Omnibearing expected function safety test system and method thereof

Abstract

The invention provides an omnibearing expected function safety test system and method. The omnibearing expected function safety test system comprises a scene database, a virtual test module and an analysis module. The scene database comprises a plurality of scene groups, each scene group corresponds to each source category in a plurality of source categories, each scene group comprises a plurality of scenes, and each scene corresponds to at least one of a plurality of trigger conditions and a plurality of function limits. The virtual test module determines a plurality of to-be-tested persons in the source category according to the demand of the to-be-tested system, selects a selected person corresponding to the to-be-tested person from the scene group, generates a plurality of virtual test scenes according to the scene of the selected person, and performs a simulation test on the to-be-tested system according to the virtual test scenes to test the to-be-tested system. And determining whether at least one test failure person exists in the virtual test scene or not. And the analysis module provides corresponding improvement measures, so that the test efficiency is improved.

Description

Technical Field

[0001] The present invention relates to a testing system and a testing method, and more particularly to a comprehensive expected functional safety testing system and a comprehensive expected functional safety testing method. Background Art

[0002] In early simulation tests, most of the focus was on functional testing of self-driving cars. However, safety issues of self-driving cars do not all stem from functional failures, but may be related to the driving environment or operation, such as traffic signs being blocked, heavy rain blocking vision, or misuse by personnel, etc., resulting in many unexpected safety issues. Based on this, relevant units have formulated the standard ISO21448 related to the intended functional safety (Safety Of The Intended Functionality; SOTIF) to make up for the parts that cannot be covered by the traditional functional safety standard ISO 26262, thereby controlling the risks caused by self-driving cars due to design deficiencies or performance limitations in known or unknown hazard scenarios within a reasonable range.

[0003] Currently, most companies will conduct SOTIF-related tests when designing L1 (level 1) or higher self-driving cars. However, these tests are mostly conducted on actual roads, without unified testing methods and standards, no specific risk assessment benchmarks, and low consistency of test scenarios. In addition, actual road testing is also prone to safety issues for testers. Furthermore, actual road testing is still more inclined to actual vehicle verification of component functions, with low coverage of key scenarios, and there is still room for improvement.

[0004] In view of this, how to effectively and comprehensively conduct all-round expected functional safety testing has become the goal of relevant industry players. Summary of the invention

[0005] In order to solve the above problems, the present invention provides a comprehensive expected functional safety testing system and a comprehensive expected functional safety testing method, which can effectively and comprehensively perform comprehensive expected functional safety testing through system architecture configuration.

[0006] According to one embodiment of the present invention, a comprehensive expected functional safety test system is provided, which includes a scenario database, a virtual test module and an analysis module. The scenario database includes multiple scenario groups, each scenario group corresponds to each source category in multiple source categories, each scenario group includes multiple scenes, and each scene corresponds to at least one of multiple trigger conditions and multiple functional limits. The virtual test module determines multiple test subjects in the aforementioned multiple source categories according to the needs of a system under test, selects multiple selected subjects corresponding to the aforementioned multiple test subjects from the aforementioned multiple scenario groups, generates multiple virtual test scenarios from the aforementioned multiple scenes of the aforementioned multiple selected subjects, and simulates the system under test with the aforementioned multiple virtual test scenarios to confirm whether there is at least one test failure in the aforementioned multiple virtual test scenarios. The analysis module confirms a trigger condition or a functional limit corresponding to the aforementioned at least one test failure in the aforementioned multiple virtual test scenarios to provide corresponding improvement measures.

[0007] In this way, since multiple scene groups in the scene database have corresponding source categories, the scene group can be selected according to the needs of the system to be tested, and each scene has a corresponding trigger condition or functional limit, and the corresponding solution can be quickly found when the scene fails, so that the system to be tested can be tested systematically, comprehensively and quickly. Based on this, the scene database can be fully utilized to quickly and accurately find the corresponding scene to carry out efficient, economical and accurate testing, identify the hazardous scenes of self-driving vehicles, identify driving behavior control and personnel status and misuse, and then find the trigger conditions and factors of unknown hazardous scenes, provide component manufacturers with improvement projects and measures, and reduce the risk of self-driving cars.

