Automobile system fault tree construction method considering expected function safety

Abstract

The invention provides an automobile system fault tree construction method considering expected function safety. The method comprises the following steps: defining an automatic driving automobile structure chart of a fault tree to be constructed; setting an initial scene and setting a top event; the top event represents an accident causing the hazard; all dangerous events causing the top event are connected with the top event through an OR gate; converting the dangerous event into a dangerous event of an execution system in an automobile system structure; aiming at each dangerous event, carrying out reverse traversal on the structure chart of the automatic driving automobile to decompose the dangerous event to obtain a plurality of sub-events causing the dangerous event, and taking the sub-events of the category of the dangerous event of the input component as the dangerous event of a new round of iteration according to the category of the sub-events; traversing until the fault tree is constructed, wherein the sub-events comprise a function failure event of the current component, an expected function failure event of the current component and a dangerous event of an input component of the current component.

Description

Technical Field

[0001] The present invention relates to the technical field of automobile fault tree construction, and in particular to a method for constructing an automobile system fault tree taking into account expected functional safety. Background Art

[0002] Fault tree analysis focuses on the occurrence of top events and describes the logical relationship between the occurrence of basic events and top events. The traditional static fault tree is composed of AND gates and OR gates, while the dynamic fault tree is composed of dynamic logic gates such as priority AND gates, cold standby gates, and functional dependency gates. Fault tree analysis is still one of the most commonly used safety analysis techniques and is widely used in many fields such as aerospace, nuclear energy, electricity, chemical industry, and transportation.

[0003] In recent years, due to the rapid development of artificial intelligence technology, autonomous driving technology has been widely used in automotive systems, and the concept of "intended functional safety" has also emerged. The emergence of this concept aims to fill the limitations of traditional "functional safety", which focuses on the insufficient performance of functions. In expected functional safety, scenarios are an important aspect of evaluating the expected functional safety of automobiles. Although the functions of automobiles have passed a large number of tests, due to the complexity of the driving environment of the automobile, the expected functional safety issues of functions may only appear in certain scenarios. The traditional fault tree construction method focuses on the functional safety of automotive systems and the functional failure of automotive systems / components, which can no longer meet the expected functional safety requirements of automobiles. Summary of the invention

[0004] The present invention proposes a method for constructing a fault tree of an automobile system taking into account the expected functional safety, so as to solve the technical problem that the prior art does not take into account the expected functional safety of the automobile.

[0005] In order to solve the above technical problems, the present invention provides a method for constructing a fault tree of an automobile system considering expected functional safety, comprising the following steps:

[0006] Step S1: defining a structure diagram of an autonomous driving vehicle for which a fault tree is to be constructed;

[0007] Step S2: setting an initial scene and setting a top event; the top event represents an accident that causes harm;

[0008] Step S3: connecting all dangerous events that cause the top event with the top event through an OR gate;

[0009] Step S4: converting the dangerous event into a dangerous event of the execution system in the automobile system structure;

[0010] Step S5: For each of the dangerous events, reverse traverse the structure diagram of the autonomous driving vehicle to decompose the dangerous event to obtain a number of sub-events that cause the dangerous event, and according to the category of the sub-event, the sub-event of the dangerous event of the input component is taken as the dangerous event of a new round of iteration, and step S5 is repeated until the fault tree is constructed; the sub-events include the functional failure event of the current component, the expected functional failure event of the current component and the dangerous event of the input component of the current component.

[0011] Preferably, step S5 comprises:

[0012] Step S51: if the functional failure event of the current component can lead to the current dangerous event, then the relationship between the functional failure event and the dangerous event is expressed according to the corresponding logic;

[0013] Step S52: If the expected functional failure event of the current component can lead to the current dangerous event, firstly use an OR gate to list the corresponding expected functional failure events, and use the corresponding logic gate to represent the relationship between the events;

[0014] Step S53: If the dangerous event of the input component of the current component can cause the current dangerous event to occur, then the dangerous event is inserted and the process returns to step S5 for traversal.

