Whole vehicle hazard analysis and risk assessment method, device and equipment and vehicle

Abstract

The invention discloses a vehicle hazard analysis and risk assessment method, device and equipment and a vehicle, and relates to the technical field of vehicles. The whole vehicle hazard analysis and risk assessment method comprises the following steps: obtaining function case information of a whole vehicle; performing security correlation analysis on the function case information to obtain function case security indication information; if the function case safety indication information indicates that the function case information is related to the safety of the whole vehicle, associating the function case information with a failure mode of the whole vehicle to obtain function abnormal information; then, performing security correlation analysis on the functional abnormality information to obtain functional abnormality security indication information; and if the functional abnormity safety indication information indicates that the functional abnormity information is related to the safety of the whole vehicle, performing hazard analysis and risk assessment on the whole vehicle based on the functional abnormity information. According to the embodiment of the invention, the analysis and evaluation efficiency of vehicle hazard analysis and risk evaluation can be improved.

Description

Technical Field

[0001] The present application relates to the field of vehicle technology, and in particular to a whole vehicle hazard analysis and risk assessment method, device, equipment and vehicle. Background Art

[0002] Hazard analysis and risk assessment are important steps in the development of functional safety concepts. By identifying and classifying hazardous events caused by abnormal functional performance in related items and formulating safety goals and their corresponding ASIL levels to prevent hazardous events or reduce the degree of hazard, the system can meet the corresponding safety requirements when a failure occurs, thereby ensuring the safety of passengers and vehicles.

[0003] In the related technologies, the workload of hazard analysis and risk assessment is huge and the efficiency of analysis and assessment is low. Summary of the invention

[0004] The main purpose of the embodiments of the present application is to provide a whole vehicle hazard analysis and risk assessment method, device, equipment and vehicle, aiming to improve the analysis and assessment efficiency of whole vehicle hazard analysis and risk assessment.

[0005] To achieve the above objectives, one aspect of an embodiment of the present application provides a vehicle hazard analysis and risk assessment method, comprising the following steps: Obtain functional use case information of the entire vehicle; Performing security relevance analysis on the functional use case information to obtain functional use case security indication information; If the functional use case safety indication information indicates that the functional use case information is related to the safety of the entire vehicle, then associating the functional use case information with the failure mode of the entire vehicle to obtain functional abnormality information; Performing safety relevance analysis on the functional abnormality information to obtain functional abnormality safety indication information; If the abnormal function safety indication information indicates that the abnormal function information is related to the safety of the entire vehicle, then a hazard analysis and risk assessment is performed on the entire vehicle based on the abnormal function information.

[0006] In some embodiments, the hazard analysis and risk assessment of the entire vehicle based on the functional abnormality information includes: Obtain the vehicle's operating scenario information; Associating the function abnormality information with the operation scenario information to obtain a hazard event; Determine a key hazard event based on the hazard event, wherein the key hazard event is used to characterize that the exposure probability or severity level of the hazard event is higher than a corresponding preset value; Conduct hazard analysis and risk assessment on the entire vehicle based on the hazardous events and the key hazardous events.

[0007] In some embodiments, associating the functional abnormality information with the operation scenario information to obtain a hazardous event includes: Analyze the correlation between the operation scenario information and the functional use case information to obtain correlation scenario information; The functional abnormality information is associated with the associated scene information to obtain a hazardous event.

[0008] In some embodiments, the performing hazard analysis and risk assessment on the entire vehicle according to the hazard event and the key hazard event includes: Score the severity level, exposure probability level and controllability level of the hazardous events and the key hazardous events; Performing vehicle safety integrity level grading according to the severity level score, the exposure probability level score, and the controllability level score to obtain vehicle safety integrity level grading information; Determining a vehicle safety target based on the classification information; The vehicle safety objectives are combined to obtain the vehicle hazard analysis and risk assessment results.

[0009] In some embodiments, associating the functional use case information with the failure mode of the entire vehicle to obtain functional abnormality information includes: Obtain vehicle failure mode information; Determine functional failure information corresponding to the functional use case information according to the failure mode information; The functional failure information is associated with the functional use case information to obtain the functional abnormality information.

[0010] In some embodiments, after performing safety correlation analysis on the functional use case information to obtain functional use case safety indication information, the vehicle hazard analysis and risk assessment method further includes: If the functional use case safety indication information indicates that the functional use case information is not relevant to the safety of the entire vehicle, further analysis of the functional use case information is terminated.

[0011] In some embodiments, after performing safety correlation analysis on the functional abnormality information to obtain functional abnormality safety indication information, the vehicle hazard analysis and risk assessment method further includes: If the abnormal function safety indication information indicates that the abnormal function information is not relevant to the safety of the entire vehicle, further analysis of the abnormal function information is terminated.

[0012] To achieve the above-mentioned purpose, another aspect of the embodiment of the present application provides a whole vehicle hazard analysis and risk assessment device, the whole vehicle hazard analysis and risk assessment device comprising: The acquisition module is used to obtain the functional use case information of the whole vehicle; A first analysis module, configured to perform security correlation analysis on the functional use case information to obtain functional use case security indication information; an associating module, configured to associate the functional use case information with a failure mode of the whole vehicle to obtain functional abnormality information if the functional use case safety indication information indicates that the functional use case information is related to the safety of the whole vehicle; A second analysis module is used to perform safety correlation analysis on the function abnormality information to obtain function abnormality safety indication information; The analysis and evaluation module is used to perform hazard analysis and risk evaluation on the whole vehicle based on the functional abnormality information if the functional abnormality safety indication information indicates that the functional abnormality information is related to the safety of the whole vehicle.

[0013] To achieve the above-mentioned purpose, another aspect of an embodiment of the present application proposes an electronic device, which includes a memory and a processor, wherein the memory stores a computer program, and the processor implements the above-mentioned vehicle hazard analysis and risk assessment method when executing the computer program.

[0014] To achieve the above-mentioned purpose, another aspect of an embodiment of the present application proposes a vehicle, which performs whole vehicle hazard analysis and risk assessment through a whole vehicle hazard analysis and risk assessment method of the above-mentioned embodiment, an electronic device of the above-mentioned embodiment, or a whole vehicle hazard analysis and risk assessment device of the above-mentioned embodiment.

