Personal misuse hazard assessment method, device and equipment for expected function safety and medium

Abstract

The invention discloses an expected function safety man-made misuse hazard assessment method and device, equipment and a medium. The expected function safety man-made misuse hazard assessment method comprises the following steps: extracting a target man-vehicle interaction element from a function case of vehicle automatic driving, and determining a hazard behavior associated with the target man-vehicle interaction element; the function case is used for describing implementation requirements of the automatic driving function in different scenes; extracting a target scene feature from the function case, and determining a man-made misuse scene matched with the target scene feature according to the target scene feature and the target man-vehicle interaction element; and according to the hazardous behavior and the man-made misuse scene, determining a hazardous event, and carrying out severity and controllability evaluation on the hazardous event. According to the technical scheme provided by the embodiment of the invention, the man-made misuse harm is evaluated, so that a developer can conveniently design an expected function safety man-machine interaction requirement according to the evaluation result of the hazard event.

Description

Technical Field

[0001] The present invention relates to the field of autonomous driving technology, and in particular to a method, device, equipment and medium for assessing the hazard of human misuse of expected functional safety. Background Art

[0002] With the rapid development of intelligent networking technology, the utilization rate of automobile autonomous driving functions has gradually increased. While autonomous driving provides convenience for drivers and passengers, it also brings potential risks. Therefore, expected functional safety has become an important concept in the field of autonomous driving.

[0003] Intended functional safety refers to hazards or risk events caused by performance limitations, insufficient functions and human misuse. Since the autonomous driving function introduces complex human-machine interactions, it is very easy to cause human misuse when the driver does not understand the system or does not trust it enough. Therefore, the hazard assessment of human misuse of intended functional safety is of great significance to safe driving. Summary of the invention

[0004] The present invention provides a method, device, equipment and medium for hazard assessment of human misuse of expected functional safety, which provides a basis for developers to design human-computer interaction requirements for expected functional safety by conducting hazard assessment on human misuse of expected functional safety.

[0005] According to one aspect of the present invention, a method for assessing the hazard of human misuse of expected functional safety is provided, comprising:

[0006] Extracting target human-vehicle interaction elements from the functional use cases of the vehicle's autonomous driving, and determining hazardous behaviors associated with the target human-vehicle interaction elements; the functional use cases are used to describe the implementation requirements of the autonomous driving function in different scenarios;

[0007] Extracting target scenario features from the functional use case, and determining a human misuse scenario matching the target scenario features based on the target scenario features and the target human-vehicle interaction elements;

[0008] Based on the hazardous behavior and the human misuse scenario, a hazardous event is determined, and the severity and controllability of the hazardous event are evaluated.

[0009] According to another aspect of the present invention, there is provided an expected functional safety human misuse hazard assessment device, comprising:

[0010] A hazardous behavior determination module, used to extract target human-vehicle interaction elements from the functional use cases of the vehicle's autonomous driving, and determine hazardous behaviors associated with the target human-vehicle interaction elements; the functional use cases are used to describe the implementation requirements of the autonomous driving function in different scenarios;

[0011] A misuse scenario determination module, used to extract target scenario features from the functional use case, and determine a human misuse scenario matching the target scenario features based on the target scenario features and the target human-vehicle interaction elements;

[0012] The hazard assessment module is used to determine the hazard event based on the hazard behavior and the human misuse scenario, and to assess the severity and controllability of the hazard event.

[0013] According to another aspect of the present invention, there is provided an electronic device, the electronic device comprising:

[0014] at least one processor; and

[0015] a memory communicatively connected to the at least one processor; wherein,

[0016] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the method for assessing the hazard of human misuse of expected functional safety described in any embodiment of the present invention.

[0017] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the method for assessing the hazard of human misuse of expected functional safety described in any embodiment of the present invention when executed.

[0018] According to another aspect of the present invention, a computer program product is provided, including a computer program, which, when executed by a processor, implements the method for assessing the hazard of human misuse of intended functional safety according to any embodiment of the present disclosure.

[0019] The technical solution of the embodiment of the present invention extracts the target human-vehicle interaction elements in the functional use case of the vehicle's autonomous driving, and determines the hazardous behaviors associated with the target human-vehicle interaction elements, and then extracts the target scene features in the functional use case, and determines the human misuse scenarios that match the target scene features based on the target scene features and the target human-vehicle interaction elements, and finally determines the hazardous events based on the hazardous behaviors and the human misuse scenarios, and evaluates the severity and controllability of the hazardous events, providing a basis for developers to design expected functional safety human-computer interaction requirements.

[0020] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 is a flow chart of a method for assessing the hazard of human misuse of expected functional safety provided in accordance with Embodiment 1 of the present invention;

[0023] Figure 2 is a flow chart of a method for assessing the hazard of human misuse of expected functional safety provided in accordance with Embodiment 2 of the present invention;

[0024] Figure 3 is a structural schematic diagram of an expected functional safety human misuse hazard assessment device provided according to Embodiment 3 of the present invention;

[0025] Figure 4 It is a schematic diagram of the structure of an electronic device that implements the method for assessing the hazard of human misuse of intended functional safety according to an embodiment of the present invention. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0027] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0028] Embodiment 1

[0029] Figure 1A flowchart of a method for assessing the hazard of human misuse of intended functional safety is provided for the first embodiment of the present invention. This embodiment is applicable to the case where human misuse hazard assessment is performed according to the functional use case of the vehicle's automatic driving. The method can be performed by an apparatus for assessing the hazard of human misuse of intended functional safety. The apparatus can be implemented in the form of hardware and / or software. The apparatus can be configured in various general-purpose computing devices. Figure 1 As shown, the method includes:

[0030] S110. Extract target human-vehicle interaction elements from functional use cases of vehicle autonomous driving, and determine hazardous behaviors associated with the target human-vehicle interaction elements; functional use cases are used to describe the implementation requirements of autonomous driving functions in different scenarios.