[0015] Preferably, step S51 connects the environmental factor to the fault tree through a prohibition gate when expressing the functional failure event of the current component.

[0016] Preferably, in step S52, the triggering condition of the expected functional failure event is represented by a prohibition gate.

[0017] Preferably, step S5 also includes: if the current component is an execution or decision-making system of an autonomous driving vehicle, the functional failure events of steps S51, S52 and S53, the expected functional failure events and the dangerous events of the input components are connected to the driver situation awareness error events through an AND gate, and then connected to the dangerous events.

[0018] Preferably, in step S4, the driver situation awareness error event that can lead to the dangerous event is connected to the dangerous event through an OR gate.

[0019] Preferably, when constructing the fault tree, uncovered faults of redundant components are also analyzed by an incomplete coverage model.

[0020] Preferably, the driver situation awareness error event includes:

[0021] 1) The autonomous driving system makes an erroneous perception / decision or execution result, but the driver does not notice the erroneous result, resulting in the driver not taking over the car;

[0022] 2) The autonomous driving system makes a correct perception / decision or execution result, but the driver believes that the autonomous driving system makes an incorrect perception / decision or execution result, causing the driver to take over the car and make incorrect driving behavior.

[0023] The beneficial effects of the present invention include at least: the fault tree constructed by the present invention can better represent the functional failure events and expected functional failure events in the automobile system structure. By traversing the fault tree, the scenario information that needs to be considered can be obtained in the design stage so as to be tested in the test stage. Through the qualitative analysis of the fault tree, the combination of functional failure / expected functional failure events that caused the accident can be derived. In addition, quantitative analysis can also analyze the conditional independence and conditional dependence events in the fault tree, which is helpful for safety analysis of autonomous driving vehicles. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 A schematic diagram of a method flow chart of an embodiment of the present invention;

[0025] Figure 2 A schematic diagram of a fault tree of expected functional failure according to an embodiment of the present invention;

[0026] Figure 3 A schematic diagram of a fault tree of underlying causes of failure of expected functions according to an embodiment of the present invention;

[0027] Figure 4 This is a schematic diagram of the structure of an autonomous driving vehicle according to an embodiment of the present invention;

[0028] Figure 5 This is a fault tree diagram of an embodiment of the present invention that does not consider an incomplete coverage model;

[0029] Figure 6 A fault tree diagram of an incomplete coverage model considered in an embodiment of the present invention;

[0030] Figure 7 A schematic diagram of the perception-decision-execution architecture of an autonomous driving vehicle according to an embodiment of the present invention;

[0031] Figure 8 A schematic diagram of a driver takeover model of an autonomous driving vehicle according to an embodiment of the present invention;

[0032] Fig. 9 A schematic diagram of interaction between a driver and an automatic driving system according to an embodiment of the present invention;

[0033] Fig.10 A fault tree diagram of a human-computer interaction model according to an embodiment of the present invention;

[0034] Fig.11A schematic diagram of a fault tree constructed by the human-computer interaction model of an embodiment of the present invention according to whether the autonomous driving perception / decision-making system has made a correct decision;

[0035] Fig.12 A schematic diagram of a fault tree constructed for a top event according to an embodiment of the present invention;

[0036] Fig.13 A schematic diagram of a fault tree constructed for a collision accident between a vehicle and a preceding vehicle according to an embodiment of the present invention;

[0037] Fig.14 A schematic diagram of a fault tree constructed for a dangerous event of a brake actuation system not working properly according to an embodiment of the present invention;

[0038] Fig.15 A schematic diagram of a fault tree constructed for a dangerous event in which an autonomous driving decision system does not work properly according to an embodiment of the present invention;

[0039] Fig.16 A schematic diagram of a fault tree constructed for a brake execution system function failure according to an embodiment of the present invention;

[0040] Fig.17 This is a schematic diagram of a fault tree constructed for an expected functional failure of a brake execution system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0041] The following is a clear and complete description of the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work belong to the protection scope of the present invention.

[0042] The main execution stages of an autonomous vehicle include perception, decision-making, and execution. Therefore, the expected functional safety in the embodiments of the present invention mainly targets the expected functional safety issues occurring in these three stages.

