Function security analysis method and device and storage medium
By obtaining and filtering the initial scene database, selecting related scenarios that match the vehicle functions for safety analysis, the problem of insufficient credibility of vehicle functional safety analysis results is solved, and higher safety and credibility of analysis results is achieved.
Patent Information
- Application Number
- CN202410997331.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-07-23
- Publication Date
- 2024-12-13
AI Technical Summary
The prior art is difficult to improve the credibility of vehicle functional safety analysis results, resulting in insufficient vehicle safety.
By obtaining the initial scene library, selecting the associated scenarios that match the vehicle's function to be analyzed, performing safety analysis, and determining the complete results of the associated scenarios to evaluate whether the scene coverage meets the safety analysis requirements, thereby improving the credibility of the safety analysis results. .
Through completeness verification, ensure that the safety analysis results cover as many scenarios as possible, improving the credibility of the analysis results and the safety of the vehicle.
Smart Images
Figure CN119128894A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of vehicle development technology, and in particular to a functional safety analysis method, device and storage medium. Background Art
[0002] With the acceleration of vehicle electrification and intelligence, more and more vehicle functions rely on electronic and electrical systems, the complexity and integration of the system are becoming higher and higher, and the safety risks brought by functional failure are correspondingly increasing. Therefore, functional safety is gradually becoming a hot topic in the industry.
[0003] HARA analysis provides a basis for subsequent safety design and development by systematically identifying and evaluating potential hazardous events in vehicle functions. The credibility of the analysis results is closely related to the safety of the vehicle during the design and implementation stages, so how to improve the credibility of the analysis results is crucial to vehicle safety. Summary of the invention
[0004] The main technical problem solved by the present application is to provide a functional safety analysis method, device and storage medium, which can improve the credibility of safety analysis results.
[0005] In order to solve the above technical problems, a technical solution adopted in the present application is: to provide a functional safety analysis method, the method comprising: obtaining an initial scenario library; selecting associated scenarios that match the vehicle function to be analyzed from the initial scenario library; based on the associated scenarios, performing a safety analysis on the function to be analyzed, and obtaining a safety analysis result of the function to be analyzed; based on the safety analysis result, determining the completeness result of the associated scenarios; the completeness result is used to characterize whether the scenario coverage of the associated scenarios meets the safety analysis requirements when performing a safety analysis on the function to be analyzed.
[0006] Among them, obtaining the initial scenario library includes: obtaining the first environmental factor under each target environment category; the first environmental factor under each target environment category is obtained by classifying several second environmental factors that affect the operation of the vehicle; the first environmental factors under different target environment categories are arranged and combined to obtain several scenarios in the initial scenario library.
[0007] Among them, each scene in the initial scene library is formed by arranging and combining the first environmental factors under different target environment categories; selecting an associated scene matching the vehicle function to be analyzed from the initial scene library, including: determining the associated environment category of the function to be analyzed from the target environment category; selecting several candidate scenes containing the third environmental factor of the associated environment category from the initial scene library; for each candidate scene, in response to the candidate scene being consistent with the actual working condition of the vehicle using the function to be analyzed, determining the candidate scene as an associated scene of the analysis function.
[0008] Among them, in the process of selecting associated scenes that match the vehicle's function to be analyzed from the initial scene library, the method also includes: eliminating the remaining scenes in the initial scene library except the associated scenes, and / or, adding reasons for not matching the vehicle's function to be analyzed to the remaining scenes; and / or, after selecting associated scenes that match the vehicle's function to be analyzed from the initial scene library, the method also includes: adding the associated scenes of the function to be analyzed to the initial scene library; and / or, the target environment category includes the vehicle's driving location, road conditions, driving maneuvers, vehicle status, other vehicle characteristics and at least part of other considerations.
[0009] Among them, after eliminating the remaining scenes except the associated scenes in the initial scene library and adding reasons for the remaining scenes not matching the vehicle functions to be analyzed, the method also includes: verifying whether the operation of eliminating the remaining scenes is reasonable based on the reasons.
[0010] Among them, the number of associated scenarios is multiple, and the safety analysis results include hazard events; based on the associated scenarios, a safety analysis is performed on the function to be analyzed, and the safety analysis results of the function to be analyzed are obtained, including: performing hazard and operability analysis on the function to be analyzed to obtain the failure type of the function to be analyzed, and establishing a hazard event by combining each associated scenario and the failure type of the function to be analyzed.
