An evaluation method for automatic driving intended function safety test scene

Abstract

The application discloses an evaluation method for automatic driving expected function safety test scenes, and evaluation steps of the evaluation method include hazard risk assessment, safety distance assessment, collision detection assessment, cause-effect relationship assessment and collision mitigation assessment. After each step of assessment is completed, whether next step assessment is performed is determined according to an assessment result of the assessment step, and thus test workloads of the test scenes are greatly reduced, and expected function safety development efficiency is improved.

Description

Technical Field

[0001] This invention relates to the field of autonomous driving testing, and more specifically to an evaluation method for testing scenarios involving the expected functional safety of autonomous driving. Background Technology

[0002] Currently, autonomous driving is developing towards higher levels of driver assistance systems. In order to meet the safety requirements of road vehicles, the traditional functional safety standard ISO 26262 can no longer cover the driving scenarios that cause accidents due to performance limitations. ISO 21448 supplements this standard and makes up for the parts that ISO 26262 cannot cover. ISO 21448 defines SOTIF (Safety Of The Intended Functionality) as a hazard caused by insufficient intended function or reasonably foreseeable misuse. It analyzes the causes that may lead to the hazard (i.e., triggering conditions). If the triggering conditions cannot be identified and evaluated by an effective and operable method, it will cause serious safety hazards to autonomous vehicles. Summary of the Invention

[0003] The purpose of this invention is to provide an evaluation method for test scenarios of expected functional safety in autonomous driving, so as to reduce the testing workload of test scenarios and improve the development efficiency of expected functional safety.

[0004] To address the aforementioned technical problems, this invention provides a technical solution: an evaluation method for a test scenario of expected functional safety of autonomous driving, wherein the method performs the following steps on the input test scenario;

[0005] The overall risk score of a test scenario is obtained by multiplying its probability of occurrence, controllability, and severity scores. Then, the overall risk level of the test scenario is determined based on the overall risk score. The overall risk level determines whether the test scenario passes or fails. If the test scenario passes, the evaluation ends; if it fails, the evaluation continues to the next step.

[0006] Based on the driving parameters of the vehicle and adjacent vehicles in the input test scenario, the regional safety level of the vehicle relative to the location of adjacent vehicles is obtained. The test scenario is then judged as to whether it passes based on the regional safety level. If the test scenario passes, the evaluation ends; if the test scenario fails, the subsequent evaluation steps continue.

[0007] The evaluation of a test scenario is determined based on the collision results between the vehicle and adjacent vehicles in the input test scenario. If the test scenario passes, the evaluation ends; if the test scenario fails, the evaluation continues to the next step.

[0008] The cause of the collision is determined based on the autonomous vehicle's active behavior in the input test scenario. The test scenario is then judged as to whether it passes or fails. If the test scenario passes, the evaluation ends; if the test scenario fails, the subsequent evaluation steps continue.

[0009] The collision mitigation evaluation is obtained based on the collision mitigation measures taken by the vehicle before the collision in the input test scenario, and the test scenario is judged as passed based on the collision mitigation evaluation.

[0010] The evaluation results of test scenarios that fail to pass all of the above steps are marked as failed, while the evaluation results of the remaining test scenarios are marked as passed.

[0011] According to the above scheme, the probability score is obtained based on the probability of occurrence of the hazardous event, which is divided into five levels: generally impossible, generally rare, possible, very likely, and almost always. The severity score is obtained based on the severity of the hazardous event, which is divided into five levels: property damage or shock, minor injury, serious injury, major injury, and fatal injury. The controllability score is obtained based on the controllability of the hazardous event, which is divided into five levels: very easy to control, relatively easy to control, moderately difficult to control, relatively difficult to control, and uncontrollable.

[0012] The overall risk level is divided into unacceptable risk, tolerable higher risk, tolerable lower risk, and acceptable risk based on the overall risk score. Test scenarios with an overall risk level of unacceptable risk or tolerable higher risk fail, test scenarios with an overall risk level of tolerable lower risk fail or pass conditionally, and test scenarios with an overall risk level of acceptable risk pass.