[0008] In the all-round anticipated functional safety testing system according to the aforementioned embodiment, at least two of the aforementioned multiple test subjects may have an interactive influence, and all of the aforementioned multiple scenes of at least two scene groups corresponding to the aforementioned at least two test subjects may be taken as multiple scenes to be coupled, and the test conditions of at least two of the aforementioned multiple scenes to be coupled are coupled to generate a virtual test scene.

[0009] According to the all-round expected functional safety testing system of the aforementioned embodiment, the test conditions of each scenario to be coupled can be divided into at least a high-level condition and a low-level condition. In the virtual testing module, a virtual test scenario is first generated with the high-level condition of a scenario to be coupled to perform a simulation test on the system to be tested. If the simulation test fails, another virtual test scenario is generated with the low-level condition of the aforementioned scenario to be coupled to perform a simulation test on the system to be tested; if the simulation test is successful, the aforementioned other virtual test scenario is not generated with the low-level condition of the aforementioned scenario to be coupled, and when the aforementioned virtual test scenario and the aforementioned other virtual test scenario of the aforementioned scenario to be coupled have at least one successful test, the simulation test is determined to be passed, and the boundary value of the test condition of the system to be tested in the aforementioned scenario to be coupled is obtained; and if the system to be tested passes the simulation test in the aforementioned scenario to be coupled, the aforementioned scenario to be coupled is coupled with at least another scenario to be coupled to generate another virtual test scenario.

[0010] According to the all-round expected functional safety testing system of the aforementioned embodiment, if the aforementioned virtual test scenario and the aforementioned another virtual test scenario of the aforementioned scenario to be coupled both fail in the test, the aforementioned scenario to be coupled may not be coupled with the aforementioned at least another scenario to be coupled to generate the aforementioned another virtual test scenario.

[0011] According to the comprehensive expected functional safety testing system of the aforementioned embodiment, the aforementioned multiple source categories may at least include a camera, a radar, an actuator and a human-machine interface.

[0012] According to another embodiment of the present invention, a comprehensive expected functional safety test method is provided, which includes a scenario providing step, a virtual testing step and an analysis step. In the scenario providing step, a scenario database includes multiple scenario groups, each scenario group corresponds to each source category in multiple source categories, each scenario group includes multiple scenes, and each scene corresponds to at least one of multiple trigger conditions and multiple functional limits. In the virtual testing step, a virtual testing module determines multiple test subjects in the aforementioned multiple source categories according to the requirements of a system under test, selects multiple selected subjects corresponding to the aforementioned multiple test subjects from the aforementioned multiple scenario groups, generates multiple virtual test scenes from the aforementioned multiple scenes of the aforementioned multiple selected subjects, and performs simulation tests on the system under test with the aforementioned multiple virtual test scenes to confirm whether there is at least one test failure in the aforementioned multiple virtual test scenes. In the analysis step, an analysis module confirms a trigger condition or a functional limit corresponding to the aforementioned at least one test failure in the aforementioned multiple virtual test scenes to provide corresponding improvement measures.

[0013] According to the all-round expected functional safety testing method of the aforementioned embodiment, in which, in the virtual testing step, at least two of the aforementioned multiple test subjects have an interactive influence, and all of the aforementioned multiple scenes of at least two scene groups corresponding to the aforementioned at least two test subjects are taken as multiple scenes to be coupled, and the test conditions of at least two of the aforementioned multiple scenes to be coupled are coupled to generate a virtual test scene.

[0014] According to the all-round expected functional safety testing method of the aforementioned embodiment, in the virtual testing step, a virtual test scenario can be first generated with a high-level condition of a scene to be coupled to perform a simulation test on the system to be tested. If the simulation test fails, another virtual test scenario is generated with a low-level condition of the aforementioned scene to be coupled to perform a simulation test on the system to be tested; if the simulation test is successful, the aforementioned other virtual test scenario is not generated with the low-level condition of the aforementioned scene to be coupled, and when the aforementioned virtual test scenario of the aforementioned scene to be coupled and the aforementioned other virtual test scenario have at least one successful test, the simulation test is determined to be passed, and the boundary value of the test condition of the system to be tested in the aforementioned scene to be coupled is obtained; and if the system to be tested passes the simulation test in the aforementioned scene to be coupled, the aforementioned scene to be coupled is coupled with at least another scene to be coupled to generate another virtual test scenario.