[0011] Wherein, establishing a hazardous event in combination with each associated scenario and the failure type of the function to be analyzed includes: selecting a hazardous associated scenario from the associated scenarios based on the failure type of the function to be analyzed; wherein there is a safety risk when the vehicle operates under the failure type and the hazardous associated scenario; associating the hazardous associated scenario and the failure type to establish the hazardous event; and / or, the safety analysis result also includes the vehicle safety integrity level of the hazardous event; after the hazard and operability analysis is performed on the function to be analyzed in combination with each associated scenario and the failure type of the function to be analyzed and the hazardous event is established, the method also includes: performing severity and controllability assessments on the hazardous event respectively to determine the severity result and controllability result of the hazardous event; determining the vehicle safety integrity level of the hazardous event by comprehensively considering the severity result, controllability result and exposure level of the hazardous event; wherein the exposure level of the hazardous event is the exposure level that meets the preset requirements among the exposure levels corresponding to each environment in the hazard associated scenario.
[0012] Among them, the safety analysis results also include hazard associated scenarios; based on the safety analysis results, the completeness results of the associated scenarios are determined, including: respectively determining the first number of environmental categories and the second number of environments in the hazard associated scenarios, and respectively determining the third number of environmental categories and the fourth number of environments in the initial scenario library; determining a first ratio of the first number to the third number, and a second ratio of the second number to the fourth number; in response to the first ratio being greater than a first preset threshold and the second ratio being greater than a second preset threshold, determining that the scene coverage of the associated scenarios meets the safety analysis requirements.
[0013] To solve the above technical problems, another technical solution adopted in the present application is: to provide an electronic device, comprising a memory and a processor coupled to each other, the memory storing program instructions; the processor is used to execute the program instructions stored in the memory to implement the above method.
[0014] In order to solve the above technical problem, another technical solution adopted by the present application is: providing a computer-readable storage medium for storing program instructions, which can be executed to implement the above method.
[0015] The above scheme first selects the associated scenarios that match the vehicle's function to be analyzed from the initial scenario library, and performs a safety analysis on the function to be analyzed based on the associated scenarios. After obtaining the safety analysis results of the function to be analyzed, the completeness results of the associated scenarios are determined based on the safety analysis results. Among them, the completeness results are used to characterize whether the scene coverage of the associated scenarios of the function to be analyzed meets the safety analysis requirements when the safety analysis is performed on the function to be analyzed. After performing a safety analysis on the function to be analyzed and obtaining the safety analysis results, the present application performs a completeness check on the associated scenarios. Compared with the method of not performing a completeness check on the associated scenarios, the above-mentioned verification method of the present application can determine whether the scene coverage of the associated scenarios of the function to be analyzed meets the safety analysis requirements when the safety analysis is performed on the function to be analyzed, thereby improving the credibility of the safety analysis results. BRIEF DESCRIPTION OF THE DRAWINGS
[0016] Figure 1 It is a flow chart of an embodiment of a functional safety analysis method provided by the present application;
[0017] Figure 2 yes Figure 1 The flowchart of step S13 is shown as an embodiment;
[0018] Figure 3 It is a schematic diagram of a framework of an embodiment of an electronic device provided by the present application;
[0019] Figure 4 It is a schematic diagram of the framework of the computer-readable storage medium provided by this application. DETAILED DESCRIPTION
[0020] In order to make the purpose, technical solution and effect of the present application clearer and more specific, the present application is further described in detail below with reference to the accompanying drawings and examples.
[0021] In addition, if there are descriptions involving "first", "second", etc. in the embodiments of the present application, the descriptions of "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or suggesting their relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in the field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such combination of technical solutions does not exist and is not within the scope of protection required by this application.
[0022] It should be noted that the functional safety method of the present application is essentially an optimized hazard analysis and risk assessment (HARA) method for performing safety analysis on various functions of a vehicle. Vehicle functions may be, for example, safety performance-related functions, driver assistance functions, power system-related functions, or control system-related functions.
[0023] See also Figure 1 , Figure 1 is a flow chart of an embodiment of the functional safety analysis method provided by the present application. It should be noted that if there are substantially the same results, this embodiment does not Figure 1 The process sequence shown is limited. Figure 1 As shown, this embodiment includes:
[0024] S11: Obtain an initial scene library.