[0013] According to the above scheme, the area safety level is divided into four levels: absolutely safe zone, comfort measure zone, emergency measure zone, and insurmountable zone. When the area safety level is absolutely safe zone, the lateral distance between the vehicle and adjacent vehicles is greater than the lateral safe distance and the longitudinal distance is greater than the longitudinal safe distance. When the area safety level is comfort measure zone, the vehicle needs to take measures to avoid a collision, and the measures taken by the vehicle meet the preset comfort measure restrictions. When the area safety level is emergency measure zone, the vehicle needs to take measures to avoid a collision, and the measures taken by the vehicle meet the preset emergency measure restrictions. When the area safety level is emergency measure zone, the vehicle cannot avoid a collision and can only take risk mitigation measures. The vehicle parameters restricted by the comfort measure restrictions and emergency measure restrictions include the acceleration value during deceleration.

[0014] Test scenarios where the area's safety level is deemed unmanageable or an emergency response zone fail; test scenarios where the area's safety level is deemed comfortable or conditionally pass fail; test scenarios where the area's safety level is deemed absolutely safe pass.

[0015] According to the above scheme, the collision result includes whether a collision occurred or not; test scenarios in which a collision occurred are deemed unsuccessful, while test scenarios in which a collision did not occur are deemed successful.

[0016] According to the above scheme, the collision mitigation evaluation includes whether the collision mitigation measures are effective, whether there are no collision mitigation measures, or whether the measures are ineffective. If the following conditions are met: before the vehicle takes collision mitigation measures, the lateral distance between the vehicle and the adjacent vehicle is less than the lateral safe distance and the longitudinal distance is less than the longitudinal safe distance; and the lateral acceleration of the vehicle when taking collision mitigation measures is within the lateral acceleration range of the absolute safe zone, and the longitudinal acceleration of the vehicle when taking collision mitigation measures is within the longitudinal acceleration range of the absolute safe zone, then the collision mitigation evaluation is that the collision mitigation measures are effective; otherwise, the collision mitigation evaluation is that there are no collision mitigation measures or that the measures are ineffective. The lateral acceleration range of the absolute safe zone is the minimum to maximum lateral acceleration required for the vehicle to return to the absolute safe zone, and the longitudinal acceleration range of the absolute safe zone is the minimum to maximum longitudinal acceleration required for the vehicle to return to the absolute safe zone.

[0017] An evaluation device for an autonomous driving expected function safety test scenario, used to perform the evaluation method for the autonomous driving expected function safety test scenario described above, includes an input port, an output port, and an evaluation module. The input port is used to input the test scenario and related parameters of the test scenario, the output port is used to output the evaluation result of the test scenario, and the evaluation module is used to evaluate the steps of the evaluation method for the autonomous driving expected function test scenario described above.

[0018] According to the above scheme, the probability score is obtained based on the probability of occurrence of the hazardous event, which is divided into five levels: generally impossible, generally rare, possible, very likely, and almost always. The severity score is obtained based on the severity of the hazardous event, which is divided into five levels: property damage or shock, minor injury, serious injury, major injury, and fatal injury. The controllability score is obtained based on the controllability of the hazardous event, which is divided into five levels: very easy to control, relatively easy to control, moderately difficult to control, relatively difficult to control, and uncontrollable.

[0019] The overall risk score is the product of the probability of occurrence score, the controllability score, and the severity score. The overall risk level is divided into unacceptable risk, tolerable higher risk, tolerable lower risk, and acceptable risk based on the overall risk score. Test scenarios with an overall risk level of unacceptable risk or tolerable higher risk fail. Test scenarios with an overall risk level of tolerable lower risk fail or pass conditionally. Test scenarios with an overall risk level of acceptable risk pass.