[0015] According to the all-round expected functional safety testing method of the aforementioned embodiment, in the virtual testing step, if the aforementioned virtual test scenario and the aforementioned another virtual test scenario of the aforementioned scenario to be coupled both fail in the test, the aforementioned scenario to be coupled may not be coupled with the aforementioned at least another scenario to be coupled to generate the aforementioned another virtual test scenario.

[0016] The all-round expected functional safety testing method according to the aforementioned implementation method may further include a real vehicle testing step. When the system to be tested is tested with the aforementioned multiple virtual test scenarios and at least one of the aforementioned test scenarios does not fail, the system to be tested is mounted on a vehicle and the vehicle is subjected to a real test on an actual road.

[0017] According to the comprehensive expected functional safety testing method of the aforementioned implementation method, in the actual vehicle testing step, the vehicle can continue to perform actual testing until a test termination condition is met. The test termination condition is β = -ln[(1-η) / 2α], α represents the actual accident frequency, β is the measured accident-free mileage or duration, and η is the reliability of failure occurrence.

[0018] The all-round expected functional safety testing method according to the aforementioned implementation may further include a scenario expansion step. In the actual vehicle testing step, if the system under test fails to at least one new scenario, the aforementioned at least one new scenario is added to the scenario database. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 A system block diagram of a comprehensive expected functional safety test system according to an embodiment of the present invention is shown;

[0020] Figure 2 A block flow chart showing a comprehensive expected functional safety testing method according to another embodiment of the present invention; and

[0021] Figure 3 Draw Figure 2 Flowchart of the steps in the comprehensive, intended functional safety testing approach.

[0022]

Explanation of symbols

[0023] 1000: Comprehensive expected functional safety test system

[0024] 1100: Scene database

[0025] 1110: Scene Group

[0026] 1200: Virtual test module

[0027] 1210: Scene selection unit

[0028] 1220: simulation test unit

[0029] 1300:Analysis module

[0030] S1: System under test

[0031] S01,S02,S03,S04,S05,S06,S07,S08,S09,S10,S11,S12,S13,S14: Steps

[0032] S2000: Comprehensive test method for expected functional safety

[0033] S2100: Scenario provision steps

[0034] S2200: Virtual Test Steps

[0035] S2300: Analysis steps

[0036] S2400: Actual vehicle testing steps

[0037] S2500: Scenario Expansion Steps DETAILED DESCRIPTION

[0038] Embodiments of the present invention will be described below with reference to the accompanying drawings. For the sake of clarity, many practical details will be described together in the following description. However, the reader should understand that these practical details should not be used to limit the present invention. That is, in some embodiments of the present invention, these practical details are not necessary. In addition, in order to simplify the drawings, some conventional structures and elements will be depicted in a simple schematic manner in the drawings; and repeated elements may be represented by the same number or similar number.

[0039] In addition, the terms "first", "second", "third" and the like in this document are only used to describe different elements or components, and do not limit the elements / components themselves. Therefore, the first element / component may also be renamed as the second element / component. Moreover, the combination of elements / components / mechanisms / modules in this document is not a generally known, conventional or conventional combination in this field. Whether the elements / components / mechanisms / modules themselves are conventional cannot be used to determine whether their combination relationship is easy to be easily completed by a person of ordinary skill in the technical field.

[0040] See also Figure 1 ,in Figure 1 FIG. 1 is a system block diagram of a comprehensive expected functional safety test system 1000 according to an embodiment of the present invention. The comprehensive expected functional safety test system 1000 includes a scenario database 1100 , a virtual test module 1200 and an analysis module 1300 .

