Fusion security demand generation method, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a fusion security demand generation method, electronic equipment and a storage medium. According to the method, in the development process of the automatic transverse control function of the heavy vehicle, transverse control function related items including an implementation function and an expected function are defined, hazard events of the transverse control function related items are obtained through danger and operability analysis, and the risk of the transverse control function related items is analyzed through a hazard and risk analysis method. The method comprises the steps of obtaining a safety target of a hazardous event, a vehicle safety integrity level and residual risk acceptance, obtaining a target risk level in a risk level table according to the vehicle safety integrity level and the residual risk acceptance, establishing a functional safety architecture according to the target risk level and the safety target, obtaining a safety constraint condition based on the functional safety architecture, and sending the safety constraint condition to a server. And the safety constraint body condition is converted into the target safety requirement to analyze the harm caused by the transverse control failure and the expected insufficient function, so that the development efficiency of the automatic transverse control function is improved, the development period is shortened, and the reliability and the safety are improved.

Description

Technical Field

[0001] The present application relates to intelligent connected vehicle technology, and in particular to a method for generating integrated safety requirements, an electronic device and a storage medium. Background Art

[0002] With the rapid development of intelligence and networking, the information domain and physical domain of intelligent and connected vehicles are accelerating their integration, and functional safety and expected functional safety are intertwined, influence each other, and couple with each other, and even transform and derive from each other under certain conditions.

[0003] The existing solutions for the development of functional safety and expected functional safety of vehicle lateral control usually conduct safety analysis and design separately. However, when analyzing functional safety and expected functional safety separately, the development cycle is long and the obtained safety requirements are not perfect, which may lead to the occurrence of hazards.

[0004] Therefore, when developing the functional safety requirements for vehicle lateral control, the existing solutions analyze functional safety and expected functional safety separately, resulting in a long development cycle and incomplete safety requirements, which makes the safety and reliability of the vehicle lateral control function low. Summary of the invention

[0005] The embodiments of the present application provide a fusion safety requirement generation method, an electronic device and a storage medium, which are used to shorten the development cycle and improve the safety requirements when developing functional safety requirements for vehicle lateral control, thereby improving the safety and reliability of the vehicle's lateral control function.

[0006] In a first aspect, an embodiment of the present application provides a method for generating a fusion security requirement, including:

[0007] Define lateral control function related items and function design specifications, wherein the lateral control function related items are used to indicate the lateral implementation functions and lateral expected functions of the vehicle during the safety life cycle, the lateral implementation functions are used to indicate the lane keeping function, and the function design specifications are used to indicate the status information and operating environment of the vehicle;

[0008] Through hazard and operability analysis, a list of hazard events related to the horizontal control function is obtained, and in the list of hazard events, target hazard events are identified by keywords;

[0009] Obtain the safety target, vehicle safety integrity level and residual risk acceptance of the target hazard event through hazard and risk analysis methods;

[0010] Obtaining a target risk level according to the vehicle safety integrity level and the residual risk acceptance, and establishing a functional safety architecture according to the target risk level and the safety goal;

[0011] Based on the functional safety architecture, safety constraint conditions are obtained, and the safety constraint body conditions are converted into target safety requirements.

[0012] In a possible implementation, the lateral expected functions include: function activation, function exit, lane line recognition, judgment decision and function execution;

[0013] The function activation is used to indicate that the vehicle enters the lane keeping state, the function exit is used to indicate that the vehicle exits the lane keeping state, the lane line recognition is used to indicate the recognition distance between the vehicle and the lane lines on both sides, the judgment decision is used to indicate whether to activate the steering function based on the recognition distance, and the function execution is used to indicate the execution of the lane keeping function when the deviation distance between the vehicle's center axis and the lane center line exceeds a threshold.

[0014] In a possible implementation manner, the status information includes: driving status, driver information and device status, wherein the driving status is used to indicate a speed change of the vehicle, the driver information is used to indicate the identity information and driving status of the driver, and the device status is used to indicate whether each vehicle-mounted device is operating normally;

[0015] The operating environment includes scene features and environmental information, wherein the scene features are used to indicate road types and road boundaries, and the environmental information is used to indicate weather, lighting, and road conditions when the vehicle is traveling.