[0015] The embodiments of the present application include at least the following beneficial effects: The present application provides a whole vehicle hazard analysis and risk assessment method, device, equipment and vehicle. In an embodiment of the present application, first, functional use case information of the whole vehicle is obtained; a safety correlation analysis is performed on the functional use case information to obtain functional use case safety indication information; if the functional use case safety indication information indicates that the functional use case information is related to the safety of the whole vehicle, then the functional use case information is associated with the failure mode of the whole vehicle to obtain functional abnormality information; then, a safety correlation analysis is performed on the functional abnormality information to obtain functional abnormality safety indication information; if the functional abnormality safety indication information indicates that the functional abnormality information is related to the safety of the whole vehicle, then a hazard analysis and risk assessment of the whole vehicle is performed based on the functional abnormality information. The embodiments of the present application perform a safety relevance analysis on the functional use case information, and when the functional use case information is related to the safety of the whole vehicle, associates the functional use case information with the failure mode of the whole vehicle, thereby excluding the analysis and evaluation of the functional use case information that is not related to safety, thereby improving the analysis and evaluation efficiency. Furthermore, by performing a safety relevance analysis on the functional abnormality information, and when the functional abnormality information is related to the safety of the whole vehicle, a hazard analysis and risk assessment of the whole vehicle is performed based on the functional abnormality information, thereby excluding the analysis and evaluation of the functional abnormality information that is not related to safety, thereby further improving the analysis and evaluation efficiency of the hazard analysis and risk assessment of the whole vehicle.

[0016] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the description of the embodiments in conjunction with the following drawings, in which: Figure 1 is a flow chart of a vehicle hazard analysis and risk assessment method provided by some embodiments of the present application; Figure 2 It is a flow chart of the traditional vehicle hazard analysis and risk assessment method; Figure 3 is another flow chart of the vehicle hazard analysis and risk assessment method provided by some embodiments of the present application; Figure 4 is another flow chart of the vehicle hazard analysis and risk assessment method provided by some embodiments of the present application; Figure 5 is a schematic block diagram of modules of a vehicle hazard analysis and risk assessment device provided in some embodiments of the present application; Figure 6 It is a schematic diagram of the hardware structure of an electronic device provided in some embodiments of the present application. DETAILED DESCRIPTION

[0018] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the reference to "embodiment" in this article means that the specific features, structures or characteristics described in conjunction with the embodiment may be included in at least one embodiment of the present application. The appearance of this phrase in various positions in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the embodiments of the present application. They are only examples of devices and methods consistent with some aspects of the embodiments of the present application as detailed in the attached claims.

[0019] It is understood that the terms "first", "second", etc. used in this application can be used to describe various concepts in this article, but unless otherwise specified, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another concept. For example, without departing from the scope of the embodiment of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the words "if" and "if" as used herein can be interpreted as "at the time of" or "when" or "in response to determination".

[0020] The terms "at least one", "multiple", "each", "any", etc. used in this application, at least one includes one, two or more, multiple includes two or more, each refers to each of the corresponding multiple, and any refers to any one of the multiple.

[0021] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0022] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0023] In order to make the inventive concept of the present application easy to understand, before describing the embodiments of the present application in detail, the English abbreviations (terms) / related concepts involved in the embodiments of the present application are first described. The English abbreviations (terms) / related concepts involved in the embodiments of the present application are subject to the following explanations.

[0024] ASIL: ASIL stands for Automotive Safety Integrity Level, which refers to the automobile safety integrity level.

[0025] SOA: The full name of SOA is Service-Oriented Architecture, which refers to service-oriented architecture.

[0026] As the level of intelligent networking and electrification of automobiles increases, the proportion of software in automobiles is also increasing. As user needs continue to change, automotive software also needs to adapt to new needs of rapid iteration. To this end, in the context of software-defined cars, automotive electronic and electrical architecture is transitioning from traditional distributed, "signal-oriented" electronic and electrical E / E architecture to "service-oriented" SOA architecture. The essence of the SOA architecture is to modularize and standardize the originally dispersed ECUs and their corresponding basic software functions, decouple various application areas from each other, and redeploy them into a layered software architecture. Cars can provide different services to drivers through different software configurations without adding or replacing hardware, thereby achieving thousands of faces for thousands of people. With the launch of the new SOA-based architecture platform, functional safety development also needs to adapt to changes in development methods under SOA.

[0027] In traditional functional safety development, the development of the "hazard analysis and risk assessment" process is the most time-consuming. The purpose of "hazard analysis and risk assessment" is to: identify and classify hazardous events caused by abnormal functional performance in related items; formulate safety goals and their corresponding ASIL levels to prevent hazardous events or reduce the degree of hazard, so as to avoid unreasonable risks. Therefore, when conducting "hazard analysis and risk assessment", it is necessary to describe the operating scenario and operating mode when a hazardous event occurs due to abnormal functional performance of related items. Traditional operating scenarios often require a combination of weather (sunny, rainy and snowy), road conditions (dry road, slippery road, icy and snowy road, etc.), location (country roads, highways, urban congested roads, etc.), brightness information (no street lights during the day or at night, etc.), driver operations (lane changes, U-turns, medium and high-speed driving, etc.), surrounding obstacles, etc., in order to describe the operating scenario information when a hazardous event occurs. These operating scenarios can often be combined into hundreds of operating scenarios through the above scenarios, such as "on a rainy night, on a slippery road without street lights, when driving at a medium speed on a curve in the city, the low beam lights unexpectedly go out, causing a collision with the curve guardrail." Each hazard event needs to be rated for severity level S, exposure probability E, and controllability C, so as to derive the vehicle safety integrity level ASIL. This makes the "hazard analysis and risk assessment" process very labor-intensive, and beginners are also prone to problems such as low work efficiency and insufficient analysis due to inappropriate and insufficient combinations of operating scenarios.

[0028] Under the SOA architecture, the form of "functional abnormality + operation scenario = hazard event" is still used for hazard analysis and risk assessment, which leads to low efficiency and many irrelevant scenarios. For a vehicle, there are three types of functional abnormalities for one function: unexpected loss of functional output, unexpected increase of functional output, and unexpected reverse function output. At the same time, there are road conditions (dry road surface and icy and snowy road surface), location (curve, highway, urban one-way road, slope road, mountain road), brightness information (daytime and night without street lights), driver operation (lane change, U-turn, turn, straight driving), surrounding obstacles (oncoming vehicles, vehicles in the same direction in adjacent lanes, and pedestrians around) and multiple operation scenarios. The number of hazard events formed is: 3*2*5*2*4*3=720. In the future, it is necessary to rate the three parameters of severity level S, exposure probability E, and controllability C for these 720 combined hazard events, so as to obtain the vehicle safety integrity level ASIL. This is a very large workload, and often there will be unreasonable combinations of running scenarios, for example: there may be a combination of high-speed and U-turn, but in fact, U-turn operations are not allowed when driving on the highway. Therefore, these unreasonable combinations will waste developers' processing energy and reduce efficiency.

