Vehicle hardware function safety assessment method and system

Abstract

The invention provides a vehicle hardware function safety assessment method and system. The method comprises the following steps: acquiring hardware element information of a plurality of related hardware elements of target hardware; processing the hardware element information by using a first evaluation model in the security evaluation model to obtain a first hardware failure rate; under the condition that it is determined that the first hardware failure rate does not meet the preset failure rate condition, a target security mechanism is matched from a security mechanism database, security mechanism information of the target security mechanism is obtained, and the security mechanism information at least comprises diagnosis coverage rate information; processing the security mechanism information and the hardware element information by using a second assessment model in the security assessment model to obtain a second hardware failure rate; and when it is determined that the failure rate of the second hardware meets the preset failure rate condition, outputting an evaluation result of the target hardware. The technical problem that the evaluation result is affected by manual operation errors and subjective judgment factors of analysts can be avoided.

Description

Technical Field

[0001] The present invention relates to the field of vehicle technology, and in particular to a vehicle hardware functional safety assessment method and system. Background Art

[0002] With the widespread use of vehicle electronic components, the technical requirements for hardware complexity are increasing, and the requirements for hardware failure rate are becoming more and more stringent.

[0003] A highly complex hardware design consists of thousands of hardware elements, and evaluating the quantitative indicators of vehicle hardware functional safety is a necessary development content. Traditional vehicle hardware functional safety quantitative indicator analysis is affected by factors such as manual input data errors, inappropriate reference to standard data, and subjective judgment of analysts, which makes the quantitative indicator evaluation results different from the actual values, and the actual hardware failure rate is higher than the target value, which brings safety risks.

[0004] At present, the industry has implemented the following designs for quantitative analysis:

[0005] 1) Manually input hardware element information according to the hardware circuit design diagram;

[0006] 2) For each hardware element, manually calculate and fill in relevant information according to the calculation algorithm, such as single point fault metric (SPFM), latent fault metric (LFM) and random hardware failure probability metric (PMHF) values;

[0007] 3) Calculate the quantitative value of failure rate overall.

[0008] The above solution has the following problems:

[0009] 1) To conduct quantitative indicator analysis on vehicle hardware functional safety, it is necessary to manually input hardware element information based on the hardware circuit design diagram, which is a huge workload and prone to editing errors;

[0010] 2) When evaluating hardware failure rates, industry standards are usually cited, which are usually foreign standards and do not fully match national conditions, resulting in deviations in the evaluation results;

[0011] 3) Analysts make subjective judgments on fault types and safety mechanism diagnostic coverage, resulting in biased evaluation results.

[0012] Currently, no effective solution has been proposed for the above-mentioned technical problems. Summary of the invention

[0013] The main purpose of the present invention is to provide a vehicle hardware functional safety assessment method and system to solve the problem in the prior art that manual operation and subjective judgment of analysts cause differences between quantitative indicator assessment results and true values.

[0014] In order to achieve the above-mentioned purpose, according to one aspect of the present invention, a vehicle hardware functional safety assessment method is provided, comprising: obtaining hardware element information of multiple relevant hardware elements of the target hardware, the hardware element information at least including the hardware element failure rate and the hardware element type, and the relevant hardware elements are hardware elements that affect the functional safety target of the target hardware; using a first assessment model in a safety assessment model to process the hardware element information to obtain a first hardware failure rate; when it is determined that the first hardware failure rate does not meet the preset failure rate condition, matching the target safety mechanism from a safety mechanism database, and obtaining safety mechanism information of the target safety mechanism, the safety mechanism information at least including diagnostic coverage information; using a second assessment model in the safety assessment model to process the safety mechanism information and the hardware element information to obtain a second hardware failure rate; when it is determined that the second hardware failure rate meets the preset failure rate condition, outputting an assessment result of the target hardware, the assessment result at least including the second hardware failure rate and the safety mechanism information of the target safety mechanism.

[0015] Optionally, before obtaining the hardware element information of multiple related hardware elements of the target hardware, the method further includes: importing a hardware circuit design drawing of the target hardware; and identifying all hardware elements in the hardware circuit design drawing.

[0016] Optionally, the hardware element failure rate includes a first element failure rate and a second element failure rate, the first element failure rate is the overall failure rate of the hardware element, the second element failure rate is the failure rate of the hardware element under a relevant failure mode, and the relevant failure mode is a failure mode among multiple failure modes of the relevant hardware elements that affects the target hardware functional safety target.

[0017] Optionally, matching the target security mechanism from the security mechanism database includes the following steps: based on a first matching condition, determining the target hardware element from multiple related hardware elements, and obtaining hardware element information of the target hardware element; based on a second matching condition, determining the target failure mode from multiple related failure modes of the target hardware element; determining a security mechanism set that matches the hardware element type and target failure mode of the target hardware element from the security mechanism database; and based on a third matching condition, matching the target security mechanism from the security mechanism set.

[0018] Optionally, the first matching condition is that the first element failure rate of the target hardware element is greater than the first element failure rates of other related hardware elements.

[0019] Optionally, the second matching condition is that the second element failure rate of the target fault mode is greater than the second element failure rates of other related fault modes.

[0020] Optionally, the third matching condition is that the diagnostic coverage of the target safety mechanism is greater than the diagnostic coverage of the remaining safety mechanisms in the safety mechanism set.

[0021] Optionally, in the same hardware element, the first element failure rate is distributed to multiple second element failure rates according to a preset distribution ratio.