[0043] like Figure 1 As shown, an embodiment of the present invention provides a method for constructing a fault tree of an automobile system considering expected functional safety, comprising the following steps:

[0044] Step S1: defining a structure diagram of an autonomous driving vehicle for which a fault tree is to be constructed;

[0045] Step S2: Set the initial scene and set the top event; the top event represents the accident that causes the hazard;

[0046] Step S3: connect all dangerous events that cause top events with the top event through an OR gate;

[0047] Step S4: converting the dangerous event into a dangerous event of the execution system in the automobile system structure;

[0048] Step S5: For each of the dangerous events, reverse traverse the structure diagram of the autonomous driving vehicle to decompose the dangerous event to obtain several sub-events that cause the dangerous event, and according to the category of the sub-event, the sub-event of the dangerous event of the input component is used as the dangerous event of the new round of iteration. Repeat step S5 until the fault tree is constructed; consider the expected functional safety in the process of constructing the fault tree.

[0049] Scenarios are very important in expected functional safety. The embodiments of the present invention use the inhibit gate in the fault tree to make up for the deficiency that the traditional static fault tree cannot well express the scenarios in the autonomous driving car. The use of the inhibit gate indicates that certain defects in the autonomous driving system are triggered under the scenario, which well expresses the concept of expected functional safety. At the same time, through the representation of the scenario by the inhibit gate, the possible causes of a certain event in the scenario can be listed, which can further guide the testing work of the autonomous driving car.

[0050] like Figure 2 As shown in the figure, consider a following vehicle scenario. One possible scenario of a collision between the ego vehicle and the vehicle in front is that the vehicle in front brakes suddenly, which is represented by a prohibition gate in the figure. In the scenario of sudden braking in front, the reasons for the collision between the ego vehicle and the vehicle in front may be (a) the brake component has a functional failure; (b) the brake component has not failed, and the braking operation is performed in time, but the braking distance is too long; (c) the brake component has not failed, but the braking operation is not performed or is performed too late. Each reason is connected to the prohibition gate through an OR gate.

[0051] like Figure 3 As shown in FIG. 1 , the method can also indicate the underlying cause of the expected function failure. Although the camera can still work normally, in the case of insufficient visibility such as rainy and snowy weather, the camera may not be able to recognize the vehicle in front, resulting in the expected function failure.

[0052] Step S1 defines the structure diagram of the autonomous driving vehicle. In the structure diagram, the components of the autonomous driving vehicle and the relationships between the components need to be specified. For example, a simple autonomous driving vehicle structure is as follows: Figure 4As shown in the figure, the autonomous driving car consists of a perception system, a decision system, and an execution system. The perception system uses radar and cameras for redundant design, and the decision system uses two sets of computing chips. When one set of computing chips fails, the other set of computing chips can work normally and continue to perform decision-making tasks. The four wheels of the vehicle are equipped with electronic control units, and the electronic control units on each wheel are dual-redundant to increase safety. The autonomous driving car system perceives the surrounding environment and its own information through the perception system, and transmits it to the decision system for task decision-making. After the decision system makes a decision, it sends a response instruction to the execution system for execution.

[0053] Wherein, step S5 comprises the following steps:

[0054] Step 51: If the functional failure event of the current component can lead to the current dangerous event, the relationship between the functional failure event and the dangerous event is expressed according to the corresponding logic. In the embodiment of the present invention, when expressing the functional failure of the basic component, in order to further refine the fault process, the environmental factors (scenarios) are taken into account, because environmental factors can also cause the component to fail. In addition, even with sufficient redundancy, a failure caused by a component, such as erroneous data, can propagate to other components and cause the entire system to fail. In order to further increase the accuracy of fault tree construction, the embodiment of the present invention also takes into account the incomplete coverage model in the functional failure event of the component.

[0055] Step 52: If the expected functional failure event of the current component can lead to the current dangerous event, first use the OR gate to list the corresponding expected functional failure events, use the inhibit gate to represent the triggering conditions of the current environment, and use the corresponding logic gate to represent the relationship between the events.