[0029] In view of this, the present application proposes a method, device, equipment and vehicle for whole vehicle hazard analysis and risk assessment. The scheme obtains functional use case information of the whole vehicle; performs safety correlation analysis on the functional use case information to obtain functional use case safety indication information; if the functional use case safety indication information indicates that the functional use case information is related to the safety of the whole vehicle, then the functional use case information is associated with the failure mode of the whole vehicle to obtain functional abnormality information; then, performs safety correlation analysis on the functional abnormality information to obtain functional abnormality safety indication information; if the functional abnormality safety indication information indicates that the functional abnormality information is related to the safety of the whole vehicle, then performs hazard analysis and risk assessment on the whole vehicle based on the functional abnormality information. The embodiments of the present application perform a safety relevance analysis on the functional use case information, and when the functional use case information is related to the safety of the whole vehicle, associates the functional use case information with the failure mode of the whole vehicle, thereby excluding the analysis and evaluation of the functional use case information that is not related to safety, thereby improving the analysis and evaluation efficiency. Furthermore, by performing a safety relevance analysis on the functional abnormality information, and when the functional abnormality information is related to the safety of the whole vehicle, a hazard analysis and risk assessment of the whole vehicle is performed based on the functional abnormality information, thereby excluding the analysis and evaluation of the functional abnormality information that is not related to safety, thereby further improving the analysis and evaluation efficiency of the hazard analysis and risk assessment of the whole vehicle.

[0030] The method provided in the embodiment of the present application can be applied to the electronic device provided in the embodiment of the present application, wherein the electronic device can be a terminal or a server.

[0031] The terminal may be a tablet computer, a laptop computer, a desktop computer, etc., but is not limited thereto.

[0032] The server can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content distribution networks, as well as big data and artificial intelligence platforms.

[0033] The following will describe in detail the implementation steps of a vehicle hazard analysis and risk assessment method provided by an embodiment of the present application in conjunction with the accompanying drawings.

[0034] Please refer to Figure 1 , Figure 1 It is a flowchart of a vehicle hazard analysis and risk assessment method provided by some embodiments of the present application; it should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in an order different from that shown here.

[0035] The method of the embodiment of the present application comprises the following steps: Step 101: Obtaining functional use case information of the entire vehicle; Step 102: Perform security correlation analysis on the functional use case information to obtain functional use case security indication information; Step 103: If the functional use case safety indication information indicates that the functional use case information is related to the safety of the entire vehicle, then the functional use case information is associated with the failure mode of the entire vehicle to obtain functional abnormality information; Step 104: Performing safety relevance analysis on the function abnormality information to obtain function abnormality safety indication information; Step 105: If the abnormal function safety indication information indicates that the abnormal function information is related to the safety of the entire vehicle, then a hazard analysis and risk assessment is performed on the entire vehicle based on the abnormal function information.

[0036] In steps 101 to 105 shown in the embodiment of the present application, by performing a safety relevance analysis on the functional use case information, and when the functional use case information is related to the safety of the whole vehicle, the functional use case information is associated with the failure mode of the whole vehicle, thereby excluding the analysis and evaluation of the functional use case information that is not related to safety, thereby improving the analysis and evaluation efficiency. Furthermore, by performing a safety relevance analysis on the functional abnormality information, and when the functional abnormality information is related to the safety of the whole vehicle, a hazard analysis and risk assessment of the whole vehicle is performed based on the functional abnormality information, thereby excluding the analysis and evaluation of the functional abnormality information that is not related to safety, thereby further improving the analysis and evaluation efficiency of the hazard analysis and risk assessment of the whole vehicle.

[0037] Before introducing the specific implementation methods of the present application, in order to facilitate a clearer understanding of the improvements made by the present application to the relevant technologies, it is necessary to give a further detailed introduction to the relevant technologies.

[0038] Please refer to Figure 2 , Figure 2 This is a flow chart of the traditional vehicle hazard analysis and risk assessment method. In the traditional vehicle hazard analysis and risk assessment method, the functions to be analyzed of the vehicle are subdivided into sub-functions, for example, the functions are divided into sub-function 1, sub-function 2, sub-function 3, and so on to sub-function n, etc.; then, failure mode analysis is introduced for each sub-function, that is, the failure mode is combined with the function / sub-function to obtain the functional abnormality; since the failure mode is divided into multiple failure modes, therefore, for each sub-function there will be a combination of failure mode 1, failure mode 2, and so on to failure mode n, which will be a huge combination; each failure mode will correspond to a functional abnormality, and then each functional abnormality will be associated with all the operating scenarios to obtain a hazard event. Among them, Figure 2The ellipsis in the text indicates that the corresponding associated part is omitted.

[0039] For associating each functional anomaly with all operating scenarios, there are the following examples: for functional anomaly 1 of failure mode 1 corresponding to sub-function 1, by associating with operating scenario 1, hazard event 1 is obtained; functional anomaly 1 is associated with operating scenario 2 to obtain hazard event 2; functional anomaly 1 is associated with operating scenario 3 to obtain hazard event 3, and so on, functional anomaly 1 is associated with operating scenario n to obtain hazard event n. After that, each hazard event needs to be classified and the safety goal determined. If the determined safety goals are similar, they can be merged into one safety goal, and the highest ASIL level is assigned to the merged safety goal.

[0040] The above are the conventional methods currently used for hazard analysis and risk assessment processes. It can be seen that the existing hazard analysis and risk assessment processes have problems such as low work efficiency and many useless / irrelevant operating scenarios. However, due to the previous architecture of the vehicle (distributed architecture), each function corresponds to an electronic control unit (ECU). Under this architecture, each ECU works independently. Therefore, when performing hazard analysis and risk assessment on the entire vehicle, it can only be done through functions and subdividing functions into sub-functions. Even if the operating scenarios can be optimized, it is difficult to effectively and significantly improve the efficiency of this work.

[0041] With the evolution of the automotive electrical and electronic architecture (EEA), the automotive electrical and electronic architecture has transitioned from the traditional distributed, "signal-oriented" electrical and electronic E / E architecture to the "service-oriented" SOA architecture. The essence of the SOA architecture is to modularize and standardize the originally dispersed ECUs and their corresponding basic software functions, decouple various application areas from each other, and redeploy them into a layered software architecture. The SOA architecture is service-oriented. Under the SOA architecture, different services can be provided to drivers through different software configurations. Therefore, this application proposes a more efficient vehicle hazard analysis and risk assessment method based on the SOA architecture.

[0042] The specific implementation methods of the above steps are introduced below.

[0043] In step 101, firstly, the functional use case information of the whole vehicle is obtained.

[0044] In the service-oriented architecture (SOA) methodology, functional use cases are an important concept that describes the specific implementation scenarios and steps of system functions. By analyzing these use cases, the functional requirements of the system can be refined, and the interaction boundaries and information exchange methods between the system and participants (such as users or other systems) can be clarified. System functional analysis under the SOA architecture involves a detailed step description of each use case, which shows how the system implements each use case together with the participants. In this way, the boundaries between the system and external systems or users can be clearly defined, and the way of information interaction can be clarified.