[0025] This embodiment is used to perform safety analysis on each function to be analyzed of the vehicle, determine the safety analysis results corresponding to each function, and then use the safety analysis results corresponding to each function to verify whether the scenario coverage of the associated scenarios used in the safety analysis of the function to be analyzed meets the safety analysis requirements. If the scenario coverage of the associated scenarios meets the safety analysis requirements, it indicates that the safety analysis results are obtained by analyzing as many scenarios as possible, rather than the analysis results corresponding to the safety analysis of only some typical scenarios.
[0026] It should be noted that each scenario in the initial scenario library contains different combinations of environmental factors; considering that limited scenarios cannot provide strong support for functional safety analysis, and fewer environmental factors cannot build sufficient scenarios, in order to build a sufficient number of scenario libraries, it is necessary to obtain enough environmental factors.
[0027] In some embodiments, the initial scenario library can be constructed by combining the vehicle operating environments recorded in the existing and relatively large functional safety standards or functional safety-related standards. For example, the initial scenario library can be constructed by combining data such as environmental factors in vehicle operating scenarios recorded in at least two of the three standards ISO26262, VDA702, and J2980.
[0028] In one embodiment, the second environmental factors that affect the vehicle operation scene can be classified into categories to obtain the first environmental factors under each target environmental category, and then the first environmental factors under different environmental categories can be arranged and combined to obtain several scenes in the initial scene library. Among them, the second environmental factors can be environmental factors recorded in at least two of the three standards of ISO26262, VDA702 and J2980.
[0029] In a specific embodiment, the target environment categories include at least some of the location where the vehicle is traveling, road conditions, driving maneuvers, vehicle status, other vehicle characteristics, and other considerations.
[0030] The first environmental factors included in the location where the vehicle is traveling include at least part of highways, rural roads, urban roads, intersections, muddy roads, off-road roads, parking lots, roads, and maintenance stations. Road conditions include at least part of road friction (dry, ice and snow, snow accumulation, wet, different adhesion coefficients), slopes, and road widths; driving operations include at least part of starting, parking, moving forward, reversing, driving straight, turning, avoiding lanes, changing lanes, and closing; vehicle status includes at least part of cruising, crawling, accelerating, decelerating, parking, stopping, and collision; other considerations include at least part of side wind, oncoming traffic, construction areas, accident scenes, traffic jams, and pedestrians; other vehicle characteristics include at least part of the system status of other vehicles, fault codes, trailers, heavy loads, flameouts, ignitions, and remote vehicle start-ups. In this embodiment, the first environmental factors under different environmental categories can be arranged and combined to obtain several scenes in the initial scene library.
[0031] It should be noted that in the process of arranging and combining the first environmental factors under different environmental categories, for each target environmental category, one or more first environmental factors under the environmental category can be selected and arranged in combination with one or more first environmental factors under other target environmental categories.
[0032] S12: Selecting associated scenes matching the vehicle function to be analyzed from the initial scene library.
[0033] It should be noted that in this embodiment, there are one or more functions to be analyzed. When there are multiple functions to be analyzed, step S12 needs to select associated scenes that match the respective functions to be analyzed of the vehicle from the initial scene library.
[0034] In one embodiment, for each scenario in the initial scenario library, it can be determined whether the scenario meets the actual working condition of the vehicle using the function to be analyzed. If so, the scenario is determined to be an associated scenario of the function to be analyzed.
[0035] In another embodiment, according to the analysis requirements of the function to be analyzed, the associated environment category of the function to be analyzed can be determined from the target environment category, and then several candidate scenes containing the third environmental factor of the associated environment category can be selected from the initial scene library; for each candidate scene, in response to the candidate scene being consistent with the actual working conditions of the vehicle using the function to be analyzed, the candidate scene is determined to be an associated scene of the function to be analyzed.
[0036] Exemplarily, the target environment categories include four categories, ABCD, among which the target environment category required for the safety analysis of the function to be analyzed is ABD (which is the associated environment category of the function to be analyzed). Therefore, in this embodiment, the scene containing the third environmental factor corresponding to the target environment category ABD can be directly selected from the initial scene library (as a candidate scene), wherein not all candidate scenes can meet the actual working conditions of the vehicle using the function to be analyzed. For example, the function to be analyzed is the output braking torque function, and the candidate scene is a scene in which the vehicle is stationary and the engine is turned off. In the scene in which the vehicle is stationary and the engine is turned off, the output braking torque function will not be used, that is, the stationary scene does not meet the working conditions of the vehicle output braking torque function, so the stationary scene is not an associated scene of the output braking torque function. Therefore, in this embodiment, it is necessary to perform processing for each candidate scene to determine whether the candidate scene meets the actual working conditions of the vehicle using the function to be analyzed.