[0022] According to another aspect of the present invention, a vehicle hardware functional safety assessment system is provided, comprising: an acquisition module, the acquisition module is used for hardware element information of multiple relevant hardware elements of target hardware, the hardware element information at least includes hardware element failure rate and hardware element type, and the relevant hardware elements are hardware elements that affect the functional safety target of the target hardware; a first assessment module, the first assessment module is used to process the hardware element information using a first assessment model in a safety assessment model to obtain a first hardware failure rate; a matching module, the matching module is used to match the target safety mechanism from a safety mechanism database and obtain safety mechanism information of the target safety mechanism when it is determined that the first hardware failure rate does not meet the preset failure rate condition, and the safety mechanism information of the target safety mechanism includes at least diagnostic coverage information; a second assessment module, the second assessment module is used to process the safety mechanism information and hardware element information using a second assessment model in the safety assessment model to obtain a second hardware failure rate; an output module, the output module is used to output the assessment result of the target hardware when it is determined that the second hardware failure rate meets the preset failure rate condition, the assessment result at least includes the second hardware failure rate and safety mechanism information of the target safety mechanism.

[0023] Furthermore, the vehicle hardware functional safety assessment system also includes: an import module, which is used to import the hardware circuit design drawing of the target hardware; and an identification module, which is used to identify all hardware elements in the hardware circuit design drawing.

[0024] In an embodiment of the present invention, hardware element information of multiple relevant hardware elements of the target hardware is obtained, the hardware element information at least includes the hardware element failure rate and the hardware element type, and the relevant hardware elements are hardware elements that affect the functional safety target of the target hardware; the hardware element information is processed by using the first evaluation model in the safety evaluation model to obtain the first hardware failure rate; when it is determined that the first hardware failure rate does not meet the preset failure rate condition, the target safety mechanism is matched from the safety mechanism database, and the safety mechanism information of the target safety mechanism is obtained, and the safety mechanism information at least includes the diagnostic coverage information; the safety mechanism information and the hardware element information are processed by using the second evaluation model in the safety evaluation model to obtain the second hardware failure rate; when it is determined that the second hardware failure rate meets the preset failure rate condition, the evaluation result of the target hardware is output, and the evaluation result at least includes the second hardware failure rate and the safety mechanism information of the target safety mechanism, which can automatically match the target safety mechanism and obtain the safety mechanism information of the target safety mechanism, the failure rate evaluation has high accuracy, the hardware design safety is good, and it can avoid being affected by factors such as manual input data misoperation, citing inappropriate standard data, and subjective judgment of analysts, so that the quantitative indicator evaluation result is different from the true value. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The drawings constituting a part of the present application are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0026] Figure 1 is a hardware structure block diagram of a computer terminal of a vehicle hardware functional safety assessment method according to one embodiment of the present invention;

[0027] Figure 2 is a flow chart of a vehicle hardware functional safety assessment method according to one optional embodiment of the present invention;

[0028] Figure 3 is a structural block diagram of a vehicle hardware functional safety assessment system according to one embodiment of the present invention;

[0029] Figure 4 It is a flowchart of a vehicle hardware functional safety assessment method according to one optional embodiment of the present invention. DETAILED DESCRIPTION

[0030] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0031] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein, for example. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0032] According to an embodiment of the present application, a method embodiment of a vehicle hardware functional safety assessment method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0033] The method embodiment can be executed in a computer terminal or a similar computing device. For example, if the method is executed in a computer terminal, Figure 1 As shown, the computer terminal may include one or more processors 102 (the processor may include but is not limited to a central processing unit (CPU), a graphics processing unit (GPU), a digital signal processing (DSP) chip, a microprocessor (MCU), a programmable logic device (FPGA), a neural network processor (NPU), a tensor processor (TPU), an artificial intelligence (AI) type processor, etc.) and a memory 104 for storing data. Optionally, the above-mentioned computer terminal may also include a transmission device 106 for communication functions, an input and output device 108, and a display device 110. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above-mentioned computer terminal. For example, the computer terminal may also include more or fewer components than the above-mentioned structure description, or have a configuration different from the above-mentioned structure description.

[0034] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the vehicle hardware functional safety assessment method in the embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, the above-mentioned vehicle hardware functional safety assessment method is realized. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories can be connected to the mobile terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0035] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the mobile terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device can be a radio frequency (Radio Frequency, referred to as RF) module, which is used to communicate with the Internet wirelessly.

[0036] The display device 110 may be, for example, a touch screen type liquid crystal display (LCD) and a touch display (also referred to as a "touch screen" or "touch display screen"). The liquid crystal display may enable a user to interact with a user interface of the mobile terminal. In some embodiments, the mobile terminal has a graphical user interface (GUI), and a user may interact with the GUI by finger contact and / or gestures on a touch-sensitive surface, wherein the human-computer interaction functions here may optionally include the following interactions: creating web pages, drawing, word processing, making electronic documents, games, video conferencing, instant messaging, sending and receiving emails, call interfaces, playing digital videos, playing digital music and / or web browsing, etc. The executable instructions for executing the above human-computer interaction functions are configured / stored in a computer program product or readable storage medium executable by one or more processors.

[0037] According to the vehicle hardware functional safety assessment method of the embodiment of the present application, as Figure 2 As shown, the method comprises the following steps:

[0038] Step S301: Acquire hardware element information of multiple relevant hardware elements of target hardware, where the hardware element information at least includes hardware element failure rate and hardware element type, and the relevant hardware elements are hardware elements that affect the functional safety objectives of the target hardware;

[0039] Specifically, in step S301, the hardware element types include resistance elements, capacitance elements, inductance elements, etc., and the failure rate of hardware elements is an important indicator for evaluating vehicle quality and reliability.