[0045] Optionally, the functional use cases of the whole vehicle can be designed and obtained according to the functional requirements of the vehicle. The functional use cases of the whole vehicle can also be extracted from the description of the system functions through the use case diagram and the activity diagram. This application does not limit the method of obtaining the functional use cases of the whole vehicle.

[0046] For example, the functional use case of the whole vehicle may be a low beam function use case. For example, the low beam function use case includes: manually turning on the low beam, manually turning off the low beam, automatically turning off the low beam, turning on the low beam fault reminder, and turning off the low beam fault reminder.

[0047] Specifically, the low beam function use case can be expressed in the form of: Use case 1 - Low beam manually switched on.

[0048]

[0049] Use case 2 - Low beam manually switched off.

[0050]

[0051] Use case 3 - Low beam automatically turns off.

[0052]

[0053] Use case 4 - Low beam fault reminder is on.

[0054]

[0055] Use case 5 - Low beam failure reminder turned off.

[0056]

[0057] It should be understood that the above is only a specific example of the functional use case of the whole vehicle in the embodiment of the present application. The functional use cases of the whole vehicle may also include functional use cases such as seat belt functional use cases, generator functional use cases, engine functional use cases, and functional use cases of various components of the power system, etc.

[0058] The embodiment provided in the present application obtains functional use case information of the whole vehicle, thereby providing data support for subsequent hazard analysis and risk assessment of the whole vehicle based on the functional use case information.

[0059] In step 102, security relevance analysis is performed on the functional use case information to obtain functional use case security indication information.

[0060] Safety relevance analysis of functional use cases refers to the process of in-depth research and evaluation of the safety aspects involved in a functional use case. This analysis aims to confirm whether the functional use case is relevant to the safety of the vehicle.

[0061] Optionally, Bayesian theorem can be used to analyze the probability of a safety incident caused by a specific functional use case, or statistical methods can be used to analyze the correlation between fault data and a specific functional use case, so as to obtain functional use case safety indication information. It should be understood that the functional use case safety indication information can indicate whether the current functional use case is related to the safety of the vehicle.

[0062] In addition, machine learning methods can be applied to predict the correlation between functional use case information and vehicle safety by building a neural network model.

[0063] For example, the low beam function use case can be expressed as follows through safety relevance analysis:

[0064] Among them, the functional use case security indication information can be represented by the characters "√" or "×", or by "0" or "1", where "1" can indicate that the corresponding functional use case is related to security; "0" can indicate that the corresponding functional use case is not related to security, and this application does not impose any restrictions on this.

[0065] It can be seen that for manual turning on of low beam, through analysis, it is considered that it is related to safety; for manual turning off of low beam and automatic turning off of low beam, through analysis, it is considered that it is related to safety; for turning on of low beam fault reminder and turning off of low beam fault reminder, through analysis, it is considered that it is not related to safety.

[0066] The method provided in the embodiment of the present application performs safety relevance analysis on functional use case information to obtain functional use case safety indication information, which can help engineers more accurately evaluate the potential risks that may exist in corresponding functional use cases, and also provide an analytical basis for vehicle hazard analysis and risk assessment.

[0067] In step 103, if the functional use case safety indication information indicates that the functional use case information is related to the safety of the entire vehicle, then the functional use case information is associated with the failure mode of the entire vehicle to obtain functional abnormality information.

[0068] It should be understood that since the hazard analysis and risk assessment of the vehicle is intended to identify and classify hazardous events caused by abnormal functional performance in related items; and to formulate safety goals and their corresponding ASIL levels to prevent hazardous events from occurring or reduce the degree of hazard, in order to avoid unreasonable risks. Therefore, further hazard analysis and risk assessment can be performed only on the functional use case information related to the safety of the entire vehicle. That is, when the functional use case information is related to the safety of the entire vehicle, the functional use case information is associated with the failure mode of the entire vehicle to obtain functional abnormality information. In this way, the number of functional use cases that need to be analyzed is reduced, the workload is reduced, and the analysis efficiency is improved.

[0069] The failure modes of the entire vehicle may include sudden loss of function, function output less than expected, function output greater than expected, unexpected function output, function output earlier than expected, function output later than expected, and function stuck.

[0070] Functional failure information corresponding to the functional use case information can be determined according to the failure mode information, and the functional failure information can be associated with the functional use case information to obtain functional abnormality information.

[0071] In the above example, the safety-related use cases for the low beam function include manual turning on of the low beam, manual turning off of the low beam, and automatic turning off of the low beam.

[0072] The functional failure information corresponding to the functional use case information related to the safety of the whole vehicle can be determined based on the failure mode information, and the functional failure information can be associated with the functional use case information (related to safety) to obtain the functional abnormality information. For example, the functional failure information corresponding to the manual opening of the low beam can be determined as the low beam cannot be lit based on the sudden loss of function (failure mode information), and the low beam cannot be lit is associated with the manual opening of the low beam to obtain the functional abnormality information: "The low beam is not lit, affecting the driver's field of vision of this vehicle."

[0073] Exemplarily, the functional fault information corresponding to the manual turning off / automatic turning off of the low beam can be determined as the inability to turn off the low beam based on the sudden loss of function (failure mode information). The inability to turn off the low beam is combined with the manual turning off / automatic turning off of the low beam to obtain the functional abnormality information of "power consumption". For example, the unexpected functional output (unexpected lighting of the low beam / unexpected turning off of the low beam) can be associated with the manual turning on of the low beam, the manual turning off of the low beam and the automatic turning off of the low beam, respectively, to obtain the functional abnormality information. For example, for the unexpected lighting of the low beam combined with the manual turning on of the low beam, the functional abnormality information of "power consumption" can be obtained. For the manual turning off of the low beam, the automatic turning off of the low beam combined with the unexpected turning off of the low beam, the functional abnormality information of "the low beam is not on, affecting the driver's field of vision of the vehicle" can be obtained.

[0074] In some embodiments of the present application, if the functional use case safety indication information indicates that the functional use case information is not relevant to the safety of the entire vehicle, further analysis of the functional use case information is terminated.

[0075] It should be understood that for functional use cases that are not related to the safety of the entire vehicle, since their execution results are irrelevant to the safety of the vehicle, they do not need to be analyzed in the vehicle hazard analysis and risk assessment.

[0076] For example, in the above example, the low beam function use cases that are not related to safety include low beam fault reminder on and low beam fault reminder off. Therefore, no further analysis can be performed on these two items, that is, no analysis can be performed on the association between the function use case information and the failure mode of the whole vehicle for these two items, so as to save computing resources and improve computing efficiency.