[0041] The scene database 1100 includes a plurality of scene groups 1110 corresponding to each source category of a plurality of source categories. Each scene group 1110 includes a plurality of scenes corresponding to at least one of a plurality of trigger conditions and a plurality of function limits.

[0042] The virtual testing module 1200 determines a plurality of test subjects from the plurality of source categories according to the requirements of a system S1 under test, selects a plurality of selected subjects corresponding to the plurality of test subjects from the plurality of scene groups 1110, generates a plurality of virtual testing scenes from the plurality of scenes of the plurality of selected subjects, and performs simulation testing on the system S1 under test with the plurality of virtual testing scenes to confirm whether there is at least one test failure in the plurality of virtual testing scenes.

[0043] The analysis module 1300 confirms a trigger condition or a functional limit corresponding to the at least one test failure in the plurality of virtual test scenarios to provide corresponding improvement measures.

[0044] In this way, since the multiple scenario groups 1110 in the scenario database 1100 have corresponding source categories, the scenario group 1110 can be selected according to the needs of the system S1 to be tested, and each scenario has a corresponding trigger condition or functional limit, and a corresponding solution can be quickly found when the scenario fails, so that the system S1 to be tested can be tested systematically, comprehensively and quickly. The details of the all-round expected functional safety test system 1000 will be described in detail later.

[0045] The scene database 1100 may be stored in an electronic device, such as a computer and a server. The scenes in the scene database 1100 may be collected in advance or designed according to needs, and each scene may correspond to a source category and at least correspond to a functional limitation or a trigger condition. The source category may include a camera, a radar, an actuator, and a human-machine interface. The source category may also include other sensors, an interchange, a general road, or other categories, and the actuator may be further subdivided into brakes or steering, etc., not limited to the above disclosure. Functional limitations may be, for example, the performance of the sensor is affected or the specifications are limited; trigger conditions may be, for example, abnormal road surface and bad weather. Table 1 shows the scenes corresponding to the source category of the camera, wherein, in the unsafe control action (UCA), UCA-1 is required but not provided, and UCA-2 is not required but provided; the functional limitation PL-1 may be, for example, the camera is affected by the illumination, the functional limitation PL-2 may be, for example, the camera is affected by the visibility, and PL-3 may be, for example, the camera FOV is too small and there is a blind spot; the trigger condition TC-1 may be, for example, strong direct light, and the trigger condition TC-2 may be, for example, alternating light and dark (tunnel entrance), and the scene LS-1 is a scene including the test condition that the camera is affected by the illumination of strong direct light (corresponding to one functional limitation and one trigger condition at the same time), the scene LS-2 is a scene including the test condition that the tunnel entrance is alternating light and dark (corresponding to one functional limitation and one trigger condition at the same time), and the scene LS-10 is a scene including the test condition that the camera FOV is too small (corresponding to only one functional limitation). It should be noted here that Table 1 is only an example, and the present invention is not limited by its number or content.

[0046] Table 1. Scenes corresponding to source category camera

[0047]

[0048]

[0049] The scenarios included in the scenario database 1100 have been classified according to source categories, functional limitations and / or trigger conditions. They can be classified by identifying dangerous events of autonomous driving vehicles through hazard analysis and risk assessment (HARA), and then deriving corresponding trigger conditions through system-theoretic process analysis (STPA), but are not limited to this.

[0050] The virtual test module 1200 refers to software or a program executed by a processor. The virtual test module 1200 may include a scene selection unit 1210 and a simulation test unit 1220. The scene selection unit 1210 may be used to select scenes from the scene database 1100, and the simulation test unit 1220 may establish a virtual test scene for simulation testing. The simulation test unit 1220 may include software such as Matlab / simulink, carsim, and Prescan to establish a virtual test scene (modify weather conditions and light sources), add sensors (ideal sensors, millimeter wave radars, cameras, etc.), and add controllers to perform closed-loop control operation simulations through the vehicle's dynamic model, but is not limited thereto.

