Trigger condition analysis method for expected function safety of automatic driving perception system

Abstract

The invention discloses a trigger condition analysis method for expected function safety of an automatic driving perception system. The method comprises the following steps: analyzing an automatic driving expected function and a corresponding perception system; defining a perception system indicator based on the autonomous driving expectation function; analyzing the performance limitation of the sensing system based on the combination of the sensing system index and a preset performance limitation analysis keyword; identifying the whole vehicle level influence and harm caused by the performance limitation; based on the performance limitation and the whole vehicle level influence and harm, defining a sensing system limitation scene library; performing cause analysis based on the sensing system limited scene library, and exporting a trigger condition; and verifying the trigger condition through a simulation test. The technology provided by the invention provides powerful support for forward design analysis of expected function safety.

Description

Technical Field

[0001] The present invention relates to the field of autonomous driving expected functional safety technology, and in particular to a trigger condition analysis method for the expected functional safety of an autonomous driving perception system. Background Art

[0002] With the rapid development of intelligent connected vehicles and self-driving cars, the self-driving controller has become the new executor and decision-maker of the self-driving function. Intelligent connected vehicles and self-driving cars require that the self-driving controller has no errors or failures in the perception decision-making execution level. In some complex traffic conditions, the unexpected behavior of the vehicle will become an unstable factor. Therefore, in order to ensure the correctness and safety of the self-driving function, the R&D personnel proposed the vehicle expected function technology safety as a supplement to the vehicle functional safety. The expected function safety technology can reduce the hazards and accidents caused by algorithm limitations and insufficient performance, and the comprehensiveness of the trigger condition analysis based on the perception system is an important part of the vehicle expected function technology. Summary of the invention

[0003] The purpose of the present invention is to improve the comprehensiveness of the trigger conditions of the perception system for the expected functional safety analysis, and to provide a trigger condition analysis method for the expected functional safety of the perception system. The present invention analyzes the autonomous driving function and the corresponding perception system, defines the perception system indicators, analyzes the performance limitations of the perception system, identifies the vehicle-level impact and hazards caused by the performance limitations of the perception system, defines the perception system limitation scenario library, derives the trigger conditions through causal analysis, and verifies the trigger conditions through simulation testing, providing strong support for the forward design analysis of the expected functional safety.

[0004] A trigger condition analysis method for the expected functional safety of an autonomous driving perception system, comprising:

[0005] S1. Analyze the expected functions of autonomous driving and their corresponding perception systems;

[0006] S2. defining perception system indicators based on the expected autonomous driving functions;

[0007] S3. Analyze the performance limitations of the perception system based on a combination of the perception system indicators and preset performance limitation analysis keywords;

[0008] S4. Identify the vehicle-level impacts and hazards caused by the performance limitations;

[0009] S5. Based on the performance limitations and vehicle-level impacts and hazards, define a library of perception system limitation scenarios;

[0010] S6. Perform cause analysis based on the limited scenario library of the perception system and derive trigger conditions;

[0011] S7. Verify the trigger condition through simulation testing.

[0012] Among them, in step S1, the expected functions of autonomous driving include expected functions that rely on the perception system for situational awareness during autonomous driving and the correctness of perception will affect the safety of autonomous driving, including expected functions of emergency intervention in autonomous driving systems and expected functions of autonomous driving systems with driving automation levels of L1-L5.

[0013] Wherein, in step S1, the perception system is a system that provides perception input for autonomous driving.

[0014] Among them, in step S1, the perception system includes one or more of a camera, a radar, a high-precision map module, and a combined navigation module.

[0015] Among them, in step S2, the perception system indicators include performance indicators, hardware indicators, environmental indicators and algorithm indicators defined by the perception system to realize the autonomous driving function.

[0016] Among them, in step S3, the performance limitations include technical capability limitations, including the facilitation of harmful behavior or the inability to prevent, detect and mitigate reasonably foreseeable indirect misuse under one or more triggering conditions, and the technical capability limitations include limited computing performance, limited sensor perception range, and limited execution. For example, the performance limitations of the automatic emergency braking function are low perception accuracy, insufficient algorithm real-time performance, etc.

