Related failure analysis method and device, medium and equipment

Abstract

The invention discloses a related failure analysis method and device, a medium and equipment, and the method comprises the steps: determining the safety levels of a system logic model and a plurality of function modules according to the safety level requirements of a target product; determining at least one related failure group with a cascade failure relationship according to the security levels and the signal transmission directions of the plurality of functional modules; according to each related failure group, the protection measure of each related failure group is determined, only failure analysis needs to be carried out on the related failure groups, the analysis range of coupling factors is narrowed, the workload of safety analysis is greatly reduced, in addition, the related failure groups are determined on the basis of a signal transmission method in a system logic model, and the reliability of safety analysis is improved. And the condition of incomplete related failure identification is avoided.

Description

Technical Field

[0001] The present invention relates to the field of functional safety technology, and in particular to a related failure analysis method, device, medium and equipment. Background Art

[0002] In order to ensure the functional safety of some products, these products must be developed for functional safety during the design phase so that they meet the functional safety standards. Dependent Failure Analysis (DFA) is the basis for product functional safety development and an indispensable part of product functional safety development. Dependent failure analysis is to effectively analyze the research object and identify the cause of failure, so as to formulate targeted safety measures and minimize the possibility of failure.

[0003] There are many causes of correlated failures, and they are difficult to analyze and identify. Currently, the functional safety standards of various industries (such as ISO26262-2018, IEC 61608-2010) do not provide corresponding analysis methods. It is difficult to ensure the completeness of correlated failure analysis by only using the checklist in the appendix of ISO26262. If the method of traversing all elements is used, the workload of correlated failure analysis will be very large, which is not suitable for large systems. Summary of the invention

[0004] In view of this, the present invention provides a related failure analysis method, device, medium and equipment, the main purpose of which is to solve the problem of heavy workload of the current related failure analysis method.

[0005] According to one aspect of the present application, a correlation failure analysis method is provided, the method comprising:

[0006] Determine the security level of the system logic model and multiple functional modules according to the security level requirements of the target product;

[0007] Determining at least one related failure group having a cascading failure relationship according to the security levels and signal transmission directions of the plurality of functional modules;

[0008] According to each of the related failure groups, a protection measure for each of the related failure groups is determined.

[0009] Optionally, determining at least one related failure group having a cascading failure relationship according to the security levels and signal transmission directions of the multiple functional modules includes:

[0010] According to the security level and signal transmission direction of the functional modules, two adjacent functional modules with different security levels are identified to obtain multiple candidate failure groups, wherein in each candidate failure group, the functional module with the first signal is the first functional module, and the functional module with the second signal is the second functional module;

[0011] A candidate failure group in which the safety level of the first functional module is lower than the safety level of the second functional module is identified as a related failure group having a cascading failure relationship.

[0012] Optionally, the related failure analysis method further includes:

[0013] Draw a fault tree of the target product according to the functional requirements of the target product and the system logic model;

[0014] Identify from the fault tree the main fault function modules that jointly cause the target product to fail and the safety mechanisms corresponding to the main fault function modules;

[0015] The main fault function module and the corresponding safety mechanism are regarded as a related failure group having a common cause failure relationship.

[0016] Optionally, determining a protection measure for each of the related failure groups according to each of the related failure groups includes:

[0017] Based on a preset table of related failure coupling factors, determining a failure cause corresponding to each of the related failure groups;

[0018] Determine the failure risk level corresponding to each relevant failure group according to the functions corresponding to the functional modules in each of the relevant failure groups;

[0019] According to the failure cause and failure risk level corresponding to each of the related failure groups, the protection measures corresponding to each of the related failure groups are determined.

[0020] Optionally, determining the failure risk level corresponding to each relevant failure group according to the functions of the functional modules in each relevant failure group includes:

[0021] Determine the failure consequence corresponding to each relevant failure group according to the function of the functional module in each of the relevant failure groups;

[0022] According to the failure consequences corresponding to each relevant failure group, the failure risk level corresponding to each relevant failure group is determined.

[0023] Optionally, determining the protection measures corresponding to each of the related failure groups according to the failure causes and failure risk levels corresponding to each of the related failure groups includes:

[0024] Obtain relevant failure groups with high failure risk levels as relevant failure groups to be analyzed;

[0025] Based on the failure causes corresponding to the relevant failure groups to be analyzed, protection measures corresponding to the relevant failure groups to be analyzed are determined.