[0031] Functional use cases are used to describe the implementation requirements of autonomous driving functions in different scenarios. Functional use cases are application examples for specific functions included in the autonomous driving function product requirement document. Functional use cases include requirement description, execution actions, preconditions, postconditions, and operating scenario characteristics.

[0032] The human-vehicle interaction element is used to provide a software or hardware interface for the car and the person to interact. The human-vehicle interaction element can be various components for the interaction between the person and the vehicle. For example, the human-vehicle interaction element can be an automatic driving function setting switch, a positioning function switch, a vehicle light switch, a voice control command, a steering wheel, an accelerator pedal, and a brake pedal.

[0033] Hazardous behavior is a behavior that causes safety risks due to the misuse of human-vehicle interaction elements. For example, the hazardous behavior is that the driver does not know that he needs to operate the activation switch to activate the Navigation on Pilot (NOP) function, and the driver mistakenly believes that he has activated the NOP function and gives up the lateral and longitudinal control of the vehicle. Another example of hazardous behavior is that after the NOP function is activated, the driver turns off the automatic adjustment mode of the high beam.

[0034] In the embodiment of the present invention, in order to propose the human-machine interaction safety design requirements based on the product requirements of the autonomous driving function, so as to reduce the safety risks caused by the misuse, it is necessary to identify the possible hazardous events based on the functional use cases of the vehicle's autonomous driving, so as to conduct a hazard assessment for the hazardous events. First, the target human-vehicle interaction element is extracted from the functional use cases of the vehicle's autonomous driving. Specifically, the functional use cases can be segmented, and then each segmentation is calculated with the pre-stored human-vehicle interaction element for similarity. If the similarity between the current segmentation and the pre-stored human-vehicle interaction element is higher than the set threshold, the current segmentation can be determined as the target human-vehicle interaction element. Among them, the pre-selected stored human-vehicle interaction element can be determined according to the system architecture of the autonomous driving function included in the current vehicle. It can also be a pre-trained human-vehicle interaction element recognition model, and the functional use case of the vehicle's autonomous driving is input into the recognition model to obtain at least one target human-vehicle interaction element output by the recognition model.

[0035] Further, the hazardous behavior associated with the target human-vehicle interaction element is determined. Specifically, the human-vehicle interaction element can be used as a training sample in advance, and at least one hazardous behavior associated with the human-vehicle interaction element can be used as a label for model training to obtain a hazardous behavior prediction model. After obtaining the target human-vehicle interaction element in the functional use case, the target human-vehicle interaction element is input into the hazardous behavior prediction model to obtain the hazardous behavior corresponding to the target human-vehicle interaction element output by the model.

[0036] Alternatively, for each target human-vehicle interaction element, the pre-set human misuse guide words are traversed, and the traversed guide words and the target human-vehicle interaction element are spliced ​​to obtain the cause of human misuse. The cause of human misuse is then input into the large model for distinguishing harmful behaviors to determine whether the current cause of human misuse is reasonable. If it is reasonable, the current cause of misuse is determined to be a harmful behavior. Among them, the large model for distinguishing harmful behaviors is obtained by training the initial classification model using a large number of harmful behaviors collected in advance as training samples. The human misuse guide words can be extracted based on the harmful behaviors collected in advance, such as "not understanding", "wrong identification", "misjudgment error" and "deliberate".

[0037] In a specific example, in the "autonomous driving function activation" use case, the target human-vehicle interaction elements extracted include the driving mode setting soft key, the positioning function setting soft key, and the automatic emergency braking (Autonomous Emergency Braking, AEB) function setting soft key. For the driving mode setting soft key, the above-mentioned human misuse guide words are traversed to obtain the hazardous behavior. Taking the misuse guide word "intentional" as an example, the reason for human misuse can be obtained as "After NOP is activated, the driver deliberately sets the driving mode to an unusual mode through the driving mode setting soft key, resulting in NOP being unable to accelerate or change lanes." The hazard discrimination model predicts that this reason for human misuse is reasonable. Therefore, the above-mentioned human misuse reason is used as the hazardous behavior associated with the driving mode setting soft key.

[0038] Optionally, the human-vehicle interaction elements are divided into center console interaction type, combination switch interaction type, voice control interaction type and actuator operation interaction type.