[0017] Among them, in step S4, the vehicle-level impact and harm include the vehicle-level harm or possible accidents caused by the performance limitation.

[0018] Among them, in step S5, the perception system limitation scenario library includes the performance limitations, as well as a collection of scenarios of vehicle-level impacts and hazards, including the situation in which severe weather conditions affect the signal propagation path, making real-time navigation impossible and causing accidents.

[0019] Among them, in step S6, the trigger condition refers to the preset condition that leads to performance limitation in the limited scenario of the perception system. The preset condition will trigger a subsequent reaction of the perception system, and the subsequent reaction will lead to harmful behavior or the inability to prevent, detect and mitigate reasonably foreseeable indirect misuse, that is, the vehicle-level impact and harm caused by the performance limitation in the limited scenario library of the perception system.

[0020] Among them, in step S7, the simulation test includes reducing performance limitations through measures such as algorithm improvement and replacement of the perception system, and then verifying the trigger conditions in simulation, closed road, and actual road environments to improve the recognition rate and accuracy of the autonomous driving function perception system.

[0021] The trigger condition analysis method for the expected functional safety of the autonomous driving perception system of the present invention is proposed based on the requirements for the development analysis of the expected functional safety of the autonomous driving function perception system. It analyzes the expected functions of autonomous driving and the corresponding perception system, defines the perception system indicators, analyzes the performance limitations of the perception system, identifies the vehicle-level impacts and hazards caused by the performance limitations of the perception system, and defines the perception system limitation scenario library. Through causal analysis, the steps of obtaining the trigger conditions of the perception system are obtained. This provides a design and analysis method for the forward development of the expected functional safety trigger conditions, solves the problems of incomplete coverage of the current perception system trigger condition analysis and low safety and reliability, and also provides an effective reference for the forward development of controller decision algorithms and actuator control strategies. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 Flow chart of a method for analyzing trigger conditions for expected functional safety of an autonomous driving perception system according to an embodiment of the present invention.

[0023] Figure 2 It is a schematic diagram of a perception system corresponding to the expected work of autonomous driving according to an embodiment of the present invention.

[0024] Figure 3 This is a schematic diagram of performance indicators of the perception system corresponding to the expected functions of autonomous driving in an embodiment of the present invention. DETAILED DESCRIPTION

[0025] The present invention will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0026] See also Figure 1 As shown, a trigger condition analysis method for the expected functional safety of an autonomous driving perception system in an embodiment of the present invention includes the following specific steps:

[0027] S1. Analyze the expected functions of autonomous driving and their corresponding perception systems;

[0028] S2. defining perception system indicators based on the expected autonomous driving functions;

[0029] S3. Analyze the performance limitations of the perception system based on a combination of the perception system indicators and preset performance limitation analysis keywords;

[0030] S4. Identify the vehicle-level impacts and hazards caused by the performance limitations;

[0031] S5. Based on the performance limitations and vehicle-level impacts and hazards, define a library of perception system limitation scenarios;

[0032] S6. Perform cause analysis based on the limited scenario library of the perception system and derive trigger conditions;

[0033] S7. Verify the trigger condition through simulation testing.

[0034] In the embodiment of the present application, in the step S1, the expected functions of autonomous driving include expected functions that rely on the perception system for situational awareness during autonomous driving and the correctness of the perception will affect the safety of autonomous driving, including expected functions of emergency intervention in the autonomous driving system and expected functions of the autonomous driving system with a driving automation level of L1-L5, such as the expected function of high-speed navigation of the perception system.

[0035] In an embodiment of the present application, in step S1, the perception system is a system that provides perception input for autonomous driving, and the perception system includes one or more of a camera, a radar, a high-precision map module, and a combined navigation module connected to an autonomous driving controller, which together form the perception system.

[0036] Specifically, the camera includes a front-view camera, a side-view camera, a surround-view camera, and a rear-view camera; the radar includes a corner radar, a front radar, a laser radar, and an ultrasonic radar.

