Vehicle safety fusion hazard analysis method and device, electronic equipment and medium

Abstract

The invention discloses a vehicle safety fusion hazard analysis method and device, electronic equipment and a medium, and the method comprises the steps: carrying out the hazard and operability analysis of each vehicle function operation scene, and obtaining a hazard analysis result corresponding to each safety analysis type in each vehicle function operation scene; performing hazard fusion analysis on the hazard analysis result corresponding to each safety analysis type in each vehicle function operation scene to obtain a hazard fusion analysis result corresponding to each vehicle function operation scene, and performing hazard analysis and risk assessment according to the hazard fusion analysis result of each vehicle function operation scene to obtain a risk assessment result corresponding to each vehicle function operation scene. And determining a hazard triggering condition corresponding to each vehicle function operation scene and a hazard processing scheme corresponding to the hazard triggering condition. The method can achieve vehicle safety fusion hazard analysis, improves the comprehensiveness of vehicle safety hazard analysis, improves the reliability and safety of an automobile intelligent driving system, and can be widely applied to the technical field of automobiles.

Description

Technical Field

[0001] The present invention relates to the field of automobile technology, and in particular to a vehicle safety fusion hazard analysis method, device, electronic equipment and medium. Background Art

[0002] With the rapid development of intelligent connected vehicles and autonomous vehicles, the design of high-reliability and safety automotive electronic systems has attracted increasing attention from all parties. Among them, functional safety, expected functional safety, network security and data security are indispensable parts in the design of autonomous vehicle systems.

[0003] The current automotive industry usually analyzes safety risks and designs safety measures from a single safety perspective. It does not use systematic thinking to conduct safety analysis at the vehicle level. The hazard analysis of vehicle functions is not comprehensive enough, and safety measures are prone to over-design. Summary of the invention

[0004] The main purpose of the embodiments of the present application is to propose a method that can realize vehicle safety fusion hazard analysis, improve the comprehensiveness of vehicle safety hazard analysis, and enhance the reliability and safety of the automobile intelligent driving system.

[0005] On the one hand, an embodiment of the present application proposes a vehicle safety fusion hazard analysis method, the method comprising the following steps:

[0006] Obtain multiple vehicle function operation scenarios;

[0007] Acquire multiple safety analysis types, perform hazard and operability analysis on each of the vehicle function operation scenarios, and obtain hazard analysis results corresponding to each of the safety analysis types in each of the vehicle function operation scenarios;

[0008] Performing hazard fusion analysis on the hazard analysis results corresponding to each of the safety analysis types under each of the vehicle function operation scenarios to obtain hazard fusion analysis results corresponding to each of the vehicle function operation scenarios;

[0009] According to the hazard fusion analysis results of each of the vehicle function operation scenarios, hazard analysis and risk assessment are performed to determine the hazard triggering conditions corresponding to each of the vehicle function operation scenarios and the hazard handling solutions corresponding to the hazard triggering conditions.

[0010] In some embodiments, the safety analysis types include functional safety, expected functional safety, network security and data security. The acquiring of multiple safety analysis types, performing hazard and operability analysis on each of the vehicle function operation scenarios, and obtaining hazard analysis results corresponding to each of the safety analysis types in each of the vehicle function operation scenarios specifically include:

[0011] Obtaining the design operating conditions of the vehicle function operating scenario;

[0012] Obtaining a first related item definition corresponding to the functional safety, identifying a first hazard trigger source and a first hazard trigger consequence corresponding to the functional safety according to the first related item definition and the design operating condition, and obtaining a first hazard analysis result;

[0013] Obtaining a second related item definition corresponding to the expected functional safety, identifying a second hazard trigger source and a second hazard trigger consequence corresponding to the expected functional safety according to the second related item definition and the design operating condition, and obtaining a second hazard analysis result;

[0014] Obtaining a third related item definition corresponding to the network security, identifying a third hazard trigger source and a third hazard trigger consequence corresponding to the network security according to the third related item definition and the design operation condition, and obtaining a third hazard analysis result;

[0015] Obtain a fourth related item definition corresponding to the data security, identify a fourth hazard trigger source and a fourth hazard trigger consequence corresponding to the data security according to the fourth related item definition and the designed operating conditions, and obtain a fourth hazard analysis result.