[0037] In one embodiment, in the process of selecting the associated scenes that match the vehicle function to be analyzed from the initial scene library, the remaining scenes in the initial scene library except the associated scenes can also be eliminated, and reasons for not matching the vehicle function to be analyzed can be added to the remaining scenes.
[0038] In an optional implementation, a scene screening table can also be constructed for selecting the associated scenes matching the vehicle function to be analyzed from the initial scene library. During the screening process, the associated scenes of the function to be analyzed are marked for selection, and the scenes that are not associated scenes of the function to be analyzed are marked for elimination or not marked to distinguish the scenes from the associated scenes, and the reasons for the elimination of the scenes are noted in the table. It should be noted that the above-mentioned "eliminating the remaining scenes in the initial scene library except the associated scenes" does not mean eliminating the remaining scenes from the initial scene library, but is used to indicate that the remaining scenes are irrelevant to the safety analysis of the function to be analyzed, that is, when the associated scenes are used to perform safety analysis on the function to be analyzed later, the remaining scenes marked for elimination or not marked do not need to be considered.
[0039] In some embodiments, after eliminating the remaining scenes in the initial scene library except the associated scenes and adding reasons for the remaining scenes not matching the vehicle functions to be analyzed, it is also possible to verify whether the above-mentioned operation of eliminating the remaining scenes is reasonable based on the added reasons for not matching the vehicle functions to be analyzed.
[0040] Specifically, based on the reasons for adding the corresponding remaining scenes, it is verified why the remaining scenes were not selected in the process of selecting the associated scenes matching the vehicle functions to be analyzed from the initial scene library, and then it is verified whether the selected associated scenes are reasonable.
[0041] In some embodiments, after selecting the associated scene matching the vehicle function to be analyzed from the initial scene library, the associated scene of the function to be analyzed can also be added to the initial scene library. That is, in this application, each time a safety analysis is performed on a function to be analyzed, the associated scene corresponding to the function to be analyzed is added to the initial scene library, so that the initial scene library is gradually improved as the number of analyzed functions increases.
[0042] S13: Based on the associated scenarios, perform security analysis on the function to be analyzed and obtain security analysis results of the function to be analyzed.
[0043] It should be noted that each function to be analyzed corresponds to multiple associated scenarios, and a security analysis is performed on the function to be analyzed based on each associated scenario. The obtained security analysis results of the function to be analyzed include the hazard events obtained by the analysis.
[0044] It should also be noted that when the corresponding function to be analyzed is used in any associated scenario, there are two situations: normal use of the function and abnormal use of the function, and the types of abnormal functions of different functions to be analyzed are different. For example, in a certain associated scenario, the torque value of the output drive torque is A, but due to vehicle abnormalities, the output torque may be abnormal, such as excessive output torque, too small output torque, or output torque stuck.
[0045] In one embodiment, based on the associated scenarios, a security analysis is performed on the function to be analyzed to obtain the security analysis results of the function to be analyzed, including: performing a hazard and operability analysis on the function to be analyzed to obtain the failure type of the function to be analyzed, and establishing a hazard event in combination with each associated scenario and the failure type of the function to be analyzed. That is, in this embodiment, a hazard and operability analysis is performed on the function to be analyzed to determine the functional failure (abnormality) that may exist in the function to be analyzed. Among them, the failure type of the function to be analyzed is related to the specific function to be analyzed. For the specific method of establishing a hazard event, please refer to Figure 2 Related description of the illustrated embodiment.
[0046] In one implementation scenario, the function to be analyzed includes an output drive torque function, the failure type of which may include but is not limited to at least one of an output drive torque greater than an expected output torque, an output drive torque less than an expected output torque, an inability to output the expected torque, an unexpected output torque, and an output torque stuck; it may also be an output torque that is too large (the output drive torque is greater than the expected output torque, and the difference between the output drive torque and the expected output torque is greater than a first preset threshold), or an output torque that is too small (the output drive torque is less than the expected output torque, and the difference between the output drive torque and the expected output torque is less than a second preset threshold).