[0040] It should be noted that the failure of multiple related hardware elements of the target hardware may cause the target hardware to fail, or the failure of a single related hardware element of the target hardware may cause the target hardware to fail, that is, double-point failure and single-point failure.

[0041] Step S302: Processing the hardware element information using the first assessment model in the safety assessment model to obtain a first hardware failure rate;

[0042] Optionally, in step S302, the first evaluation model is:

[0043] Failure of single-point failure mode of hardware elements: SF = element failure rate * failure mode distribution ratio;

[0044] Overall single point failure rate: SPFM= ;

[0045] Failure of dual-point failure mode of hardware elements: LF = element failure rate * failure mode distribution ratio;

[0046] Overall double point failure: LFM= ;

[0047] Random hardware failure rate: PMHF=λ SPF +λ RF +λ MPF,DP *λ MPF,L *T Lifetime .

[0048] Where SR,HW is the safety-related hardware element; λ is the overall failure rate, λ=λ SPF +λ RF +λ MPF +λ S ; SPF is the single point failure rate; RF is the residual fault failure rate; MPF,DP is the detectable and perceptible multi-point failure rate; MPF,L is the latent fault failure rate; SPFM is the single point fault metric, LMF is the latent fault metric, and PMHF is the random hardware failure probability metric.

[0049] Step S303: when it is determined that the first hardware failure rate does not meet the preset failure rate condition, matching the target safety mechanism from the safety mechanism database and obtaining safety mechanism information of the target safety mechanism, the safety mechanism information at least including diagnostic coverage information;

[0050] It should be noted that the first hardware failure rate is the first hardware failure metric, a preset failure rate condition and a preset target condition.

[0051] Step S304: using the second evaluation model in the security evaluation model to process the security mechanism information and the hardware element information to obtain a second hardware failure rate;

[0052] Optionally, in step S304, the second evaluation model is:

[0053] If SPFM<target value, λ[SPF]=λ1+λ2+…+λ n , and λ1>λ2>…>λ n ;

[0054] Automatically match λ1 with the safety mechanism with the highest diagnostic coverage for the corresponding failure in the safety mechanism database, and recalculate λ[SPF], at which point λ[SPF]=λ2+…+λ n +λ1, and λ2>…>λ n >λ1; if SPFM is still < target value, repeat the above operation for λ2 until SPFM > target value, or it has been repeated n times.

[0055] If LFM<target value, λ[MPF,L]=λ1+λ2+…+λ n , and λ1>λ2>…>λ n ;

[0056] Automatically match λ1 with the safety mechanism with the highest diagnostic coverage for the corresponding failure in the safety mechanism database, and recalculate λ[MPF,L], where λ[MPF,L]=λ2+…+λ n +λ1, and λ2>…>λ n >λ1; if LFM is still < target value, repeat the above operation for λ2 until LFM > target value, or it has been repeated n times.

[0057] When SPFM and LFM are both > target values, if PMHF > target value, you should consider replacing the hardware to reduce the basic failure rate.

[0058] In this embodiment, after calculating the quantitative value of the failure rate according to the hardware element single-point fault mode failure rate formula, the hardware element double-point fault mode failure rate formula and the PMHF formula, the functional safety quantitative indicator results and the safety mechanism design plan are automatically output.

[0059] Step S305: when it is determined that the second hardware failure rate meets the preset failure rate condition, output the evaluation result of the target hardware, the evaluation result at least including the second hardware failure rate and the security mechanism information of the target security mechanism.

[0060] Through the above steps, the hardware element information of multiple relevant hardware elements of the target hardware is obtained, and the hardware element information at least includes the hardware element failure rate and the hardware element type, and the relevant hardware elements are the hardware elements that affect the functional safety target of the target hardware; the hardware element information is processed by using the first evaluation model in the safety evaluation model to obtain the first hardware failure rate; when it is determined that the first hardware failure rate does not meet the preset failure rate condition, the target safety mechanism is matched from the safety mechanism database, and the safety mechanism information of the target safety mechanism is obtained, and the safety mechanism information at least includes the diagnostic coverage information; the safety mechanism information and the hardware element information are processed by using the second evaluation model in the safety evaluation model to obtain the second hardware failure rate; when it is determined that the second hardware failure rate meets the preset failure rate condition, the evaluation result of the target hardware is output, and the evaluation result at least includes the second hardware failure rate and the safety mechanism information of the target safety mechanism, and the target safety mechanism can be automatically matched and the safety mechanism information of the target safety mechanism can be obtained, the failure rate evaluation has high accuracy, the hardware design safety is good, and it can avoid being affected by factors such as manual input data misoperation, citing inappropriate standard data, and subjective judgment of analysts, so that the quantitative indicator evaluation result is different from the true value.

[0061] Optionally, in step S301, before obtaining hardware element information of multiple related hardware elements of the target hardware, the following steps are included:

[0062] Step S3011: importing the hardware circuit design drawing of the target hardware;

[0063] Specifically, the hardware element information of the target hardware is included in the hardware circuit design. Figure 1 By importing the hardware quantitative indicator evaluation tool, there is no need to manually process the element information on the hardware circuit design diagram, saving manpower.

[0064] It should be noted that the evaluation tool is a vehicle hardware functional safety evaluation system, which can be an electronic device including a memory and a processor or a similar computing device, or a system such as a computer program.

[0065] Step S3012: Identify all hardware elements in the hardware circuit design diagram.