[0016] In some embodiments, performing hazard fusion analysis on the hazard analysis results corresponding to each of the safety analysis types under each of the vehicle function operation scenarios to obtain hazard fusion analysis results corresponding to each of the vehicle function operation scenarios specifically includes:

[0017] Performing a system function hazard fusion analysis on the first hazard analysis result and the second hazard analysis result to generate a full matrix of functional safety risk events, and determining a first hazard fusion analysis result according to the full matrix of functional safety risk events; the system function hazard fusion analysis at least includes a hardware function failure hazard analysis, a software system function failure hazard analysis, a sensor performance limitation hazard analysis, an algorithm performance limitation hazard analysis, and a driving misoperation hazard analysis;

[0018] The third hazard analysis result and the fourth hazard analysis result are subjected to information function hazard fusion analysis to generate a full matrix of information security risk events; and the second hazard fusion analysis result is determined based on the full matrix of information security risk events; the information function hazard fusion analysis includes at least information management anomaly hazard analysis and data anomaly hazard analysis.

[0019] In some embodiments, the hazard analysis and risk assessment are performed according to the hazard fusion analysis results of each vehicle function operation scenario to determine the hazard triggering conditions corresponding to each vehicle function operation scenario and the hazard handling scheme corresponding to the hazard triggering conditions, specifically including:

[0020] Determine functional safety goals based on the first hazard fusion analysis results;

[0021] Determining information security goals according to the second hazard fusion analysis results;

[0022] Determining the hazard triggering condition according to the functional safety goal and the information security goal;

[0023] According to the hazard triggering condition and the designed operating condition, the corresponding hazard handling plan is determined.

[0024] In some embodiments, determining the hazard triggering condition according to the functional safety goal and the information security goal specifically includes:

[0025] According to the functional safety objectives, determining corresponding functional safety risk triggering conditions;

[0026] According to the information security objectives, determine corresponding information security risk triggering conditions;

[0027] According to the functional safety risk triggering condition and the information security risk triggering condition, conditions are integrated to generate the hazard triggering condition.

[0028] In some embodiments, obtaining a first related item definition corresponding to the functional safety, identifying a first hazard trigger source and a first hazard trigger consequence corresponding to the functional safety according to the first related item definition and the design operating condition, and obtaining a first hazard analysis result specifically includes:

[0029] According to the first related item definition, determining functional safety related items and functional safety keywords;

[0030] A functional hazard analysis is performed through a hazard and operability analysis system according to the functional safety related items, the functional safety keywords and the designed operating conditions to determine the first hazard triggering source and the first hazard triggering consequence corresponding to the first hazard triggering source.

[0031] In some embodiments, obtaining a third related item definition corresponding to the network security, identifying a third hazard trigger source and a third hazard trigger consequence corresponding to the network security according to the third related item definition and the designed operating condition, and obtaining a third hazard analysis result specifically includes:

[0032] According to the third related item definition, determining network security related items and network security keywords;

[0033] According to the network security related items, the network security keywords and the designed operating conditions, a network hazard analysis is performed using a security threat model to determine the third hazard trigger source and the third hazard trigger consequence corresponding to the third hazard trigger source.

[0034] On the other hand, an embodiment of the present application provides a vehicle safety fusion hazard analysis device, the device comprising:

[0035] The first module is used to obtain multiple vehicle function operation scenarios;

[0036] The second module is used to obtain multiple safety analysis types, perform hazard and operability analysis on each of the vehicle function operation scenarios, and obtain hazard analysis results corresponding to each of the safety analysis types under each of the vehicle function operation scenarios;

[0037] The third module is used to perform hazard fusion analysis on the hazard analysis results corresponding to each of the safety analysis types under each of the vehicle function operation scenarios to obtain hazard fusion analysis results corresponding to each of the vehicle function operation scenarios;

[0038] The fourth module is used to perform hazard analysis and risk assessment based on the hazard fusion analysis results of each vehicle function operation scenario, and determine the hazard trigger conditions corresponding to each vehicle function operation scenario and the hazard handling solutions corresponding to the hazard trigger conditions.

[0039] On the other hand, an embodiment of the present application proposes an electronic device, which includes a memory and a processor, wherein the memory stores a computer program, and the processor implements the vehicle safety fusion hazard analysis method described above when executing the computer program.

[0040] On the other hand, an embodiment of the present application proposes a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the vehicle safety fusion hazard analysis method described above is implemented.

[0041] The embodiments of the present application include at least the following beneficial effects: the present application provides a vehicle safety fusion hazard analysis method, device, electronic device and medium, which performs hazard and operability analysis on each vehicle function operation scenario to obtain the hazard analysis results corresponding to each safety analysis type under each vehicle function operation scenario, performs hazard fusion analysis on the hazard analysis results corresponding to each safety analysis type under each vehicle function operation scenario, obtains the hazard fusion analysis results corresponding to each vehicle function operation scenario, performs hazard analysis and risk assessment based on the hazard fusion analysis results of each vehicle function operation scenario, and determines the hazard triggering conditions corresponding to each vehicle function operation scenario and the hazard handling scheme corresponding to the hazard triggering conditions. The present application can use systematic thinking to perform safety analysis on the vehicle from the vehicle level, integrate the hazard analysis results corresponding to multiple safety analysis types, realize vehicle safety fusion hazard analysis, improve the comprehensiveness of vehicle safety hazard analysis, and enhance the reliability and safety of the automobile intelligent driving system. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 is a flow chart of a vehicle safety fusion hazard analysis method provided in an embodiment of the present application;