[0077] The method provided in the embodiment of the present application associates the functional use case information with the failure mode of the whole vehicle to obtain functional abnormality information when the functional use case safety indication information indicates that the functional use case information is related to the safety of the whole vehicle. It is possible to focus on the functional use case information related to the safety of the whole vehicle, and further associate these functional use cases with the failure mode, which can reduce the workload, optimize the analysis process, avoid redundant data, and improve the efficiency of analysis and calculation.

[0078] In step 104, a safety correlation analysis is performed on the function abnormality information to obtain function abnormality safety indication information.

[0079] Exemplarily, the functional abnormality information of "power consumption" and "dipped beam is not on, affecting the field of vision of the driver of this vehicle" is obtained through the above examples, and further safety analysis can be performed on the obtained functional abnormality information. Through calculation and analysis, it can be obtained that power consumption is not directly related to driving safety. Therefore, the functional abnormality safety indication information can be obtained as "irrelevant", "0" or "×", where "0" or "×" can represent irrelevant. The functional abnormality information of "dipped beam is not on, affecting the field of vision of the driver of this vehicle" is directly related to driving safety after analysis. Therefore, the functional abnormality safety indication information can be obtained as "relevant", "1" or "√", where "1" or "√" can represent relevant.

[0080] Optionally, the chi-square test method can be used to perform safety correlation analysis on the functional abnormality information, that is, a contingency table can be constructed between the functional abnormality information and the safety of the vehicle, and then the chi-square statistic is calculated and then compared with the chi-square distribution to determine whether there is a relationship between the functional abnormality information and the safety of the vehicle.

[0081] Optionally, the probability of occurrence of the functional abnormality information under vehicle unsafe conditions and the likelihood ratio can also be calculated through conditional probability and likelihood ratio to determine whether there is a relationship between the functional abnormality information and the safety of the vehicle. The present application does not limit the specific manner of performing safety correlation analysis on functional abnormality information.

[0082] It can be seen that after the safety correlation analysis of the functional use cases and functional anomalies, there is only one functional anomaly left in the low beam functional use case, that is, the low beam is not on, affecting the driver's field of vision. In the future, only this functional anomaly needs to be combined into a scene. Therefore, the efficiency of subsequent calculation and analysis can be improved.

[0083] In some embodiments of the present application, if the abnormal function safety indication information indicates that the abnormal function information is not relevant to the safety of the entire vehicle, further analysis of the abnormal function information is terminated.

[0084] It should be understood that for functional abnormality information that is not related to the safety of the entire vehicle, since the occurrence of functional abnormality is not related to the safety of the vehicle, it is not necessary to analyze it in the vehicle hazard analysis and risk assessment.

[0085] For example, in the above example, the functional abnormality information not related to safety is "power consumption". Therefore, this item may not be further analyzed, that is, the vehicle hazard analysis and risk assessment analysis may not be performed on this item, so as to save computing resources and improve computing efficiency.

[0086] In step 105 , if the abnormal function safety indication information indicates that the abnormal function information is related to the safety of the entire vehicle, a hazard analysis and risk assessment is performed on the entire vehicle based on the abnormal function information.

[0087] Exemplarily, the functional abnormality information obtained through the above example, "the low beam is not on, affecting the driver's field of vision", is directly related to driving safety. Therefore, based on this functional abnormality information, the hazard analysis and risk assessment of the entire vehicle can be carried out.

[0088] In some embodiments of the present application, hazard analysis and risk assessment of the entire vehicle are performed based on functional abnormality information. The vehicle's operating scenario information can be first obtained, and then the functional abnormality information is associated with the operating scenario information to obtain hazardous events, and key hazardous events are determined based on the hazardous events, wherein key hazardous events are used to characterize that the exposure probability or severity level of the hazardous events is higher than the corresponding preset value. Finally, hazard analysis and risk assessment of the entire vehicle are performed based on the hazardous events and key hazardous events.

[0089] In the process of associating the functional abnormality information with the operation scenario information, the correlation between the operation scenario information and the functional use case information can be first analyzed to obtain the associated scenario information, and the functional abnormality information can be associated with the associated scenario information to obtain the hazardous event.

[0090] Exemplarily, the vehicle's operating scenario information may include highways, urban roads, country roads, road adhesion coefficients, lighting environment, straight-line driving, curved driving, normal driving, and pedestrians / obstacles ahead during vehicle driving. For the low beam function use case, it can be concluded through calculation and analysis that it is irrelevant to the road adhesion condition, and it will not cause harm to driving when there is sufficient light. Therefore, the road adhesion condition and the operating scenario information with sufficient light can be eliminated, and the remaining scenario information is considered to be associated with the functional use case information. Therefore, these scenario information can be called associated scenario information. The associated scenario information can be associated with the functional abnormality information to obtain a hazardous event.

[0091] Exemplarily, the associated scene information is associated with the functional abnormality information, and the resulting hazardous events may be: on a city road at night, there are no lights, the low beam is not on / is unexpectedly extinguished, causing the driver to lose vision and crash into the curve guardrail / pedestrians when driving on a curve.

[0092] It should be understood that the above example is merely a combination under an association relationship. There may be multiple combinations according to different association scenario information and functional abnormality information, and this application will not elaborate on this.

[0093] In order to avoid problems such as insufficient scenario analysis and inadequate hazard event analysis, key hazard events can also be determined based on hazard events, where key hazard events are used to characterize that the exposure probability or severity level of the hazard event is higher than the corresponding preset value.

[0094] Generally, when conducting a vehicle hazard analysis and risk assessment, it is necessary to classify all identified hazardous events. For each hazardous event, the severity of the potential injury should be estimated based on the determined reasons. The severity can be assigned a severity level of S0, S1, S2 or S3 according to some standards. If the severity level of a hazardous event is S0, there is no need to assign an ASIL level.

[0095] For example, hazardous events with no injuries can be classified as S0; hazardous events with mild and moderate injuries can be classified as S1; hazardous events with severe and life-threatening injuries (with the possibility of survival) can be classified as S2; hazardous events with life-threatening injuries (uncertainty of survival) and fatal injuries can be classified as S3.

[0096] For example, a hazardous event classified as level S3 can be determined as a major hazardous event. That is, a hazardous event with a severity level higher than level S2 is determined as a major hazardous event, and finally a hazard analysis and risk assessment of the entire vehicle is performed based on the hazardous events and the major hazardous events.

[0097] In some embodiments of the present application, hazardous events and key hazardous events can be scored according to severity levels, exposure probability levels, and controllability levels; the vehicle safety integrity level can be graded according to the severity level scores, exposure probability level scores, and controllability level scores to obtain vehicle safety integrity level grading information; the vehicle safety goals are determined according to the grading information; and the vehicle safety goals are combined to obtain vehicle hazard analysis and risk assessment results.