[0037] In the embodiment of the present application, in step S2, the perception system indicators include performance indicators, hardware indicators, environmental indicators and algorithm indicators defined by the perception system to realize the autonomous driving function, and the parameter indicators are preliminarily defined by the indicators of the sensors involved in the autonomous driving function, see Figure 3 As shown, the perception system indicators are sensor indicators, and its performance indicators include pixels, frame rate, signal-to-noise ratio, detection distance, etc. Its hardware indicators include horizontal field of view angle, vertical field of view angle, wireless beam angle, angular resolution, etc. Its environmental indicators include operating temperature, waterproof and dustproof, protection level, ambient temperature, etc. Its algorithm indicators include accuracy, robustness, model generalization ability, real-time, etc.

[0038] For example, when analyzing the triggering conditions of the high-speed navigation expected function of the perception system, the performance indicators of the integrated navigation module of the perception system involved include the indicators shown in Table 1.

[0039] Table 1 Combined navigation indicators

[0040] Serial number Indicator Classification Indicator 1 Environmental indicators Protection level 2 Environmental indicators Operating ambient temperature 3 Performance Indicators Roll accuracy 4 Performance Indicators Pitch accuracy 5 Performance Indicators Yaw accuracy 6 Performance Indicators GNSS lost lock position 7 Performance Indicators GNSS lost heading 8 Performance Indicators RTK positioning accuracy 9 Performance Indicators Single point positioning accuracy 10 Performance Indicators GNSS data update rate 11 Algorithm indicators Positioning accuracy 12 Algorithm indicators Real-time

[0041] In some embodiments, in step S3, the performance limitation analysis keywords are set according to the specific circumstances of the expected function of autonomous driving of the perception system to be analyzed. For example, the performance limitations of the expected function of automatic emergency braking are low perception accuracy, insufficient algorithm real-time performance, etc. The performance limitation analysis keywords include too large, too small, opposite, too slow, too fast, stuck, drifting, and lost, as shown in Table 2.

[0042] Table 2 Performance limitation analysis keywords

[0043] Serial number Keywords 1 Too large 2 Too small 3 on the contrary 4 Too slow 5 Too fast 6 Stuck 7 drift 8 Lost

[0044] In the embodiments of the present application, the performance limitation is to analyze the hazards manifested at the vehicle level due to the performance limitation, and further detailed analysis is performed on the hazards that may cause to the vehicle. If there are no hazards, the performance limitation analysis process can be terminated.

[0045] In the embodiment of the present application, in step S3, the performance limitations include technical capability limitations, including the facilitation of harmful behavior or the inability to prevent, detect and mitigate reasonably foreseeable indirect misuse under one or more triggering conditions, and the technical capability limitations include limited computing performance, limited sensor perception range, and limited execution. For example, the performance limitations of the automatic emergency braking function are low perception accuracy, insufficient algorithm real-time performance, etc., and the performance limitations of the group navigation are shown in Table 3 below. The perception system performance limitations of different intended functions are different, and they vary according to the specific functions, and are analyzed specifically.

[0046] Table 3 Integrated navigation performance limitations

[0047]

[0048] In the embodiment of the present application, in step S4, the vehicle-level impacts and hazards include vehicle-level hazards or possible accidents caused by the performance limitations. For example, for combined navigation, the possible vehicle-level hazards are identified and analyzed as shown in Table 4 below.

[0049] Table 4 Combined navigation vehicle level hazards

[0050]

[0051] In an embodiment of the present application, in step S5, the perception system limitation scenario library includes the performance limitations, as well as a collection of scenarios that have impacts and hazards at the vehicle level, such as when severe weather conditions affect the signal propagation path, making it impossible to perform real-time navigation and thus causing an accident.

[0052] In the embodiment of the present application, when defining the limited scenario library of the perception system, the scenario library definition can be carried out through environmental factors such as road structure, traffic infrastructure, traffic participants, natural environment, vehicle status, communication information, etc., and the limited scenario library is given by brainstorming or permutation and combination. The following Table 5 shows an example of a scenario library given for the combined navigation with the expected navigation function.

[0053] Table 5 Combined navigation limited scenario library

[0054]

[0055] In the embodiment of the present application, in step S6, the trigger condition refers to the preset condition that leads to performance limitation in the limited scene of the perception system, which will trigger the subsequent reaction of the perception system, and the subsequent reaction will promote harmful behavior or fail to prevent, detect and mitigate reasonably foreseeable indirect misuse, that is, the vehicle-level impact and harm caused by the performance limitation in the limited scene library of the perception system. The following table 5 shows an embodiment of the combined navigation trigger condition obtained by causal analysis.