[0039] In this optional embodiment, the human-vehicle interaction elements can be divided into center console interaction type, combination switch interaction type, voice control interaction type and actuator operation interaction type. Among them, the center console interaction can include two modes, one is the warning notification issued by the vehicle to the vehicle through the center console in the form of indicator lights or icons, and the other is the operation performed by the driver through the center console soft switch. Specifically, according to the different functional categories of the elements, they can be divided into Advanced Driving Assistance System (ADAS) domain, automatic driving function settings, chassis domain and comfort domain interaction elements. For example, the human-vehicle interaction elements in the ADAS domain include the cruise speed adjustment switch, the time distance adjustment switch, the positioning function switch, the automatic emergency braking AEB function switch and the blind spot detection (Blind Spot Detection, BSD) function switch; the interactive elements of the autonomous driving function setting include the enable setting switch, the activation switch, the autonomous driving style setting switch, the intelligent deviation function setting switch, the lever lane change setting switch and the voice prompt function setting switch; the chassis domain switches include the driving mode setting, the Electronic Stability Controller (ESC) switch, the Auto Vehicle Hold (AVH) switch, the Hill Descent Controll (HDC) switch, the Electronic Park Brake (EPB) soft key, etc.; the comfort domain switches include the rearview mirror folding switch setting soft key, the adaptive high beam switch setting, the AR tailgate opening switch, the wiper automatic gear switch setting and other soft switches and combination switches. Furthermore, the combination switch includes the low beam switch, high beam switch, lane change light switch, turn signal switch, wiper switch, gear switch, door switch, seat belt switch, etc. Voice control is the driver controlling the system through voice commands, such as function activation, pause and exit, etc. Actuator operation includes the driver operating the steering wheel, brake pedal and accelerator pedal, etc.

[0040] S120. Extract target scenario features from the functional use case, and determine a human misuse scenario that matches the target scenario features based on the target scenario features and the target human-vehicle interaction elements.

[0041] Scene features are used to characterize the scenes during vehicle driving. Scene features may include road type (main urban road, expressway or urban auxiliary road, etc.), road geometry (straight road, curve, etc.), lane style (two-way 4 lanes, two-way 2 lanes, etc.), marking quality (clear, blurred, etc.), lane width, longitudinal section (horizontal, slope, etc.), paving status (asphalt), expected vehicle motion status and expected obstacle motion status, etc.

[0042] Human misuse scenarios refer to scenarios where people misuse the target human-vehicle interaction elements to associate with the autonomous driving function under the target scenario characteristics. For example, when driving on a main road in a city, the operational design domain (ODD) conditions for NOP activation are met, but the driver does not operate the exclusive physical switch (i.e., does not operate the driving mode setting soft key), and mistakenly thinks that the NOP function is activated.

[0043] In an embodiment of the present invention, after determining the hazardous behavior associated with the target human-vehicle interaction element, target scene features are further extracted in the functional use case. For example, the target scene features may include the road type being a city main road, the road geometry being a straight road, the lane style being a two-way four-lane road, the marking quality being clear, the lane width being 3.5 meters, the longitudinal section being horizontal, and the paving state being asphalt paving, etc.

[0044] Further, according to the target scene features and the target human-vehicle interaction elements, a human misuse scenario matching the target scene features is determined. Specifically, based on the target human-vehicle interaction elements, at least one candidate misuse scenario can be determined in the scenario library. Among them, the scenario library stores human-vehicle interaction elements and human misuse scenarios associated with the human-vehicle interaction elements. Then, based on the target scene features, a human misuse scenario matching the target scene features is determined in at least one candidate misuse scenario. In a specific example, the target scene features include the road type being a city main road, and the target human-vehicle interaction element is a driving mode setting soft key. Then, multiple candidate misuse scenarios associated with the driving mode setting soft key can be located in the scenario library first, for example, when driving on a city main road, the ODD condition for NOP activation is met, and the driver does not operate the exclusive physical switch, mistakenly activating the NOP function, or when driving on a highway, the ODD condition for NOP activation is met, and the driver does not operate the exclusive physical switch, mistakenly activating the NOP function. Finally, based on the acquired target scenario features, it can be determined that the human misuse scenario is: when driving on a city main road, the ODD conditions for NOP activation are met, and the driver does not operate the exclusive physical switch and mistakenly thinks that the NOP function is activated.

[0045] S130. Determine hazardous events based on hazardous behaviors and human misuse scenarios, and evaluate the severity and controllability of hazardous events.

[0046] A hazardous incident is an incident in which a person performs a hazardous behavior in a human misuse scenario, which may pose a safety risk to the person.

[0047] In an embodiment of the present invention, a hazardous event is determined based on the hazardous behavior and human misuse scenario obtained above, and the severity and controllability of the hazardous event are evaluated based on the hazardous behavior and human misuse scenario. Specifically, the hazardous behavior and the human misuse scenario can be spliced, that is, the hazardous behavior can be embedded in a specific position of the human misuse scenario to obtain the hazardous event. For example, the hazardous behavior is embedded after the scene description information of the human misuse scenario.

[0048] Exemplarily, the hazardous behavior is that the driver is unaware of the need to operate the activation switch to activate the NOP function, and the driver mistakenly believes that he has activated the NOP function, and gives up the lateral and longitudinal control of the vehicle. The human misuse scenario is that the vehicle is traveling on the main road in the city, and the ODD conditions for NOP activation are met. The driver does not operate the exclusive physical switch, and mistakenly believes that the NOP function is activated. By splicing the above hazardous behavior and human misuse scenario, we can get the hazardous event: the vehicle is traveling on the main road in the city, and the ODD conditions for NOP activation are met. The driver is unaware of the need to operate the activation switch to activate the NOP function, and the driver mistakenly believes that he has activated the NOP function, and gives up the lateral and longitudinal control of the vehicle.

[0049] After obtaining the hazardous event, continue to analyze the severity and controllability of the hazardous event. Specifically, the severity of the hazardous event is determined based on the expected ego vehicle motion state and the expected obstacle motion state in the human misuse scenario. The expected ego vehicle motion state may include the ego vehicle speed, acceleration, and vehicle position; the expected obstacle motion state may include the obstacle speed, acceleration, and obstacle position.