[0020] According to the above scheme, the area safety level is divided into four levels: absolutely safe zone, comfort measure zone, emergency measure zone, and insurmountable zone. When the area safety level is absolutely safe zone, the lateral distance between the vehicle and adjacent vehicles is greater than the lateral safe distance and the longitudinal distance is greater than the longitudinal safe distance. When the area safety level is comfort measure zone, the vehicle needs to take measures to avoid a collision, and the measures taken by the vehicle meet the preset comfort measure restrictions. When the area safety level is emergency measure zone, the vehicle needs to take measures to avoid a collision, and the measures taken by the vehicle meet the preset emergency measure restrictions. When the area safety level is emergency measure zone, the vehicle cannot avoid a collision and can only take risk mitigation measures. The vehicle parameters restricted by the comfort measure restrictions and emergency measure restrictions include the acceleration value during deceleration.

[0021] Test scenarios where the area's safety level is deemed unmanageable or an emergency response zone fail; test scenarios where the area's safety level is deemed comfortable or conditionally pass fail; test scenarios where the area's safety level is deemed absolutely safe pass.

[0022] According to the above scheme, the collision result includes whether a collision occurred or not; test scenarios in which a collision occurred are deemed unsuccessful, while test scenarios in which a collision did not occur are deemed successful.

[0023] According to the above scheme, the collision mitigation evaluation includes whether the collision mitigation measures are effective, whether there are no collision mitigation measures, or whether the measures are ineffective. If the following conditions are met: before the vehicle takes collision mitigation measures, the lateral distance between the vehicle and the adjacent vehicle is less than the lateral safe distance and the longitudinal distance is less than the longitudinal safe distance; and the lateral acceleration of the vehicle when taking collision mitigation measures is within the lateral acceleration range of the absolute safe zone, and the longitudinal acceleration of the vehicle when taking collision mitigation measures is within the longitudinal acceleration range of the absolute safe zone, then the collision mitigation evaluation is that the collision mitigation measures are effective; otherwise, the collision mitigation evaluation is that there are no collision mitigation measures or that the measures are ineffective. The lateral acceleration range of the absolute safe zone is the minimum to maximum lateral acceleration required for the vehicle to return to the absolute safe zone, and the longitudinal acceleration range of the absolute safe zone is the minimum to maximum longitudinal acceleration required for the vehicle to return to the absolute safe zone.

[0024] The beneficial effects of this invention are: the method divides the assessment into five steps, namely, hazard risk assessment, safe distance assessment, collision detection assessment, causal relationship assessment, and collision mitigation assessment. After each step of the assessment is completed, the decision on whether to proceed to the next step is made based on the assessment results of that step, thereby greatly reducing the testing workload of the test scenario and improving the efficiency of expected functional safety development. Attached Figure Description

[0025] Figure 1 This is a flowchart of an evaluation method for a safety testing scenario of expected functions of autonomous driving according to Embodiment 1 of the present invention;

[0026] Figure 2 This is a schematic diagram of the overall risk score acquisition process in Embodiment 1 of the present invention. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of the embodiments of this disclosure clearer, the technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this disclosure. All other embodiments obtained by those skilled in the art based on the described embodiments of this disclosure without creative effort are within the scope of protection of this disclosure.

[0028] Example 1:

[0029] See Figure 1 An evaluation method for a test scenario of expected functional safety of autonomous driving, the method performs the following steps on the input test scenario;

[0030] Based on the probability score, controllability score, and severity score of the input test scenario, the overall risk score of the test scenario is obtained. Then, the overall risk level of the test scenario is divided according to the overall risk score. The overall risk level determines whether the test scenario passes or fails. Test scenarios that pass the evaluation end, while test scenarios that fail continue to the subsequent evaluation steps.

[0031] Based on the driving parameters of the vehicle and adjacent vehicles in the input test scenario, the regional safety level of the vehicle relative to the location of adjacent vehicles is obtained. The test scenario is then judged as to whether it passes based on the regional safety level. If the test scenario passes, the evaluation ends; if the test scenario fails, the subsequent evaluation steps continue.

[0032] The evaluation of a test scenario is determined based on the collision results between the vehicle and adjacent vehicles in the input test scenario. If the test scenario passes, the evaluation ends; if the test scenario fails, the evaluation continues to the next step.