[0056] Table 6 Combined navigation trigger conditions

[0057]

[0058]

[0059] In an embodiment of the present application, in step S7, the simulation test includes reducing performance limitations through measures such as algorithm improvement and replacement of the perception system, and then verifying the trigger conditions in a simulation, closed road, and actual road environment to improve the recognition rate and accuracy of the autonomous driving function perception system.

[0060] In the above step S7 of the present application, when verifying the trigger conditions, it includes verifying whether the intelligent driving system can execute the safety strategy in the identified trigger conditions, such as prompting the driver to take over, pull over, etc. In addition, if new trigger conditions are identified during the test verification process, further analysis can be performed to supplement the performance limitations of the corresponding perception system indicators, and then a closed-loop process of expected functional safety development verification can be formed.

[0061] Below, we take the expected function of high-speed navigation of autonomous driving as an example, and please refer to Figure 1 shown.

[0062] Step 1: Analyze the expected functions of high-speed navigation and the perception systems involved:

[0063] The high-speed pilot function uses the navigation system to input the destination and generate a navigation route. The system can control the vehicle's driving, lane changing, and following according to the driving route planned by the navigation map and combined with the perception system. The perception system involved includes sensors such as the front-view camera, surround-view camera, millimeter-wave radar, laser radar, integrated navigation module, and high-precision map module. Figure 2 shown.

[0064] Step 2: Define perception system metrics:

[0065] Based on the perception system involved in the expected function of high-speed navigation, combined with Figure 3 The indicator classification shown and the definition of its combined navigation indicators are shown in Table 1 as mentioned above.

[0066] Step 3: Analyze and perceive system performance limitations:

[0067] Based on the performance limitation analysis keywords listed in Table 2 mentioned above and combined with the perception system indicators obtained from the analysis in step 2 above (as shown in Table 1), the performance limitations of the combined navigation are analyzed. Some of the combined navigation performance limitations are shown in Table 3 mentioned above.

[0068] Step 4: Identify vehicle-level impacts and hazards caused by perception system performance limitations:

[0069] Based on the combined navigation performance limitations analyzed in step 3, possible vehicle-level impacts and hazards are identified. Some combined navigation vehicle-level hazards are shown in Table 4 as mentioned above.

[0070] Step 5: Define the perception system limitation scenario library:

[0071] After analyzing the vehicle-level hazards of combined navigation, a combined navigation performance limitation scenario library is defined based on the performance limitations of combined navigation. For example, the scenario library is defined through environmental factors such as road structure, traffic infrastructure, traffic participants, natural environment, vehicle status, communication information, etc., and a limited scenario library is given by brainstorming or permutation and combination. Some combined navigation limitation scenario libraries are shown in Table 5 above.

[0072] Step 6: Perform cause analysis and derive trigger conditions:

[0073] The combined navigation limitation scenario library and performance limitation are analyzed together to identify the special factors that cause performance limitation in the limitation scenario and form the combined navigation triggering conditions. Some combined navigation triggering conditions are shown in the above Table 6.

[0074] Step 7: Verify the trigger conditions through simulation test:

[0075] After obtaining the trigger conditions, in the forward analysis and development process, after taking measures to correct the perception system, simulation tests are performed in a simulated, closed road environment to improve the recognition rate and accuracy of the autonomous driving function perception system; the measures taken to correct the perception system include reducing performance limitations through measures such as algorithm improvement and replacement of the perception system.

[0076] In summary, the trigger condition analysis method for the expected functional safety of the perception system in an embodiment of the present invention, based on the forward design analysis of the expected functional safety trigger conditions, solves the problems of incomplete coverage and low safety and reliability of the current perception system trigger condition analysis, and also provides an effective reference for the forward development of controller decision algorithms and actuator control strategies.

[0077] The basic principles and main features of the present invention and the advantages of the present invention are shown and described above. It is obvious to those skilled in the art that the present invention is not limited to the details of the above exemplary embodiments, and the present invention can be implemented in other specific forms without departing from the spirit or basic features of the present invention.