[0050] Furthermore, based on the human misuse scenario, the hazardous behavior is simulated to obtain the driver's reaction time. The reaction time threshold associated with the expected vehicle motion state is obtained. The reaction time is compared with the reaction time threshold. When the reaction time is greater than the reaction time threshold, it is determined that the hazardous event is uncontrollable, and the greater the difference between the reaction time and the reaction time threshold, the more uncontrollable it is.

[0051] The technical solution of the embodiment of the present invention extracts target human-vehicle interaction elements in functional use cases of vehicle autonomous driving, and determines the hazardous behaviors associated with the target human-vehicle interaction elements, and then extracts target scene features in the functional use cases, and determines the human misuse scenarios that match the target scene features based on the target scene features and the target human-vehicle interaction elements, and finally determines hazardous events based on the hazardous behaviors and human misuse scenarios, and evaluates the severity and controllability of the hazardous events, providing a basis for developers to design expected functional safety human-computer interaction requirements, reducing road risks caused by improper operation due to unfamiliarity with functions, poor driver condition, or excessive trust in the driver's autonomous driving function, and thus improving the driver's trust and satisfaction with the autonomous driving function.

[0052] Embodiment 2

[0053] Figure 2 This is a flowchart of a method for assessing the hazard of human misuse of expected functional safety provided in the second embodiment of the present invention. This embodiment is further refined on the basis of the above embodiment, and provides specific steps for extracting target human-vehicle interaction elements in the functional use case of the vehicle's autonomous driving, and determining the hazardous behavior associated with the target human-vehicle interaction elements, specific steps for determining the human misuse scenario that matches the target scenario characteristics based on the target scenario characteristics and the target human-vehicle interaction elements, and specific steps for determining hazardous events based on the hazardous behavior and human misuse scenarios, and assessing the severity and controllability of the hazardous events. Figure 2 As shown, the method includes:

[0054] S210. Based on the human-vehicle interaction elements included in the vehicle's autonomous driving system, identify target human-vehicle interaction elements in functional use cases of the vehicle's autonomous driving.

[0055] The human-vehicle interaction elements are determined based on the system architecture of the current vehicle's autonomous driving functions. Autonomous driving functions may include Auto Parking Assist (APA), Home-zone Parking Assist (HPA), Remote Parking Assist (RPA), Automated Valet Parking (AVP), Navigation on Pilot (NOP), and Navigation on Autopilot (NOA). Based on the above autonomous driving functions, the system architecture of the vehicle's autonomous driving functions mainly includes the human-machine interface (HMI), vehicle sensors, planners, controllers, actuators, and on-board cloud.

[0056] Based on the above system architecture, the human-computer interaction approach can be divided into center console interaction, combination switch, voice control and actuator operation according to the different element interaction methods. The center console interaction can include two methods, one is the warning notification issued by the vehicle to the vehicle through the center console in the form of indicator lights or icons, and the other is the operation performed by the driver through the center console soft switch. According to the different element function categories, it can be divided into ADAS domain, automatic driving function setting, chassis domain and comfort domain interaction elements. For example, ADAS domain interaction elements include cruise speed adjustment switch, time distance adjustment switch, positioning function switch, AEB function switch and BSD function switch; automatic driving function setting interaction elements include enable setting switch, activation switch, automatic driving style setting switch, intelligent deviation function setting switch, lever lane change setting switch and voice prompt function setting switch; chassis domain switches include driving mode settings, ESC, AVH switch, HDC switch, EPB soft keys, etc.; comfort domain switches include rearview mirror folding switch setting soft keys, adaptive high beam switch settings, AR tailgate opening switch, wiper automatic gear switch settings and other soft switches and combination switches. Furthermore, the combination switch includes the low beam switch, high beam switch, lane change light switch, turn signal switch, wiper switch, gear switch, door switch, seat belt switch, etc. Voice control is the driver controlling the system through voice commands, such as function activation, pause and exit, etc. Actuator operation includes the driver operating the steering wheel, brake pedal and accelerator pedal, etc.

[0057] In an embodiment of the present invention, based on the human-vehicle interaction elements included in the vehicle automatic driving system, target human-vehicle interaction elements are identified in the functional use cases of the vehicle automatic driving. Specifically, the functional use cases of the vehicle automatic driving are segmented, and then each segmentation is similar to the pre-stored human-vehicle interaction elements. If the similarity between the current segmentation and the pre-stored human-vehicle interaction elements is higher than a set threshold, the current segmentation can be determined as the target human-vehicle interaction element. It is also possible to pre-train a human-vehicle interaction element recognition model, input the functional use cases of the vehicle automatic driving into the recognition model, and obtain at least one target human-vehicle interaction element output by the recognition model.

[0058] S220: For the target human-vehicle interaction element, a pre-set list of human misuse guide words is traversed to obtain harmful behaviors associated with the target human-vehicle interaction element.