[0026] According to another aspect of the present application, a related failure analysis device is provided, comprising:

[0027] A security level determination module is used to determine the security level of the system logic model and multiple functional modules according to the security level requirements of the target product;

[0028] A related failure group determination module, configured to determine at least one related failure group having a cascading failure relationship according to the security levels and signal transmission directions of the plurality of functional modules;

[0029] The protection measure determination module is used to determine the protection measure of each related failure group according to each related failure group.

[0030] Optionally, the security level determination module is further used to:

[0031] According to the security level and signal transmission direction of the functional modules, two adjacent functional modules with different security levels are identified to obtain multiple candidate failure groups, wherein in each candidate failure group, the functional module with the first signal is the first functional module, and the functional module with the second signal is the second functional module;

[0032] A candidate failure group in which the safety level of the first functional module is lower than the safety level of the second functional module is identified as a related failure group having a cascading failure relationship.

[0033] Optionally, the relevant failure group determination module is further used for:

[0034] Draw a fault tree of the target product according to the functional requirements of the target product and the system logic model;

[0035] Identify from the fault tree the main fault function modules that jointly cause the target product to fail and the safety mechanisms corresponding to the main fault function modules;

[0036] The main fault function module and the corresponding safety mechanism are regarded as a related failure group having a common cause failure relationship.

[0037] Optionally, the protection measure determination module is further used to:

[0038] Based on a preset table of related failure coupling factors, determining a failure cause corresponding to each of the related failure groups;

[0039] Determine the failure risk level corresponding to each relevant failure group according to the functions corresponding to the functional modules in each of the relevant failure groups;

[0040] According to the failure cause and failure risk level corresponding to each of the related failure groups, the protection measures corresponding to each of the related failure groups are determined.

[0041] Optionally, the protection measure determination module is further used to:

[0042] Determine the failure consequence corresponding to each relevant failure group according to the function of the functional module in each of the relevant failure groups;

[0043] According to the failure consequences corresponding to each relevant failure group, the failure risk level corresponding to each relevant failure group is determined.

[0044] Optionally, the protection measure determination module is further used to:

[0045] Obtain relevant failure groups with high failure risk levels as relevant failure groups to be analyzed;

[0046] Based on the failure causes corresponding to the relevant failure groups to be analyzed, protection measures corresponding to the relevant failure groups to be analyzed are determined.

[0047] According to another aspect of the present application, a storage medium is provided, in which at least one executable instruction is stored, and the executable instruction enables a processor to perform operations corresponding to the above-mentioned related failure analysis method.

[0048] According to another aspect of the present application, a computer device is provided, comprising: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus;

[0049] The memory is used to store at least one executable instruction, and the executable instruction enables the processor to execute operations corresponding to the above-mentioned related failure analysis method.

[0050] By means of the above technical solution, the technical solution provided by the embodiment of the present invention has at least the following advantages:

[0051] The present application provides a method, device, equipment and medium for analyzing related failures. According to the safety level requirements of the target product, the safety level of the system logic model and multiple functional modules is determined. According to the safety levels and signal transmission directions of the multiple functional modules, multiple related failure groups with cascading failure relationships are determined. Failure analysis is performed on each related failure group, and protection measures for the related failure groups are determined. Only the related failure groups need to be analyzed, which narrows the analysis scope of the coupling factors and greatly reduces the workload of the safety analysis. In addition, the related failure groups are determined based on the signal transmission method in the system logic model, thereby avoiding the situation where the related failures are not fully identified.

[0052] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0054] Figure 1 A flowchart of a related failure analysis method provided by an embodiment of the present application is shown;

[0055] Figure 2 A system logic model diagram of a related failure analysis method provided by an embodiment of the present application is shown;

[0056] Figure 3 A fault tree diagram of a related failure analysis method provided by an embodiment of the present application is shown;

[0057] Figure 4 A block diagram of a related failure analysis device provided in an embodiment of the present application is shown;

[0058] Figure 5 A schematic structural diagram of a computer device provided by an embodiment of the present invention is shown.

[0059] in,

[0060] Figure 4 In: 402-security level determination module; 404-related failure group determination module; 406-protection measure determination module;

[0061] Figure 5 In it: 502 - processor; 504 - communication interface; 506 - memory; 508 - communication bus; 510 - program. DETAILED DESCRIPTION

[0062] The present invention will be described in detail below with reference to the accompanying drawings and in combination with embodiments. It should be noted that the embodiments and features in the embodiments of the present invention can be combined with each other without conflict.