[0098] The example above gives an example of severity rating.

[0099] The exposure probability level means that for each hazardous event, the exposure probability of each operating scenario can be estimated according to some standards. The exposure probability can be divided into probability levels of E0, E1, E2, E3 or E4. If the exposure probability level of a hazardous event is designated as E0, no ASIL level needs to be assigned.

[0100] For example, for operating scenarios that are impossible to occur, they can be classified as E0; for operating scenarios with a very low probability of occurrence, they can be classified as E1; for operating scenarios with a low probability of occurrence, they can be classified as E2; for operating scenarios with a medium probability of occurrence, they can be classified as E3; for operating scenarios with a high probability of occurrence, they can be classified as E4.

[0101] For the above-mentioned low beam function use case example, the urban / rural road and no street light scenarios can be identified as key hazard events for the maximum exposure probability E. The high-speed collision scenario can be identified as a key hazard event for the maximum severity level S.

[0102] For each hazardous event, the controllability of the hazardous event by the driver or other personnel in the operational scenario can be estimated according to some criteria. The controllability can be assigned a controllability level of C0, C1, C2 or C3.

[0103] For example, for controllable land, it can be classified as C0 level; for simply controllable land, it can be classified as C1 level; for generally controllable land, it can be classified as C2 level; for difficult to control or uncontrollable land, it can be classified as C3 level.

[0104] After that, the Automotive Safety Integrity Level (ASIL) can be graded based on the severity level score, exposure probability level score, and controllability level score. The ASIL level reflects the requirements of the electronic system in terms of functional safety. The ASIL level is divided into four levels: A, B, C, and D. Each level corresponds to different safety requirements and risk levels, with ASIL A being the lowest safety integrity level and ASIL D being the highest. In addition to these four ASIL levels, the QM level indicates that quality management, that is, functional safety, is not required.

[0105] For example, ASIL A: The lowest safety requirement, applicable to systems with less impact on safety. The system will not have a serious impact on vehicle safety when a failure occurs. For example, an ordinary vehicle lighting system may be rated as ASIL A. ASIL B: Higher safety requirements, applicable to systems that have a certain impact on safety. Failure may cause safety issues, but usually will not lead to catastrophic consequences. For example, the part of the vehicle audio system with emergency alarm function may be rated as ASIL B. ASIL C: Higher safety requirements, applicable to systems that have a significant impact on vehicle safety. Failure may cause more serious safety incidents. For example, an electric brake control system may be rated as ASIL C. ASIL D: The highest safety requirements, applicable to systems that are critical to vehicle safety. Failure may result in catastrophic safety consequences and pose a major threat to occupant safety. For example, airbags, anti-lock braking systems, and power steering systems must reach ASIL D level.

[0106] For the above-mentioned use case example of the low beam function, the hazard event can be: on a city road at night, there is no light, the low beam is not on / unexpectedly extinguished, causing the driver to lose his field of vision, and when driving on a curve, hit the curve guardrail / pedestrian, where the severity level is S3, the exposure probability level is E3, and the controllability level is C2, and ASIL classification is performed to obtain ASIL B; the hazard event can be on a country road at night, there is no light, the low beam is not on / unexpectedly extinguished, causing the driver to lose his field of vision, and when driving in a straight line, hit the pedestrian in front, where the severity level is S3, the exposure probability level is E2, and the controllability level is C3, and ASIL classification is performed to obtain ASIL B; the hazard event can be on a city road at night, there is no light, the low beam is not on / unexpectedly extinguished, causing the driver to rear-end the vehicle in front, where the severity level is S1, the exposure probability level is E3, and the controllability level is C0, and ASIL classification is performed to obtain QM.

[0107] Afterwards, the vehicle safety goals are determined based on the classification information; the vehicle safety goals are combined to obtain the vehicle hazard analysis and risk assessment results.

[0108] For example, for ASIL B level, the safety goal is to avoid unexpected extinguishing / failure to light up of the low beam; for QM level, the safety goal is to avoid unexpected extinguishing / failure to light up of the low beam. After that, similar safety goals can be merged into one safety goal, and the highest ASIL level is assigned to the merged safety goal. Therefore, the merged safety goal is: ASIL B, avoid unexpected extinguishing / failure to light up of the low beam.

[0109] This realizes the hazard analysis and risk assessment method for the entire vehicle.

[0110] Please refer to Figure 3 , Figure 3 It is another flow chart of the vehicle hazard analysis and risk assessment method provided by some embodiments of the present application. The vehicle hazard analysis and risk assessment method provided by some embodiments of the present application is based on the SOA architecture, and uses the functional use cases under the SOA architecture methodology to split the functional use cases (for example, the low beam functional use case) into sub-use cases, including use case 1 (for example, the low beam is manually turned on), use case 2 (for example, the low beam is manually turned off), and so on, until use case n (for example, the low beam fault reminder is turned off). Afterwards, the sub-use cases are analyzed and calculated for safety relevance, and safety-related sub-use cases (for example: the low beam is manually turned on / the low beam is manually turned off) and safety-irrelevant (safety-irrelevant) sub-use cases (for example: the low beam fault reminder is turned off) are obtained. For sub-use cases that are not related to safety, further analysis and calculation can be terminated. For sub-use cases that are related to safety, they can be further associated with failure modes, and functional anomalies after the sub-use cases and failure modes are associated are analyzed. Safety-related analysis and calculation of functional anomalies are performed to obtain functional anomaly information related to safety (for example, the low beam is not on, affecting the driver's field of vision) and functional anomaly information that is not related to safety (for example, power consumption). For functional anomaly information that is not related to safety, further analysis and calculation can be terminated. For functional anomaly information that is related to safety, it can be further associated with multiple operating scenarios to obtain multiple hazardous events, and multiple hazardous events are classified separately to determine safety goals, merge safety goals, and obtain vehicle hazard analysis and risk assessment results. At the same time, in the process of associating functional anomaly information with multiple operating scenarios, the E maximum operating scenario and the S maximum operating scenario will be added for analysis to determine safety goals as one of the analysis elements of the vehicle hazard analysis and risk assessment results.

[0111] The embodiments provided in this application calculate the safety relevance of functional anomalies and operating scenarios. For example, if the low beam is turned on unexpectedly, this functional anomaly will not affect safety and does not need to be included in the subsequent analysis. Another example is that for the low beam function, if the ambient brightness is high enough, it will not cause harm. Therefore, when selecting the operating scenario, the scenario with sufficient brightness information does not need to be introduced. Subsequently, the key hazard events with the maximum exposure probability E and the maximum severity level S are introduced, that is, the operating scenarios with the most frequent / longest functional operation or the greatest personal injury caused by functional anomalies are analyzed, which can improve the comprehensiveness of the analysis and make the analysis complete. It can also reduce the association between unnecessary functional anomalies and unnecessary operating scenarios, reduce the total number of hazard events, thereby improving computing efficiency, saving computing resources, and quickly deriving safety goals and their corresponding ASIL levels.