[0059] In an embodiment of the present invention, after obtaining the target human-vehicle interaction element in the functional use case, for each target human-vehicle interaction element, the pre-set human misuse guide words are traversed, and the traversed guide words and the target human-vehicle interaction element are spliced ​​to obtain the cause of human misuse. The cause of human misuse is then input into the large model for distinguishing harmful behaviors to determine whether the current cause of human misuse is reasonable. If it is reasonable, the currently considered cause of misuse is determined as a harmful behavior. Among them, the large model for distinguishing harmful behaviors is obtained by training the initial classification model using a large number of harmful behaviors collected in advance as training samples. The human misuse guide words can be extracted based on the harmful behaviors collected in advance, for example, "not understanding", "wrong identification", "misjudgment error" and "deliberate".

[0060] Optionally, for the target human-vehicle interaction element, a pre-set list of human misuse guide words is traversed to obtain harmful behaviors associated with the target human-vehicle interaction element, including:

[0061] For the target human-vehicle interaction element, one human-misuse guide word is sequentially extracted from the pre-set human-misuse guide word list as the current guide word;

[0062] The current guide word is spliced ​​with the target human-vehicle interaction element to obtain the cause of human misuse;

[0063] Input the cause of human misuse into the harmful behavior discrimination large model to obtain the discrimination result output by the harmful behavior discrimination large model;

[0064] When the judgment result is that the cause of human misuse is reasonable, the hazardous behavior associated with the target human-vehicle interaction element is determined according to the cause of human misuse, and the operation is returned to be executed in the pre-set human misuse guide word list, and one human misuse guide word is extracted one by one as the current guide word until the traversal of the human misuse guide word list is completed.

[0065] In this optional embodiment, there is provided a specific method for traversing a pre-set list of human misuse guide words for a target human-vehicle interaction element to obtain the harmful behavior associated with the target human-vehicle interaction element: first, for the target human-vehicle interaction element, extract one human misuse guide word in the pre-set list of human misuse guide words in turn as the current guide word. Then, the current guide word is spliced ​​with the target human-vehicle interaction element to obtain the cause of human misuse. The cause of human misuse is input into the harmful behavior discrimination large model to obtain the discrimination result output by the harmful behavior discrimination large model. If the discrimination result is that the cause of human misuse is reasonable, the harmful behavior associated with the target human-vehicle interaction element is determined according to the cause of human misuse, and the operation of extracting one human misuse guide word in the pre-set list of human misuse guide words as the current guide word in turn is returned to be executed until the traversal of the human misuse guide word list is completed.

[0066] In a specific example, the guiding words for human misuse include "not understanding", "misidentification", "misjudgment" and "intentional". In the "autonomous driving function activation" use case, the target human-vehicle interaction elements are extracted, including the driving mode setting soft key. For the real-time mode setting soft key, traversing the above guiding words, we can get the cause of human misuse: "After NOP is activated, the driver deliberately sets the driving mode to an unusual mode through the driving mode setting soft key, resulting in NOP being unable to accelerate or change lanes." The hazard discrimination model predicts that this cause of human misuse is reasonable. Therefore, the above cause of human misuse is used as the hazardous behavior associated with the driving mode setting soft key.

[0067] For the "autonomous driving function activation" use case, identify all the interaction elements between people and vehicles involved in this use case, such as the driver cannot correctly operate the activation switch due to misunderstanding, the driving mode is set to an extraordinary mode, the positioning function is set to off, the AEB function is set to off, the BSD function is set to off, the rearview mirror folding switch is set to off, the smart high beam mode is set to off, the wiper automatic mode is set, the ESC OFF setting is off, the AVH setting is on, the CST setting is off, the HDC setting is on, the AR tailgate is open, the door is open, etc. Match the human-vehicle interaction elements with appropriate human misuse guide words to determine the hazardous behavior, as shown in Table 1.

[0068] Table 1

[0069]

[0070]

[0071] For the use cases of "overriding driver takes over steering wheel" and "overriding driver takes over accelerator pedal or brake pedal", identify all driver misuse behaviors involved in the use case, including accidentally touching the steering wheel, accidentally pressing the accelerator pedal and the brake pedal. Match the human-vehicle interaction elements with appropriate human misuse guide words to determine the hazardous behaviors, as shown in Table 3.

[0072] Table 2

[0073]

[0074] S230. Extract target scenario features from the functional use case, and determine at least one candidate misuse scenario in a scenario library based on the target human-vehicle interaction element; the scenario library stores human-vehicle interaction elements and human misuse scenarios associated with the human-vehicle interaction elements.

[0075] The scenario library stores a plurality of human-vehicle interaction elements contained in the vehicle and at least one human misuse scenario associated with each human-vehicle interaction element.

[0076] In an embodiment of the present invention, target scenario features are extracted from functional use cases, and then based on the target human-vehicle interaction element, at least one candidate misuse scenario associated with the target human-vehicle interaction element is determined in a scenario library.

[0077] S240: Based on the target scenario feature, determine a human misuse scenario that matches the target scenario feature in at least one candidate misuse scenario.

[0078] In the embodiment of the present invention, after the candidate misuse scenarios are determined, a human misuse scenario matching the target scenario feature is further determined in at least one candidate misuse scenario based on the target scenario feature.

[0079] In a specific example, the current target human-vehicle interaction element is the positioning function setting soft key, and the target scene feature is the city main road. Based on the positioning function setting soft key, the candidate misuse scenarios associated with the positioning function setting soft key can be determined in the feature library, including: driving on the city main road, meeting the ODD condition for NOP activation, the driver did not operate the exclusive physical switch, and mistakenly thought that the NOP function was activated; driving on the highway, meeting the ODD condition for NOP activation, the driver did not operate the exclusive physical switch, and mistakenly thought that the NOP function was activated. Further, according to the target scene feature (city main road), the human misuse scenario is further determined to be driving on the city main road, meeting the ODD condition for NOP activation, the driver did not operate the exclusive physical switch, and mistakenly thought that the NOP function was activated.