[0056] Step 53: If the dangerous event of the input component of the current component can cause the current dangerous event to occur, then insert the dangerous event and return to step 5 for traversal.

[0057] The incomplete coverage model mentioned in step S51 is explained as follows: Traditional fault-tolerant systems are mainly implemented through component redundancy. Under the redundant mechanism, when a component fails, the system can still perform its functions normally due to the existence of redundancy. However, under the incomplete coverage model, even with sufficient redundancy, a failure caused by a component, such as incorrect data, can spread to other components, causing the entire system to fail. Consider a brake control unit with two electronic control units A and B as redundancies. If the incomplete coverage model is not considered, its fault tree is as follows: Figure 5 As shown in Figure 2, this fault tree only considers the coverage faults of electronic control units A and B. After considering the incomplete coverage model, the fault tree is as follows: Figure 6In this fault tree, in addition to the covered faults of the electronic control units A and B, the uncovered faults of the electronic control units A and B are also considered.

[0058] In addition, in the autonomous vehicle system, human factors are also an important factor that cannot be ignored. The driver changes from the role of system operator to supervisor. The perception-decision-execution architecture of the autonomous vehicle is as follows: Figure 7 As shown in Figure 2, the driver's takeover model is as follows: Figure 8 As shown in Figure 2, the interaction between the driver and the automated driving system is as follows: Fig. 9 As shown. Although the driver is freed from the tiring driving task, he still needs to pay attention to the surrounding environment at all times, maintain a certain level of situational awareness, and intervene in time when dangerous situations occur. With the support of augmented reality or artificial intelligence visualization technology, due to the high computing performance of computing chips, the results of perception and decision-making are usually displayed at the same time, and the driver can perceive the results of the perception and decision-making of the autonomous vehicle. In this case, in addition to intervening in the execution stage of the autonomous vehicle, the driver can also intervene in the perception / decision-making stage. In addition, when the driver perceives the wrong perception / decision result, he may not choose to take over the car directly, but put his hands on the steering wheel and his feet on the brake pedal. In this case, when the driver wants to take over the car later, his success rate of taking over the car will increase.

[0059] Under this human-computer interaction model, there are two reasons that lead to collision accidents of autonomous vehicles.

[0060] 1) The autonomous driving system made an erroneous perception / decision or execution result, but the driver was unaware of the erroneous result, resulting in the driver not taking over the car.

[0061] 2) The autonomous driving system makes a correct perception / decision or execution result, but the driver believes that the autonomous driving system makes an incorrect perception / decision or execution result, causing the driver to take over the car and possibly make incorrect driving behaviors.

[0062] The fault tree constructed is as follows Fig.10 As shown, considering the above-mentioned following car scenario, depending on whether the autonomous driving perception / decision-making system makes the correct decision, the fault tree is as follows Fig.11 shown.

[0063] When constructing the overall fault tree, if the current component is an execution or decision system, the functional failure events, expected functional failure events and dangerous events of the input components mentioned in step S51, step S52 and step 53 are connected to the above-mentioned driver situation awareness error event through an AND gate, and then connected to the current dangerous event. For the dangerous event in step S4, if the above-mentioned driver situation awareness error event can also cause it to occur, the event is connected to the dangerous event through an OR gate.

[0064] The embodiment of the present invention is as follows Figure 4 The automobile system structure diagram shown in the figure is used for explanation. The initial scenario selected is that there is a vehicle driving in a short distance in front of the vehicle, that is, the following scenario of the vehicle. On the basis of the initial scenario, the collision scenario between the vehicle and the vehicle in front and the collision scenario between the vehicle and the roads on both sides are further refined. According to the method of the present invention, the functional failure events and expected functional failure events in the automobile system structure are listed from top to bottom. After constructing the fault tree, the structure diagram is searched for its main functional failure events, and the possible uncovered failures of the components are connected to the main functional failure events through OR gates. A part of the constructed fault tree is shown in the figure. Figures 12 to 17 shown.