[0066] Specifically, the evaluation tool will automatically identify the imported hardware circuit design drawings, the hardware element information, identification numbers, etc. on the design drawings, saving manpower. At the same time, it can avoid errors in manually input data information or the influence of human subjective judgment factors, which may cause differences in the results and make the hardware failure rate assessment higher than the target value, bringing safety risks.

[0067] In this embodiment, after identifying all the hardware elements in the hardware circuit design diagram, the relevant hardware elements that affect the target hardware functional safety target can be determined according to the hardware functional safety target. The determination of the relevant hardware elements can be performed automatically or manually confirmed and screened out by the operator. The circuit design diagram includes the hardware element information of all the hardware elements. The evaluation tool identifies all the hardware elements in the circuit design diagram and obtains the hardware element information of each hardware element to prepare for the subsequent calculation of the overall hardware failure rate, making the subsequent hardware failure rate calculation faster.

[0068] Optionally, in steps S301-S305, the hardware element failure rate includes a first element failure rate and a second element failure rate, the first element failure rate is the overall failure rate of the hardware element, the second element failure rate is the failure rate of the hardware element under a relevant failure mode, and the relevant failure mode is a failure mode that affects the target hardware functional safety target among multiple failure modes of the relevant hardware elements.

[0069] Specifically, when the overall failure rate of the target hardware is a non-safety-related fault type, the target hardware elements will not enter the failure rate calculation of the relevant failure mode. When the overall failure rate of the target hardware is a relevant safety target fault type, the hardware failure rate that affects the functional safety target of the target hardware under the relevant failure mode is calculated. Then, when the second hardware failure rate meets the preset failure rate conditions, the failure rate result of the target hardware related failure mode is output.

[0070] It should be noted that failure rate refers to the probability of failure of a system or hardware in a unit of time, and the unit is expressed in FIT, where 1FIT=10 -9 In this embodiment, the first factor failure rate is the overall failure rate of the hardware factors, and the overall failure rate target is clearly defined, for example, ASIL (Automotive Safety Integrity Level) D < 10FIT; ASIL B < 100FIT; ASILC < 100FIT.

[0071] Optionally, in step S303, matching a target security mechanism from a security mechanism database includes the following steps:

[0072] Step S3031: based on the first matching condition, determine a target hardware element from a plurality of related hardware elements, and obtain hardware element information of the target hardware element;

[0073] Step S3032: determining a target failure mode from the plurality of related failure modes of the target hardware element based on the second matching condition;

[0074] Step S3033: Determine, from the safety mechanism database, a safety mechanism set that matches the hardware element type and the target failure mode of the target hardware element;

[0075] Specifically, after automatically refining and generating the hardware element failure mode, the safety mechanism set of the target hardware element is determined, the failure mode type is manually analyzed, and the failure mode is classified. For example, it is analyzed whether the target failure mode has an appropriate safety mechanism to control the failure mode of the target hardware element. If the target hardware element does not match any safety mechanism set, the fault is judged to be a single point fault. If the target hardware element can only be combined with another independent hardware element fault to cause the fault to take effect, it is judged to be a double point fault.

[0076] It should be noted that in the dual-point failure mode, if one of the target hardware element or another independent hardware element associated with it is not detected by the safety mechanism and is not perceived by the user, and the fault is not discovered until the second hardware element fails, then this dual-point failure mode is a latent dual-point failure, that is, a dual-point (latent) failure.

[0077] Step S3034: Based on the third matching condition, match the target security mechanism from the security mechanism set.

[0078] Through steps S3031 to S3034, the first hardware failure rate is judged, and a target diagnosis is performed on the hardware elements judged to not meet the preset failure rate requirements. First, the target hardware elements are identified and the hardware element information of the target hardware elements is obtained. Then, a security mechanism set that matches the type and failure mode of the target hardware elements is determined from the security mechanism database based on the obtained hardware element information of the target hardware elements. Finally, the target security mechanism is matched from the security mechanism set to obtain the security mechanism information, i.e., a failure rate diagnosis is performed.

[0079] It should be noted that the first matching condition, the second matching condition and the third matching condition can be preset matching conditions of the hardware element information, target failure mode and target safety mechanism of the target hardware element, or can be customized matching conditions based on the hardware element information, target failure mode and target safety mechanism of the target hardware element to be screened.

[0080] In a preferred embodiment of the present application, the matching principle of the target security mechanism is as follows:

[0081] Step 1: Define the overall failure rate target, for example, ASIL D < 10 FIT; ASIL B < 100 FIT; ASIL C < 100 FIT; ASIL A can be customized;

[0082] Step 2: Use the evaluation tool to calculate the overall failure rate of the current target hardware, and determine whether the overall failure rate of the target hardware meets the failure rate target. If it meets the target, the matching is terminated; otherwise, proceed to step 3.

[0083] Step 3: The evaluation tool sorts the hardware elements in descending order according to their failure rates;

[0084] Step 4: The assessment tool sorts the failure mode proportions of individual factors in descending order, matches the failure mode with the highest failure rate from the safety mechanism database, and gives priority to the safety mechanism with the highest DC;

[0085] Step 5: The evaluation tool calculates the overall failure rate after adding the coverage of the mechanism to determine whether the overall failure rate meets the failure rate target. If so, the matching is terminated.

[0086] If after step five, the overall failure rate still does not meet the overall failure rate target, then go to step three again, that is, re-sort the hardware element failure rates of the relevant hardware elements in descending order, and then sort the failure mode proportions of the individual elements in descending order, match the failure mode with the highest failure rate from the safety mechanism library, and again give priority to matching the safety mechanism with the highest DC, and then calculate the overall failure rate again until the overall failure rate meets the overall failure rate target. It should be noted that before matching the target safety mechanism each time, the hardware element failure rates of all relevant hardware elements should be sorted, and each time the target safety mechanism is matched, the failure mode with the highest failure rate should be matched with the safety mechanism with the highest DC in the database.