[0063] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined invention purpose, the specific implementation methods, structures, features and effects of the present invention application are described in detail below in conjunction with the accompanying drawings and preferred embodiments. In the following description, different "one embodiment" or "embodiment" does not necessarily refer to the same embodiment. In addition, specific features, structures, or characteristics in one or more embodiments may be combined in any suitable form.

[0064] According to the ISO26262 standard, correlated failures include common cause failure (CCF) and cascading failure (CF). Common cause failure is a single point failure that destroys the independence of redundant design. The purpose of common cause failure analysis is to find common cause weaknesses in system design that will lead to common cause failures of redundant subsystems, and then formulate design strategies to reduce such hazards. Cascading failure is a failure of a certain element caused by a root cause, which in turn causes the failure of another element or multiple elements. The purpose of cascading failure analysis is to prove that elements with different ASIL (safety performance) levels or with and without ASIL levels can coexist. Both common cause failure analysis and cascading failure analysis must be performed during correlated failure analysis. The existing correlated failure analysis method needs to traverse all elements. Although the correlated failure analysis is complete, the workload is large.

[0065] In view of the problem that the current related failure analysis methods have a large workload, the present application embodiment provides a related failure analysis method, such as Figure 1 As shown, the method includes:

[0066] 102: Determine the security level of the system logic model and multiple functional modules according to the security level requirements of the target product;

[0067] 104: Determine at least one related failure group having a cascading failure relationship according to the safety levels and signal transmission directions of the plurality of functional modules;

[0068] 106: According to each related failure group, determine the protection measures for each related failure group.

[0069] Specifically, the design requirements of the target product include the functions to be realized by the target product or the needs of the customer, etc. The safety level of the target product is the functional safety level (ASIL level), which is generally pre-defined. The system logic model is drawn by splitting the functional modules according to the functional requirements of the target product. The system logic model can generally be expressed as the signal transmission relationship between the functional modules and the modules.

[0070] In this embodiment, the security levels of the system logic model and multiple functional modules that implement the functions of the target product are determined according to the security level requirements of the target product.

[0071] The safety level of each functional module is derived from the safety target level of the target product. If the safety target level of the target product is ASILB, in principle, the safety level configured for each major functional module is also ASILB. However, in reality, such an operation will greatly increase the cost, and some functional modules do not have safety chips that match the safety level. Therefore, such modules can be split into multiple modules with low safety levels that can realize this function, and there are monitoring modules that meet the ASILB level in multiple modules. For example Figure 2 In the figure, the safety target level of the target product is ASILB, and the power conversion module generally needs to adopt the same safety level, but this will make the overall cost higher. Therefore, the safety level of the power conversion module M02 is downgraded to QM level. At the same time, in order to meet the requirement of ASILB for the safety target level, the safety mechanism of the power conversion module is increased, such as the power monitoring module M03. The safety level of the power monitoring module is ASILB level, so the power conversion module and the power monitoring module that realize the power conversion function meet the target safety level.

[0072] It can be seen that different functional modules are split according to the security level requirements of the target product, and the resulting system logic model and the security levels of each functional module are not the same. The final system logic model is related to the cost, function, and security level of each functional module.

[0073] According to the signal transmission direction of the functional modules in the system logic model and the safety level of each functional module, multiple related failure groups with cascading failure relationships are identified, and failure analysis is performed on each related failure group. For example, based on a preset table of related failure coupling factors, the causes of related failures are analyzed, their failure consequences are analyzed, and failure risks are evaluated, etc., and corresponding protection measures are determined in a targeted manner.

[0074] The present application provides a correlated failure analysis method. Compared with the prior art, the security level of the system logic model and multiple functional modules is determined according to the security level requirements of the target product. According to the security levels and signal transmission directions of the multiple functional modules, multiple correlated failure groups with cascading failure relationships are determined. Failure analysis is performed on each correlated failure group, and protection measures for the correlated failure groups are determined. Only the correlated failure groups need to be analyzed, which narrows the analysis scope of the coupling factors and greatly reduces the workload of the safety analysis. In addition, the correlated failure groups are determined based on the system logic model to avoid incomplete identification of correlated failures.

[0075] In one embodiment, at least one related failure group having a cascading failure relationship is determined according to the security levels and signal transmission directions of the plurality of functional modules, including:

[0076] According to the security level of the functional module and the signal transmission direction, two adjacent functional modules with different security levels are identified to obtain multiple candidate failure groups, wherein in each candidate failure group, the functional module with the first signal is the first functional module, and the functional module with the second signal is the second functional module;

[0077] A candidate failure group in which the safety level of the first functional module is lower than the safety level of the second functional module is identified as a related failure group having a cascading failure relationship.

