist, and Front Crossing Traffic Braking). Brake function and RCTB (Rear Crossing Traffic Brake) function for braking when rear traffic crosses;The autonomous driving level is L0, and it includes the following functions: Blind Spot Detection (BSD), Lane Change Decision Aid (LCDA), Lane Departure Warning (LDW), Forward Collision Warning (FCW), Traffic Sign Recognition (TSR), Rear Collision Warning (RCW), Door Open Warning (DOW), Front Crossing Traffic Alert (FCTA), Rear Crossing Traffic Alert (RCTA), Intelligent Headlight Control (IHC), and Adaptive Driving Beam (ADB).

[0040] Functional safety refers to the reliance on the correct operation of a system or device upon input; it is an integral part of overall safety. Optional functional safety objectives refer to the safety goals that must be met to prevent or reduce the hazards of each assigned function.

[0041] Specifically, the functions to be assigned to the vehicle are determined; a hazard analysis and risk assessment (HARA) is performed on each function to be assigned to obtain at least one optional functional safety objective corresponding to each function to be assigned.

[0042] S120. Based on the functions to be assigned, determine the partial functional architecture and the overall vehicle functional architecture.

[0043] The partial functional architecture stores the functional components corresponding to any function to be assigned. The overall vehicle functional architecture stores the functional components corresponding to all functions to be assigned. It should be noted that both the partial functional architecture and the overall vehicle functional architecture also reflect the connection relationships between the functional components.

[0044] In one optional embodiment, the partial functional architecture and the overall vehicle functional architecture are determined based on each function to be assigned, including: generating the overall vehicle functional architecture based on the functional devices corresponding to all functions to be assigned; and generating the partial functional architecture corresponding to each function to be assigned based on the functional devices corresponding to each function to be assigned.

[0045] Specifically, it can generate a complete vehicle function including all functions to be assigned, and generate a complete vehicle function architecture based on the functional devices corresponding to the complete vehicle function and the connection relationships between the functional devices; for any function to be assigned, it can generate a partial function architecture corresponding to the function to be assigned based on the functional devices corresponding to the function to be assigned and the connection relationships between the functional devices.

[0046] Understandably, by introducing functional components, the accuracy of the generated vehicle functional architecture and partial functional architecture is improved.

[0047] S130. Determine the target functional safety requirements based on the partial functional architecture, the overall vehicle functional architecture, and optional functional safety objectives.

[0048] Among them, the target functional safety requirement refers to the functional safety requirement that needs to be allocated to the functional devices corresponding to each function to be allocated.

[0049] S140. Based on the target functional safety requirements, determine the device functional safety requirements of the functional devices corresponding to the functions to be assigned in the vehicle.

[0050] In this context, a functional device refers to a device required to perform the assigned function. For example, a functional device may include a controller, actuator, sensor, input module, output module, and gateway, etc. Device functional safety requirements refer to the functional safety requirements assigned to any given functional device.

[0051] This invention provides a functional safety requirement allocation scheme for vehicles, which involves obtaining at least one optional functional safety target for each function to be allocated in the vehicle; determining a partial functional architecture and a complete vehicle functional architecture based on each function to be allocated; determining target functional safety requirements based on the partial functional architecture, the complete vehicle functional architecture, and the optional functional safety target; and determining the device functional safety requirements of the functional devices corresponding to the functions to be allocated in the vehicle based on the target functional safety requirements. The above-described solution, by introducing the functions to be assigned, optional functional safety targets, the overall vehicle functional architecture, and partial functional architecture, achieves the determination of target functional safety requirements from multiple dimensions, improving the accuracy and comprehensiveness of the determination of target functional safety requirements, and thus improving the accuracy of device functional safety requirements. Furthermore, in this embodiment of the invention, by using the overall vehicle functional architecture, the target functional safety requirements are determined based on consideration of multiple functions to be assigned, improving the accuracy of the determined target functional safety requirements, and thus improving the accuracy of device functional safety requirements. Moreover, in this embodiment of the invention, by determining the target functional safety requirements based on partial functional architecture, overall vehicle functional architecture, and optional functional safety targets, the target functional safety requirements are determined based on a comprehensive consideration of both individual functions to be assigned and the overall set of functions to be assigned, improving the accuracy of the determined target functional safety requirements, and thus improving the accuracy of device functional safety requirements.