[0065] In this fault tree, you can see the scenario information represented by the forbidden gate. By traversing the fault tree, you can get the scenario information that needs to be considered in the design phase so that you can test it in the test phase. Through the qualitative analysis of the fault tree, you can deduce the combination of functional failure / expected functional failure events that caused the accident. In addition, quantitative analysis can also analyze the conditional independence and conditional dependence events in the fault tree.

[0066] The embodiment of the present invention also provides a human-computer interaction model to expand the construction of the fault tree.

[0067] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. Only the preferred embodiments of the present invention are expressed. The description is more specific and detailed, but it cannot be understood as limiting the scope of the patent of the present invention. As long as there is no contradiction in the combination of these technical features, they should be considered as the scope recorded in this specification.

[0068] It should be noted that, for those skilled in the art, several modifications and improvements can be made without departing from the concept of the present invention, and these modifications and improvements all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

Claims

1. A method for constructing a fault tree of an automobile system considering expected functional safety, characterized in that: The following steps are involved: Step S1: defining a structure diagram of an autonomous driving vehicle for which a fault tree is to be constructed; Step S2: setting an initial scene and setting a top event; the top event represents an accident that causes harm; Step S3: connecting all dangerous events that cause the top event with the top event through an OR gate; Step S4: converting the dangerous event into a dangerous event of the execution system in the automobile system structure; Step S5: For each of the dangerous events, reverse traverse the structure diagram of the autonomous driving vehicle to decompose the dangerous event to obtain a number of sub-events that cause the dangerous event, and according to the category of the sub-event, the sub-event of the dangerous event of the input component is taken as the dangerous event of a new round of iteration, and step S5 is repeated until the fault tree is constructed; the sub-events include the functional failure event of the current component, the expected functional failure event of the current component and the dangerous event of the input component of the current component.

2. The method for constructing a fault tree of an automobile system considering expected functional safety according to claim 1, characterized in that: Step S5 includes: Step S51: if the functional failure event of the current component can lead to the current dangerous event, then the relationship between the functional failure event and the dangerous event is expressed according to the corresponding logic; Step S52: If the expected functional failure event of the current component can lead to the current dangerous event, firstly use an OR gate to list the corresponding expected functional failure events, and use the corresponding logic gate to represent the relationship between the events; Step S53: If the dangerous event of the input component of the current component can cause the current dangerous event to occur, then the dangerous event is inserted and the process returns to step S5 for traversal.

3. The method for constructing a fault tree of an automobile system considering expected functional safety according to claim 2, characterized in that: Step S51 connects the environmental factor to the fault tree through a prohibition gate when expressing the functional failure of the current component.

4. The method for constructing a fault tree of an automobile system considering expected functional safety according to claim 3, characterized in that: In step S52, the triggering condition of the expected functional failure is represented by a prohibition gate.

5. The method for constructing a fault tree of an automobile system considering expected functional safety according to claim 4, characterized in that: Step S5 also includes: if the current component is the execution or decision-making system of the autonomous driving vehicle, the functional failure events of steps S51, S52 and S53, the expected functional failure events and the dangerous events of the input components are connected to the driver situation awareness error events through an AND gate, and then connected to the dangerous events.

6. The method for constructing a fault tree of an automobile system considering expected functional safety according to claim 1, characterized in that: In step S4, the driver situation awareness error event that can lead to the dangerous event is connected to the dangerous event through an OR gate.

7. The method for constructing a fault tree of an automobile system considering expected functional safety according to claim 1, characterized in that: When constructing the fault tree, the uncovered faults of redundant components are also analyzed through the incomplete coverage model.

8. A method for constructing an automobile system fault tree considering expected functional safety according to claim 5 or 6, characterized in that: The driver situation awareness error events include: 1) The autonomous driving system makes an erroneous perception / decision or execution result, but the driver does not notice the erroneous result, resulting in the driver not taking over the car; 2) The autonomous driving system makes a correct perception / decision or execution result, but the driver believes that the autonomous driving system makes an incorrect perception / decision or execution result, causing the driver to take over the car and make incorrect driving behavior.

Images