[0078] Specifically, in this application, the impact of the high-security level module on the low-security level module can be omitted for analysis, because it can be considered that the high-security level module has achieved higher security protection requirements and the probability of its output signal failing is low. Therefore, the cascading failure in this application only focuses on the impact of the low-security level module on the high-security level module.

[0079] Specifically, two adjacent functional modules are first divided into an object group as a candidate failure group with a cascading failure relationship, and then a candidate failure group in which the safety level of the previous module is lower than the safety level of the next module is selected from the candidate failure group as a related failure group with a cascading failure relationship. Among them, the front and the back are mainly defined according to the signal flow direction. For example, the safety level QM / QM(B) < the safety level ASILB / ASILB(B). The adjacent modules in which the safety level of the previous module is QM / QM(B) and the safety level of the next module is ASILB / ASILB(B) are regarded as a related failure group with a cascading failure relationship, and multiple related failure groups with cascading failure relationships are accurately obtained. After the related failure groups are determined, failure analysis is performed on the related failure groups, which greatly narrows the scope of analysis and does not cause omissions.

[0080] In one embodiment of the present invention, the related failure analysis method further includes:

[0081] Draw the fault tree of the target product according to the functional requirements and system logic model of the target product;

[0082] Identify the main fault function modules that cause the target product to fail and the safety mechanisms corresponding to the main fault function modules from the fault tree;

[0083] The main fault function modules and the corresponding safety mechanisms are regarded as related failure groups with common cause failure relationships.

[0084] Specifically, according to the functions realized by the target product, the faults that cause the target product to fail to realize the functions are found, and according to these faults, a fault tree is drawn, which includes the functional modules that cause the faults and the faults caused by these functional modules. From the fault tree, the modules under the logical "AND" relationship, that is, the modules under the "AND" gate, that is, the main fault functional module that causes the target product to fail and the safety mechanism corresponding to the main fault functional module, are obtained, and the main fault functional module and the safety mechanism corresponding to the main fault functional module are taken as related failure groups. When the safety mechanism corresponding to the main fault functional module includes multiple functional modules, it can also be divided into multiple related failure groups according to the functional modules in the safety mechanism, and a functional module in the safety mechanism and the main fault functional module are taken as a group as a related failure group with a common cause failure relationship, and multiple related failure groups with a common cause failure relationship are obtained, and multiple related failure groups with a common cause failure relationship can be accurately obtained.

[0085] In one embodiment of the present invention, determining a protection measure for each related failure group according to each related failure group includes:

[0086] Based on the preset related failure coupling factor table, determine the failure cause corresponding to each related failure group;

[0087] Determine the failure risk level corresponding to each relevant failure group according to the functions corresponding to the functional modules in each relevant failure group;

[0088] According to the failure cause and failure risk level corresponding to each relevant failure group, the protection measures corresponding to each relevant failure group are determined.

[0089] Specifically, based on the preset table of related failure coupling factors, the causes of related failures are analyzed; the preset table of related failure coupling factors includes shared resources, shared information input, anti-environmental interference, the same production and maintenance process, the same type of components, communications, unexpected interfaces, etc., and the failure causes of each related failure group are analyzed in terms of these aspects. Generally, a related failure group corresponds to multiple coupling factors. For each related failure group, according to the functions corresponding to the functional modules in the related failure group, its failure consequences are analyzed and its failure risk level is evaluated. For related failure groups with unacceptable risks, such as high risk levels, corresponding protection measures are determined based on their coupling factors and failure causes, thereby improving the accuracy of related failure analysis.

[0090] In one embodiment of the present invention, determining the failure risk level corresponding to each related failure group according to the functions of the functional modules in each related failure group includes:

[0091] According to the functions of the functional modules in each relevant failure group, determine the failure consequences corresponding to each relevant failure group;

[0092] According to the failure consequences corresponding to each relevant failure group, the failure risk level corresponding to each relevant failure group is determined.

[0093] Specifically, for each relevant failure group, the failure consequences are analyzed according to the functions realized by the functional modules in the relevant failure group, and the failure risk level is determined according to the impact of the failure consequences on the functions of the entire target product.