[0016] In a possible implementation manner, obtaining a list of hazardous events related to the lateral control function includes:

[0017] Based on the functional design specification, and through the hazard and operability analysis, obtaining failure information of each function in the lateral control function related items;

[0018] According to each of the failure information, hazardous events corresponding to each function are obtained, and the hazardous event list includes hazardous events corresponding to each of the functions, wherein the failure information includes steering request loss, steering request angle is too large, steering request angle is too small, steering request reverse, unexpected steering and steering request stuck.

[0019] In a possible implementation manner, obtaining the safety target, vehicle safety integrity level, and residual risk acceptance of the target hazard event includes:

[0020] Based on the functional design specification, the severity, exposure rate and controllability of the target hazard event are obtained through the hazard and risk analysis method;

[0021] The vehicle safety integrity level is obtained according to the severity, exposure rate and controllability, and the residual risk acceptance is obtained according to the severity and the controllability, wherein the residual risk acceptance includes acceptable risk, conditionally tolerable risk or unacceptable risk.

[0022] In a possible implementation manner, obtaining a target risk level according to the vehicle safety integrity level and the residual risk acceptance includes:

[0023] In the risk level table, according to a combination of the vehicle safety integrity level and the residual risk acceptance, risk level information is obtained, and the target risk level is determined by the risk level information, wherein the risk level information includes low, medium, high or severe;

[0024] The risk level table pre-stores a first mapping relationship and a second mapping relationship, wherein the first mapping relationship is used to indicate a positive correlation between the vehicle safety integrity level and the risk level information, and the second mapping relationship is used to indicate a positive correlation between the residual risk acceptance and the risk level information.

[0025] In a possible implementation, establishing a functional safety architecture according to the target risk level and the safety goal includes:

[0026] When the target risk level is medium, high or severe, based on the safety goal, establishing the functional safety architecture, the functional safety architecture is used to reduce the target risk level to a low level;

[0027] When the target risk level is low, the functional safety architecture is not established.

[0028] In a second aspect, an embodiment of the present application provides a fusion security requirement generation device, including:

[0029] an acquisition module, used to define lateral control function related items and function design specifications, wherein the lateral control function related items are used to indicate lateral implementation functions and lateral expected functions of the vehicle during its safety life cycle, the lateral implementation functions are used to indicate lane keeping functions, and the function design specifications are used to indicate status information and operating environment of the vehicle;

[0030] A processing module is used to obtain a list of hazardous events related to the lateral control function through hazard and operability analysis, identify target hazardous events in the list of hazardous events through keywords, and obtain a safety target, a vehicle safety integrity level, and a residual risk acceptance of the target hazardous event through a hazard and risk analysis method;

[0031] A control module is used to obtain a target risk level according to the vehicle safety integrity level and the residual risk acceptance, establish a functional safety architecture according to the target risk level and the safety goal, obtain safety constraints based on the functional safety architecture, and convert the safety constraints into target safety requirements.

[0032] In a third aspect, an embodiment of the present application provides an electronic device, including: a memory, a processor;

[0033] The memory stores computer-executable instructions;

[0034] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the above first aspect and / or various possible implementations of the first aspect.

[0035] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the first aspect above and / or various possible implementations of the first aspect.

[0036] The integrated safety demand generation method, electronic device and storage medium provided in the embodiments of the present application define lateral control function-related items including implementation functions and expected functions during the development process of the automatic lateral control function of a heavy-duty vehicle, obtain a list of hazard events of the lateral control function-related items through hazard and operability analysis, identify target hazard events in the hazard event list, obtain safety goals, vehicle safety integrity levels and residual risk acceptance of target hazard events through hazard and risk analysis methods, obtain target risk levels in the risk level table according to the vehicle safety integrity level and residual risk acceptance, establish a functional safety architecture according to the target risk level and safety goals, obtain safety constraints based on the functional safety architecture, and convert the safety constraints into target safety requirements, thereby comprehensively analyzing the hazards caused by lateral control failure and insufficient expected functions, effectively improving the development efficiency of automatic lateral control, reducing the development cycle, and improving product reliability and safety. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0038] Figure 1 Schematic diagram of the process of generating integrated security requirements provided for this application Figure 1 ;

[0039] Figure 2 Schematic diagram of the process of generating integrated security requirements provided for this application Figure 2 ;

[0040] Figure 3 A risk level diagram provided for this application;

[0041] Figure 4 A diagram of the security architecture provided for this application;

[0042] Figure 5 A schematic diagram of the structure of the integrated security requirement generation device provided in this application;

[0043] Figure 6 A schematic diagram of the structure of the electronic device provided in this application.