[0052] Based on the above technical solution, the method further includes: for any functional device, determining whether there is a conflict between the device functional safety requirements of the functional device; if so, updating the device functional safety requirements of the functional device.

[0053] Specifically, for any given functional device, conflict detection is performed on multiple device functional safety requirements of that functional device to determine whether there are conflicting device functional safety requirements among the various device functional safety requirements of that functional device; if so, the conflicting device functional safety requirements and the reasons for the conflict are determined; based on the reasons for the conflict, the conflicting device functional safety requirements are updated.

[0054] Understandably, by conducting conflict detection on the functional safety requirements of devices and updating the functional safety requirements based on the detection results, the accuracy of the functional safety requirements of functional devices is improved, the impact of conflicting functional safety requirements on the operation of functional devices is avoided, and the executability of functional devices is improved.

[0055] It should be noted that for any given functional device, multiple device functional safety requirements may be assigned. Identical device functional safety requirements can be merged to reduce the amount of data.

[0056] Example 2

[0057] Figure 2This is a flowchart of a method for allocating functional safety requirements for a vehicle according to Embodiment 2 of the present invention. Based on the above embodiments, this embodiment further refines the operation of "determining target functional safety requirements based on partial functional architecture, overall vehicle functional architecture, and optional functional safety objectives" into "determining the overall vehicle functional safety requirements corresponding to the overall vehicle functional architecture; determining partial functional safety requirements corresponding to each partial functional architecture based on the partial functional architecture and optional functional safety objectives; and generating target functional safety requirements including overall vehicle functional safety requirements and partial functional safety requirements," thereby improving the mechanism for determining target functional safety requirements. It should be noted that for parts not detailed in this embodiment, please refer to the descriptions in other embodiments.

[0058] See Figure 2 The method for allocating functional safety requirements for vehicles shown includes:

[0059] S210. Obtain at least one optional functional safety objective for each function to be assigned in the vehicle.

[0060] S220. Based on the functions to be assigned, determine the partial functional architecture and the overall vehicle functional architecture.

[0061] S230. Determine the vehicle functional safety requirements corresponding to the vehicle functional architecture.

[0062] Among them, the functional safety requirements of the whole vehicle refer to the functional safety requirements obtained from the perspective of the functional architecture of the whole vehicle.

[0063] Specifically, an inductive safety analysis is performed on the overall vehicle functional architecture to obtain the overall vehicle functional safety requirements.

[0064] S240. Based on the partial functional architecture and optional functional safety objectives, determine the partial functional safety requirements corresponding to each partial functional architecture.

[0065] Among them, partial functional safety requirements refer to functional safety requirements derived from consideration of partial functional architecture.

[0066] Specifically, deductive security analysis is performed on some functional architectures and optional functional security objectives to obtain partial functional security requirements.

[0067] S250, Generate target functional safety requirements that include overall vehicle functional safety requirements and partial functional safety requirements.

[0068] In an optional embodiment, after determining the partial functional safety requirements corresponding to each partial functional architecture based on the partial functional architecture and optional functional safety objectives, the method further includes: updating the partial functional safety requirements based on the partial functional safety requirements, each functional device in the partial functional architecture, and functional safety measures; correspondingly, generating target functional safety requirements that include vehicle functional safety requirements and partial functional safety requirements, including: generating target functional safety requirements that include vehicle functional safety requirements and updated partial functional safety requirements.

[0069] Functional safety measures refer to measures that allow for the addition of functional components from the perspective of the overall vehicle functional architecture.

[0070] Specifically, based on some functional safety requirements, the functional components in some functional architectures, and functional safety measures, it is determined whether new functional components can be added; if so, some functional safety requirements are updated.

[0071] Understandably, by introducing functional safety measures and updating some functional safety requirements, the applicability of some functional safety requirements is improved.