[0094] In one embodiment, according to the failure cause and failure risk level corresponding to each related failure group, the protection measures corresponding to each related failure group are determined, including:

[0095] Obtain relevant failure groups with high failure risk levels as relevant failure groups to be analyzed;

[0096] Based on the failure causes corresponding to the relevant failure groups to be analyzed, protection measures corresponding to the relevant failure groups to be analyzed are determined.

[0097] Specifically, according to the failure causes and coupling factors, the corresponding protection measures of the relevant failure groups with high risk levels are determined, and corresponding modifications or tests are performed according to the protection measures to ensure that the designed target product meets the design requirements and improve the accuracy of the relevant failure analysis.

[0098] For example, the 12V to 5V module and the 5V power monitoring module are a related failure group. The failure reason is that the voltage output by the 12V to 5V module exceeds the working monitoring range of the 5V power monitoring module, which may affect the operation of the 5V power monitoring module. Therefore, the determined protection measure is to modify the 5V monitoring module so that its voltage resistance characteristics should be able to withstand the input of 16V voltage.

[0099] In one embodiment, the complete dependent failure analysis process is recorded, including the system logic model and fault tree, to ensure that the risk of all dependent failures is reduced to an acceptable level.

[0100] In one embodiment, taking the motor power module of the laser radar as an example, relevant failure analysis is performed:

[0101] S101: Determine the security level of the functional module.

[0102] According to the requirements of the target product, determine the relevant analysis scope of the motor power module of the laser radar. The analysis scope of this embodiment is Figure 2 The functional modules within the dotted box include M01 module, M02 module, M03 module, M04 module, M05 module, M06 module, M07 module and M08 module.

[0103] According to the signal transmission direction between the functional modules within the relevant analysis range, the system architecture diagram is used to establish the module-level system logic model, such as Figure 2 shown. Figure 2 The M01 module is a power protection module; the M02 module converts the KL30 signal output by the battery into a 5V voltage signal; the M03 module monitors the voltage signal converted by the M02 module for over-voltage and under-voltage. If there is no problem, the VCC5V signal is given to the M04 module and the M06 module; the M04 module is the power management module of the SOC, which converts the 5V power signal into 3.3V, 1.8V, 1.2V, and 0.85V power signals and provides them to the M05 module; the M05 module is the SOC. The M06 module is the power management module of the motor, which converts the 5V power signal into 3.3V and 3.0V power signals and provides them to the M07 module and the M08 module; the M07 module is an ADC module, which periodically samples the power information input by the M06 module and sends it to the SOC. The SOC receives the voltage information sampled by the M07 module to perform over-voltage and under-voltage diagnosis of the motor power supply; the M08 module is the motor and does not undertake any tasks in the power supply function.

[0104] The ASIL level of each functional module in the logical model of this system comes from the safety target level (ASILB) of the target product. Since the safety target of the target product is ASILB, in principle, the safety level of each functional module is also ASILB. Since there is no ASILB-level module to implement a certain function, such a module can be split into multiple modules that can implement this function, and there are modules that meet the ASILB level among the multiple modules. (For example, the function implemented by M02 is more important, and generally requires the same safety level ASILB as the target product, but this will make the overall cost higher or there is no safety chip of the same level corresponding to the module on the market, so the safety level of the power conversion module M02 is downgraded to the QM level. At the same time, in order to meet the requirement that the safety target level is ASILB, a safety mechanism for the power conversion module is added, such as the power monitoring module M03, and the safety level of the power monitoring module is defined as ASILB level). Figure 2 Similar situations include M06 and M07. In this case, M02 and M06 are architectural elements, M03 and M07 are monitoring elements, and M05 is both an architectural element and a monitoring element. It performs both functions and is developed according to the requirements of the architectural elements first.

[0105] If the architecture elements are not sufficiently independent, the monitoring elements and architecture elements inherit the ASIL level of the target product (that is, the architecture elements need to inherit the ASIL B safety level of the target product. If the architecture elements are QM, monitoring elements must be added at this time, requiring the architecture elements of QM + the monitoring requirements of ASILB to meet the requirements of ASILB). The initial design of this embodiment is that the M02 module and the M03 module, and the M06 module and the M07 module are independent, which means that there can be no interference between them, such as electromagnetic interference. However, the independence of this initial design needs to be verified, that is, the relevant failure analysis methods of this application are used to prove the independence between modules. If they are not independent, protective measures need to be added or the ASIL level needs to be modified.

[0106] S102: Identify related failure groups.