[0043] Figure 2 is a flowchart of step S102 in an embodiment of the present application;

[0044] Figure 3 is a flowchart of step S202 in an embodiment of the present application;

[0045] Figure 4 is a flowchart of step S203 in an embodiment of the present application;

[0046] Figure 5 is a flowchart of step S103 in an embodiment of the present application;

[0047] Figure 6 It is a schematic diagram of the full matrix of functional safety risk events in an embodiment of the present application;

[0048] Figure 7 is a flowchart of step S104 in an embodiment of the present application;

[0049] Figure 8 is a flowchart of step S403 in an embodiment of the present application;

[0050] Fig. 9 It is a structural schematic diagram of a vehicle safety fusion hazard analysis device provided in an embodiment of the present application;

[0051] Fig.10 It is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0052] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0053] It should be noted that, although the functional modules are divided in the device schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first", "second", etc. in the specification, claims and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0054] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0055] First, some nouns involved in this application are analyzed:

[0056] 1) ODC: Operational Design Condition, which is a general term for various conditions applicable to the functional operation of an automated driving system when it is designed, including the design operating range, vehicle status, driver and passenger status, traffic conditions, operating conditions, and other necessary conditions.

[0057] 2)HAZOP: Hazard and Operability Study is a formal structured method that comprehensively and systematically studies every component in the system, including hazards and operability problems caused by the deviation of important parameters from the specified design conditions.

[0058] 3) STRIDE model: The STRIDE model is a threat modeling method designed to identify and assess computer security threats. The model consists of six letters, each of which represents a security threat category: S (Spoofing): Disguise, refers to disguising as an object or person, violating the user's authentication information, for example, by disguising as someone else to operate; T (Tampering): Tampering, refers to unauthorized modification of systems, data or code, and unauthorized changes to information in storage or transmission; R (Repudiation): Repudiation, refers to a transaction party denying that a transaction has been conducted; I (Information disclosure): Information disclosure refers to sensitive data being obtained by unauthorized entities; D (Denial of service): Denial of service, refers to making the service unavailable. E (Elevation of privilege): Privilege escalation, refers to the attacker elevating his or her privileges in the system.

[0059] The present application can be used in many general or special computer system environments or configurations. For example: car terminals, server computers, tablet devices, multi-processor systems, microprocessor-based systems, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0060] It should be noted that in each specific implementation of the present application, when it comes to the need to perform relevant processing based on data related to user identity or characteristics such as user information, user behavior data, user historical data, and user location information, the user's permission or consent will be obtained first, and the collection, use, and processing of these data will comply with relevant laws, regulations, and standards. In addition, when the embodiment of the present application needs to obtain the user's sensitive personal information, the user's separate permission or consent will be obtained through a pop-up window or by jumping to a confirmation page. After clearly obtaining the user's separate permission or consent, the necessary user-related data for the normal operation of the embodiment of the present application will be obtained.

[0061] Reference Figure 1 , Figure 1This is an optional flow chart of a vehicle safety fusion hazard analysis method provided in an embodiment of the present application. The method may include but is not limited to steps S101 to S104:

[0062] Step S101, obtaining multiple vehicle function operation scenarios;

[0063] Step S102, obtaining multiple safety analysis types, performing hazard and operability analysis on each vehicle function operation scenario, and obtaining hazard analysis results corresponding to each safety analysis type in each vehicle function operation scenario;

[0064] Step S103, performing hazard fusion analysis on the hazard analysis results corresponding to each safety analysis type under each vehicle function operation scenario to obtain the hazard fusion analysis results corresponding to each vehicle function operation scenario;

[0065] Step S104, performing hazard analysis and risk assessment based on the hazard fusion analysis results of each vehicle function operation scenario, and determining the hazard triggering conditions corresponding to each vehicle function operation scenario and the hazard handling solutions corresponding to the hazard triggering conditions.