[0051] When the system S1 to be tested is to be tested, the source category to be tested (the subject to be tested) can be obtained according to the requirements of the system S1 to be tested, so that the scene selection unit 1210 can select the scene group 1110 (the selected subject) corresponding to the subject to be tested from the scene database 1100, and then the simulation test unit 1220 generates a virtual test scene, and the system S1 to be tested can be simulated. For example, the requirement of the system S1 to be tested is lane keeping aid (Lane Keeping Aid; LKA). Using the system theory process analysis method, the source categories related to lane keeping aid can be analyzed as cameras, controllers, actuators and human-machine interfaces, and these source categories are the selected subjects. In addition, the system specifications, operation specifications (including applicable vehicle speed and system disablement conditions, etc.), sensor specifications (such as camera FOV, etc.) of the system S1 to be tested can be input to perform simulation testing.

[0052] In one embodiment, the scene selection unit can select multiple scenes, and each scene is generated by the simulation test unit one by one to perform a virtual test scene for testing. The test can be sorted according to the different impacts of different trigger conditions. For example, scene LS-8 is a sandstorm, and scene LS-7 is a foggy day. The impact of foggy days is greater, so a virtual test scene LS-7 is first established and tested.

[0053] In one embodiment, more than two scenes can be fused for testing. Specifically, if at least two of the multiple test subjects have an interactive influence, all scenes of at least two scene groups corresponding to the aforementioned at least two test subjects can be taken as multiple scenes to be coupled, and the test conditions of at least two of the aforementioned multiple scenes to be coupled are coupled to generate a virtual test scene. For example, there are 1st to 3rd test subjects, and each test subject has 1st to 10th scenes, wherein the 1st test subject has an interactive influence with the 2nd test subject. Therefore, the 1st to 10th scenes of the 1st test subject and the 1st to 10th scenes of the 2nd test subject are the scenes to be coupled (a total of 1st to 20 scenes to be coupled). The scene selection unit can, for example, take out the test conditions of the 1st scene to be coupled and the 2nd scene to be coupled, and then the simulation test unit generates a virtual test scene that simultaneously includes the above two test conditions.

[0054] In another embodiment, the test conditions of each scenario to be coupled can be divided into at least a high-level condition and a low-level condition. The virtual test module first generates a virtual test scenario with the high-level condition of the scenario to be coupled to perform a simulation test on the system to be tested. If the simulation test fails, another virtual test scenario is generated with the low-level condition of the aforementioned scenario to be coupled to perform a simulation test on the system to be tested. If the simulation test succeeds, the aforementioned other virtual test scenario is not generated with the low-level condition of the aforementioned scenario to be coupled. When the aforementioned virtual test scenario and the aforementioned other virtual test scenario of the aforementioned scenario to be coupled have at least one successful test, the simulation test is determined to be passed, and the boundary value of the test condition of the system to be tested in the aforementioned scenario to be coupled is obtained. Moreover, if the system to be tested passes the simulation test in the aforementioned scenario to be coupled, the aforementioned scenario to be coupled is coupled with at least another scenario to be coupled to generate another virtual test scenario. On the contrary, if the aforementioned virtual test scenario and the aforementioned other virtual test scenario of the aforementioned scenario to be coupled both fail to test, the aforementioned scenario to be coupled is not coupled with the aforementioned at least another scenario to be coupled to generate the aforementioned other virtual test scenario.

[0055] For example, the simulation test unit first generates a virtual test scene for testing with a high degree condition (e.g., heavy rain) of the first scene to be coupled (rainy day). If the test is successful, there is no need to generate a virtual test scene for testing with a low degree condition (e.g., light rain, whose rainfall is less than heavy rain) of the first scene to be coupled. On the contrary, if the test fails, the low degree condition of the first scene to be coupled must be generated into a virtual test scene for testing. In this way, the boundary value of the system to be tested S1 for rainy days can be obtained. The test condition can have a medium degree condition between the high degree condition and the low degree condition, but is not limited to this.