[0072] In an optional embodiment, after updating some functional safety requirements, the method further includes updating some functional architectures corresponding to the updated functional safety requirements.

[0073] Specifically, based on the updated functional security requirements, the corresponding functional architecture is determined and updated accordingly.

[0074] Understandably, updating some functional architectures improved the accuracy of those functional architectures.

[0075] S260. Based on the target functional safety requirements, determine the device functional safety requirements of the functional devices corresponding to the functions to be assigned in the vehicle.

[0076] The vehicle functional safety requirement allocation scheme provided in this invention refines the operation of determining target functional safety requirements based on partial functional architecture, overall vehicle functional architecture, and optional functional safety objectives into determining the overall vehicle functional safety requirements corresponding to the overall vehicle functional architecture; determining partial functional safety requirements corresponding to each partial functional architecture based on partial functional architecture and optional functional safety objectives; and generating target functional safety requirements that include both overall vehicle functional safety requirements and partial functional safety requirements, thus improving the mechanism for determining target functional safety requirements. This scheme, by introducing both overall vehicle functional safety requirements and partial functional safety requirements to determine target functional safety requirements, improves the accuracy of the determined target functional safety requirements.

[0077] In an optional embodiment, after obtaining at least one optional functional safety target for each function to be assigned in the vehicle, the method further includes: merging the optional functional safety targets to obtain at least one candidate functional safety target; correspondingly, before determining the device functional safety requirements of the functional devices corresponding to the functions to be assigned in the vehicle based on the target functional safety requirements, the method further includes: generating a whole vehicle functional association relationship based on the whole vehicle functional safety requirements, the candidate functional safety targets, and the functions to be assigned; generating a partial functional association relationship based on the partial functional safety requirements, the optional functional safety targets, and the functions to be assigned; and determining the correspondence between the functional devices and the target functional safety requirements based on the whole vehicle functional association relationship and / or the partial functional association relationship.

[0078] Among them, candidate functional safety objectives refer to functional safety objectives that are obtained by merging optional functional safety objectives. Vehicle functional relationships refer to the relationships between candidate functional safety objectives, functions to be assigned, and vehicle functional safety requirements. Partial functional relationships refer to the relationships between partial functional safety requirements, optional functional safety requirements, and functions to be assigned.

[0079] Understandably, by introducing candidate functional safety targets, the number of functional safety targets is reduced, and the efficiency of subsequent processing is improved. At the same time, by introducing the functional relationships of the whole vehicle and some functional relationships, the accurate positioning of functional components is achieved, avoiding the omission of functional components.

[0080] Example 3

[0081] Figure 3A This is a flowchart of a method for determining a vehicle functional safety architecture according to Embodiment 3 of the present invention. Based on the above embodiments, this embodiment determines the vehicle functional safety architecture through a method for allocating vehicle functional safety requirements. It should be noted that for parts not described in detail in this embodiment, please refer to the descriptions in other embodiments.

[0082] See Figure 3A The method for determining the vehicle functional safety architecture shown includes:

[0083] S311. Perform HARA analysis on each function to be assigned to obtain the optional function security objectives corresponding to each function to be assigned.

[0084] It should be noted that one function to be assigned may correspond to multiple optional function security targets.

[0085] S312. Merge the optional functional safety targets to obtain candidate functional safety targets, and connect the candidate functional safety targets with the corresponding functions to be assigned.

[0086] Specifically, identical optional functional safety targets among the optional functional safety targets are merged to obtain candidate functional safety targets; optional functional safety targets that do not have the same characteristics are directly used as candidate functional safety targets.

[0087] Specifically, for different functions to be assigned, the same optional functional safety objectives can be merged. However, the Automotive Safety Integrity Level (ASIL), safety metrics, and fault-tolerant time interval (FTTI) within the optional functional safety objectives are different. For example, the merging of optional functional safety objectives can be achieved using the format of Table 1.

[0088] Table 1. Schematic diagram of optional functional safety objectives merging

[0089]

[0090] See Table 1. The functional descriptions of the optional functional safety objectives in the first column can be combined to obtain candidate functional safety objectives; however, ASIL, safety metrics, and FTTI are still presented separately and linked to their corresponding functions.