[0080] The human misuse scenarios of the “NOP activation” use case are shown in Table 3, which mainly include scenario characteristics, such as environmental conditions, road conditions, traffic conditions, traffic participants, and vehicle status.

[0081] Table 3

[0082]

[0083]

[0084]

[0085]

[0086] For the use cases of “the overriding driver takes over the steering wheel” and “the overriding driver takes over the accelerator pedal or brake pedal”, the human misuse scenarios associated with the use cases are identified as shown in Table 4.

[0087] Table 4

[0088]

[0089]

[0090] S250: Based on the set splicing rules, the hazardous behavior and the human misuse scenario are spliced ​​to obtain a hazardous event.

[0091] In the embodiment of the present invention, based on the set splicing rules, the harmful behavior and the human misuse scene are spliced ​​to obtain the harmful event. Specifically, according to the splicing rules, the harmful behavior is embedded in a specific position of the human misuse scene to obtain the harmful event. For example, the harmful behavior is embedded after the scene description information of the human misuse scene.

[0092] Exemplarily, the hazardous behavior is that the driver is unaware of the need to operate the activation switch to activate the NOP function, and the driver mistakenly believes that he has activated the NOP function, and gives up the lateral and longitudinal control of the vehicle. The human misuse scenario is that the vehicle is traveling on the main road in the city, and the ODD conditions for NOP activation are met. The driver does not operate the exclusive physical switch, and mistakenly believes that the NOP function is activated. By splicing the above hazardous behavior and human misuse scenario, we can get the hazardous event: the vehicle is traveling on the main road in the city, and the ODD conditions for NOP activation are met. The driver is unaware of the need to operate the activation switch to activate the NOP function, and the driver mistakenly believes that he has activated the NOP function, and gives up the lateral and longitudinal control of the vehicle.

[0093] S260: Determine the severity of the hazardous event based on the expected vehicle motion state and the expected obstacle motion state in the human misuse scenario.

[0094] Severity is used to assess whether the hazardous event causes injury and the severity of the injury. A severity greater than 0 indicates injury, and the larger the severity value, the more severe the injury. Controllability is used to assess whether the harm caused by the hazardous event is controllable. A controllability greater than 0 indicates uncontrollable, and the larger the controllability value, the more uncontrollable it is.

[0095] In the embodiment of the present invention, the severity of the hazardous event is determined based on the expected vehicle motion state and the expected obstacle motion state in the human misuse scenario. Specifically, the vehicle speed and position in the expected vehicle motion state, and the vehicle speed and position of the obstacle speed in the expected obstacle motion state are obtained. The speed difference between the two is calculated based on the vehicle speed and the obstacle speed, and the distance between the two is calculated based on the vehicle position and the obstacle position. The collision scenario between the two is predicted based on the distance and speed difference, and the severity of the hazardous event is determined.

[0096] S270: Based on the human misuse scenario, simulate the hazardous behavior to obtain the driver's reaction time, compare the reaction time with a reaction time threshold associated with the expected vehicle motion state, and determine the controllability of the hazardous event based on the comparison result.

[0097] In an embodiment of the present invention, based on a human misuse scenario, a dangerous behavior is simulated to obtain the driver's reaction time. A reaction time threshold associated with the expected vehicle motion state is obtained. The reaction time is compared with the reaction time threshold, and the controllability of the dangerous event is determined according to the comparison result. When the reaction time is greater than the reaction time threshold, it is determined that the dangerous event is uncontrollable, and the greater the difference between the reaction time and the reaction time threshold, the more uncontrollable it is.

[0098] Optionally, after the severity and controllability of the hazard event is assessed, it also includes:

[0099] Determine whether the hazard event is acceptable based on its severity and controllability;

[0100] When the hazard event is unacceptable, the hazard event will be output.

[0101] In this optional embodiment, after the severity and controllability of the hazardous event are evaluated, whether the hazardous event is acceptable is determined based on the severity and controllability of the hazardous event. The severity of the harm caused by the hazardous event is positively correlated with the severity value, that is, the larger the severity value, the more serious the harm caused by the hazardous event; the controllability of the hazardous event is negatively correlated with the controllability value, that is, the larger the controllability value, the more uncontrollable the hazardous event. When the severity of the hazardous event is greater than the severity threshold, and the controllability is greater than the controllability threshold, the hazardous event is determined to be unacceptable. The severity threshold and the controllability threshold can be adjusted according to demand. For example, in order to maximize the safety of people in the vehicle, the severity threshold and the controllability threshold can be set to 0.

[0102] When a hazardous event is unacceptable, the hazardous event is output. Developers can propose expected functional safety human-computer interaction requirements based on the unacceptable regulations of severity and controllability analysis, complete the complete traceability of expected functional safety personnel misuse analysis, guide design and development, and reduce safety risks caused by human misuse.