[0066] In some embodiments, the safety analysis types include functional safety, expected functional safety, network security, and data security. Figure 2 , Figure 2 This is an optional flowchart of step S102 in the embodiment of the present application. Step S102 may include but is not limited to steps S201 to S205:

[0067] Step S201, obtaining the design operation conditions of the vehicle function operation scenario;

[0068] Step S202, obtaining a first related item definition corresponding to the functional safety, identifying a first hazard trigger source and a first hazard trigger consequence corresponding to the functional safety according to the first related item definition and the design operating conditions, and obtaining a first hazard analysis result;

[0069] Step S203, obtaining a second related item definition corresponding to the expected functional safety, identifying a second hazard trigger source and a second hazard trigger consequence corresponding to the expected functional safety according to the second related item definition and the design operating conditions, and obtaining a second hazard analysis result;

[0070] Step S204, obtaining a third related item definition corresponding to network security, identifying a third hazard trigger source and a third hazard trigger consequence corresponding to network security according to the third related item definition and the designed operating conditions, and obtaining a third hazard analysis result;

[0071] Step S205, obtaining a fourth related item definition corresponding to data security, identifying a fourth hazard trigger source and a fourth hazard trigger consequence corresponding to data security according to the fourth related item definition and the designed operating conditions, and obtaining a fourth hazard analysis result.

[0072] In some embodiments, from the perspective of functional safety, it is possible to analyze and solve the hazards to the whole vehicle caused by the failure of the vehicle's electronic and electrical systems; from the perspective of expected functional safety, it is possible to analyze and solve the hazards to the whole vehicle caused by insufficient performance of the functions or misuse of the vehicles; from the perspective of network security, it is possible to analyze and solve the hazards to the whole vehicle caused by network attacks on the vehicle's electronic and electrical systems, components or functions; from the perspective of data security, it is possible to analyze and solve the hazards to the whole vehicle caused by abnormal vehicle data.

[0073] In some embodiments, based on the design operating conditions (ODC, Operational Design Condition) of the vehicle function operation scenarios, various safety hazard analysis methods are used to identify hazardous events (such as the above-mentioned hazard trigger sources) caused by abnormalities such as functional safety, expected functional safety, network security, and data security in the vehicle function operation scenarios, and evaluate the risk results of the entire vehicle caused by these hazardous events (such as the above-mentioned hazard trigger consequences).

[0074] In some embodiments, optionally, a hazard analysis of the vehicle is performed from the perspective of functional safety and expected functional safety in the vehicle function operation scenario through the HAZOP method, and vehicle-wide hazard events caused by network security and data security are identified in the vehicle function operation scenario through the STRIDE model.

[0075] In some embodiments, reference Figure 3 , Figure 3 This is an optional flowchart of step S202 in the embodiment of the present application. Step S202 may include but is not limited to steps S301 to S302:

[0076] Step S301, determining functional safety related items and functional safety keywords according to the first related item definition;

[0077] Step S302 , performing a functional hazard analysis through a hazard and operability analysis system according to functional safety related items, functional safety keywords and design operating conditions, and determining a first hazard triggering source and a first hazard triggering consequence corresponding to the first hazard triggering source.

[0078] In some embodiments, optionally, HAZOP analysis is used to identify and evaluate the failure forms of functional safety-related items, which may cause hazards and thus cause potential hazards to vehicle occupants, other vehicles and occupants, or other personnel. First, the failure forms of the function are determined through functional safety keywords, including loss of function, function exceeding expectations, function less than expectations, wrong function direction, unexpected provision of functions and failure of functions updated as expected, abnormal function response, premature function response, late function response, etc.; then, in the vehicle function operation scenario, based on the design operation conditions, analyze the impact of the function failure on the entire vehicle and the hazards caused to personnel; finally, determine the hazard events corresponding to the functional safety (such as the first hazard trigger source mentioned above) and the consequences caused by the hazard events (such as the first hazard trigger consequences mentioned above). Similarly, according to the expected functional safety-related items, the expected functional safety keywords and the design operation conditions, the second hazard trigger source corresponding to the expected functional safety and the corresponding second hazard trigger consequences are determined through HAZOP analysis.

[0079] In some embodiments, reference Figure 4 , Figure 4 is an optional flowchart of step S203 in the embodiment of the present application. Step S203 may include but is not limited to steps S401 to S402.

[0080] Step S401, determining network security related items and network security keywords according to the third related item definition;

[0081] Step S402, based on network security related items, network security keywords and design operation conditions, a network hazard analysis is performed using a security threat model to determine a third hazard trigger source and a third hazard trigger consequence corresponding to the third hazard trigger source.

[0082] In some embodiments, the STRIDE model is used to identify and evaluate the failure forms of network security related items. These behaviors may cause harm, thereby causing potential harm to vehicle occupants, other vehicles and occupants, or other personnel. First, the failure forms of network functions are determined through network security keywords, including deception, tampering, denial, information leakage, denial of service, privilege escalation, etc.; then, in the vehicle function operation scenario, based on the design operation conditions, the impact of network function failure on the entire vehicle and the harm caused to personnel are analyzed; finally, the corresponding hazard events of network security (such as the third hazard trigger source mentioned above) and the consequences of the hazard events (such as the third hazard trigger consequences mentioned above) are determined. Similarly, according to data security related items, data security keywords and design operation conditions, the fourth hazard trigger source corresponding to data security and the corresponding fourth hazard trigger consequences are identified through the STRIDE model.