[0091] S313. Generate the vehicle functional architecture based on the functional devices corresponding to each function to be assigned.

[0092] The vehicle's functional architecture can accommodate all functions to be assigned. For example, see [link to example]. Figure 3B The vehicle functional architecture shown can include all related components such as sensors, controllers, actuators, power supplies, and gateways.

[0093] It should be noted that in actual vehicle models, 1-2 main controller ECUs (including main controller and backup controller), 10-20 sensors (including various cameras, LiDAR, millimeter-wave radar, ultrasonic radar, combined inertial navigation, high-precision maps, etc.), more than 10 actuators (including braking, steering, power, body, etc.), 30-50 controllers, plus power supply system, gateway and other related components.

[0094] S314. Perform inductive safety analysis on the vehicle functional architecture to obtain the vehicle functional safety requirements; link the vehicle functional safety requirements with candidate functional safety targets and functions to be assigned to obtain the vehicle functional relationships.

[0095] Specifically, an inductive safety analysis is conducted on the overall vehicle functional architecture. Functional Safety Requirements (FSRs) are proposed for all related components such as sensors, controllers, actuators, power supplies, and gateways, as well as the interfaces between various functional devices. The FSRs are linked to candidate functional safety targets and to the functions to be assigned.

[0096] S315. Determine the partial functional architecture corresponding to each function to be assigned based on the functional devices corresponding to each function to be assigned.

[0097] S316. For any function to be assigned, perform deductive security analysis on the optional functional security objectives and partial functional architecture of the function to be assigned to obtain partial functional security requirements; link the partial functional security requirements with the optional functional security objectives and the function to be assigned to obtain partial functional relationships.

[0098] In an optional embodiment, some functional safety requirements can be updated based on partial functional safety requirements, functional devices corresponding to the functions to be assigned, and functional safety measures; then, the updated partial functional safety requirements can be linked with optional functional safety targets and functions to be assigned to obtain partial functional association relationships.

[0099] S317. Generate target functional safety requirements that include partial functional safety requirements and overall vehicle functional safety requirements.

[0100] S318. Based on the target functional safety requirements, determine the device functional safety requirements of the functional devices corresponding to the functions to be assigned in the vehicle.

[0101] S319. For any functional device, organize / merge the device functional safety requirements for that functional device, and handle conflicts to obtain updated device functional safety requirements.

[0102] Specifically, for any functional device, the functional safety requirements related to that functional device in the target functional safety requirements are assigned to that functional device as its device functional safety requirements; it is then checked whether the functional device has the same device functional safety requirements; if so, the identical device functional safety requirements are merged. In the merged device functional safety requirements, the ASIL is taken as the highest among the identical device functional safety requirements, and the safety metric value is taken as the most stringent among the identical device functional safety requirements.

[0103] Furthermore, the device's functional safety requirements are checked for conflicting requirements; if any conflict exists, the conflict points and causes are analyzed, and the device's functional safety requirements are updated accordingly.

[0104] S320. Based on the functional safety requirements of each functional component, the vehicle functional architecture is updated to obtain the vehicle functional safety architecture.

[0105] The vehicle functional safety architecture stores the functional components in the vehicle when each assigned function is in a safe state. It should be noted that the vehicle functional safety architecture also reflects the connection relationships between these functional components.

[0106] It should be noted that S314 and S315 can be performed simultaneously.

[0107] In this embodiment of the invention, the process of determining the vehicle functional safety architecture can be viewed as a "divide-conquer-divide-conquer" process. Specifically, S311 can be considered as a divide process; S312-S314 as a conquer process; S315-S316 as a divide process; and S317-S320 as a conquer process.

[0108] In this embodiment of the invention, both bottom-up inductive safety analysis and top-down deductive safety analysis are conducted for each optional functional safety objective of the to-be-assigned function. Each method has its advantages and complements the others. Bottom-up inductive safety analysis performs failure mode analysis on each to-be-assigned function of the entire vehicle functional architecture; while top-down deductive safety analysis performs cause analysis on each optional functional safety objective of each to-be-assigned function. By implementing these two analysis methods, a comprehensive and thorough safety analysis can be achieved for each functional device, the interfaces between functional devices, and external influences on the architecture, resulting in high coverage of some functional safety requirements.