[0047] In another embodiment, the above safety analysis results also include the automobile safety integrity level of the hazardous event. After the hazardous event is established in combination with each associated scenario and the failure type of the function to be analyzed, the severity and controllability of the hazardous event can be further evaluated to determine the severity result and controllability result of the hazardous event, and then the severity result, controllability result and exposure level of the hazardous event are combined to determine the automobile safety integrity level of the hazardous event, and finally the hazard analysis and risk assessment report of the function to be analyzed is output. The exposure level of the hazardous event is the exposure level that meets the preset requirements among the exposure levels corresponding to the environmental factors in the hazardous associated scenario that causes the hazardous event in the associated scenario; in one embodiment, the level of each environmental factor in the associated scenario can be defined when the associated scenario is established.
[0048] In a specific embodiment, if the environmental factors in the hazard-related scenario are independent of each other and the hazard of the function failure to be analyzed is related to the occurrence frequency of the hazard-related scenario, the occurrence frequency of the hazard-related scenario can be determined by multiplying the occurrence frequencies corresponding to the environmental factors, and further determining the exposure level that meets the preset requirements. Of course, the minimum of the exposure levels corresponding to the environmental factors in the hazard-related scenario can also be used as the exposure level that meets the preset requirements.
[0049] S14: Based on the safety analysis results, determine the completeness results of the associated scenarios; the completeness results are used to characterize whether the scenario coverage of the associated scenarios meets the safety analysis requirements when performing safety analysis on the function to be analyzed.
[0050] In one embodiment, after determining the above-mentioned hazard-associated scenarios, the first number of environmental categories and the second number of environmental factors in the hazard-associated scenarios can be determined respectively, and the third number of environmental categories and the fourth number of environmental factors in the initial scenario library can be determined respectively; then the first ratio of the first number to the third number, and the second ratio of the second number to the fourth number are determined; if the first ratio is greater than the first preset threshold, and the second ratio is greater than the second preset threshold, it is determined that the scenario coverage of the associated scenarios meets the safety analysis requirements. Wherein, when the scenario coverage of the associated scenarios meets the safety analysis requirements, it indicates that the safety analysis result of the function to be analyzed is the result obtained by analyzing as many scenarios as possible, and the credibility of the obtained safety analysis result is high.
[0051] In another embodiment, after determining the above-mentioned hazard association scenario, the first number of environmental categories and the second number of environmental factors in the hazard association scenario can be determined respectively, and the fifth number of environmental categories and the sixth number of environmental factors in the association scenario can be determined respectively, and then the third ratio of the first number to the fifth number and the fourth ratio of the second number to the sixth number can be determined. If the third ratio and the fourth ratio are respectively greater than the corresponding preset thresholds, it can also be determined that the scenario coverage of the association scenario meets the safety analysis requirements. The specific preset threshold values and are determined according to actual conditions.
[0052] It should be noted that the number of scenes in the above-mentioned hazard association scenes, associated scenes and initial scene libraries are all multiple, and the first number is the total number of environmental categories covered in the multiple hazard association scenes. Exemplarily, the environmental categories covered by hazard association scene 1 are ABC, and the environmental categories covered by hazard association scene 2 are AB, then the number of environmental categories covered by the hazard association scene is 3. The method of covering environmental categories in the associated scenes and the initial scene library is the same as that of the hazard association scenes, and will not be explained one by one here.
[0053] The above scheme first selects the associated scenarios that match the vehicle function to be analyzed from the initial scenario library, and performs a safety analysis on the function to be analyzed based on the associated scenarios. After obtaining the safety analysis results of the function to be analyzed, the completeness results of the associated scenarios are determined based on the safety analysis results. Among them, the completeness results are used to characterize whether the scene coverage of the associated scenarios of the function to be analyzed meets the safety analysis requirements when the safety analysis is performed on the function to be analyzed. After performing a safety analysis on the function to be analyzed and obtaining the safety analysis results, the present application performs a completeness check on the associated scenarios. Compared with the method of not performing a completeness check on the associated scenarios, the above-mentioned verification method of the present application can determine whether the scene coverage of the associated scenarios of the function to be analyzed meets the safety analysis requirements when the safety analysis is performed on the function to be analyzed, thereby ensuring that as many scenarios as possible are covered, thereby improving the credibility of the safety analysis results.