[0044] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0045] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0046] Intelligent connected vehicles are a new generation of information-physical systems that are equipped with advanced on-board sensors, controllers and actuators, integrate modern communications and networks, artificial intelligence and other technologies, and have functions such as complex environment perception, intelligent decision-making, and collaborative control. When developing functions on intelligent connected vehicles, such as vehicle lateral control, functional safety and expected functional safety are an indispensable part of the design of autonomous driving vehicle systems.

[0047] Based on existing industry standards, functional safety focuses on whether the system can enter a safe state after failure to avoid greater hazards, while expected functional safety focuses on insufficient expected functions at the vehicle level, performance limitations of electronic and electrical system elements, and misuse by personnel, such as use cases where functions may be activated or disabled. Existing solutions usually conduct safety analysis and design separately for the development of functional safety and expected functional safety of vehicle lateral control. However, the safety requirements generated by this development make the development cycle longer, and the obtained safety requirements are not perfect, resulting in low safety and reliability of the vehicle lateral control function.

[0048] Therefore, the present application provides a method for generating integrated safety requirements. In the process of developing the automatic lateral control function of a heavy-duty vehicle, items related to the lateral control function including the implemented functions and the expected functions are defined. A list of hazard events of the lateral control function-related items is obtained through hazard and operability analysis. Target hazard events are identified in the list of hazard events. Safety goals, vehicle safety integrity levels, and residual risk acceptance of target hazard events are obtained through hazard and risk analysis methods. According to the vehicle safety integrity level and the residual risk acceptance, the target risk level is obtained in the risk level table. A functional safety architecture is established according to the target risk level and safety goals. Safety constraints are obtained based on the functional safety architecture, and the safety constraints are converted into target safety requirements, thereby comprehensively analyzing the hazards caused by lateral control failure and insufficient expected functions, effectively improving the development efficiency of automatic lateral control, reducing the development cycle, and improving product reliability and safety.

[0049] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0050] Figure 1 Schematic diagram of the process of generating integrated security requirements provided for this application Figure 1 ,like Figure 1 As shown, the method includes:

[0051] S101. Define lateral control function related items and function design specifications, wherein the lateral control function related items are used to indicate lateral implementation functions and lateral expected functions of a vehicle during its safety lifecycle, the lateral implementation functions are used to indicate a lane keeping function, and the function design specifications are used to indicate status information and operating environment of the vehicle;

[0052] Specifically, for the automatic lateral control function of heavy vehicles, define fusion-related items and functional design specifications, where the definition of fusion-related items includes functional description, fusion safety boundaries and regulatory requirements, dependencies and interactive information with other vehicle systems, the composition of the automatic lateral control system, and known performance limitations and functional deficiencies;

[0053] Among them, the functional description indicates the implemented functions and expected functions of automatic lateral control in the safety life cycle. The expected functions include the vehicle-level SOTIF (Safety of the Intended Functionality) strategy, use cases in which the functions may be activated or disabled, and the transitions between activation and shutdown use cases, description of decision logic, etc. The functional description also indicates the relevant system architecture and its components for implementing the functions and expected functions, the potential consequences of insufficient behavior, performance limitations, and reasonably foreseeable misuse identification trigger conditions and countermeasures.