[0107] First, based on Figure 2 Identify groups of related failures of cascading type, from Figure 2 The adjacent modules with different ASIL levels and whose safety level of the previous functional module is lower than that of the latter functional module are identified, and the related failure groups shown in Table 1 are obtained.

[0108] In this embodiment, cascading failure focuses on the impact of failure of low-security level modules on high-security level modules between adjacent modules. Figure 2 , QM / QM(B)<ASILB / ASILB(B). Two adjacent functional modules are divided into an object group. Adjacent modules with the same safety level, such as M01 module and M02 module, M03 module and M04 module, meet the requirements of element coexistence, and their safety levels are the same, so the analysis can be omitted. Since the interference affects the next-level module by outputting information, the impact of the high-safety level module on the low-safety level module can also be omitted. Only the impact of the low-safety level module on the high-safety level module is considered. Therefore, two adjacent safety modules whose safety level of the previous module is lower than that of the latter module are obtained as related failure groups with a cascading failure relationship. Finally, the related failure groups that meet the cascading failure relationship are shown in Table 1.

[0109] Table 1 Related failure groups with cascading failure relationships

[0110]

[0111] The function of concern in this embodiment is that the M06 motor power module provides correct voltage information to the motor. The corresponding safety mechanism is that the M07 module samples the output of the M06 module, and the M05 module receives the information from the M07 module to perform over-voltage and under-voltage monitoring. Assuming that the M06 module is independent of the corresponding safety mechanism, the M06 module and the corresponding safety mechanism are ASIL decomposed. The decomposition result is that the safety level of the M06 module is QM (B), the safety level of the M07 module is ASILB (B), and the M04 module and the M05 module undertake the tasks of other safety functions, so they inherit the safety level of ASILB; according to the function of concern in this embodiment, it can be seen that the top event of the fault tree is that the M06 module outputs incorrect motor power information to the M08 module. The fault tree is drawn based on the logical "and" relationship between the expected function and the safety mechanism, such as Figure 3 shown.

[0112] in accordance with Figure 3 Identify related failure groups with common cause failure relationships, identify Figure 3 The modules under the logical AND relationship in the fault tree, that is, the modules under the “AND” gate, are used to obtain the related failure groups shown in Table 2. When the safety mechanism includes multiple modules, the modules included in the safety mechanism can also be split and written, as shown in Table 3.

[0113] Table 2 Related failure groups with common cause failure relationships

[0114]

[0115] Table 3 Related failure groups with common cause failure relationships

[0116]

[0117]

[0118] This step identifies multiple related failure groups through a structured approach. Compared with traversing all modules, it greatly narrows the scope of analysis and avoids omissions.

[0119] S103: Analyze relevant failure causes.

[0120] Based on the checklist of related failure coupling factors, the failure causes of each related failure group are analyzed one by one from the aspects of shared resources, shared information input, resistance to environmental interference, the same production and maintenance process, the same type of components, communication, unexpected interfaces, etc. The analysis results are shown in Table 4.

[0121] Table 4 Cause analysis of related failures

[0122]

[0123]

[0124] S104: Evaluate relevant failure risks.

[0125] For each related failure group, the failure consequence is analyzed, and the failure risk is evaluated based on the failure consequence. The failure risk assessment results are shown in Table 5. For example, the 12V to 5V module and the 5V power supply monitoring module are a related failure group. The failure consequence is that the power supply and functional modules of the subsequent stage may be damaged, resulting in the failure to provide the correct power supply to the target product, affecting the operation of the entire target product. Therefore, the failure risk level is high.

[0126] For another example, the ADC (analog-to-digital conversion) module and the power management module. If the ADC module outputs an erroneous power signal to the power management module, it will affect the power management module to trigger a fault response. However, this does not affect the realization of the overall function of the target product. Therefore, the failure risk level is low.

[0127] Table 5 Risk assessment of related failure groups

[0128]

[0129] S105: Determine protection measures.

[0130] For related failure groups with unacceptable risks, for example, related failure groups with high risk levels, corresponding protection measures are determined based on their coupling factors. The corresponding protection measures are shown in Table 6.

[0131] Table 6 Protection measures for related failures

[0132]

[0133]

[0134]

[0135] The identified protection measures are:

[0136] The voltage resistance characteristics of the DFA-M01 monitoring module should be able to withstand the input of 16V voltage to ensure that the monitoring module is not damaged.

[0137] DFA-M02 should conduct reliability tests and EMC samples on the whole machine according to the corresponding laws and regulations, and pass the test requirements.