[0112] The following is a detailed introduction and description of the solution of the embodiment of the present invention in conjunction with a specific application example.

[0113] In the embodiment of the present application, a vehicle hazard analysis and risk assessment method is provided, which is used to evaluate the functional safety of road vehicles. Specifically, the method is based on the SOA architecture and can be analyzed using functional use cases under the SOA architecture methodology. Figure 4 , Figure 4 It is another flow chart of the vehicle hazard analysis and risk assessment method provided by some embodiments of the present application. When performing vehicle hazard analysis and risk assessment, the function to be analyzed can be confirmed first, and then the use case of the function to be analyzed can be confirmed, and further calculation can be made as to whether the use case of the function to be analyzed is related to the safety of the vehicle. If the analysis result indicates that the use case of the function to be analyzed is not related to the safety of the vehicle, the analysis can be terminated; if the analysis result indicates that the use case of the function to be analyzed is related to the safety of the vehicle, the failure mode is combined with the function use case to obtain the functional abnormality, and further analysis is performed as to whether the functional abnormality is related to the safety of the vehicle. If the analysis result indicates that the functional abnormality is not related to the safety of the vehicle, the analysis can be terminated; if the analysis result indicates that the functional abnormality is related to the safety of the vehicle, the functional abnormality is combined with the operation scenario, and only the scenario related to the use case is selected to obtain the hazard event, and the maximum exposure probability E and the maximum severity level S of the key hazard events are supplemented for analysis, and the hazard events are scored as S, E and C, and then ASIL level classification is performed, safety goals are determined, and the safety goals are combined to obtain the vehicle hazard analysis and risk assessment results.

[0114] The above is an introduction to the embodiment of the vehicle hazard analysis and risk assessment method provided in this application.

[0115] The implementation of the vehicle hazard analysis and risk assessment device provided in the embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0116] For the vehicle hazard analysis and risk assessment method provided in the above embodiment, the present application embodiment also provides a vehicle hazard analysis and risk assessment device for implementing the above method, such as Figure 5 As shown, Figure 5 This is a schematic block diagram of the modules of the vehicle hazard analysis and risk assessment device according to an embodiment of the present application. The vehicle hazard analysis and risk assessment device 500 includes: The acquisition module 501 is used to acquire the functional use case information of the whole vehicle; The first analysis module 502 is used to perform security correlation analysis on the functional use case information to obtain functional use case security indication information; The association module 503 is used to associate the functional use case information with the failure mode of the whole vehicle to obtain functional abnormality information if the functional use case safety indication information indicates that the functional use case information is related to the safety of the whole vehicle; The second analysis module 504 is used to perform safety correlation analysis on the function abnormality information to obtain function abnormality safety indication information; The analysis and evaluation module 505 is used to perform hazard analysis and risk evaluation on the whole vehicle based on the functional abnormality information if the functional abnormality safety indication information indicates that the functional abnormality information is related to the safety of the whole vehicle.

[0117] It can be understood that the contents of the above method embodiments are all applicable to the present device embodiments, the functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0118] like Figure 6 As shown, the embodiment of the present application also provides an electronic device, the electronic device 600 includes a memory 601, one or more processors 602 ( Figure 6 Only one is shown) and a computer program stored in the memory 601 and executable on the processor 602. Among them: the memory 601 is used to store software programs and units, and the processor 602 executes various functional applications and data processing by running the software programs and units stored in the memory 601 to obtain the resources corresponding to the above-mentioned preset events. Optionally, the processor 602 implements the above-mentioned vehicle hazard analysis and risk assessment method by running the above-mentioned computer program stored in the memory 601.

[0119] The memory 601, as a non-transitory computer-readable medium, can be used to store non-transitory software programs and non-transitory computer executable programs. In addition, the memory 601 may include a high-speed random access memory, and may also include a non-transitory memory, such as at least one disk storage device, a flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory 601 may optionally include a memory remotely arranged relative to the processor, and these remote memories may be connected to the processor 602 via a network.

[0120] It can be understood that the contents of the above method embodiments are all applicable to the electronic device embodiment, the functions specifically implemented by the electronic device embodiment are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0121] The embodiment of the present application also provides a vehicle, which performs hazard analysis and risk assessment through the above-mentioned vehicle hazard analysis and risk assessment method, device or the above-mentioned electronic device. Specifically, the vehicle can be a private car, such as a sedan, SUV, MPV or pickup truck. The vehicle can also be an operating vehicle, such as a van, bus, small truck or large trailer. The vehicle can be a gasoline vehicle or a new energy vehicle. When the vehicle is a new energy vehicle, it can be a hybrid vehicle or a pure electric vehicle.

[0122] It can be understood that the contents of the above method embodiments are all applicable to the present vehicle embodiment, the functions specifically implemented by the present vehicle embodiment are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0123] An embodiment of the present application also provides a computer program product, which includes a computer program. When the computer program is executed by one or more processors, it can implement the steps of the above-mentioned vehicle hazard analysis and risk assessment method.

[0124] It can be understood that the contents of the above method embodiments are all applicable to the present computer program product, the functions specifically implemented by the present computer program product embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0125] The vehicle hazard analysis and risk assessment method, device, electronic device, vehicle and computer program product provided in the embodiments of the present application perform safety relevance analysis on functional use case information, and when the functional use case information is related to the safety of the whole vehicle, associate the functional use case information with the failure mode of the whole vehicle, thereby eliminating the analysis and evaluation work of functional use case information that is not related to safety, thereby improving the analysis and evaluation efficiency. Furthermore, by performing safety relevance analysis on functional abnormality information, and when the functional abnormality information is related to the safety of the whole vehicle, perform hazard analysis and risk assessment on the whole vehicle based on the functional abnormality information, thereby eliminating the analysis and evaluation work of functional abnormality information that is not related to safety, thereby further improving the analysis and evaluation efficiency of the vehicle hazard analysis and risk assessment.

[0126] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0127] Although specific embodiments are described herein, those of ordinary skill in the art will recognize that many other modifications or alternative embodiments are also within the scope of the present disclosure. For example, any of the functions and / or processing capabilities described in conjunction with a particular device or component may be performed by any other device or component. In addition, although various exemplary implementations and architectures have been described according to embodiments of the present disclosure, those of ordinary skill in the art will recognize that many other modifications to the exemplary implementations and architectures herein are also within the scope of the present disclosure.