[0054] S102, obtaining a list of hazardous events related to the lateral control function through hazard and operability analysis, identifying target hazardous events in the list of hazardous events through keywords, and obtaining a safety target, a vehicle safety integrity level, and a residual risk acceptance of the target hazardous event through a hazard and risk analysis method;

[0055] Specifically, after completing the definition of the relevant items and functional design specifications of the lateral control function, the functional failure (Malfunction) of the lateral control is obtained through the Hazard and Operability Study (HAZOP) method, and a performance deficiency analysis is performed. Based on the obtained functional failures, a fusion hazard event list is generated, that is, a combination of scenarios and failures;

[0056] Furthermore, through hazard and risk analysis methods, each hazard event is identified and classified, that is, the target hazard event is obtained, acceptance criteria are defined, safety metrics for hazardous behaviors are defined, and safety confirmation goals derived from the acceptance criteria are defined, and integrated safety goals are formulated to prevent the occurrence of hazardous events or reduce the degree of hazard, that is, the safety goals of the target hazard event, the vehicle safety integrity level and the residual risk acceptance are obtained.

[0057] S103, obtaining a target risk level according to the vehicle safety integrity level and the residual risk acceptance, and establishing a functional safety architecture according to the target risk level and the safety goal;

[0058] Specifically, after obtaining the safety target of the target hazard event, the vehicle safety integrity level and the residual risk acceptance, the preset risk level table is looked up according to the vehicle safety integrity level and the residual risk acceptance to obtain the target risk level of the target hazard event, that is, to determine the fusion risk level, where the risk level table is used to indicate the risk assessment criteria for the fusion of functional safety and expected functional safety.

[0059] S104, based on the functional safety architecture, obtaining safety constraint conditions, and converting the safety constraint conditions into target safety requirements;

[0060] Specifically, after obtaining the functional safety architecture, unsafe control behaviors are identified and analyzed based on the functional safety architecture to determine safety constraints, which can be safety mechanisms, algorithm requirements, sensor / controller performance requirements, and driver behavior requirements. Safety constraints are refined into target safety requirements, which include functional safety requirements and expected functional safety requirements.

[0061] An embodiment of the present application provides a method for generating integrated safety requirements. In the process of developing an automatic lateral control function for a heavy-duty vehicle, items related to the lateral control function including implementation functions and expected functions are defined. A list of hazard events for items related to the lateral control function is obtained through hazard and operability analysis. Target hazard events are identified in the list of hazard events. Safety goals, vehicle safety integrity levels, and residual risk acceptance of target hazard events are obtained through hazard and risk analysis methods. According to the vehicle safety integrity level and the residual risk acceptance, the target risk level is obtained in a risk level table. A functional safety architecture is established according to the target risk level and safety goals. Safety constraints are obtained based on the functional safety architecture, and the safety constraints are converted into target safety requirements, thereby comprehensively analyzing the hazards caused by lateral control failure and insufficient expected functions, effectively improving the development efficiency of automatic lateral control, reducing the development cycle, and improving product reliability and safety.

[0062] Figure 2 Schematic diagram of the process of generating integrated security requirements provided for this application Figure 2 , Figure 3 The risk level diagram provided for this application, Figure 4 The security architecture diagram provided for this application is combined with Figure 2 , Figure 3 and Figure 4 As shown, a method for generating integrated security requirements is described in detail, and the method includes:

[0063] S201. Define lateral control function related items and functional design specifications, where the lateral control function related items are used to indicate lateral implemented functions and lateral expected functions of the vehicle during its safety life cycle;

[0064] Specifically, the lateral expected functions include: function activation, function exit, lane line recognition, judgment decision and function execution, among which, function activation is used to indicate that the vehicle enters the lane keeping state, function exit is used to indicate that the vehicle exits the lane keeping state, lane line recognition is used to indicate the recognition distance between the vehicle and the lane lines on both sides, judgment decision is used to indicate whether to activate the steering function according to the recognition distance, function execution is used to indicate the execution of the lane keeping function when the deviation distance between the vehicle center axis and the lane center line exceeds the threshold, and the lateral implementation function is used to indicate whether lane keeping is required according to the current vehicle condition, and execute lane keeping when necessary. Further, the related items of the lateral control function are shown in the following table:

[0065]

[0066] Furthermore, the state information and operating environment of the vehicle are indicated by the functional design specifications. The state information includes driving state, driver information and equipment state. The driving state is used to indicate the speed change of the vehicle. The driver information is used to indicate the identity information and driving state of the driver. The equipment state is used to indicate whether each vehicle-mounted device is operating normally. The operating environment includes scene features and environmental information. The scene features are used to indicate the road type and road boundary. The environmental information is used to indicate the weather, lighting and road surface conditions when the vehicle is driving. The functional design specifications are shown in the following table:

[0067]

[0068] S202, based on the functional design specification, obtaining failure information of each function in the lateral control function related items through the hazard and operability analysis;

[0069] Specifically, after completing the definition of the relevant items of the lateral control function and the functional design specifications, the HAZOP method built into the MA tool, i.e., the hazard and operability analysis, is used to create the functional failure of the intelligent lateral control and conduct a performance deficiency analysis, i.e., to obtain the failure information of the relevant items of the lateral control function, such as the lane keeping function. The failure information of the lane keeping function is shown in the following failure table:

[0070]

[0071] Among them, failure information includes steering request loss, steering request angle is too large, steering request angle is too small, steering request is reverse, unexpected steering and steering request is stuck.

[0072] S203, acquiring a hazard event corresponding to each function according to each failure information, wherein the hazard event list includes the hazard events corresponding to each function, and in the hazard event list, identifying a target hazard event by a keyword;

[0073] Specifically, after obtaining each failure information, based on each failure information, a scenario library for intelligent horizontal control is created through the built-in scenario library of MA. The tool can automatically generate a list of fused hazard events such as combinations of scenarios and failures, and use the combination of each scenario and failure as the corresponding hazard event. By identifying the same keywords in the failure table, the target hazard event is obtained based on the same keywords.

[0074] S204, based on the functional design specification, obtaining the severity, exposure rate and controllability of the target hazard event through the hazard and risk analysis method;

[0075] Specifically, after obtaining the hazardous events corresponding to each failure information, the safety goals of the corresponding hazardous events, i.e., the target hazardous events, are obtained through HARA (Hazard Analysis and Risk Assessment), i.e., the fusion of safety goals, severity S, exposure rate E and controllability C. According to the severity, exposure rate and controllability of each hazardous event, the corresponding vehicle safety integrity level, i.e., ASIL level and residual risk acceptance are obtained, where the safety goals are used to indicate the functions that meet the normal operation of the project.

[0076] S205, obtaining the vehicle safety integrity level according to the severity, exposure rate and controllability, and obtaining the residual risk acceptance according to the severity and the controllability;

[0077] Specifically, after obtaining the severity, exposure rate and controllability of each hazardous event, the ASIL level of each hazardous event is determined based on the severity S, exposure rate E, and controllability C; the acceptance criteria for residual risk are determined based on the severity S and controllability C. For hazardous events corresponding to failure information such as unexpected steering, the vehicle safety integrity level and residual risk acceptance as the target hazardous event are shown in the following criteria table:

[0078]

[0079] Among them, residual risk acceptance includes acceptable risk, conditional tolerable risk or unacceptable risk.

[0080] S206. In the risk level table, according to a combination of the vehicle safety integrity level and the residual risk acceptance, obtain risk level information, and determine the target risk level through the risk level information;

[0081] Specifically, after obtaining the vehicle safety integrity level and residual risk acceptance of each hazardous event, in the risk level table, the corresponding risk level information is obtained according to the vehicle safety integrity level and residual risk acceptance of the target hazardous event, and the target risk level, that is, the risk level of the hazardous event, is determined by the risk level information. Among them, the risk level information includes low, medium, high or severe. The risk level table is shown in the following table:

[0082]

[0083] Among them, the risk level table pre-stores a first mapping relationship and a second mapping relationship. The first mapping relationship is used to indicate the positive correlation between the vehicle safety integrity level and the risk level information, and the second mapping relationship is used to indicate the positive correlation between the residual risk acceptance and the risk level information. For example, when the ASIL level, that is, the vehicle safety integrity level, is B and the residual risk is an unacceptable risk, the corresponding risk level information is obtained in the risk level table, and the target risk level indicated by the risk level information is high.