[0109] In this embodiment of the invention, in the top-down deductive safety analysis, for each optional functional safety objective of each function to be assigned, while considering the failure causes and failure combinations that violate the optional functional safety objective, the design of functional safety measures at the vehicle architecture level is also considered.

[0110] For example, see Figure 3CThe diagram illustrates a partial functional architecture update employing functional safety measures. The original partial functional architecture included input module 1, a controller, and an actuator; the updated partial functional architecture includes input module 1, input module 2, a controller, and an actuator. Specifically, the top-level optional functional safety objective is ASIL D. Previously, the failure of one input module would lead to a violation of the optional functional safety objective, requiring ASIL D to be assigned to that input module. However, since there is another input module with similar functionality at the vehicle architecture level, the controller can verify the inputs of both input modules. Furthermore, since the two input modules are independent, it is possible to integrate both input modules. This input module can undergo ASIL decomposition, satisfying ASIL B(D).

[0111] For example, see Figure 3D The diagram illustrates a functional safety measure-based update of a partial functional architecture. The original functional architecture included an input module, a calculation module, a control module, and an execution module; the updated functional architecture includes an input module, a calculation module, a control module, an execution module, an actuator, vehicle speed validity verification, and vehicle speed. Specifically, the top-level optional functional safety objective is ASIL D. Previously, failure of any of the input, calculation, or control modules would violate this optional functional safety objective, requiring ASIL D to be assigned to all three modules. However, at the functional level, the corresponding functions in this part of the architecture operate at relatively low speeds (e.g., the APA function requires a speed below 10 km / h). From the perspective of the overall vehicle functional architecture, vehicle speed can be introduced for ASIL decomposition. The actuator (e.g., the power steering controller EPS) determines the vehicle speed before responding to the main controller's request. Therefore, the input, calculation, and control modules can be decomposed into QM(D), and the vehicle speed into ASIL D(D). The EPS actuator must satisfy ASIL D, with vehicle speed and EPS being relatively easy to achieve ASIL D.

[0112] It is understood that in the embodiments of the present invention, functional safety measures are adopted to update some functional architectures, which is conducive to the decomposition of some functional safety requirements, reduces design difficulty, reduces workload, and avoids over-design.

[0113] In this embodiment of the invention, optional functional safety objectives are merged, and each candidate functional safety objective is linked to its corresponding assigned function for traceability. The advantages of this approach are that each assigned function is included in the functional safety objectives, while reducing the overall number of functional safety objectives. Simultaneously, the correspondence between the vehicle's functional safety requirements and candidate functional safety objectives becomes clearer. Once a vehicle's functional safety requirement is linked to a candidate functional safety objective, it is easily linked to the assigned function. This allows for inductive safety analysis where the failure impact of each functional component only needs to be linked to the merged candidate functional safety objectives, significantly reducing workload. Furthermore, during deductive safety analysis, since optional functional safety objectives have already been merged, when performing deductive safety analysis on optional functional safety objectives with the same functional description for different assigned functions, the candidate functional safety objective with the same functional description can be used. Only the differences in the functional architecture of different parts need to be considered, thus saving significant analysis time and improving design efficiency.

[0114] The vehicle functional safety determination scheme provided by this invention has a high degree of comprehensiveness in safety analysis and a high coverage of target functional safety requirements. By introducing functional safety measures, it is beneficial to decompose some functional safety requirements and avoid over-design. By introducing candidate functional safety targets, the safety analysis has strong reusability and high design efficiency.

[0115] Example 4

[0116] Figure 4 This is a schematic diagram of the structure of a vehicle functional safety requirement allocation device provided in Embodiment 4 of the present invention. This embodiment can be applied to the situation of allocating the functional safety requirements of various functional devices in a vehicle. The method can be executed by the vehicle functional safety requirement allocation device, which can be implemented in hardware and / or software. The device can be configured in an electronic device that carries the functional safety requirement allocation function of a vehicle.