[0033] The cause of the collision is determined based on the autonomous vehicle's active behavior in the input test scenario. The test scenario is then judged as to whether it passes or fails. If the test scenario passes, the evaluation ends; if the test scenario fails, the subsequent evaluation steps continue.

[0034] The collision mitigation evaluation is obtained based on the collision mitigation measures taken by the vehicle before the collision in the input test scenario, and the test scenario is judged as passed based on the collision mitigation evaluation.

[0035] The evaluation result of the test scenario that fails to pass all the above steps is marked as FAIL, and the evaluation result of the remaining test scenarios is marked as PASS.

[0036] The elements of the test scenarios to which this method is applicable include:

[0037] The vehicle's environment (e.g., elevated roads, ordinary roads with traffic lights, etc.);

[0038] The vehicle's status (including vehicle speed and acceleration);

[0039] The relative position and relative speed of the vehicle with other traffic participants;

[0040] External weather conditions for the vehicle;

[0041] Is the driver in the loop?

[0042] Each element in the test scenario is represented by a specific numerical value. The test scenario can be generated manually based on test requirements, or it can be generated by a computer model by arranging and combining different values ​​of the elements.

[0043] Furthermore, the probability score is derived from the probability of the hazardous event occurring, which is divided into five levels: generally impossible, generally rare, possible, highly likely, and almost always. The severity score is derived from the severity of the hazardous event, which is divided into five levels: property damage or shock, minor injury, serious injury, major injury, and fatal injury. The controllability score is derived from the controllability of the hazardous event, which is divided into five levels: very easy to control, relatively easy to control, moderately difficult to control, relatively difficult to control, and uncontrollable.

[0044] The overall risk score is the product of the probability of occurrence score, the controllability score, and the severity score. The overall risk level is divided into unacceptable risk, tolerable higher risk, tolerable lower risk, and acceptable risk based on the overall risk score. Test scenarios with an overall risk level of unacceptable risk or tolerable higher risk fail; test scenarios with an overall risk level of tolerable lower risk fail or pass conditionally; and test scenarios with an overall risk level of acceptable risk pass.

[0045] Specifically, see the overall scoring model. Figure 2 The occurrence probability score, controllability score, and severity score can be obtained through human input (e.g., brainstorming combining prior experience and system limitations) or model analysis; the scoring models for occurrence probability (P), controllability (C), and severity (S) are shown in the table below:

[0046]

[0047]

[0048]

[0049] The scoring model for the overall risk score (R) is shown in the table below:

[0050]

[0051] The results of the hazard risk assessment conducted based on the overall risk level are shown in the table below:

[0052]

[0053] Furthermore, the area safety level is divided into four levels: absolutely safe zone, comfort measure zone, emergency measure zone, and unmanageable zone. When the area safety level is absolutely safe zone, the lateral distance between the vehicle and adjacent vehicles is greater than the lateral safe distance and the longitudinal distance is greater than the longitudinal safe distance. When the area safety level is comfort measure zone, the vehicle needs to take measures to avoid a collision, and the measures taken by the vehicle must meet preset comfort measure limits (in this embodiment, acceleration is less than 4m / s). When the area safety level is an emergency response zone, the vehicle needs to take measures to avoid a collision, and the measures taken by the vehicle must meet the preset emergency response limits (in this embodiment, acceleration greater than 9m / s). When the area safety level is an emergency response area, the vehicle cannot avoid a collision and can only take risk mitigation measures; the vehicle parameters restricted by the comfort measures restrictions and emergency measures restrictions include the acceleration value during deceleration;

[0054] Test scenarios where the area's safety level is deemed unmanageable or an emergency response zone fail; test scenarios where the area's safety level is deemed comfortable or pass conditionally fail; test scenarios where the area's safety level is absolutely safe pass.