[0084] S207. When the target risk level is medium, high or severe, based on the safety goal, establish the functional safety architecture, wherein the functional safety architecture is used to reduce the target risk level to a low level;

[0085] Specifically, after obtaining the target risk level and safety goal, a functional safety architecture is established according to the safety goal and the target risk level of the target hazard event, so as to assign the ASIL level to the electronic and electrical units that cause the hazard event through the functional safety architecture; the verification goal of the expected functional safety is to achieve the horizontal expected function to reduce the risk to a reasonable level, that is, to achieve the target risk level to a low level, where the reasonable level is defined as: the accident rate caused by the function is less than or equal to the accident rate of the same accident caused by humans;

[0086] Furthermore, the concept of functional safety target ASIL level is used to determine the verification target. Different ASIL levels have different requirements for software and hardware, and different verification requirements. For details, refer to the ISO26262 standard, in which the functional safety architecture includes signal interaction information between various units such as perception units, logic control units, and execution units. The control signal and feedback signal are indicated by the signal interaction information. Each control signal or feedback signal can be used as a control behavior. When the target risk level is low, the functional safety architecture is not established.

[0087] S208, based on the functional safety architecture, obtaining safety constraint conditions, and converting the safety constraint conditions into target safety requirements;

[0088] Specifically, after obtaining the functional safety architecture, each control behavior is determined according to the control signal or feedback signal, and in each control behavior, unsafe control behaviors are identified according to the STPA (Systems-Theoretic Process Analysis) analysis method, and safety constraints are determined based on the unsafe control behaviors. The safety constraints can be safety mechanisms, algorithm requirements, sensor / controller performance requirements, and driver behavior requirements;

[0089] The target safety requirements include functional safety requirements and expected functional safety requirements, which need to be refined through safety constraints. The functional safety requirements related to the failure of electronic and electrical systems need to be assigned ASIL levels. The ASIL levels are inherited from the safety goals. After obtaining the target safety requirements, the safety implementation is verified and confirmed based on the target safety requirements.

[0090] An embodiment of the present application provides a method for generating integrated safety requirements. In the process of developing an automatic lateral control function for a heavy-duty vehicle, items related to the lateral control function including implementation functions and expected functions are defined. A list of hazard events for items related to the lateral control function is obtained through hazard and operability analysis. Target hazard events are identified in the list of hazard events. Safety goals, vehicle safety integrity levels, and residual risk acceptance of target hazard events are obtained through hazard and risk analysis methods. According to the vehicle safety integrity level and the residual risk acceptance, the target risk level is obtained in a risk level table. A functional safety architecture is established according to the target risk level and safety goals. Safety constraints are obtained based on the functional safety architecture, and the safety constraints are converted into target safety requirements, thereby comprehensively analyzing the hazards caused by lateral control failure and insufficient expected functions, effectively improving the development efficiency of automatic lateral control, reducing the development cycle, and improving product reliability and safety.

[0091] Figure 5 A schematic diagram of the structure of the integrated security demand generation device provided in this application, such as Figure 4 As shown, the fusion security requirement generating device 50 provided in this embodiment includes:

[0092] An acquisition module 501 is used to define lateral control function related items and function design specifications, wherein the lateral control function related items are used to indicate lateral implementation functions and lateral expected functions of a vehicle during a safety life cycle, the lateral implementation functions are used to indicate a lane keeping function, and the function design specifications are used to indicate status information and an operating environment of the vehicle;

[0093] The processing module 502 is used to obtain a list of hazardous events related to the lateral control function through hazard and operability analysis, identify target hazardous events in the list of hazardous events through keywords, and obtain the safety target, vehicle safety integrity level and residual risk acceptance of the target hazardous event through a hazard and risk analysis method;

[0094] The control module 503 is used to obtain the target risk level according to the vehicle safety integrity level and the residual risk acceptance, establish a functional safety architecture according to the target risk level and the safety goal, obtain safety constraints based on the functional safety architecture, and convert the safety constraints into target safety requirements.

[0095] In a possible implementation, the acquisition module 501 is specifically used to define the lateral expected functions including: function activation, function exit, lane line recognition, judgment and decision making, and function execution;

[0096] The function activation is used to indicate that the vehicle enters the lane keeping state, the function exit is used to indicate that the vehicle exits the lane keeping state, the lane line recognition is used to indicate the recognition distance between the vehicle and the lane lines on both sides, the judgment decision is used to indicate whether to activate the steering function based on the recognition distance, and the function execution is used to indicate the execution of the lane keeping function when the deviation distance between the vehicle's center axis and the lane center line exceeds a threshold.