[0117] like Figure 4 As shown, the device includes: a security target acquisition module 410, a functional architecture determination module 420, a functional safety requirement determination module 430, and a functional safety requirement allocation module 440. Among them,

[0118] The safety target acquisition module 410 is used to acquire at least one optional functional safety target for each function to be assigned in the vehicle.

[0119] The functional architecture determination module 420 is used to determine the partial functional architecture and the overall vehicle functional architecture based on each function to be assigned.

[0120] Functional safety requirement determination module 430 is used to determine target functional safety requirements based on partial functional architecture, vehicle functional architecture and optional functional safety objectives;

[0121] The functional safety requirement allocation module 440 is used to determine the device functional safety requirements of the functional devices corresponding to the functions to be allocated in the vehicle based on the target functional safety requirements.

[0122] This invention provides a functional safety requirement allocation scheme for vehicles. The scheme involves: acquiring at least one optional functional safety target for each function to be allocated in the vehicle using a safety target acquisition module; determining a partial functional architecture and a complete vehicle functional architecture based on each function to be allocated using a functional architecture determination module; determining target functional safety requirements based on the partial functional architecture, the complete vehicle functional architecture, and the optional functional safety target using a functional safety requirement determination module; and determining the device functional safety requirements of the corresponding functional devices for each function to be allocated in the vehicle based on the target functional safety requirements using a functional safety requirement allocation module. The above-described solution, by introducing the functions to be assigned, optional functional safety targets, the overall vehicle functional architecture, and partial functional architecture, achieves the determination of target functional safety requirements from multiple dimensions, improving the accuracy and comprehensiveness of the determination of target functional safety requirements, and thus improving the accuracy of device functional safety requirements. Furthermore, in this embodiment of the invention, by using the overall vehicle functional architecture, the target functional safety requirements are determined based on consideration of multiple functions to be assigned, improving the accuracy of the determined target functional safety requirements, and thus improving the accuracy of device functional safety requirements. Moreover, in this embodiment of the invention, by determining the target functional safety requirements based on partial functional architecture, overall vehicle functional architecture, and optional functional safety targets, the target functional safety requirements are determined based on a comprehensive consideration of both individual functions to be assigned and the overall set of functions to be assigned, improving the accuracy of the determined target functional safety requirements, and thus improving the accuracy of device functional safety requirements.

[0123] Optional, the functional safety requirements determination module 430 includes:

[0124] The vehicle functional safety requirement determination unit is used to determine the vehicle functional safety requirements corresponding to the vehicle functional architecture.

[0125] The partial functional safety requirement determination unit is used to determine the partial functional safety requirements corresponding to each partial functional architecture based on the partial functional architecture and optional functional safety objectives.

[0126] The target functional safety requirement determination unit is used to generate target functional safety requirements, including overall vehicle functional safety requirements and partial functional safety requirements.

[0127] Optionally, after the partial functional safety requirement determination unit, the device further includes:

[0128] The partial functional safety requirement update unit is used to update the partial functional safety requirements based on the partial functional safety requirements, the functional devices in the partial functional architecture, and the functional safety measures.

[0129] Correspondingly, the target functional safety requirements determination unit includes:

[0130] The target functional safety requirement update subunit is used to generate target functional safety requirements that include the overall vehicle functional safety requirements and the updated partial functional safety requirements.

[0131] Optionally, following the partial functional safety requirement update unit, the device further includes:

[0132] The partial functional architecture update unit is used to update the partial functional architecture corresponding to the updated partial functional security requirements.

[0133] Optionally, after the functional safety target acquisition module 410, the device further includes:

[0134] The candidate functional safety target determination module is used to merge the various optional functional safety targets to obtain at least one candidate functional safety target;

[0135] Accordingly, prior to the functional safety requirement allocation module 440, the device also includes:

[0136] The whole vehicle function association determination module is used to generate whole vehicle function associations based on the whole vehicle functional safety requirements, candidate functional safety targets and functions to be assigned;

[0137] The partial function association determination module is used to generate partial function associations based on partial function security requirements, optional function security objectives, and functions to be assigned.