[0103] The technical solution of the embodiment of the present invention is based on the human-vehicle interaction elements included in the vehicle automatic driving system, identifies the target human-vehicle interaction elements in the functional use case of the vehicle automatic driving, and traverses the preset list of human misuse guide words for the target human-vehicle interaction elements to obtain the hazardous behavior associated with the target human-vehicle interaction elements, and then extracts the target scene features in the functional use case, and based on the target human-vehicle interaction elements, determines at least one candidate misuse scenario in the scene library, and based on the target scene features, determines the human misuse scenario matching the target scene features in at least one candidate misuse scenario, and further, based on the set splicing rules, splices the hazardous behavior and the human misuse scenario to obtain a hazardous event, and determines the severity of the hazardous event based on the expected self-vehicle motion state and the expected obstacle motion state in the human misuse scenario, and finally simulates the hazardous behavior based on the human misuse scenario to obtain the driver's reaction time, and compares the reaction time with the reaction time threshold associated with the expected self-vehicle motion state, and determines the controllability of the hazardous event according to the comparison result, which can provide a basis for developers to design expected functional safety human-computer interaction requirements.

[0104] Embodiment 3

[0105] Figure 3 This is a schematic diagram of the structure of a device for assessing the hazard of human misuse of expected functional safety provided by Embodiment 3 of the present invention. Figure 3 As shown, the device comprises:

[0106] The hazardous behavior determination module 310 is used to extract target human-vehicle interaction elements from the functional use cases of the vehicle's autonomous driving, and determine hazardous behaviors associated with the target human-vehicle interaction elements; the functional use cases are used to describe the implementation requirements of the autonomous driving function in different scenarios;

[0107] A misuse scenario determination module 320, configured to extract target scenario features from the functional use case, and determine a human misuse scenario matching the target scenario features based on the target scenario features and the target human-vehicle interaction elements;

[0108] The hazard assessment module 330 is used to determine a hazard event based on the hazard behavior and the human misuse scenario, and to assess the severity and controllability of the hazard event.

[0109] The technical solution of the embodiment of the present invention extracts the target human-vehicle interaction elements in the functional use case of the vehicle's autonomous driving, and determines the hazardous behaviors associated with the target human-vehicle interaction elements, and then extracts the target scene features in the functional use case, and determines the human misuse scenarios that match the target scene features based on the target scene features and the target human-vehicle interaction elements, and finally determines the hazardous events based on the hazardous behaviors and the human misuse scenarios, and evaluates the severity and controllability of the hazardous events, providing a basis for developers to design expected functional safety human-computer interaction requirements.

[0110] Optionally, the harmful behavior determination module 310 includes:

[0111] An interactive element recognition unit, for recognizing a target human-vehicle interactive element in a functional use case of the vehicle's autonomous driving system based on the human-vehicle interactive elements included in the vehicle's autonomous driving system;

[0112] The hazardous behavior determination unit is used to traverse a preset list of human misuse guide words for the target human-vehicle interaction element to obtain the hazardous behavior associated with the target human-vehicle interaction element.

[0113] Optionally, the misuse scenario determination module 320 is specifically configured to:

[0114] Based on the target human-vehicle interaction element, at least one candidate misuse scenario is determined in a scenario library; the scenario library stores human-vehicle interaction elements and human misuse scenarios associated with the human-vehicle interaction elements;

[0115] Based on the target scene feature, a human misuse scene matching the target scene feature is determined in the at least one candidate misuse scene.

[0116] Optionally, the hazard assessment module 330 is specifically configured to:

[0117] Based on the set splicing rules, the harmful behavior and the human misuse scenario are spliced ​​to obtain a harmful event;

[0118] Determining the severity of the hazardous event based on the expected ego-vehicle motion state and the expected obstacle motion state in the human misuse scenario;

[0119] Based on the human misuse scenario, the hazardous behavior is simulated to obtain the driver's reaction time, and the reaction time is compared with a reaction time threshold associated with the expected vehicle motion state, and the controllability of the hazardous event is determined according to the comparison result.

[0120] Optional, intended functional safety human misuse hazard assessment device, also includes:

[0121] An event judgment module, used to determine whether the hazardous event is acceptable according to the severity and controllability of the hazardous event after evaluating the severity and controllability of the hazardous event;

[0122] The hazard event output module is used to output the hazard event when the hazard event is unacceptable.

[0123] Optional, Hazardous Behavior Determination Unit, specifically used to:

[0124] For the target human-vehicle interaction element, extracting one human-misuse guide word in a preset list of human-misuse guide words as a current guide word;

[0125] The current guide word is combined with the target human-vehicle interaction element to obtain the cause of human misuse;

[0126] Inputting the cause of human misuse into the harmful behavior discrimination large model to obtain the discrimination result output by the harmful behavior discrimination large model;

[0127] When the judgment result is that the cause of human misuse is reasonable, the hazardous behavior associated with the target human-vehicle interaction element is determined according to the cause of human misuse, and the operation of extracting one human misuse guide word as the current guide word in the pre-set human misuse guide word list is returned to be executed until the traversal of the human misuse guide word list is completed.

[0128] Optionally, the human-vehicle interaction elements are divided into a center console interaction type, a combination switch interaction type, a voice control interaction type and an actuator operation interaction type.

[0129] The device for assessing the hazard of human misuse of intended functional safety provided in an embodiment of the present invention can execute the method for assessing the hazard of human misuse of intended functional safety provided in any embodiment of the present invention, and has functional modules and beneficial effects corresponding to the execution method.

[0130] In the technical solution of the present invention, the collection, storage, use, processing, transmission, provision and disclosure of user personal information involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0131] Embodiment 4

[0132] According to an embodiment of the present invention, the present invention also provides an electronic device, a readable storage medium and a computer program product.