[0055] Specifically, lateral safety distance Longitudinal safety distance (for vehicles traveling in the same direction) The definition is as follows (refer to the RSS model):

[0056]

[0057]

[0058] In the formula, For the speed of the vehicle in front, For reaction time, Maximum braking deceleration (longitudinal)

[0059] , Minimum braking deceleration (longitudinal), For the speed of the following vehicle, The initial lateral distance between car number one (left) and car number two (right). The initial speed of car number 1 (left) For vehicle number one (left), reaction time The speed after that, This is the minimum braking deceleration (lateral). The initial velocity of car number two (right) is... For vehicle number 2 (right), during the reaction time The speed after the "+" indicates that the positive sign is applied.

[0060] The results of the safety distance assessment are shown in the table below:

[0061]

[0062] Furthermore, the collision result includes whether a collision occurred or not; test scenarios where a collision occurred are deemed unsuccessful, while test scenarios where no collision occurred are deemed successful.

[0063] Specifically, the collision results are evaluated using the collision index CI, as follows:

[0064]

[0065] In the formula, , These represent the lateral and longitudinal distances (in meters) between the vehicle and surrounding road users, respectively.

[0066] The collision detection evaluation results are shown in the table below:

[0067]

[0068] Furthermore, the causes of a collision can be categorized as either the vehicle's own fault or other causes.

[0069] Specifically, causality assessment is used to analyze whether the cause of the collision is related to the vehicle. If this analysis is performed on all braking and driving vehicles, the cause of the collision can be found. The causality assessment result is represented by causality CA. If CA=1, it means that the cause of the collision is related to the vehicle, and if CA=0, it means that the cause of the collision is not related to the vehicle.

[0070] The results of the causal relationship assessment are shown in the table below:

[0071]

[0072] Furthermore, the collision mitigation evaluation includes whether the collision mitigation measures are effective, whether there are no collision mitigation measures, or whether the measures are ineffective. If the following conditions are met: before the vehicle takes collision mitigation measures, the lateral distance between the vehicle and the adjacent vehicle is less than the lateral safe distance and the longitudinal distance is less than the longitudinal safe distance; and the lateral acceleration of the vehicle when taking collision mitigation measures is within the lateral acceleration range of the absolute safe zone, and the longitudinal acceleration of the vehicle when taking collision mitigation measures is within the longitudinal acceleration range of the absolute safe zone, then the collision mitigation evaluation is that the collision mitigation measures are effective; otherwise, the collision mitigation evaluation is that there are no collision mitigation measures or the measures are ineffective. The lateral acceleration range of the absolute safe zone is the minimum to maximum lateral acceleration required for the vehicle to return to the absolute safe zone, and the longitudinal acceleration range of the absolute safe zone is the minimum to maximum longitudinal acceleration required for the vehicle to return to the absolute safe zone.

[0073] Specifically, the collision mitigation assessment is represented by the appropriate response activity characteristic value (PRA):

[0074]

[0075] In the above formula, Minimum lateral acceleration required for the vehicle to re-reach the safe boundary, unit: m / s² ; The maximum lateral acceleration required for the vehicle to re-reach the safety boundary, in m / s². , Minimum longitudinal acceleration required for the vehicle to re-reach the safety boundary, unit: m / s² , The maximum longitudinal acceleration required for the vehicle to re-reach the safety boundary, in m / s². ;

[0076] The minimum safe distance violation characteristic value is defined as follows:

[0077]

[0078] In the above formula, The lateral distance between the vehicle and surrounding road users. This refers to the longitudinal distance between the vehicle and surrounding road users. The longitudinal safe distance between the vehicle and surrounding road users;

[0079] The collision assessment results are shown in the table below:

[0080]

[0081] Example 2:

[0082] An evaluation device for a test scenario of expected functions of autonomous driving is provided. The device includes an input port, an output port, and an evaluation module. The input port is used to input the test scenario and related parameters of the test scenario. The output port is used to output the evaluation result of the test scenario. The evaluation module is used to evaluate the steps of the method for evaluating test scenarios of expected functions of autonomous driving based on the input test scenario.