[0097] In a possible implementation, the acquisition module 501 is specifically used to define the status information including: driving status, driver information and device status, wherein the driving status is used to indicate the speed change of the vehicle, the driver information is used to indicate the identity information and driving status of the driver, and the device status is used to indicate whether each vehicle-mounted device is operating normally;

[0098] The operating environment includes scene features and environmental information, wherein the scene features are used to indicate road types and road boundaries, and the environmental information is used to indicate weather, lighting, and road conditions when the vehicle is traveling.

[0099] In a possible implementation, the processing module 502 is specifically configured to obtain failure information of each function in the lateral control function related items based on the functional design specification and through the hazard and operability analysis;

[0100] According to each of the failure information, hazardous events corresponding to each function are obtained, and the hazardous event list includes hazardous events corresponding to each of the functions, wherein the failure information includes steering request loss, steering request angle is too large, steering request angle is too small, steering request reverse, unexpected steering and steering request stuck.

[0101] In a possible implementation, the processing module 502 is specifically configured to obtain the severity, exposure rate, and controllability of the target hazard event based on the functional design specification and through the hazard and risk analysis method;

[0102] The vehicle safety integrity level is obtained according to the severity, exposure rate and controllability, and the residual risk acceptance is obtained according to the severity and the controllability, wherein the residual risk acceptance includes acceptable risk, conditionally tolerable risk or unacceptable risk.

[0103] In a possible implementation, the processing module 502 is specifically configured to obtain risk level information in the risk level table according to a combination of the vehicle safety integrity level and the residual risk acceptance, and determine the target risk level according to the risk level information, wherein the risk level information includes low, medium, high or severe;

[0104] The risk level table pre-stores a first mapping relationship and a second mapping relationship, wherein the first mapping relationship is used to indicate a positive correlation between the vehicle safety integrity level and the risk level information, and the second mapping relationship is used to indicate a positive correlation between the residual risk acceptance and the risk level information.

[0105] In a possible implementation, the control module 503 is specifically configured to establish the functional safety architecture based on the safety goal when the target risk level is medium, high or severe, and the functional safety architecture is configured to reduce the target risk level to a low level;

[0106] When the target risk level is low, the functional safety architecture is not established.

[0107] The fusion security demand generation device provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and this embodiment will not be described in detail here.

[0108] Figure 6 This is a schematic diagram of the structure of the electronic device provided in this application. Figure 6 As shown, the electronic device 60 provided in this embodiment includes: at least one processor 601 and a memory 602. Optionally, the device 60 also includes a communication component 603. The processor 601, the memory 602 and the communication component 603 are connected via a bus 604.

[0109] In a specific implementation process, at least one processor 601 executes the computer execution instructions stored in the memory 602, so that at least one processor 601 executes the above method.

[0110] The specific implementation process of the processor 601 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0111] In the above embodiments, it should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the invention may be directly implemented as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0112] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (Non-volatile Memory, NVM), such as at least one disk memory.

[0113] The bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application is not limited to only one bus or one type of bus.

[0114] The present application also provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0115] The present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above method is implemented.

[0116] The above-mentioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0117] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (Application Specific Integrated Circuits, referred to as: ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0118] The division of units is only a logical function division, and there may be other divisions in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other forms.

[0119] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0120] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0121] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0122] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0123] Finally, it should be noted that those skilled in the art will readily conceive of other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention, which follow the general principles of the present invention and include common knowledge or customary technical means in the art not disclosed by the present invention, are not limited to the precise structure described above and shown in the drawings, and may be modified and changed in various ways without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A method for generating integrated security requirements, characterized in that: include: Define lateral control function related items and function design specifications, wherein the lateral control function related items are used to indicate the lateral implementation functions and lateral expected functions of the vehicle during the safety life cycle, the lateral implementation functions are used to indicate the lane keeping function, and the function design specifications are used to indicate the status information and operating environment of the vehicle; Obtain a list of hazard events related to the horizontal control function through hazard and operability analysis, and identify target hazard events in the list of hazard events by keyword; Obtain the safety target, vehicle safety integrity level and residual risk acceptance of the target hazard event through hazard and risk analysis methods; Obtaining a target risk level according to the vehicle safety integrity level and the residual risk acceptance, and establishing a functional safety architecture according to the target risk level and the safety goal; Based on the functional safety architecture, safety constraint conditions are obtained, and the safety constraint conditions are converted into target safety requirements.