[0054] See also Figure 2 , Figure 2 yes Figure 1 The flowchart of step S13 is shown as an embodiment. In this embodiment, the hazard and operability analysis of the function to be analyzed is performed in combination with each associated scenario and the failure type of the function to be analyzed, and a hazard event is established, including:
[0055] S21: Based on the failure type of the function to be analyzed, a hazard-related scenario is selected from the associated scenarios; wherein there is a safety risk when the vehicle operates in the failure type and the hazard-related scenario.
[0056] S22: Associate hazard scenarios and failure types to establish hazard events.
[0057] This embodiment is used to select from the associated scenarios the hazard associated scenarios where there will be safety risks when the function to be analyzed is used abnormally. Exemplarily, taking the output drive torque function as an example, when the vehicle is running in the associated scenario of "urban road-dry road surface-driving forward-safe distance / smooth traffic-front vehicle acceleration-self-vehicle following acceleration", if the output drive torque function has a failure (abnormality) of excessive output torque, the vehicle will have a safety risk of colliding with the front vehicle, and the above-mentioned associated scenarios where the function to be analyzed has a safety risk under the above-mentioned failure type can be determined as hazard associated scenarios, and then the hazard associated scenarios and the corresponding failure types are associated to establish a specific hazard event.
[0058] See also Figure 3 , Figure 3 1 is a schematic diagram of a framework of an electronic device according to an embodiment of the present application. In this embodiment, the electronic device 30 includes a memory 31 and a processor 32 coupled to each other.
[0059] The memory 31 stores program instructions, and the processor 32 is used to execute the program instructions stored in the memory 31 to implement the steps of any of the above method implementations. In a specific implementation scenario, the electronic device 30 may include but is not limited to: a microcomputer, a server, and in addition, the electronic device 30 may also include a mobile device such as a laptop computer and a tablet computer, which is not limited here.
[0060] Specifically, the processor 32 is used to control itself and the memory 31 to implement the steps of any of the above-mentioned embodiments. The processor 32 can also be called a CPU (Central Processing Unit). The processor 32 may be an integrated circuit chip with signal processing capabilities. The processor 32 can also be a general-purpose processor, a digital signal processor (Digital Signal Processor, DSP), an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field-programmable gate array (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. In addition, the processor 32 can be implemented by an integrated circuit chip.
[0061] See also Figure 4 , Figure 4 It is a schematic diagram of the framework of the computer-readable storage medium provided by the present application. The computer-readable storage medium 40 of the embodiment of the present application stores a program instruction 41, and when the program instruction 41 is executed, the method provided by any embodiment of the above method and any non-conflicting combination is implemented. Among them, the program instruction 41 can form a program file and be stored in the above-mentioned computer-readable storage medium 40 in the form of a software product, so that a computer device (which can be a personal computer, a server, or a network device, etc.) executes all or part of the steps of each implementation method of the present application. The aforementioned computer-readable storage medium 40 includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a disk or an optical disk, or a terminal device such as a computer, a server, a mobile phone, and a tablet.
[0062] The above scheme first selects the associated scenarios that match the vehicle's function to be analyzed from the initial scenario library, and performs a safety analysis on the function to be analyzed based on the associated scenarios. After obtaining the safety analysis results of the function to be analyzed, the completeness results of the associated scenarios are determined based on the safety analysis results. Among them, the completeness results are used to characterize whether the scene coverage of the associated scenarios of the function to be analyzed meets the safety analysis requirements when the safety analysis is performed on the function to be analyzed. After performing a safety analysis on the function to be analyzed and obtaining the safety analysis results, the present application performs a completeness check on the associated scenarios. Compared with the method of not performing a completeness check on the associated scenarios, the above-mentioned verification method of the present application can determine whether the scene coverage of the associated scenarios of the function to be analyzed meets the safety analysis requirements when the safety analysis is performed on the function to be analyzed, thereby improving the credibility of the safety analysis results.
[0063] The above description of various embodiments tends to emphasize the differences between the various embodiments. The same or similar aspects can be referenced to each other, and for the sake of brevity, they will not be repeated herein.
[0064] The above description is only an implementation method of the present application, and does not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly used in other related technical fields, are also included in the patent protection scope of the present application.