[0087] In one embodiment of the present application, the safety mechanism or customized special measures that meet the diagnostic coverage are automatically matched, and the diagnostic coverage is manually analyzed to see whether it can be reduced. Among them, in the single-point failure coverage judgment, if the target hardware element failure mode occurs and causes the target hardware to fail, the target hardware element failure becomes a single-point failure or a residual failure, otherwise it is classified as a safety failure. If the safety mechanism covers this failure mode, the part not covered by the safety mechanism becomes a residual failure, and the failure mode not covered by the safety mechanism becomes a single-point failure. At the same time, the part covered by the safety mechanism will generate a double-point failure. Failure will only occur when the hardware element and the safety mechanism covering its failure mode fail at the same time. At this time, consider adding a safety mechanism to prevent the occurrence of double-point failures. The part covered by the safety mechanism is a detectable and perceptible double-point failure, and the part not covered by the safety mechanism is a double-point (hidden) failure.

[0088] Preferably, the high, medium and low diagnostic coverage rates of the single-point failure mode correspond to coverage rates below 99%, 97% and 90% respectively; the high, medium and low diagnostic coverage rates of the dual-point failure mode correspond to coverage rates below 99%, 90% and 90% respectively.

[0089] It should be understood by those skilled in the art that the higher the diagnostic coverage, the more accurate the automatic matching failure rate of hardware element failure rates and fault modes.

[0090] Optionally, in step S3031, the first matching condition is that the first element failure rate of the target hardware element is greater than the first element failure rates of other related hardware elements.

[0091] Optionally, in step S3032, the second matching condition is that the second element failure rate of the target fault mode is greater than the second element failure rates of other related fault modes.

[0092] Through step S3032, when the second matching condition is that the second factor failure rate of the target fault mode is greater than the second factor failure rates of other related fault modes, it can be determined that the failure mode of the target hardware is mainly determined by the second factor failure rate, and the target fault mode can be determined from multiple related fault modes.

[0093] Optionally, in step S3034, the third matching condition is that the diagnostic coverage of the target safety mechanism is greater than the diagnostic coverage of the remaining safety mechanisms in the safety mechanism set.

[0094] Through step S3034, when the third matching condition is that the diagnostic coverage of the target safety mechanism is greater than the diagnostic coverage of the remaining safety mechanisms in the safety mechanism set, it can be determined that the safety mechanism of the target hardware is mainly determined by the diagnostic coverage, and the target safety mechanism can be determined from multiple related safety mechanisms. In this embodiment, to determine the target safety mechanism from multiple related safety mechanisms, it is necessary to compare multiple diagnostic coverages of the target safety mechanism, screen out the target safety mechanism with the largest diagnostic coverage, and then determine the diagnostic coverage of the target safety mechanism.

[0095] Optionally, in steps S301 to S305, in the same hardware element, the first element failure rate is distributed to multiple second element failure rates according to a preset distribution ratio.

[0096] For example, when the hardware element is a resistance element, the failure modes include short circuit and open circuit. Since the failure modes of hardware failure caused by hardware elements may be different in different hardware circuits, the relevant failure modes change with the specific situation. The specific relevant failure modes can be determined and screened by manual operation. Taking the example that the resistance element causes hardware failure in both open circuit and short circuit, if the first element failure rate of the resistance element is 30%, and the preset distribution ratio of the open circuit and short circuit failure modes of the resistance element is 1:1, the second element failure rate of the open circuit failure is 30%*0.5, and the second element failure rate of the short circuit failure is 30%*0.5. When subsequently calculating the first hardware failure rate and the second hardware failure rate of the hardware, the second element failure rate of the open circuit and the second element failure rate of the short circuit need to be introduced.

[0097] For example, when the failure modes of the resistance element include short circuit, open circuit, and resistance value drift, among which the specific failure modes that cause hardware failure are open circuit and short circuit failure modes, and drift failure will not cause hardware failure, if the first element failure rate of the resistance element is 30%, and the preset distribution ratio of the open circuit, short circuit and resistance drift failure modes of the resistance element is 3:3:4 at this time, then the second element failure rate of the open circuit failure is 30%*0.3, and the second element failure rate of the short circuit failure is 30%*0.3. When subsequently calculating the first hardware failure rate and the second hardware failure rate of the hardware, the second element failure rate of the open circuit and the second element failure rate of the short circuit need to be introduced.

[0098] It should be noted that the preset distribution ratio is the distribution ratio of the failure modes in the same hardware element, and the hardware element can automatically generate a failure mode in combination with the matching target safety mechanism in the safety mechanism database.

[0099] In order to reflect the technical effect produced by the vehicle hardware functional safety assessment method of the present application, preferred embodiments of the vehicle hardware functional safety assessment method and vehicle hardware functional safety assessment system of the present application are provided below for illustration.

[0100] The present invention also provides a preferred embodiment of a vehicle hardware functional safety assessment method, which has the advantages of high failure rate accuracy, good hardware design safety, and saving human resources. Figure 4 As shown, the method comprises the following steps:

[0101] Step 1: Input the target hardware element circuit design diagram, identify all hardware elements in the hardware circuit design diagram, and jump to step 2;

[0102] Among them, the automatically imported hardware element information, identification number, etc. can be combined with the vehicle hardware functional safety assessment tool or the general failure mode automatic matching failure rate database safety assessment model to automatically calculate the first hardware failure rate of the relevant hardware elements and fill it in.