[0083] In some embodiments, reference Figure 5 , Figure 5 This is an optional flowchart of step S103 in the embodiment of the present application. Step S103 may include but is not limited to steps S501 to S502:

[0084] Step S501, performing a system function hazard fusion analysis on the first hazard analysis result and the second hazard analysis result to generate a full matrix of functional safety risk events, and determining the first hazard fusion analysis result according to the full matrix of functional safety risk events; the system function hazard fusion analysis at least includes hardware function failure hazard analysis, software system function failure hazard analysis, sensor performance limitation hazard analysis, algorithm performance limitation hazard analysis and driving misoperation hazard analysis;

[0085] Step S502, perform information function hazard fusion analysis on the third hazard analysis result and the fourth hazard analysis result to generate a full matrix of information security risk events, and determine the second hazard fusion analysis result based on the full matrix of information security risk events; the information function hazard fusion analysis includes at least information management anomaly hazard analysis and data anomaly hazard analysis.

[0086] In some embodiments, a fusion analysis of functional safety and expected functional safety hazards is performed, that is, starting from the hazards that may be caused by the functional link, a hazard fusion analysis is performed on the first hazard analysis result and the second hazard analysis result using analysis methods including but not limited to HARA, STPA, etc., to obtain a functional safety layer hazard fusion analysis result (such as the above-mentioned first hazard fusion analysis result).

[0087] The fusion analysis of network security and data security hazards, that is, starting from the possible hazards of the information link, uses analysis methods including but not limited to TARA to conduct fusion analysis of hazards, and obtains the fusion analysis results of information security layer hazards (such as the second fusion analysis results mentioned above).

[0088] In some embodiments, optionally, reference Figure 6 , Figure 6It is an optional schematic diagram of the full matrix of functional safety risk events in the embodiment of the present application, wherein the first hazard trigger source corresponding to the functional safety includes hazard trigger sources A1 to AN, and the corresponding first hazard trigger consequence includes hazard trigger consequence A1 to AN, the second hazard trigger source corresponding to the expected functional safety includes hazard trigger sources B1 to BN, and the corresponding second hazard trigger consequence includes hazard trigger consequence B1 to BN, the hazard trigger source A1 and the hazard trigger consequence A1 constitute functional safety risk event A1, the hazard trigger source A2 and the hazard trigger consequence A2 constitute functional safety risk event A2, the hazard trigger source B1 and the hazard trigger consequence B1 constitute functional safety risk event B1, the hazard trigger source BN and the hazard trigger consequence BN constitute functional safety risk event BN, and so on, to obtain the full matrix of functional safety risk events, and the full matrix of functional safety risk events includes functional safety risk events A1 to BN.

[0089] In some embodiments, reference Figure 7 , Figure 7 This is an optional flowchart of step S104 in the embodiment of the present application. Step S104 may include but is not limited to steps S601 to S604:

[0090] Step S601, determining a functional safety target according to the first hazard fusion analysis result;

[0091] Step S602, determining an information security target according to the second hazard fusion analysis result;

[0092] Step S603, determining a hazard triggering condition according to the functional safety goal and the information security goal;

[0093] Step S604, determining a corresponding hazard handling solution according to the hazard triggering condition and the designed operating conditions.

[0094] In some embodiments, reference Figure 8 , Figure 8 This is an optional flowchart of step S403 in the embodiment of the present application. Step S403 may include but is not limited to steps S701 to S703:

[0095] Step S701, determining corresponding functional safety risk triggering conditions according to the functional safety objectives;

[0096] Step S702, determining corresponding information security risk triggering conditions according to the information security objectives;

[0097] Step S703, performing condition fusion according to the functional safety risk triggering condition and the information security risk triggering condition to generate a hazard triggering condition.

[0098] In some embodiments, based on the hazard fusion analysis results, corresponding functional safety goals and information security goals are obtained, and then corresponding hazard triggering conditions are determined based on the functional safety goals and information security goals.

[0099] In some embodiments, assuming that the vehicle function operation scenario is a high-speed cruising scenario of the automatic driving function NOP (navigation assisted driving), the above-mentioned vehicle safety fusion hazard analysis method is applied to perform a vehicle safety fusion hazard analysis on the vehicle function operation scenario. The specific process is as follows:

[0100] The first step is to obtain the ODC corresponding to the high-speed cruising scenario of the autonomous driving function NOP, identify the hazard trigger sources and hazard trigger consequences corresponding to functional safety and expected functional safety through HAZOP, and identify the hazard trigger sources and hazard trigger consequences corresponding to network security and data security through the STRIDE model, as shown in Table 1 below:

[0101] Table 1 Hazard trigger sources and hazard trigger consequences corresponding to different safety analysis types

[0102]

[0103] The second step is to conduct a hazard fusion analysis on the hazard results corresponding to functional safety and expected functional safety, and obtain the hazard fusion analysis results of the functional safety layer: During the NOP enabling process, the vehicle may make an unexpected turn due to electronic and electrical failures or driver and passenger misoperation; conduct a hazard fusion analysis on the hazard results corresponding to network security and data security, and obtain the hazard fusion analysis results of the information security layer: During the NOP enabling process, the vehicle may make an unexpected turn due to network attacks on the vehicle system or abnormal vehicle perception data;

[0104] The third step is to determine the functional safety goal based on the ODC of the NOP high-speed cruise scenario and the safety factors corresponding to each safety analysis type, such as the reduction of friction coefficient on highways due to rain and snow, the high-risk state of system network services due to network attacks in high-speed scenarios, and the risk of vehicle data being tampered with during the generation and transmission process in high-speed scenarios. According to the results of the functional safety layer hazard fusion analysis, the functional safety goal is determined: avoid unexpected steering instructions during NOP operation; according to the results of the information security layer hazard fusion analysis, the information security goal is determined: avoid unauthorized users or processes from accessing or tampering during NOP operation;

[0105] The fourth step is to generate corresponding hazard trigger conditions according to the functional safety goals and information security goals: During the NOP enabling process, the steering command issued by the NOP function master control end is tampered with during the transmission process, resulting in the unexpected issuance of the steering command;

[0106] The fifth step is to determine the corresponding hazard handling plan based on the hazard trigger conditions and the ODC of the NOP high-speed cruising scenario: in the NOP steering function link, determine the high-risk level signal (such as functional safety level ASIL D level), and for high-risk level signals, use the SecOC (Secure Onboard Communication) module in AUTOSAR at both ends of the signal transmission and reception, and at the software layer of the vehicle system to encrypt and protect important vehicle data, effectively solving steering function abnormalities caused by communication node loss, message damage, message spoofing, etc.

[0107] Reference Fig. 9 , Fig. 9 : is an optional structural diagram of a vehicle safety fusion hazard analysis device provided in an embodiment of the present application. The device can be used to implement the above-mentioned vehicle safety fusion hazard analysis method. The device may include:

[0108] The first module is used to obtain multiple vehicle function operation scenarios;

[0109] The second module is used to obtain multiple safety analysis types, perform hazard and operability analysis on each vehicle function operation scenario, and obtain hazard analysis results corresponding to each safety analysis type under each vehicle function operation scenario;

[0110] The third module is used to perform hazard fusion analysis on the hazard analysis results corresponding to each safety analysis type under each vehicle function operation scenario, and obtain the hazard fusion analysis results corresponding to each vehicle function operation scenario;

[0111] The fourth module is used to conduct hazard analysis and risk assessment based on the hazard fusion analysis results of each vehicle function operation scenario, and determine the hazard trigger conditions corresponding to each vehicle function operation scenario and the hazard handling plan corresponding to the hazard trigger conditions.

[0112] The specific implementation of the vehicle safety fusion hazard analysis device is basically the same as the specific implementation of the above-mentioned vehicle safety fusion hazard analysis method, and will not be repeated here.

[0113] The embodiment of the present application also provides an electronic device, the electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the above-mentioned vehicle safety fusion hazard analysis method when executing the computer program. The electronic device can be any intelligent terminal including a tablet computer, a vehicle-mounted computer, etc.

[0114] See also Fig.10 , Fig.10 The hardware structure of an electronic device of another embodiment is illustrated, and the electronic device includes:

[0115] The processor 901 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application;

[0116] The memory 902 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 902 can store an operating system and other application programs. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 902, and the processor 901 calls and executes the vehicle safety fusion hazard analysis method of the embodiment of this application;

[0117] Input / output interface 903, used to implement information input and output;

[0118] Communication interface 904, used to realize communication interaction between the device and other devices, which can be realized by wired mode (such as USB, network cable, etc.) or wireless mode (such as mobile network, WIFI, Bluetooth, etc.);

[0119] A bus 905 that transmits information between the various components of the device (e.g., the processor 901, the memory 902, the input / output interface 903, and the communication interface 904);

[0120] The processor 901 , the memory 902 , the input / output interface 903 and the communication interface 904 are connected to each other in communication within the device via a bus 905 .

[0121] An embodiment of the present application also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned vehicle safety fusion hazard analysis method is implemented.