2. The method according to claim 1, characterized in that: The lateral expected functions include: function activation, function exit, lane line recognition, judgment and decision making, and function execution; The function activation is used to indicate that the vehicle enters the lane keeping state, the function exit is used to indicate that the vehicle exits the lane keeping state, the lane line recognition is used to indicate the recognition distance between the vehicle and the lane lines on both sides, the judgment decision is used to indicate whether to activate the steering function based on the recognition distance, and the function execution is used to indicate the execution of the lane keeping function when the deviation distance between the vehicle's center axis and the lane center line exceeds a threshold.

3. The method according to claim 1, characterized in that The state information includes: driving state, driver information and device state, wherein the driving state is used to indicate the speed change of the vehicle, the driver information is used to indicate the identity information and driving state of the driver, and the device state is used to indicate whether each vehicle-mounted device is operating normally; The operating environment includes scene features and environmental information, wherein the scene features are used to indicate road types and road boundaries, and the environmental information is used to indicate weather, lighting, and road conditions when the vehicle is traveling.

4. The method according to claim 1, characterized in that: The step of obtaining a list of hazardous events related to the lateral control function includes: Based on the functional design specification, and through the hazard and operability analysis, obtaining failure information of each function in the lateral control function related items; According to each of the failure information, hazardous events corresponding to each function are obtained, and the hazardous event list includes hazardous events corresponding to each of the functions, wherein the failure information includes steering request loss, steering request angle is too large, steering request angle is too small, steering request reverse, unexpected steering and steering request stuck.

5. The method according to claim 1, characterized in that The obtaining of the safety target, vehicle safety integrity level and residual risk acceptance of the target hazard event includes: Based on the functional design specification, the severity, exposure rate and controllability of the target hazard event are obtained through the hazard and risk analysis method; The vehicle safety integrity level is obtained according to the severity, exposure rate and controllability, and the residual risk acceptance is obtained according to the severity and the controllability, wherein the residual risk acceptance includes acceptable risk, conditionally tolerable risk or unacceptable risk.

6. The method according to claim 1, characterized in that The obtaining a target risk level according to the vehicle safety integrity level and the residual risk acceptance includes: In the risk level table, according to a combination of the vehicle safety integrity level and the residual risk acceptance, risk level information is obtained, and the target risk level is determined by the risk level information, wherein the risk level information includes low, medium, high or severe; The risk level table pre-stores a first mapping relationship and a second mapping relationship, wherein the first mapping relationship is used to indicate a positive correlation between the vehicle safety integrity level and the risk level information, and the second mapping relationship is used to indicate a positive correlation between the residual risk acceptance and the risk level information.

7. The method according to claims 1-6, characterized in that: The establishing of a functional safety architecture according to the target risk level and the safety goal includes: When the target risk level is medium, high or severe, based on the safety goal, establishing the functional safety architecture, the functional safety architecture is used to reduce the target risk level to a low level; When the target risk level is low, the functional safety architecture is not established.

8. A fusion security demand generation device, characterized in that: include: an acquisition module, used to define lateral control function related items and function design specifications, wherein the lateral control function related items are used to indicate lateral implementation functions and lateral expected functions of the vehicle during its safety life cycle, the lateral implementation functions are used to indicate lane keeping functions, and the function design specifications are used to indicate status information and operating environment of the vehicle; A processing module is used to obtain a list of hazardous events related to the lateral control function through hazard and operability analysis, identify target hazardous events in the list of hazardous events through keywords, and obtain a safety target, a vehicle safety integrity level, and a residual risk acceptance of the target hazardous event through a hazard and risk analysis method; A control module is used to obtain a target risk level according to the vehicle safety integrity level and the residual risk acceptance, establish a functional safety architecture according to the target risk level and the safety goal, obtain safety constraints based on the functional safety architecture, and convert the safety constraints into target safety requirements.

9. An electronic device, characterized in that: include: Memory, processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor performs the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 7 when executed by a processor.

Images