[0103] It should be noted that the failure rate database, i.e. the safety assessment model, may include failure information collected remotely by vehicle companies through cloud monitoring (Note: refer to the data reserved space in GBT 32960.3-2016 Technical Specifications for Electric Vehicle Remote Service and Management System), and make predictions through big data.

[0104] Through step one, the circuit design diagram of the target hardware element is put into the evaluation tool (vehicle hardware functional safety evaluation system), and the evaluation tool automatically identifies the first hardware failure rate in the hardware circuit diagram. In this stage, machine automation is used to collect hardware element information, reduce human input errors, save manpower, and help improve the error rate.

[0105] Step 2: Manually analyze the hardware failure modes that violate the functional safety goals. Select No if the functional safety goals are not violated, and select Yes if the functional safety goals are violated. After selecting No, the hardware elements will not be brought into the calculation efficiency algorithm. If you select Yes, the hardware elements will be brought into the calculation efficiency algorithm and jump to step 3.

[0106] Step 3: For hardware elements that select Yes, the failure rate hardware element information in the database will be combined to automatically generate failure modes and distribute failure rates. For example, for resistor elements, the failure modes are open circuit, short circuit, drift 0.5, and drift 2, and the failure rates of these four failure modes are 30%, 10%, 30%, and 30%. For capacitor elements, the failure modes are open circuit and short circuit, and the failure rates of these two failure modes are 20% and 80%. Jump to step 4.

[0107] Step 4: Manually analyze whether the failure mode distribution of this hardware element violates the functional safety goal. If it does not violate the functional safety goal, select No. If it violates the functional safety goal, select Yes. After selecting No, the hardware element failure mode will not be brought into the calculation efficiency algorithm. If you select Yes, the hardware element failure mode will be brought into the calculation efficiency algorithm and go to step 5;

[0108] Step 5: After refining the hardware failure mode, manually analyze whether the failure is a single-point failure or a double-point (latent) failure, and select Yes for the corresponding failure;

[0109] Step 6: After selecting a single point fault, automatically match the safety mechanism or custom special measures that meet the diagnostic coverage standard, and manually analyze whether the diagnostic coverage can be reduced. High, medium, and low diagnostic coverage rates correspond to 99%, 97%, and less than 90%, respectively. After selecting a dual power (latent) fault, automatically match the safety mechanism or custom special measures that meet the diagnostic coverage standard, and manually analyze whether the diagnostic coverage can be reduced. High, medium, and low diagnostic coverage rates correspond to 99%, 90%, and less than 90%, respectively.

[0110] Step 7: According to the single-point failure rate calculation formula, double-point (latent) failure rate calculation formula, and PMHF calculation formula, the respective failure rate quantitative values ​​are automatically calculated, and the functional safety quantitative indicator results and safety mechanism design solutions are output.

[0111] The calculation formulas for single-point failure rate, double-point (latent) failure rate, and PMHF are as follows:

[0112] Failure of single-point fault mode of hardware elements: SF = element failure rate * failure mode distribution ratio * (1-single-point diagnosis coverage),

[0113] Overall single point failure rate: =1-(failure rate of single-point failure mode of all elements / failure rate of all elements);

[0114] Hardware element dual-point fault mode failure: LF = element failure rate * failure mode distribution ratio * (1-dual-point diagnosis coverage),

[0115] Overall double point failure: =1-[failure rate of all elements in dual-point fault mode / (failure rate of all elements-failure rate of all elements in single-point fault mode)];

[0116] PMHF: PMHF≤λ SPF +λ RF +λ ALL DPF *λ ALL LF *T -Lifetime +λ ALL DPF *λ ALL Detected DPF *T -Service .

[0117] Where SR,HW is the safety-related hardware element; λ is the overall failure rate, λ=λ SPF +λ RF +λ MPF +λ S ; SPF is the single point failure rate; RF is the residual fault failure rate; MPF is the multi-point failure rate; S is the safety failure rate; MPF,L is the potential multi-point failure rate; ALL DPF is the failure rate of all double-point faults; ALL LF is the failure rate of all latent faults; ALL Detected DPF is the rate of all detected and reported double-point failures;

[0118] T -Lifetime is the vehicle life, T -Lifetime =10000h;

[0119] T -Service internal is the estimated time for vehicle repair, T -Service internal =100h.

[0120] The vehicle hardware functional safety assessment method in this embodiment inputs the target hardware element circuit design diagram and identifies all the hardware elements in the hardware circuit design diagram; manually analyzes and verifies the hardware failure rate that violates the functional safety target. When the target hardware failure rate verification fails, it can be modified through manual customization; the hardware elements that have passed the manual verification are combined with the matching target safety mechanism in the safety mechanism database to automatically generate a failure mode and obtain a second hardware failure rate. The failure rate after the failure mode distribution of this hardware element is manually analyzed and verified. After being refined to the hardware element failure mode, it is necessary to manually analyze whether this failure is a single-point failure or a double-point (hidden) failure. When a single-point failure or a double-electric (hidden) failure is manually selected, the safety mechanism or customized special measures that meet the diagnostic coverage standard are automatically matched. The diagnostic coverage can be manually analyzed to see if it can be reduced. According to the single-point failure rate calculation formula, the double-point (hidden) failure rate calculation formula, and the PMHF calculation formula, the respective failure rate quantitative values ​​are automatically calculated, and the functional safety quantitative indicator results and the safety mechanism design plan are output. By automatically identifying hardware element information, defining common failure modes of specific categories of hardware elements, manually analyzing hardware failure modes, estimating actual failure rates based on the enterprise-side failure rate database, integrating industry failure rate standard data and new product manuals, and automatically matching safety mechanisms or custom special measures that meet diagnostic coverage standards, we can avoid cost increases caused by over-design while meeting functional safety indicators such as single point fault metric (SPFM), double point (latent) fault metric (LFM), and random hardware failure probability metric (PMHF).