[0138] The DFA-M03 5V power supply information should comply with the safety level requirements of ASILB.

[0139] DFA-M04 The insulation distance between two related failure groups should be greater than 1.3 times the theoretical value of the creepage distance.

[0140] DFA-M05 development, production, installation and maintenance processes should be verified and comply with ISO26262 standards.

[0141] S106: DFA process record.

[0142] This embodiment narrows the analysis scope of coupling factors and greatly reduces the workload of safety analysis by identifying related failure groups and analyzing the failure causes and failure risk levels of each related failure group. In addition, its structured analysis approach avoids incomplete identification of related failures.

[0143] Furthermore, as a response to the above Figure 1 In order to realize the method shown in the figure, the embodiment of the present invention provides a related failure analysis device, such as Figure 4 As shown, the device comprises:

[0144] The security level determination module 402 is used to determine the security level of the system logic model and multiple functional modules according to the security level requirements of the target product;

[0145] A related failure group determination module 404, configured to determine at least one related failure group having a cascading failure relationship according to the security levels and signal transmission directions of the plurality of functional modules;

[0146] The protection measure determination module 406 is used to determine the protection measure of each related failure group according to each related failure group.

[0147] The present application provides a correlated failure analysis device. Compared with the prior art, the security level of the system logic model and multiple functional modules is determined according to the security level requirements of the target product. According to the security levels and signal transmission directions of the multiple functional modules, multiple correlated failure groups with cascading failure relationships are determined, and failure analysis is performed on each correlated failure group to determine the protection measures for the correlated failure groups. Only the correlated failure groups need to be analyzed, which narrows the analysis scope of the coupling factors and greatly reduces the workload of the safety analysis. In addition, the correlated failure groups determined based on the system logic model and the structured analysis approach avoid the situation where the correlated failures are not fully identified.

[0148] In one embodiment, the security level determination module is further configured to:

[0149] According to the security level of the functional module and the signal transmission direction, two adjacent functional modules with different security levels are identified to obtain multiple candidate failure groups, wherein in each candidate failure group, the functional module with the first signal is the first functional module, and the functional module with the second signal is the second functional module;

[0150] A candidate failure group in which the safety level of the first functional module is lower than the safety level of the second functional module is identified as a related failure group having a cascading failure relationship.

[0151] In one embodiment, the related failure group determination module is further configured to:

[0152] Draw the fault tree of the target product according to the functional requirements and system logic model of the target product;

[0153] Identify the main fault function modules that cause the target product to fail and the safety mechanisms corresponding to the main fault function modules from the fault tree;

[0154] The main fault function modules and the corresponding safety mechanisms are regarded as related failure groups with common cause failure relationships.

[0155] In one embodiment, the protection measure determination module is further configured to:

[0156] Based on the preset related failure coupling factor table, determine the failure cause corresponding to each related failure group;

[0157] Determine the failure risk level corresponding to each relevant failure group according to the functions corresponding to the functional modules in each relevant failure group;

[0158] According to the failure cause and failure risk level corresponding to each relevant failure group, the protection measures corresponding to each relevant failure group are determined.

[0159] In one embodiment, the protection measure determination module is further configured to:

[0160] According to the functions of the functional modules in each relevant failure group, determine the failure consequences corresponding to each relevant failure group;

[0161] According to the failure consequences corresponding to each relevant failure group, the failure risk level corresponding to each relevant failure group is determined.

[0162] In one embodiment, the protection measure determination module is further configured to:

[0163] Obtain relevant failure groups with high failure risk levels as relevant failure groups to be analyzed;

[0164] Based on the failure causes corresponding to the relevant failure groups to be analyzed, protection measures corresponding to the relevant failure groups to be analyzed are determined.

[0165] According to an embodiment of the present invention, a storage medium is provided, wherein the storage medium stores at least one executable instruction, and the computer executable instruction can execute the relevant failure analysis method in any of the above method embodiments.

[0166] Figure 5A schematic diagram of the structure of a computer device provided according to an embodiment of the present invention is shown. The specific embodiment of the present invention does not limit the specific implementation of the computer device.

[0167] like Figure 5 As shown, the computer device may include: a processor (processor) 502 , a communication interface (Communications Interface) 504 , a memory (memory) 506 , and a communication bus 508 .

[0168] The processor 502 , the communication interface 504 , and the memory 506 communicate with each other via a communication bus 508 .

[0169] The communication interface 504 is used to communicate with other devices such as clients or other servers.