[0078] Therefore, the embodiments should be considered in all respects as illustrative and non-restrictive, and the scope of the invention is defined by the appended claims rather than the foregoing description, and it is therefore intended that all changes falling within the meaning and range of equivalent elements of the claims are included in the present invention.

[0079] In addition, it should be understood that although the present specification is described according to implementation modes, not every implementation mode contains only one independent technical solution. This description of the specification is only for the sake of clarity. Those skilled in the art should regard the specification as a whole. The technical solutions in each embodiment may also be appropriately combined to form other implementation modes that can be understood by those skilled in the art.

Claims

1. A trigger condition analysis method for the expected functional safety of an autonomous driving perception system, characterized in that: include: S1. Analyze the expected functions of autonomous driving and their corresponding perception systems; S2. defining perception system indicators based on the expected autonomous driving functions; S3. Analyze the performance limitations of the perception system based on a combination of the perception system indicators and preset performance limitation analysis keywords; S4. Identify the vehicle-level impacts and hazards caused by the performance limitations; S5. Based on the performance limitations and vehicle-level impacts and hazards, define a library of perception system limitation scenarios; S6. Perform cause analysis based on the limited scenario library of the perception system and derive trigger conditions; S7. Verify the trigger condition through simulation testing.

2. The trigger condition analysis method for the expected functional safety of the autonomous driving perception system according to claim 1 is characterized in that: In step S1, the expected functions of autonomous driving include expected functions that rely on the perception system for situational awareness during autonomous driving and the correctness of the perception will affect the safety of autonomous driving, including expected functions of emergency intervention autonomous driving systems and expected functions of autonomous driving systems with driving automation levels of L1-L5.

3. The trigger condition analysis method for the expected functional safety of the autonomous driving perception system according to claim 1 is characterized in that: In step S1, the perception system is a system that provides perception input for autonomous driving.

4. The trigger condition analysis method for the expected functional safety of the autonomous driving perception system according to claim 1 is characterized in that: In step S1, the perception system includes one or more of a camera, a radar, a high-precision map module, and a combined navigation module.

5. The trigger condition analysis method for the expected functional safety of the autonomous driving perception system according to claim 1 is characterized in that: In step S2, the perception system indicators include performance indicators, hardware indicators, environmental indicators and algorithm indicators defined by the perception system to realize the autonomous driving function.

6. The trigger condition analysis method for the expected functional safety of the autonomous driving perception system according to claim 1, characterized in that: In step S3, the performance limitations include technical capability limitations, including the facilitation of harmful behavior or the inability to prevent, detect and mitigate reasonably foreseeable indirect misuse under one or more triggering conditions. The technical capability limitations include limited computing performance, limited sensor perception range, and limited execution. For example, the performance limitations of the automatic emergency braking function are low perception accuracy and insufficient algorithm real-time performance.

7. The trigger condition analysis method for the expected functional safety of the autonomous driving perception system according to claim 1, characterized in that: In step S4, the vehicle-level impacts and hazards include vehicle-level hazards or possible accidents caused by the performance limitations.

8. The trigger condition analysis method for the expected functional safety of the autonomous driving perception system according to claim 1 is characterized in that: In step S5, the perception system limitation scenario library includes the performance limitations, as well as a collection of vehicle-level impact and hazard scenarios, including the situation in which severe weather conditions affect the signal propagation path, making real-time navigation impossible and causing accidents.

9. The trigger condition analysis method for the expected functional safety of the autonomous driving perception system according to claim 1 is characterized in that: In step S6, the trigger condition refers to the preset condition that causes performance limitation in the limited scenario of the perception system. The preset condition will trigger a subsequent reaction of the perception system, which will lead to harmful behavior or the inability to prevent, detect and mitigate reasonably foreseeable indirect misuse, that is, the vehicle-level impact and harm caused by the performance limitation in the limited scenario library of the perception system.

10. The trigger condition analysis method for the expected functional safety of the autonomous driving perception system according to claim 1, characterized in that: In step S7, the simulation test includes reducing performance limitations through measures such as algorithm improvement and replacement of the perception system, and then verifying the trigger conditions in simulation, closed road, and actual road environments to improve the recognition rate and accuracy of the autonomous driving function perception system.

Images