[0056] In one case, if the high degree condition (heavy rain) of the first scene to be coupled (rainy day) passes, the scene selection unit can select the high degree condition of the first scene to be coupled and the test condition of the second scene to be coupled, and the simulation test unit generates a virtual test scene for testing. When both heavy rain and light rain fail to test, it means that the system to be tested cannot adapt to the rainy day condition, so there is no need to couple the rainy day with the test conditions of other coupled scenes, because it will inevitably fail. In this way, the boundary value of the system to be tested can be confirmed, and a solution can be found. Furthermore, the impact degree (score) of each scene can be recommended.

[0057] See also Figure 2 ,in Figure 2 A block flow chart of a comprehensive expected functional safety test method S2000 according to another embodiment of the present invention is shown. The comprehensive expected functional safety test method S2000 comprises a scenario providing step S2100, a virtual testing step S2200 and an analysis step S2300.

[0058] In the scene providing step S2100 , the scene database includes a plurality of scene groups, each scene group corresponds to each source category of a plurality of source categories, each scene group includes a plurality of scenes, and each scene corresponds to at least one of a plurality of trigger conditions and a plurality of functional limits.

[0059] In the virtual testing step S2200, the virtual testing module determines multiple test subjects from the aforementioned multiple source categories based on the needs of the system to be tested, selects multiple selected subjects corresponding to the aforementioned multiple test subjects from the aforementioned multiple scene groups, generates multiple virtual testing scenes from the aforementioned multiple scenes of the aforementioned multiple selected subjects, and performs simulation testing on the system to be tested with the aforementioned multiple virtual testing scenes to confirm whether there is at least one test failure in the aforementioned multiple virtual testing scenes.

[0060] In the analysis step S2300 , the analysis module confirms a trigger condition or a functional limit corresponding to the at least one test failure in the plurality of virtual test scenarios to provide corresponding improvement measures.

[0061] Thus, through the scenario providing step S2100, the virtual testing step S2200 and the analysis step S2300, a comprehensive test can be quickly performed on the required source category. Figure 1 Similar contents of the all-round expected functional safety testing system 1000 will not be repeated.

[0062] The all-round expected functional safety test method S2000 may further include a real vehicle test step S2400. When the system to be tested is tested with the aforementioned multiple virtual test scenarios and there is no aforementioned test failure in the aforementioned multiple virtual test scenarios, the system to be tested can be loaded into a vehicle, and the vehicle is tested on an actual road. After the system to be tested has completed the simulation test and made relevant improvements, the system to be tested has a certain degree of safety, so it can be tested on an actual road. In the real vehicle test step S2400, the vehicle can continue to perform actual testing until a test termination condition is met. The test termination condition is β=-ln[(1-η) / 2α], α represents the actual accident frequency, that is, the average number of occurrences of hazardous behavior events (accidents) per unit mileage (or unit time), that is, within a certain range, different values ​​reflect the average number of occurrences of actual accident frequencies under different states and performances, β is the measured accident-free mileage or duration, and η is the reliability of failure. When the mileage without hazardous behavior events reaches a certain value β and has a certain confidence level η, it can be considered that the system can reach the required trigger frequency α in the same driving scenario hazardous accident rate. The above actual accident frequency, measured accident-free mileage or duration, and failure reliability can be determined by the manufacturer of the system to be tested according to needs.

[0063] In addition, the all-round expected functional safety test method S2000 may further include a scenario expansion step S2500. In the actual vehicle test step S2400, if the system under test fails to respond to at least one new scenario, the at least one new scenario is added to the scenario database. During the actual vehicle test, new scenarios that do not exist in the scenario database may be encountered. At this time, the new scenarios can be added to the scenario database, which can further improve the scenarios in the scenario database and provide more comprehensive testing.

[0064] See also Figure 3 ,in Figure 3 Draw Figure 2 Flow chart of the steps of the all-round expected functional safety test method S2000. Step S01, the all-round expected functional safety test method S2000 starts, and enters step S02 to confirm the source category of the system to be tested, such as a camera, actuator, etc., and the system specifications and operating specifications can be input again. After that, enter step S03, the scene selection unit of the virtual test module selects the corresponding scene from the scene database, and enters step S04 to generate multiple virtual test scenes by the simulation test unit of the virtual test module to perform simulation testing in step S05. It should be noted that in steps S03 to S05, as described above, virtual test scenes can be generated for each selected scene one by one for testing, or a part of the selected scene can be used as a scene to be coupled to generate a virtual test scene with at least two test conditions.