[0133] Figure 4A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, applicators, blade applicators, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0134] like Figure 4 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0135] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0136] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the expected functional safety human misuse hazard assessment method.

[0137] In some embodiments, the method for assessing the hazard of human misuse of intended functional safety may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the method for assessing the hazard of human misuse of intended functional safety described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the method for assessing the hazard of human misuse of intended functional safety in any other appropriate manner (e.g., by means of firmware).

[0138] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0139] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or application.

[0140] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0141] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0142] The systems and techniques described herein may be implemented in a computing system that includes a backend component (e.g., as a data applier), or a computing system that includes a middleware component (e.g., an application applier), or a computing system that includes a frontend component (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with an implementation of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0143] A computing system may include a client and an application server. The client and the application server are generally remote from each other and usually interact through a communication network. The relationship between the client and the application server is generated by computer programs running on corresponding computers and having a client-application server relationship with each other. The application server may be a cloud application server, also known as a cloud computing application server or a cloud host, which is a host product in a cloud computing application system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS applications.

[0144] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0145] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for assessing the hazard of human misuse of intended functional safety, characterized in that: include: Extract target human-vehicle interaction elements from the functional use cases of the vehicle's autonomous driving, and determine the hazardous behaviors associated with the target human-vehicle interaction elements; The functional use cases are used to describe the implementation requirements of the autonomous driving function in different scenarios; Extracting target scenario features from the functional use case, and determining a human misuse scenario matching the target scenario features based on the target scenario features and the target human-vehicle interaction elements; Based on the hazardous behavior and the human misuse scenario, a hazardous event is determined, and the severity and controllability of the hazardous event are evaluated.

2. The method according to claim 1, characterized in that Extract target human-vehicle interaction elements from the functional use cases of vehicle autonomous driving, and determine the hazardous behaviors associated with the target human-vehicle interaction elements, including: Based on the human-vehicle interaction elements included in the vehicle's autonomous driving system, identify the target human-vehicle interaction elements in the functional use cases of the vehicle's autonomous driving; For the target human-vehicle interaction element, a preset list of human misuse guide words is traversed to obtain harmful behaviors associated with the target human-vehicle interaction element.

3. The method according to claim 1, characterized in that Determining, according to the target scene feature and the target human-vehicle interaction element, a human misuse scene matching the target scene feature, including: Based on the target human-vehicle interaction element, at least one candidate misuse scenario is determined in a scenario library; the scenario library stores human-vehicle interaction elements and human misuse scenarios associated with the human-vehicle interaction elements; Based on the target scene feature, a human misuse scene matching the target scene feature is determined in the at least one candidate misuse scene.

4. The method according to claim 1, characterized in that: Based on the hazardous behavior and the human misuse scenario, determine the hazardous event and evaluate the severity and controllability of the hazardous event, including: Based on the set splicing rules, the harmful behavior and the human misuse scenario are spliced ​​to obtain a harmful event; Determining the severity of the hazardous event based on the expected ego-vehicle motion state and the expected obstacle motion state in the human misuse scenario; Based on the human misuse scenario, the hazardous behavior is simulated to obtain the driver's reaction time, and the reaction time is compared with a reaction time threshold associated with the expected vehicle motion state, and the controllability of the hazardous event is determined according to the comparison result.

5. The method according to claim 1, characterized in that After evaluating the severity and controllability of the hazardous event, it also includes: Determine whether the hazardous event is acceptable based on the severity and controllability of the hazardous event; In the case where the hazardous event is unacceptable, the hazardous event is output.

6. The method according to claim 2, characterized in that For the target human-vehicle interaction element, a preset list of human misuse guide words is traversed to obtain harmful behaviors associated with the target human-vehicle interaction element, including: For the target human-vehicle interaction element, extracting one human-misuse guide word in a preset list of human-misuse guide words as a current guide word; The current guide word is combined with the target human-vehicle interaction element to obtain the cause of human misuse; Inputting the cause of human misuse into the harmful behavior discrimination large model to obtain the discrimination result output by the harmful behavior discrimination large model; When the judgment result is that the cause of human misuse is reasonable, the hazardous behavior associated with the target human-vehicle interaction element is determined according to the cause of human misuse, and the operation of extracting one human misuse guide word as the current guide word in the pre-set human misuse guide word list is returned to be executed until the traversal of the human misuse guide word list is completed.

7. The method according to claim 2, characterized in that The human-vehicle interaction elements are divided into a center console interaction type, a combination switch interaction type, a voice control interaction type, and an actuator operation interaction type.

8. An intended functional safety human misuse hazard assessment device, characterized in that: include: A hazardous behavior determination module, used to extract target human-vehicle interaction elements from the functional use cases of the vehicle's autonomous driving, and determine hazardous behaviors associated with the target human-vehicle interaction elements; the functional use cases are used to describe the implementation requirements of the autonomous driving function in different scenarios; A misuse scenario determination module, used to extract target scenario features from the functional use case, and determine a human misuse scenario matching the target scenario features based on the target scenario features and the target human-vehicle interaction elements; The hazard assessment module is used to determine the hazard event based on the hazard behavior and the human misuse scenario, and to assess the severity and controllability of the hazard event.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can perform the method for assessing the hazard of human misuse of intended functional safety according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the method for assessing the hazard of human misuse of intended functional safety according to any one of claims 1 to 7 when executed.

Images