[0083] Furthermore, the probability score is derived from the probability of the hazardous event occurring, which is divided into five levels: generally impossible, generally rare, possible, highly likely, and almost always. The severity score is derived from the severity of the hazardous event, which is divided into five levels: property damage or shock, minor injury, serious injury, major injury, and fatal injury. The controllability score is derived from the controllability of the hazardous event, which is divided into five levels: very easy to control, relatively easy to control, moderately difficult to control, relatively difficult to control, and uncontrollable.

[0084] The overall risk score is the product of the probability of occurrence score, the controllability score, and the severity score. The overall risk level is divided into unacceptable risk, tolerable higher risk, tolerable lower risk, and acceptable risk based on the overall risk score. Test scenarios with an overall risk level of unacceptable risk or tolerable higher risk fail. Test scenarios with an overall risk level of tolerable lower risk fail or pass conditionally. Test scenarios with an overall risk level of acceptable risk pass.

[0085] Furthermore, the area safety level is divided into four levels: absolutely safe zone, comfort measure zone, emergency measure zone, and insurmountable zone. In the absolutely safe zone, the lateral distance between the vehicle and adjacent vehicles is greater than the lateral safe distance, and the longitudinal distance is greater than the longitudinal safe distance. In the comfort measure zone, the vehicle needs to take measures to avoid a collision, and the measures taken meet preset comfort measure limits. In the emergency measure zone, the vehicle needs to take measures to avoid a collision, and the measures taken meet preset emergency measure limits. In the emergency measure zone, the vehicle cannot avoid a collision and can only take risk mitigation measures. The vehicle parameters limited by the comfort measure and emergency measure limits include the acceleration value during deceleration.

[0086] Test scenarios where the area's safety level is deemed unmanageable or an emergency response zone fail; test scenarios where the area's safety level is deemed comfortable or conditionally pass fail; test scenarios where the area's safety level is deemed absolutely safe pass.

[0087] Furthermore, the collision result includes whether a collision occurred or not; a test scenario in which a collision occurred is deemed unsuccessful, while a test scenario in which a collision did not occur is deemed successful.

[0088] Furthermore, the collision mitigation evaluation includes whether the collision mitigation measures are effective, or whether there are no collision mitigation measures or the measures are ineffective. If the following conditions are met: before the vehicle takes collision mitigation measures, the lateral distance between the vehicle and the adjacent vehicle is less than the lateral safe distance and the longitudinal distance is less than the longitudinal safe distance; and the lateral acceleration of the vehicle when taking collision mitigation measures is within the lateral acceleration range of the absolute safe zone, and the longitudinal acceleration of the vehicle when taking collision mitigation measures is within the longitudinal acceleration range of the absolute safe zone, then the collision mitigation evaluation is that the collision mitigation measures are effective; otherwise, the collision mitigation evaluation is that there are no collision mitigation measures or the measures are ineffective. The lateral acceleration range of the absolute safe zone is the minimum to maximum lateral acceleration required for the vehicle to return to the absolute safe zone, and the longitudinal acceleration range of the absolute safe zone is the minimum to maximum longitudinal acceleration required for the vehicle to return to the absolute safe zone.

[0089] The above description is merely an embodiment of the present invention and does not limit the patent scope of the present invention. Any equivalent structural or procedural transformations made based on the content of the present invention specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of the present invention.