[0121] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in each embodiment of the present invention.

[0122] In this embodiment, a vehicle hardware functional safety assessment system is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware for a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0123] Figure 3is a structural block diagram of a vehicle hardware functional safety assessment system according to one embodiment of the present invention, such as Figure 3 As shown, the evaluation system includes an acquisition module 40, a first evaluation module 42, a matching module 44, a second evaluation module 46 and an output module 48. The acquisition module 40 is used to obtain hardware element information of multiple relevant hardware elements of the target hardware. The hardware element information at least includes hardware element failure rate and hardware element type. The relevant hardware elements are hardware elements that affect the functional safety goals of the target hardware; the first evaluation module 42 is used to process the hardware element information using the first evaluation model in the safety evaluation model to obtain the first hardware failure rate; the matching module 44 is used to match the target safety mechanism from the safety mechanism database and obtain the safety mechanism information of the target safety mechanism when it is determined that the first hardware failure rate does not meet the preset failure rate condition, and the safety mechanism information of the target safety mechanism includes at least diagnostic coverage information; the second evaluation module 46 is used to process the safety mechanism information and the hardware element information using the second evaluation model in the safety evaluation model to obtain the second hardware failure rate; the output module 48 is used to output the evaluation result of the target hardware when it is determined that the second hardware failure rate meets the preset failure rate condition, and the evaluation result at least includes the second hardware failure rate and the safety mechanism information of the target safety mechanism.

[0124] Through the above-mentioned vehicle hardware functional safety assessment system, the hardware element information of multiple relevant hardware elements of the target hardware is obtained, and the hardware element information at least includes the hardware element failure rate and the hardware element type. The relevant hardware elements are hardware elements that affect the functional safety target of the target hardware; the hardware element information is processed by the first assessment model in the safety assessment model to obtain the first hardware failure rate; when it is determined that the first hardware failure rate does not meet the preset failure rate condition, the target safety mechanism is matched from the safety mechanism database, and the safety mechanism information of the target safety mechanism is obtained, and the safety mechanism information at least includes the diagnostic coverage information; the safety mechanism information and the hardware element information are processed by the second assessment model in the safety assessment model to obtain the second hardware failure rate; when it is determined that the second hardware failure rate meets the preset failure rate condition, the assessment result of the target hardware is output, and the assessment result at least includes the second hardware failure rate and the safety mechanism information of the target safety mechanism. This embodiment has high accuracy in failure rate assessment, good hardware design security, and can avoid being affected by factors such as manual input data misoperation, inappropriate reference to standard data, and subjective judgment of analysts, so that the quantitative indicator assessment result is different from the true value.

[0125] It should be noted that the above modules can be implemented by software or hardware. For the latter, it can be implemented in the following ways, but not limited to: the above modules are all located in the same processor; or the above modules are located in different processors in any combination.

[0126] It should be noted that, in this embodiment, the vehicle hardware functional safety assessment system also includes an import module and an identification module. The import module is used to import the hardware circuit design diagram of the target hardware; the identification module is used to identify all hardware elements in the hardware circuit design diagram. The technical solution of the embodiment of the present application can produce the following beneficial effects:

[0127] 1) The target hardware elements are imported through automatic identification to reduce the impact of human input errors and subjective analysis. The hardware element information is matched with the data in the security mechanism database, and only the objective value of the failure rate of the matching result is output, and then the result is analyzed manually.

[0128] 2) Save human resources and automate the identification and matching of target hardware element information.

[0129] 3) The method of this embodiment can identify the gaps between different ASILs, that is, the gaps between automotive safety integrity levels, and can automatically recommend solutions and support customized solutions.

[0130] 4) The method of this embodiment is used to evaluate the functional safety of vehicle hardware, the failure rate of the evaluation is highly accurate, and the hardware design safety is better.

[0131] An embodiment of the present invention further provides a storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above method embodiments when running.

[0132] Optionally, in this embodiment, the storage medium may be configured to store a computer program for performing the following steps:

[0133] Step S1: Obtain hardware element information of multiple relevant hardware elements of the target hardware, where the hardware element information at least includes a hardware element failure rate and a hardware element type, and the relevant hardware elements are hardware elements that affect the functional safety objectives of the target hardware;

[0134] Step S2: Processing the hardware element information using the first assessment model in the safety assessment model to obtain a first hardware failure rate;

[0135] Step S3: when it is determined that the first hardware failure rate does not meet the preset failure rate condition, matching the target safety mechanism from the safety mechanism database and obtaining safety mechanism information of the target safety mechanism, the safety mechanism information at least including diagnostic coverage information;

[0136] Step S4: using the second evaluation model in the security evaluation model to process the security mechanism information and the hardware element information to obtain a second hardware failure rate;

[0137] Step S5: when it is determined that the second hardware failure rate meets the preset failure rate condition, output the evaluation result of the target hardware, the evaluation result at least including the second hardware failure rate and the security mechanism information of the target security mechanism.

[0138] Optionally, in this embodiment, the above-mentioned storage medium may include but is not limited to: a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and other media that can store computer programs.

[0139] An embodiment of the present invention further provides a processor, which is configured to run a computer program to execute the steps in any of the above method embodiments.