[0138] The correspondence determination module is used to determine the correspondence between functional components and target functional safety requirements based on the functional association relationships of the whole vehicle and / or partial functional association relationships.

[0139] Optionally, the functional architecture determination module 420 includes:

[0140] The vehicle functional architecture determination unit is used to generate the vehicle functional architecture based on the functional components corresponding to all functions to be assigned.

[0141] A partial functional architecture determination unit is used to generate a partial functional architecture corresponding to each function to be assigned, based on the functional devices corresponding to each function to be assigned.

[0142] Optionally, the device may also include:

[0143] The conflict detection module is used to determine whether there is a conflict between the functional safety requirements of any given functional device.

[0144] The Device Functional Safety Requirements Update Module is used to update the device functional safety requirements for the device if they exist.

[0145] The vehicle functional safety requirement allocation device provided in the embodiments of the present invention can execute the vehicle functional safety requirement allocation method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects for executing the functional safety requirement allocation method for each vehicle.

[0146] In the technical solution of this invention, the collection, storage, use, processing, transmission, provision and disclosure of optional functional safety targets, functions to be assigned, functional devices, vehicle functional architecture and partial functional architecture, etc., all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0147] Example 5

[0148] Figure 5 This is a schematic diagram of an electronic device for implementing a method for allocating functional safety requirements for a vehicle, as provided in Embodiment 5 of the present invention. The electronic device 510 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The switching device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0149] like Figure 5 As shown, the switching device 510 includes at least one processor 511 and a memory, such as a read-only memory (ROM) 512 or a random access memory (RAM) 513, communicatively connected to the at least one processor 511. The memory stores computer programs executable by the at least one processor. The processor 511 can perform various appropriate actions and processes based on the computer program stored in the ROM 512 or loaded from storage unit 518 into the RAM 513. The RAM 513 may also store various programs and data required for the operation of the switching device 510. The processor 511, ROM 512, and RAM 513 are interconnected via a bus 514. An input / output (I / O) interface 515 is also connected to the bus 514.

[0150] Multiple components in the switching device 510 are connected to the I / O interface 515, including: an input unit 516, such as a keyboard, mouse, etc.; an output unit 517, such as various types of displays, speakers, etc.; a storage unit 518, such as a disk, optical disk, etc.; and a communication unit 519, such as a network card, modem, wireless transceiver, etc. The communication unit 519 allows the switching device 510 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0151] Processor 511 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 511 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 511 performs the various methods and processes described above, such as the functional safety requirement allocation method for vehicles.

[0152] In some embodiments, the vehicle functional safety requirements allocation method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 518. In some embodiments, part or all of the computer program may be loaded and / or installed on switching device 510 via ROM 512 and / or communication unit 519. When the computer program is loaded into RAM 513 and executed by processor 511, one or more steps of the vehicle functional safety requirements allocation method described above may be performed. Alternatively, in other embodiments, processor 511 may be configured to perform the vehicle functional safety requirements allocation method by any other suitable means (e.g., by means of firmware).

[0153] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0154] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0155] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0156] To provide interaction with the user, the systems and techniques described herein can be implemented on a switching device having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the switching device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0157] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0158] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0159] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0160] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for allocating functional safety requirements for a vehicle, characterized in that, include: Obtain at least one optional functional safety objective for each function to be assigned in the vehicle; Based on the functions to be assigned, determine the partial functional architecture and the overall vehicle functional architecture; Based on the partial functional architecture, the vehicle functional architecture, and the optional functional safety objectives, the target functional safety requirements are determined. Based on the target functional safety requirements, determine the device functional safety requirements of the functional devices corresponding to the functions to be assigned in the vehicle; The step of determining the target functional safety requirements based on the partial functional architecture, the vehicle functional architecture, and the optional functional safety objectives includes: Determine the vehicle functional safety requirements corresponding to the aforementioned vehicle functional architecture; Based on the partial functional architecture and the optional functional security objectives, determine the partial functional security requirements corresponding to each of the partial functional architectures; Generate target functional safety requirements that include the overall vehicle functional safety requirements and the partial functional safety requirements; The method further includes, after obtaining at least one optional functional safety objective for each function to be assigned in the vehicle: By merging the various optional functional safety objectives, at least one candidate functional safety objective is obtained; Accordingly, before determining the device functional safety requirements of the functional devices corresponding to the functions to be assigned in the vehicle based on the target functional safety requirements, the method further includes: Based on the vehicle functional safety requirements, the candidate functional safety objectives, and the functions to be assigned, generate vehicle functional association relationships; Based on the aforementioned partial functional safety requirements, the optional functional safety objectives, and the functions to be assigned, generate partial functional association relationships; Based on the overall vehicle function association and / or the partial function association, determine the correspondence between functional devices and the target functional safety requirements.