Claims

1. An evaluation method for testing expected functional safety scenarios in autonomous driving, characterized in that: This method performs the following steps on the input test scenario; The overall risk score of a test scenario is obtained by multiplying its probability of occurrence, controllability, and severity scores. Then, the overall risk level of the test scenario is determined based on the overall risk score. The overall risk level determines whether the test scenario passes or fails. Test scenarios that pass the evaluation end, while test scenarios that fail continue to the next evaluation steps. Based on the driving parameters of the vehicle and adjacent vehicles in the input test scenario, the regional safety level of the vehicle relative to the location of adjacent vehicles is obtained. The test scenario is then judged as to whether it passes based on the regional safety level. If the test scenario passes, the evaluation ends; if the test scenario fails, the subsequent evaluation steps continue. The evaluation of a test scenario is determined based on the collision results between the vehicle and adjacent vehicles in the input test scenario. If the test scenario passes, the evaluation ends; if the test scenario fails, the subsequent evaluation steps continue. The cause of the collision is determined based on the autonomous vehicle's active behavior in the input test scenario. The test scenario is then judged as to whether it passes or fails. If the test scenario passes, the evaluation ends; if the test scenario fails, the subsequent evaluation steps continue. The collision mitigation evaluation is obtained based on the collision mitigation measures taken by the vehicle before the collision in the input test scenario, and the test scenario is judged as passed based on the collision mitigation evaluation. The evaluation results of test scenarios that fail to pass all the above steps are marked as failed, while the evaluation results of the remaining test scenarios are marked as passed.

2. The evaluation method for autonomous driving expected functional safety test scenarios according to claim 1, characterized in that: The probability score is based on the probability of the hazardous event occurring, which is divided into five levels: generally impossible, generally rare, possible, very likely, and almost always. The severity score is based on the severity of the hazardous event, which is divided into five levels: property damage or shock, minor injury, serious injury, major injury, and fatal injury. The controllability score is based on the controllability of the hazardous event, which is divided into five levels: very easy to control, relatively easy to control, moderately difficult to control, relatively difficult to control, and uncontrollable. The overall risk level is divided into unacceptable risk, tolerable higher risk, tolerable lower risk, and acceptable risk based on the overall risk score. Test scenarios with an overall risk level of unacceptable risk or tolerable higher risk fail, test scenarios with an overall risk level of tolerable lower risk fail or pass conditionally, and test scenarios with an overall risk level of acceptable risk pass.

3. The evaluation method for the expected functional safety test scenario of autonomous driving according to claim 1, characterized in that: The area safety level is divided into four levels: absolutely safe zone, comfort measure zone, emergency measure zone, and insurmountable zone. In the absolutely safe zone, the lateral distance between the vehicle and adjacent vehicles is greater than the lateral safe distance, and the longitudinal distance is also greater than the longitudinal safe distance. In the comfort measure zone, the vehicle needs to take measures to avoid a collision, and these measures meet preset comfort measure limits. In the emergency measure zone, the vehicle needs to take measures to avoid a collision, and these measures meet preset emergency measure limits. In the emergency measure zone, the vehicle cannot avoid a collision and can only take risk mitigation measures. The vehicle parameters limited by the comfort measure and emergency measure limits include the acceleration value during deceleration. Test scenarios where the area's safety level is deemed unmanageable or an emergency response zone fail; test scenarios where the area's safety level is deemed comfortable or conditionally pass fail; test scenarios where the area's safety level is deemed absolutely safe pass.

4. The evaluation method for autonomous driving expected functional safety test scenarios according to claim 1, characterized in that: The collision result includes whether a collision occurred or not. Test scenarios where a collision occurred are deemed unsuccessful, while test scenarios where no collision occurred are deemed successful.

5. The evaluation method for the expected functional safety test scenario of autonomous driving according to claim 3, characterized in that: The collision mitigation evaluation includes whether the collision mitigation measures are effective, or whether there are no collision mitigation measures or the measures are ineffective. If the following conditions are met: before the vehicle takes collision mitigation measures, the lateral distance between the vehicle and the adjacent vehicle is less than the lateral safe distance and the longitudinal distance is less than the longitudinal safe distance; and the lateral acceleration of the vehicle when taking collision mitigation measures is within the lateral acceleration range of the absolute safe zone, and the longitudinal acceleration of the vehicle when taking collision mitigation measures is within the longitudinal acceleration range of the absolute safe zone, then the collision mitigation evaluation is that the collision mitigation measures are effective; otherwise, the collision mitigation evaluation is that there are no collision mitigation measures or the measures are ineffective. The lateral acceleration range of the absolute safe zone is the minimum to maximum lateral acceleration required for the vehicle to return to the absolute safe zone, and the longitudinal acceleration range of the absolute safe zone is the minimum to maximum longitudinal acceleration required for the vehicle to return to the absolute safe zone.