[0122] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0123] The embodiments of the present application provide a vehicle safety fusion hazard analysis method, device, electronic device and medium, which performs hazard and operability analysis on each vehicle function operation scenario to obtain the hazard analysis results corresponding to each safety analysis type under each vehicle function operation scenario, performs hazard fusion analysis on the hazard analysis results corresponding to each safety analysis type under each vehicle function operation scenario, obtains the hazard fusion analysis results corresponding to each vehicle function operation scenario, performs hazard analysis and risk assessment based on the hazard fusion analysis results of each vehicle function operation scenario, and determines the hazard triggering conditions corresponding to each vehicle function operation scenario and the hazard handling scheme corresponding to the hazard triggering conditions. The embodiments of the present application can use systematic thinking to perform safety analysis on the vehicle from the vehicle level, integrate the hazard analysis results corresponding to multiple safety analysis types, realize vehicle safety fusion hazard analysis, improve the comprehensiveness of vehicle safety hazard analysis, and enhance the reliability and safety of the automobile intelligent driving system.

[0124] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0125] Those skilled in the art will appreciate that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0126] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0127] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0128] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0129] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0130] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0131] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0132] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0133] It should be appreciated that embodiments of the present invention may be implemented or enforced by computer hardware, a combination of hardware and software, or by computer instructions stored in a non-transitory computer-readable memory. The method may be implemented in a computer program using standard programming techniques including a non-transitory computer-readable storage medium configured with a computer program, wherein the storage medium so configured causes the computer to operate in a specific and predefined manner - according to the methods and drawings described in the specific embodiments. Each program may be implemented in a high-level procedural or object-oriented programming language to communicate with a computer system. However, if desired, the program may be implemented in an assembly or machine language. In any case, the language may be a compiled or interpreted language. In addition, the program may be run on a programmed ASIC for this purpose.

[0134] Furthermore, the operations of the processes described herein may be performed in any suitable order unless otherwise indicated herein or otherwise clearly contradicted by context. The processes described herein (or variations and / or combinations thereof) may be performed under the control of one or more computer systems configured with executable instructions, and may be implemented as code (e.g., executable instructions, one or more computer programs, or one or more applications) that is executed collectively on one or more processors, by hardware, or a combination thereof. The computer program includes a plurality of instructions that may be executed by one or more processors.

[0135] Further, the method can be implemented in any type of computing platform that is operably connected to a suitable computer, including but not limited to a personal computer, a minicomputer, a mainframe, a workstation, a network or distributed computing environment, a separate or integrated computer platform, or in communication with a charged particle tool or other imaging device, etc. Various aspects of the present invention can be implemented in machine-readable code stored on a non-transitory storage medium or device, whether removable or integrated into a computing platform, such as a hard disk, an optical read and / or write storage medium, a RAM, a ROM, etc., so that it can be read by a programmable computer, and when the storage medium or device is read by the computer, it can be used to configure and operate the computer to perform the process described herein. In addition, the machine-readable code, or portions thereof, can be transmitted via a wired or wireless network. When such media includes instructions or programs that implement the steps described above in conjunction with a microprocessor or other data processor, the invention described herein includes these and other different types of non-transitory computer-readable storage media. When programmed according to the methods and techniques of the present invention, the present invention also includes the computer itself.

[0136] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store programs.

[0137] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the present invention is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and essence of the present invention should be within the scope of the rights of the present invention.

Claims

1. A vehicle safety fusion hazard analysis method, characterized in that: The method comprises the following steps: Obtain multiple vehicle function operation scenarios; Acquire multiple safety analysis types, perform hazard and operability analysis on each of the vehicle function operation scenarios, and obtain hazard analysis results corresponding to each of the safety analysis types in each of the vehicle function operation scenarios; Performing hazard fusion analysis on the hazard analysis results corresponding to each of the safety analysis types under each of the vehicle function operation scenarios to obtain hazard fusion analysis results corresponding to each of the vehicle function operation scenarios; According to the hazard fusion analysis results of each of the vehicle function operation scenarios, hazard analysis and risk assessment are performed to determine the hazard triggering conditions corresponding to each of the vehicle function operation scenarios and the hazard handling plans corresponding to the hazard triggering conditions.

2. The vehicle safety fusion hazard analysis method according to claim 1, characterized in that: The safety analysis types include functional safety, expected functional safety, network security and data security. The obtaining of multiple safety analysis types, performing hazard and operability analysis on each of the vehicle function operation scenarios, and obtaining hazard analysis results corresponding to each of the safety analysis types in each of the vehicle function operation scenarios specifically include: Obtaining the design operating conditions of the vehicle function operating scenario; Obtaining a first related item definition corresponding to the functional safety, identifying a first hazard trigger source and a first hazard trigger consequence corresponding to the functional safety according to the first related item definition and the design operating condition, and obtaining a first hazard analysis result; Obtaining a second related item definition corresponding to the expected functional safety, identifying a second hazard trigger source and a second hazard trigger consequence corresponding to the expected functional safety according to the second related item definition and the design operating condition, and obtaining a second hazard analysis result; Obtaining a third related item definition corresponding to the network security, identifying a third hazard trigger source and a third hazard trigger consequence corresponding to the network security according to the third related item definition and the design operation condition, and obtaining a third hazard analysis result; Obtain a fourth related item definition corresponding to the data security, identify a fourth hazard trigger source and a fourth hazard trigger consequence corresponding to the data security according to the fourth related item definition and the designed operating conditions, and obtain a fourth hazard analysis result.