[0140] Optionally, in this embodiment, the processor may be configured to perform the following steps through a computer program:

[0141] Step S1: Obtain hardware element information of multiple relevant hardware elements of the target hardware, where the hardware element information at least includes a hardware element failure rate and a hardware element type, and the relevant hardware elements are hardware elements that affect the functional safety objectives of the target hardware;

[0142] Step S2: Processing the hardware element information using the first assessment model in the safety assessment model to obtain a first hardware failure rate;

[0143] Step S3: when it is determined that the first hardware failure rate does not meet the preset failure rate condition, matching the target safety mechanism from the safety mechanism database and obtaining safety mechanism information of the target safety mechanism, the safety mechanism information at least including diagnostic coverage information;

[0144] Step S4: using the second evaluation model in the security evaluation model to process the security mechanism information and the hardware element information to obtain a second hardware failure rate;

[0145] Step S5: when it is determined that the second hardware failure rate meets the preset failure rate condition, output the evaluation result of the target hardware, the evaluation result at least including the second hardware failure rate and the security mechanism information of the target security mechanism.

[0146] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0147] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0148] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0149] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0150] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk, etc. Various media that can store program codes.

[0151] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A vehicle hardware functional safety assessment method, characterized in that: include: Acquire hardware element information of multiple relevant hardware elements of the target hardware, wherein the hardware element information includes at least a hardware element failure rate and a hardware element type, and the relevant hardware elements are hardware elements that affect the functional safety target of the target hardware; Processing the hardware element information using a first assessment model in a safety assessment model to obtain a first hardware failure rate; In the case where it is determined that the first hardware failure rate does not meet the preset failure rate condition, matching a target safety mechanism from a safety mechanism database, and acquiring safety mechanism information of the target safety mechanism, the safety mechanism information at least including diagnostic coverage information; Processing the security mechanism information and the hardware element information using a second assessment model in the security assessment model to obtain a second hardware failure rate; When it is determined that the second hardware failure rate meets the preset failure rate condition, an evaluation result of the target hardware is output, and the evaluation result at least includes the second hardware failure rate and the security mechanism information of the target security mechanism.

2. The vehicle hardware functional safety assessment method according to claim 1, characterized in that: Before obtaining hardware element information of a plurality of related hardware elements of the target hardware, the method further includes: Importing a hardware circuit design diagram of the target hardware; Identify all hardware elements in the hardware circuit design diagram.

3. The vehicle hardware functional safety assessment method according to claim 1, characterized in that: The hardware element failure rate includes a first element failure rate and a second element failure rate, wherein the first element failure rate is the overall failure rate of the hardware element, and the second element failure rate is the failure rate of the hardware element under a relevant failure mode, wherein the relevant failure mode is the failure mode that affects the target hardware functional safety target among multiple failure modes of the relevant hardware element.

4. The vehicle hardware functional safety assessment method according to claim 3, characterized in that: Matching a target security mechanism from a security mechanism database includes the following steps: Based on the first matching condition, determine a target hardware element from the plurality of related hardware elements, and obtain hardware element information of the target hardware element; Based on the second matching condition, determining a target failure mode from the plurality of related failure modes of the target hardware element; Determining, from the safety mechanism database, a safety mechanism set that matches the hardware element type of the target hardware element and the target failure mode; Based on a third matching condition, the target security mechanism is matched from the security mechanism set.

5. The vehicle hardware functional safety assessment method according to claim 4, characterized in that: The first matching condition is that the first element failure rate of the target hardware element is greater than the first element failure rates of the other related hardware elements.

6. The vehicle hardware functional safety assessment method according to claim 4, characterized in that: The second matching condition is that the second factor failure rate of the target fault mode is greater than the second factor failure rates of the other related fault modes.

7. The vehicle hardware functional safety assessment method according to claim 4, characterized in that: The third matching condition is that the diagnostic coverage of the target safety mechanism is greater than the diagnostic coverage of the remaining safety mechanisms in the safety mechanism set.

8. The vehicle hardware functional safety assessment method according to claim 3, characterized in that: In the same hardware element, the first element failure rate is distributed to a plurality of the second element failure rates according to a preset distribution ratio.

9. A vehicle hardware functional safety assessment system, characterized in that: include: An acquisition module, the acquisition module is used to acquire hardware element information of multiple relevant hardware elements of the target hardware, the hardware element information at least includes a hardware element failure rate and a hardware element type, and the relevant hardware elements are hardware elements that affect the functional safety objectives of the target hardware; A first evaluation module, the first evaluation module is used to process the hardware element information using a first evaluation model in the security evaluation model to obtain a first hardware failure rate; a matching module, wherein the matching module is used to match a target safety mechanism from a safety mechanism database and obtain safety mechanism information of the target safety mechanism when it is determined that the first hardware failure rate does not meet a preset failure rate condition, wherein the safety mechanism information at least includes diagnostic coverage information; A second evaluation module, the second evaluation module is used to process the security mechanism information and the hardware element information by using a second evaluation model in the security evaluation model to obtain a second hardware failure rate; An output module, wherein the output module is used to output an evaluation result of the target hardware when it is determined that the second hardware failure rate meets the preset failure rate condition, and the evaluation result at least includes the second hardware failure rate and the security mechanism information of the target security mechanism.

10. The vehicle hardware functional safety assessment system according to claim 9, characterized in that: The vehicle hardware functional safety assessment system further includes: An import module, the import module is used to import the hardware circuit design diagram of the target hardware; An identification module is used to identify all hardware elements in the hardware circuit design diagram.

Images