Claims
1. A functional safety analysis method, characterized in that: The method comprises: Get the initial scene library; Selecting, from the initial scene library, a related scene that matches the function to be analyzed of the vehicle; Based on the associated scenario, perform a security analysis on the function to be analyzed, and obtain a security analysis result of the function to be analyzed; Based on the security analysis result, the completeness result of the associated scenario is determined; the completeness result is used to characterize whether the scenario coverage of the associated scenario meets the security analysis requirements when performing a security analysis on the function to be analyzed.
2. The method according to claim 1, characterized in that The obtaining of the initial scene library comprises: Acquire a first environmental factor under each target environmental category; the first environmental factor under each target environmental category is obtained by classifying a plurality of second environmental factors that affect vehicle operation; The first environmental factors under different target environment categories are arranged and combined to obtain a plurality of scenes in the initial scene library.
3. The method according to claim 1, characterized in that Each scene in the initial scene library is formed by arranging and combining first environmental factors under different target environment categories; The selecting, from the initial scene library, associated scenes matching the vehicle function to be analyzed comprises: Determining the associated environment category of the function to be analyzed from the target environment category; Selecting a plurality of candidate scenes including the third environmental factor of the associated environmental category from the initial scene library; For each candidate scenario, in response to the candidate scenario being consistent with an actual operating condition of the vehicle using the function to be analyzed, the candidate scenario is determined to be an associated scenario of the analysis function.
4. The method according to claim 3, characterized in that In the process of selecting the associated scene matching the vehicle function to be analyzed from the initial scene library, the method further includes: Eliminate the remaining scenes in the initial scene library except the associated scene, and add reasons for the remaining scenes not matching the function to be analyzed of the vehicle; And / or, after selecting the associated scene matching the vehicle function to be analyzed from the initial scene library, the method further includes: Adding the associated scenarios of the function to be analyzed to the initial scenario library; And / or, the target environment category includes at least part of the location where the vehicle is traveling, road conditions, driving maneuvers, vehicle status, other vehicle characteristics, and other considerations.
5. The method according to claim 4, characterized in that After removing the remaining scenes in the initial scene library except the associated scene and adding reasons for the remaining scenes not matching the vehicle function to be analyzed, the method further includes: Based on the reasons, it is verified whether the operation of eliminating the remaining scenes is reasonable.
6. The method according to claim 1, characterized in that The number of the associated scenarios is multiple, and the safety analysis results include hazardous events; The performing security analysis on the function to be analyzed based on the associated scenario to obtain a security analysis result of the function to be analyzed includes: Performing hazard and operability analysis on the function to be analyzed to obtain the failure type of the function to be analyzed; A hazard event is established by combining the associated scenarios and the failure type of the function to be analyzed.
7. The method according to claim 6, characterized in that The establishing of a hazard event by combining the associated scenarios and the failure type of the function to be analyzed includes: Based on the failure type of the function to be analyzed, a hazard-associated scenario is selected from the associated scenarios; wherein there is a safety risk when the vehicle is running under the failure type and the hazard-associated scenario; Associating the hazard association scenario with the failure type to establish the hazard event; And / or, the safety analysis result also includes the vehicle safety integrity level of the hazardous event; after establishing the hazardous event by combining the associated scenarios and the failure type of the function to be analyzed, the method further includes: Conduct severity and controllability assessments on the hazardous events respectively, and determine the severity results and controllability results of the hazardous events; The vehicle safety integrity level of the hazardous event is determined by comprehensively considering the severity result, the controllability result and the exposure level of the hazardous event; wherein the exposure level of the hazardous event is the exposure level that meets the preset requirements among the exposure levels corresponding to the environmental factors in the hazard-associated scenario.
8. The method according to claim 7, characterized in that The safety analysis result also includes the hazard association scenario; The determining, based on the security analysis result, the completeness result of the associated scenario includes: respectively determining a first number of environmental categories and a second number of environmental factors in the hazard association scenario, and respectively determining a third number of environmental categories and a fourth number of environmental factors in the initial scenario library; determining a first ratio of the first quantity to the third quantity, and a second ratio of the second quantity to the fourth quantity; In response to the first ratio being greater than a first preset threshold and the second ratio being greater than a second preset threshold, it is determined that the scene coverage of the associated scene meets the safety analysis requirement.
9. An electronic device, characterized in that: comprising a memory and a processor coupled to each other, The memory stores program instructions; The processor is used to execute the program instructions stored in the memory to implement the method according to any one of claims 1 to 8.
10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores program instructions that can be run by a processor, and the program instructions can be executed by the processor to implement the method according to any one of claims 1 to 8.