[0128] Some aspects of the present disclosure are described above with reference to the block diagram and flow chart of the system, method, system and / or computer program product according to exemplary embodiments.It should be understood that the combination of one or more blocks in the block diagram and flow chart and the blocks in the block diagram and flow chart can be realized by executing computer executable program instructions respectively.Equally, according to some embodiments, some blocks in the block diagram and flow chart may not need to be executed in the order shown, or may not need to be executed in full.In addition, additional components and / or operations beyond those components and / or operations shown in the blocks in the block diagram and flow chart may be present in certain embodiments.

[0129] Therefore, the blocks in the block diagrams and flow charts support the combination of devices for performing the specified functions, the combination of elements or steps for performing the specified functions, and the program instruction devices for performing the specified functions. It should also be understood that each block in the block diagrams and flow charts and the combination of blocks in the block diagrams and flow charts can be implemented by a special-purpose hardware computer system or a combination of special-purpose hardware and computer instructions that performs a specific function, element or step.

[0130] The program modules, applications, etc. described herein may include one or more software components, including, for example, software objects, methods, data structures, etc. Each such software component may include computer-executable instructions that, in response to execution, cause at least a portion of the functionality described herein (e.g., one or more operations of the illustrative methods described herein) to be performed.

[0131] Software components can be encoded with any of various programming languages. An exemplary programming language can be a low-level programming language, such as an assembly language associated with a specific hardware architecture and / or an operating system platform. The software component comprising assembly language instructions may need to be converted to executable machine code by an assembler before being executed by hardware architecture and / or platform. Another exemplary programming language can be a higher-level programming language, which can be transplanted across multiple architectures. The software component comprising a higher-level programming language may need to be converted to an intermediate representation by an interpreter or a compiler before execution. Other examples of programming languages ​​include but are not limited to macro languages, shells or command languages, job control languages, scripting languages, database queries or search languages ​​or report writing languages. In one or more exemplary embodiments, the software component comprising the instruction of one of the above-mentioned programming language examples can be directly executed by an operating system or other software components, without first being converted into another form.

[0132] Software components may be stored as files or other data storage structures. Software components of similar type or related functions may be stored together, such as in a specific directory, folder, or library. Software components may be static (e.g., preset or fixed) or dynamic (e.g., created or modified at execution time).

[0133] The embodiments of the present application are described in detail above in conjunction with the accompanying drawings, but the present application is not limited to the above embodiments, and various changes can be made within the knowledge scope of ordinary technicians in the relevant technical field without departing from the purpose of the present application.

Claims

1. A vehicle hazard analysis and risk assessment method, characterized in that: The following steps are involved: Obtain functional use case information of the entire vehicle; Performing security relevance analysis on the functional use case information to obtain functional use case security indication information; If the functional use case safety indication information indicates that the functional use case information is related to the safety of the entire vehicle, then associating the functional use case information with the failure mode of the entire vehicle to obtain functional abnormality information; Performing safety relevance analysis on the functional abnormality information to obtain functional abnormality safety indication information; If the abnormal function safety indication information indicates that the abnormal function information is related to the safety of the entire vehicle, then a hazard analysis and risk assessment is performed on the entire vehicle based on the abnormal function information.

2. The vehicle hazard analysis and risk assessment method according to claim 1 is characterized in that: The hazard analysis and risk assessment of the whole vehicle based on the functional abnormality information includes: Obtain vehicle operation scenario information; Associating the function abnormality information with the operation scenario information to obtain a hazard event; Determine a key hazard event based on the hazard event, wherein the key hazard event is used to characterize that the exposure probability or severity level of the hazard event is higher than a corresponding preset value; Conduct hazard analysis and risk assessment on the entire vehicle based on the hazardous events and the key hazardous events.

3. The vehicle hazard analysis and risk assessment method according to claim 2 is characterized in that: The associating the function abnormality information with the operation scenario information to obtain a hazard event includes: Analyze the correlation between the operation scenario information and the functional use case information to obtain correlation scenario information; The functional abnormality information is associated with the associated scene information to obtain a hazardous event.

4. The vehicle hazard analysis and risk assessment method according to claim 2 is characterized in that: The hazard analysis and risk assessment of the whole vehicle according to the hazard events and the key hazard events includes: Score the severity level, exposure probability level and controllability level of the hazardous events and the key hazardous events; Performing vehicle safety integrity level grading according to the severity level score, the exposure probability level score, and the controllability level score to obtain vehicle safety integrity level grading information; Determining a vehicle safety target based on the classification information; The vehicle safety objectives are combined to obtain the vehicle hazard analysis and risk assessment results.

5. The vehicle hazard analysis and risk assessment method according to claim 1, characterized in that: The function use case information is associated with the failure mode of the whole vehicle to obtain the function abnormality information, including: Obtain vehicle failure mode information; Determine functional failure information corresponding to the functional use case information according to the failure mode information; The functional failure information is associated with the functional use case information to obtain the functional abnormality information.

6. The vehicle hazard analysis and risk assessment method according to claim 1, characterized in that: After performing safety correlation analysis on the functional use case information to obtain functional use case safety indication information, the vehicle hazard analysis and risk assessment method further includes: If the functional use case safety indication information indicates that the functional use case information is not relevant to the safety of the entire vehicle, further analysis of the functional use case information is terminated.

7. The vehicle hazard analysis and risk assessment method according to claim 1, characterized in that: After performing safety correlation analysis on the function abnormality information to obtain function abnormality safety indication information, the vehicle hazard analysis and risk assessment method further includes: If the abnormal function safety indication information indicates that the abnormal function information is not relevant to the safety of the entire vehicle, further analysis of the abnormal function information is terminated.

8. A vehicle hazard analysis and risk assessment device, characterized in that: The device comprises: The acquisition module is used to obtain the functional use case information of the whole vehicle; A first analysis module, configured to perform security correlation analysis on the functional use case information to obtain functional use case security indication information; an associating module, configured to associate the functional use case information with a failure mode of the whole vehicle to obtain functional abnormality information if the functional use case safety indication information indicates that the functional use case information is related to the safety of the whole vehicle; A second analysis module is used to perform safety correlation analysis on the function abnormality information to obtain function abnormality safety indication information; The analysis and evaluation module is used to perform hazard analysis and risk evaluation on the whole vehicle based on the functional abnormality information if the functional abnormality safety indication information indicates that the functional abnormality information is related to the safety of the whole vehicle.

9. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the vehicle hazard analysis and risk assessment method as described in any one of claims 1 to 7 when executing the computer program.

10. A vehicle, characterized in that: The vehicle performs whole vehicle hazard analysis and risk assessment through the whole vehicle hazard analysis and risk assessment method as described in any one of claims 1 to 7, the whole vehicle hazard analysis and risk assessment device as described in claim 8, or the electronic device as described in claim 9.

Images