2. The method according to claim 1, characterized in that, After determining the partial functional security requirements corresponding to each of the partial functional architectures based on the partial functional architectures and the optional functional security objectives, the method further includes: Based on the aforementioned partial functional safety requirements, the functional components in the aforementioned partial functional architecture, and the functional safety measures, the aforementioned partial functional safety requirements are updated; Accordingly, the generation of target functional safety requirements, including the overall vehicle functional safety requirements and the partial functional safety requirements, includes: Generate target functional safety requirements that include the overall vehicle functional safety requirements and the updated partial functional safety requirements.

3. The method according to claim 2, characterized in that, After updating the aforementioned functional safety requirements, the method further includes: The functional architecture corresponding to the updated functional security requirements will be updated.

4. The method according to claim 1, characterized in that, The process of determining the partial functional architecture and overall vehicle functional architecture based on each of the functions to be assigned includes: Generate the vehicle functional architecture based on the functional components corresponding to all functions to be assigned. Based on the functional devices corresponding to each of the functions to be assigned, a partial functional architecture corresponding to the function to be assigned is generated.

5. The method according to any one of claims 1-4, characterized in that, The method further includes: For any given functional device, determine whether there are any conflicts among the device functional safety requirements of that functional device; If it exists, the device functional safety requirements for that functional device will be updated.

6. A functional safety requirement allocation device for a vehicle, characterized in that, include: The safety target acquisition module is used to acquire at least one optional functional safety target for each function to be assigned in the vehicle. The functional architecture determination module is used to determine the partial functional architecture and the overall vehicle functional architecture based on the functions to be assigned. The functional safety requirement determination module is used to determine the target functional safety requirements based on the partial functional architecture, the vehicle functional architecture, and the optional functional safety objectives. The functional safety requirement allocation module is used to determine the device functional safety requirements of the functional devices corresponding to the functions to be allocated in the vehicle based on the target functional safety requirements. The functional safety requirement determination module includes: A vehicle functional safety requirement determination unit is used to determine the vehicle functional safety requirements corresponding to the vehicle functional architecture. A partial functional safety requirement determination unit is used to determine the partial functional safety requirements corresponding to each of the partial functional architectures based on the partial functional architectures and the optional functional safety objectives. The target functional safety requirement determination unit is used to generate target functional safety requirements that include the overall vehicle functional safety requirements and the partial functional safety requirements. The device further includes, after the functional safety target acquisition module, the following: The candidate functional safety target determination module is used to merge the various optional functional safety targets to obtain at least one candidate functional safety target; Accordingly, prior to the functional safety requirement allocation module, the device further includes: The vehicle function association determination module is used to generate vehicle function associations based on the vehicle function safety requirements, the candidate function safety targets, and the functions to be assigned. A partial function association determination module is used to generate partial function associations based on the partial function security requirements, the optional function security objectives, and the functions to be assigned. The correspondence determination module is used to determine the correspondence between functional devices and the target functional safety requirements based on the overall vehicle function association relationship and / or the partial function association relationship.

7. An electronic device, characterized in that, include: One or more processors; Memory, used to store one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement a method for allocating functional safety requirements for a vehicle as described in any one of claims 1-5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements a method for allocating functional safety requirements for a vehicle as described in any one of claims 1-5.

Images