[0065] In step S06, it is confirmed whether the simulation test has passed. If it has passed, the actual road test can be performed in step S07. On the contrary, if the simulation test has not passed, step S08 can be performed to propose safety improvement strategies and measures, such as modifying the algorithm. At this time, since each scenario has a corresponding trigger condition or functional limitation, the problem to be improved can be quickly found according to the scenario where the test failed, so step S09 can be performed to correct the system to be tested, and then step S02 can be re-entered.

[0066] In the actual road test of step S07, the vehicle equipped with the system to be tested can be continuously tested, and step S10 is entered to confirm whether it is a new scene. If there is a new scene, step S13 can be entered to collect the new scene and its corresponding trigger condition, and the new scene is added to the scene database in step S14. The system to be tested S1 can first end the actual road test, and then return to step S04 to generate a virtual test scene of the new scene by the simulation test unit of the virtual test module to improve the new scene, and the new scene can be stored in the scene database for subsequent use. On the contrary, if there is no scene, step S11 can be entered to confirm whether the iteration termination condition is met, that is, whether β=-ln[(1-η) / 2α] is met. If not, the test is continued. If so, step S12 is entered to complete the test of the entire system to be tested.

[0067] From the above embodiments, it can be seen that the present invention can detect unknown hazard scenarios and trigger conditions of the system to be tested based on customer-specified scenarios or actual case scenarios through a unified testing method and specific risk assessment benchmarks, provide improvement projects and measures, and reduce the risk of self-driving cars. In addition, new scenarios can be expanded through real car testing in the future, which is scalable.

[0068] Although the present invention has been disclosed as above by way of embodiments, it is not intended to limit the present invention. Anyone familiar with the art may make various changes and modifications without departing from the spirit and scope of the present invention. Therefore, the protection scope of the present invention shall be determined by the definition of the attached claims.

Claims

1. A comprehensive expected functional safety test system, characterized in that: Include: a scene database, comprising a plurality of scene groups, each of which corresponds to each of the plurality of source categories, each of which comprises a plurality of scenes, each of which corresponds to at least one of a plurality of trigger conditions and a plurality of function limits; a virtual test module, determining a plurality of subjects to be tested from the plurality of source categories according to a requirement of a system to be tested, selecting a plurality of selected subjects corresponding to the plurality of subjects to be tested from the plurality of scene groups, generating a plurality of virtual test scenes from the plurality of scenes of the plurality of selected subjects, and performing a simulation test on the system to be tested with the plurality of virtual test scenes to confirm whether there is at least one test failure in the plurality of virtual test scenes; as well as An analysis module confirms a trigger condition or a functional limit corresponding to the at least one test failure in the plurality of virtual test scenarios to provide corresponding improvement measures.

2. The all-round expected functional safety testing system according to claim 1, characterized in that: At least two of the multiple test subjects have an interactive influence, and all of the multiple scenes of at least two of the scene groups corresponding to the at least two test subjects are taken as multiple scenes to be coupled, and the test conditions of at least two of the multiple scenes to be coupled are coupled to generate a virtual test scene.

3. The all-round expected functional safety testing system according to claim 2, characterized in that: The test conditions of each of the coupled scenarios are at least divided into a high level condition and a low level condition. In the virtual test module: First, a virtual test scenario is generated by using the high-level condition of the scenario to be coupled to perform a simulation test on the system to be tested. If the simulation test fails, another virtual test scenario is generated by using the low-level condition of the scenario to be coupled to perform a simulation test on the system to be tested. If the simulation test succeeds, the other virtual test scenario is not generated with the low-level condition of the one to-be-coupled scenario, and when the one virtual test scenario of the one to-be-coupled scenario and the other virtual test scenario have at least one test success, the simulation test is determined to be passed, and the boundary value of the test condition of the system to be tested in the one to-be-coupled scenario is obtained; and If the system under test passes the simulation test in the one to-be-coupled scenario, the one to-be-coupled scenario is coupled with at least another to-be-coupled scenario to generate another virtual test scenario.