[0170] The processor 502 is used to execute the program 510, and specifically can execute the relevant steps in the above-mentioned relevant failure analysis method embodiment.

[0171] Specifically, the program 510 may include program codes, which include computer operation instructions.

[0172] The processor 502 may be a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present invention. The one or more processors included in the computer device may be processors of the same type, such as one or more CPUs; or processors of different types, such as one or more CPUs and one or more ASICs.

[0173] The memory 506 is used to store the program 510. The memory 506 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0174] The program 510 may be specifically configured to enable the processor 502 to perform the following operations:

[0175] Determine the security level of the system logic model and multiple functional modules according to the security level requirements of the target product;

[0176] Determining at least one related failure group having a cascading failure relationship according to the safety levels and signal transmission directions of the plurality of functional modules;

[0177] Based on each dependent failure group, determine the protection measures for each dependent failure group.

[0178] Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices. In one embodiment, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order than here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0179] The above embodiments are only exemplary embodiments of the present application and are not intended to limit the present application. The protection scope of the present application is defined by the claims. Those skilled in the art may make various modifications or equivalent substitutions to the present application within the essence and protection scope of the present application, and such modifications or equivalent substitutions shall also be deemed to fall within the protection scope of the present application.

Claims

1. A method for correlation failure analysis, characterized in that: include: Determine the security level of the system logic model and multiple functional modules according to the security level requirements of the target product; Determining at least one related failure group having a cascading failure relationship according to the security levels and signal transmission directions of the plurality of functional modules; According to each of the related failure groups, a protection measure for each of the related failure groups is determined.

2. The correlation failure analysis method according to claim 1, characterized in that: The step of determining at least one related failure group having a cascading failure relationship according to the security levels and signal transmission directions of the plurality of functional modules comprises: According to the security level and signal transmission direction of the functional modules, two adjacent functional modules with different security levels are identified to obtain multiple candidate failure groups, wherein in each candidate failure group, the functional module with the first signal is the first functional module, and the functional module with the second signal is the second functional module; A candidate failure group in which the safety level of the first functional module is lower than the safety level of the second functional module is identified as a related failure group having a cascading failure relationship.

3. The correlation failure analysis method according to claim 1, characterized in that: The related failure analysis method also includes: Draw a fault tree of the target product according to the functional requirements of the target product and the system logic model; Identify from the fault tree the main fault function modules that jointly cause the target product to fail and the safety mechanisms corresponding to the main fault function modules; The main fault function module and the corresponding safety mechanism are regarded as a related failure group having a common cause failure relationship.

4. The correlation failure analysis method according to claim 1 or 3, characterized in that: Determining the protection measures for each of the related failure groups according to each of the related failure groups includes: Based on a preset table of related failure coupling factors, determining a failure cause corresponding to each of the related failure groups; Determine the failure risk level corresponding to each relevant failure group according to the functions corresponding to the functional modules in each of the relevant failure groups; According to the failure cause and failure risk level corresponding to each of the related failure groups, the protection measures corresponding to each of the related failure groups are determined.

5. The correlation failure analysis method according to claim 4, characterized in that: Determining the failure risk level corresponding to each related failure group according to the functions of the functional modules in each related failure group includes: Determine the failure consequence corresponding to each relevant failure group according to the function of the functional module in each of the relevant failure groups; According to the failure consequences corresponding to each relevant failure group, the failure risk level corresponding to each relevant failure group is determined.

6. The correlation failure analysis method according to claim 4, characterized in that: Determining the protection measures corresponding to each of the related failure groups according to the failure causes and failure risk levels corresponding to each of the related failure groups includes: Obtain relevant failure groups with high failure risk levels as relevant failure groups to be analyzed; Based on the failure causes corresponding to the relevant failure groups to be analyzed, protection measures corresponding to the relevant failure groups to be analyzed are determined.

7. A correlation failure analysis device, characterized in that: include: A security level determination module is used to determine the security level of the system logic model and multiple functional modules according to the security level requirements of the target product; A related failure group determination module, configured to determine at least one related failure group having a cascading failure relationship according to the security levels and signal transmission directions of the plurality of functional modules; The protection measure determination module is used to determine the protection measure of each related failure group according to each related failure group.

8. A storage medium storing at least one executable instruction, wherein the executable instruction enables a processor to execute an operation corresponding to the relevant failure analysis method according to any one of claims 1 to 6.

9. A computer device comprising: A processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus; The memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform operations corresponding to the relevant failure analysis method according to any one of claims 1-6.

Images