6. An evaluation apparatus for an autonomous driving expected functional safety test scenario, used to perform the evaluation method for an autonomous driving expected functional safety test scenario as described in any one of claims 1-5, characterized in that: The device includes an input port, an output port, and an evaluation module. The input port is used to input a test scenario and related parameters of the test scenario. The output port is used to output the evaluation result of the test scenario. The evaluation module is used to perform the steps of the evaluation method for test scenarios of expected functions of autonomous driving as described in any one of claims 1-5 on the input test scenario.

7. The evaluation device for the expected functional safety test scenario of autonomous driving according to claim 6, characterized in that: The probability score is based on the probability of the hazardous event occurring, which is divided into five levels: generally impossible, generally rare, possible, very likely, and almost always. The severity score is based on the severity of the hazardous event, which is divided into five levels: property damage or shock, minor injury, serious injury, major injury, and fatal injury. The controllability score is based on the controllability of the hazardous event, which is divided into five levels: very easy to control, relatively easy to control, moderately difficult to control, relatively difficult to control, and uncontrollable. The overall risk score is the product of the probability of occurrence score, the controllability score, and the severity score. The overall risk level is divided into unacceptable risk, tolerable higher risk, tolerable lower risk, and acceptable risk based on the overall risk score. Test scenarios with an overall risk level of unacceptable risk or tolerable higher risk fail. Test scenarios with an overall risk level of tolerable lower risk fail or pass conditionally. Test scenarios with an overall risk level of acceptable risk pass.

8. The evaluation device for the expected functional safety test scenario of autonomous driving according to claim 6, characterized in that: The area safety level is divided into four levels: absolutely safe zone, comfort measure zone, emergency measure zone, and insurmountable zone. In the absolutely safe zone, the lateral distance between the vehicle and adjacent vehicles is greater than the lateral safe distance, and the longitudinal distance is also greater than the longitudinal safe distance. In the comfort measure zone, the vehicle needs to take measures to avoid a collision, and these measures meet preset comfort measure limits. In the emergency measure zone, the vehicle needs to take measures to avoid a collision, and these measures meet preset emergency measure limits. In the emergency measure zone, the vehicle cannot avoid a collision and can only take risk mitigation measures. The vehicle parameters limited by the comfort measure and emergency measure limits include the acceleration value during deceleration. Test scenarios where the area's safety level is deemed unmanageable or an emergency response zone fail; test scenarios where the area's safety level is deemed comfortable or conditionally pass fail; test scenarios where the area's safety level is deemed absolutely safe pass.

9. The evaluation device for the expected functional safety test scenario of autonomous driving according to claim 6, characterized in that: The collision result includes whether a collision occurred or not. Test scenarios where a collision occurred are deemed unsuccessful, while test scenarios where no collision occurred are deemed successful.

10. The evaluation device for the expected functional safety test scenario of autonomous driving according to claim 8, characterized in that: The collision mitigation evaluation includes whether the collision mitigation measures are effective, or whether there are no collision mitigation measures or the measures are ineffective. If the following conditions are met: before the vehicle takes collision mitigation measures, the lateral distance between the vehicle and the adjacent vehicle is less than the lateral safe distance and the longitudinal distance is less than the longitudinal safe distance; and the lateral acceleration of the vehicle when taking collision mitigation measures is within the lateral acceleration range of the absolute safe zone, and the longitudinal acceleration of the vehicle when taking collision mitigation measures is within the longitudinal acceleration range of the absolute safe zone, then the collision mitigation evaluation is that the collision mitigation measures are effective; otherwise, the collision mitigation evaluation is that there are no collision mitigation measures or the measures are ineffective. The lateral acceleration range of the absolute safe zone is the minimum to maximum lateral acceleration required for the vehicle to return to the absolute safe zone, and the longitudinal acceleration range of the absolute safe zone is the minimum to maximum longitudinal acceleration required for the vehicle to return to the absolute safe zone.

Images