4. The all-round expected functional safety testing system according to claim 3, characterized in that: If the one virtual test scene and the other virtual test scene of the one to-be-coupled scene both fail in the test, the one to-be-coupled scene is not coupled with the at least one other to-be-coupled scene to generate the other virtual test scene.

5. The all-round expected functional safety testing system according to claim 1, characterized in that: The plurality of source categories at least include a camera, a radar, an actuator and a human-machine interface.

6. A comprehensive expected functional safety testing method, characterized in that: Include: A scene providing step, a scene database comprising a plurality of scene groups, each of the scene groups corresponding to each of the source categories in a plurality of source categories, each of the scene groups comprising a plurality of scenes, each of the scenes corresponding to at least one of a plurality of trigger conditions and a plurality of function limits; a virtual testing step, wherein a virtual testing module determines a plurality of test subjects from the plurality of source categories according to a requirement of a system under test, selects a plurality of selected subjects corresponding to the plurality of test subjects from the plurality of scene groups, generates a plurality of virtual testing scenes from the plurality of scenes of the plurality of selected subjects, and performs simulation testing on the system under test with the plurality of virtual testing scenes to confirm whether there is at least one test failure in the plurality of virtual testing scenes; as well as In an analysis step, an analysis module confirms a trigger condition or a functional limit corresponding to the at least one test failure in the plurality of virtual test scenarios to provide corresponding improvement measures.

7. The all-round expected functional safety testing method according to claim 6, characterized in that: In the virtual test step, at least two of the multiple test subjects have an interactive influence, and all of the multiple scenes of at least two of the scene groups corresponding to the at least two test subjects are taken as multiple scenes to be coupled, and the test conditions of at least two of the multiple scenes to be coupled are coupled to generate a virtual test scene.

8. The all-round expected functional safety testing method according to claim 7, characterized in that: In this virtual test step: First, a virtual test scenario is generated by a high-level condition of the scenario to be coupled to perform a simulation test on the system to be tested. If the simulation test fails, another virtual test scenario is generated by a low-level condition of the scenario to be coupled to perform a simulation test on the system to be tested. If the simulation test succeeds, the other virtual test scenario is not generated with the low-level condition of the one to-be-coupled scenario, and when the one virtual test scenario of the one to-be-coupled scenario and the other virtual test scenario have at least one test success, the simulation test is determined to be passed, and the boundary value of the test condition of the system to be tested in the one to-be-coupled scenario is obtained; and If the system under test passes the simulation test in the one to-be-coupled scenario, the one to-be-coupled scenario is coupled with at least another to-be-coupled scenario to generate another virtual test scenario.

9. The all-round expected functional safety testing method according to claim 8, characterized in that: In the virtual test step, if the one virtual test scene and the other virtual test scene of the one to-be-coupled scene both fail in the test, the one to-be-coupled scene is not coupled with the at least one other to-be-coupled scene to generate the other virtual test scene.

10. The all-round expected functional safety testing method according to claim 9, characterized in that: The method further includes a real vehicle testing step. When the system to be tested is tested with the multiple virtual test scenarios and at least one test failure does not occur in the multiple virtual test scenarios, the system to be tested is mounted on a vehicle, and the vehicle is subjected to a real test on an actual road.

11. The all-round expected functional safety testing method according to claim 10, characterized in that: In the actual vehicle testing step, the vehicle continues to perform the actual measurement until a test termination condition is met, and the test termination condition is β=-ln[(1-η) / 2α], where α represents the actual accident frequency, β is the measured accident-free mileage or duration, and η is the reliability of failure occurrence.

12. The all-round expected functional safety testing method according to claim 10, characterized in that: The method further comprises a scenario expansion step. In the actual vehicle testing step, if the system to be tested fails to respond to at least one new scenario, the at least one new scenario is added to the scenario database.

Images