3. The vehicle safety fusion hazard analysis method according to claim 2, characterized in that: The performing hazard fusion analysis on the hazard analysis results corresponding to each of the safety analysis types under each of the vehicle function operation scenarios to obtain the hazard fusion analysis results corresponding to each of the vehicle function operation scenarios specifically includes: Performing a system function hazard fusion analysis on the first hazard analysis result and the second hazard analysis result to generate a full matrix of functional safety risk events, and determining a first hazard fusion analysis result according to the full matrix of functional safety risk events; the system function hazard fusion analysis at least includes a hardware function failure hazard analysis, a software system function failure hazard analysis, a sensor performance limitation hazard analysis, an algorithm performance limitation hazard analysis, and a driving misoperation hazard analysis; The third hazard analysis result and the fourth hazard analysis result are subjected to information function hazard fusion analysis to generate a full matrix of information security risk events; and the second hazard fusion analysis result is determined based on the full matrix of information security risk events; the information function hazard fusion analysis includes at least information management anomaly hazard analysis and data anomaly hazard analysis.

4. The vehicle safety fusion hazard analysis method according to claim 3 is characterized in that: The hazard analysis and risk assessment are performed according to the hazard fusion analysis results of each vehicle function operation scenario to determine the hazard triggering conditions corresponding to each vehicle function operation scenario and the hazard handling solutions corresponding to the hazard triggering conditions, specifically including: Determine functional safety goals based on the first hazard fusion analysis results; Determining information security goals according to the second hazard fusion analysis results; Determining the hazard triggering condition according to the functional safety goal and the information security goal; According to the hazard triggering condition and the designed operating condition, the corresponding hazard handling plan is determined.

5. The vehicle safety fusion hazard analysis method according to claim 4, characterized in that: The determining the hazard triggering condition according to the functional safety goal and the information security goal specifically includes: According to the functional safety objectives, determining corresponding functional safety risk triggering conditions; According to the information security objectives, determine corresponding information security risk triggering conditions; According to the functional safety risk triggering condition and the information security risk triggering condition, conditions are integrated to generate the hazard triggering condition.

6. The vehicle safety fusion hazard analysis method according to claim 2, characterized in that: The obtaining of a first related item definition corresponding to the functional safety, identifying a first hazard trigger source and a first hazard trigger consequence corresponding to the functional safety according to the first related item definition and the design operating condition, and obtaining a first hazard analysis result specifically includes: According to the first related item definition, determining functional safety related items and functional safety keywords; A functional hazard analysis is performed through a hazard and operability analysis system according to the functional safety related items, the functional safety keywords and the designed operating conditions to determine the first hazard triggering source and the first hazard triggering consequence corresponding to the first hazard triggering source.

7. The vehicle safety fusion hazard analysis method according to claim 2, characterized in that: The obtaining of the third related item definition corresponding to the network security, identifying the third hazard trigger source and the third hazard trigger consequence corresponding to the network security according to the third related item definition and the designed operation condition, and obtaining the third hazard analysis result specifically includes: According to the third related item definition, determining network security related items and network security keywords; According to the network security related items, the network security keywords and the designed operating conditions, a network hazard analysis is performed using a security threat model to determine the third hazard trigger source and the third hazard trigger consequence corresponding to the third hazard trigger source.

8. A vehicle safety fusion hazard analysis device, characterized in that: The device comprises: The first module is used to obtain multiple vehicle function operation scenarios; The second module is used to obtain multiple safety analysis types, perform hazard and operability analysis on each of the vehicle function operation scenarios, and obtain hazard analysis results corresponding to each of the safety analysis types under each of the vehicle function operation scenarios; The third module is used to perform hazard fusion analysis on the hazard analysis results corresponding to each of the safety analysis types under each of the vehicle function operation scenarios to obtain hazard fusion analysis results corresponding to each of the vehicle function operation scenarios; The fourth module is used to perform hazard analysis and risk assessment based on the hazard fusion analysis results of each vehicle function operation scenario, and determine the hazard trigger conditions corresponding to each vehicle function operation scenario and the hazard handling solutions corresponding to the hazard trigger conditions.

9. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the vehicle safety fusion hazard analysis method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the vehicle safety fusion hazard analysis method according to any one of claims 1 to 7 is implemented.

Images