Electronic rearview mirror system function safety concept stage analysis method

Abstract

The invention provides an electronic rearview mirror system function safety concept stage analysis method, and belongs to the technical field of electronic rearview mirror design, and the method comprises the steps: defining the function, use scene, initial architecture, operation mode and external interface of a CMS in a whole vehicle as related items; performing hazard analysis and risk assessment from the aspects of controllability, severity and exposure on the basis of the defined related items in combination with a main operation scene of the CMS determined from the adaptive scene, and determining a safety target of the CMS and a corresponding automobile safety integrity level; and according to the determined safety target and the automobile safety integrity level, in combination with the defined initial architecture, decomposing the safety target to each electronic component of the electronic rearview mirror system, and generating a functional safety demand allocated to each electronic component. According to the method, from the whole vehicle level, related items are comprehensively defined, hazard analysis and risk assessment are accurately carried out, safety requirements are reasonably decomposed, reliable operation of the CMS is ensured, and the driving safety is improved.

Description

Technical Field

[0001] This application belongs to the field of electronic rearview mirror design technology, specifically relating to a functional safety concept stage analysis method for electronic rearview mirror systems. Background Technology

[0002] CMS is short for Camera-Based Mirror System, an electronic rearview mirror.

[0003] With the development of automotive intelligence and electronic technology, Compatible View Systems (CMS) are gradually becoming an important technological direction to replace traditional optical rearview mirrors. Traditional rearview mirrors, due to their reliance on optical reflection, have many limitations during vehicle operation. For example, in adverse weather conditions (such as rain and fog) and poor lighting conditions (such as nighttime and tunnels), the clarity of vision decreases significantly, and blind spots exist. In contrast, electronic rearview mirrors, by capturing environmental images through cameras and digitally displaying them on an in-vehicle screen, can effectively overcome these drawbacks. For instance, image enhancement technology can improve visual effects in low light conditions, and wide-angle or stitching technologies can expand the field of view. However, as a critical system directly related to driving safety, the functional safety of electronic rearview mirrors cannot be ignored. System failures (such as camera malfunction, image processing delays, or display screen lag) may prevent drivers from obtaining timely and accurate information about the rear environment, potentially leading to traffic accidents.

[0004] Currently, the automotive industry widely adopts the ISO 26262 standard for functional safety development. However, a systematic approach to functional safety concept-stage analysis of CMS at the vehicle-wide level is lacking. Existing technologies mostly focus on hardware failure analysis of individual controllers (such as camera modules), failing to conduct comprehensive and accurate hazard identification and risk assessment from the perspective of the entire vehicle system, combining the various operating modes of CMS (such as forward, turning, and reversing) and dynamic switching logic. This makes it difficult to reasonably derive clear, targeted, and traceable functional safety requirements for each electronic component at the concept stage, creating potential risks for subsequent system design.

[0005] Therefore, there is an urgent need for a functional safety concept phase analysis method for the whole vehicle level of CMS, so as to systematically complete the entire process from the definition of relevant items to the derivation of safety requirements, and provide a solid foundation for the safe and reliable operation of CMS. Summary of the Invention

[0006] This application provides a method for functional safety concept phase analysis of an electronic rearview mirror system, including the following steps: S1. Define the functions, usage scenarios, initial architecture, operating modes, and external interfaces of the electronic rearview mirror system in the vehicle as relevant items; S2. Based on the defined relevant items and combined with the main operating scenarios of the electronic rearview mirror system determined from the adaptation scenarios, conduct hazard analysis and risk assessment from three aspects: controllability C, severity S, and exposure E, and determine the safety target SG of the electronic rearview mirror system and the corresponding vehicle safety integrity level ASIL. S3. Based on the determined safety target SG and the vehicle safety integrity level ASIL, and in conjunction with the defined initial architecture, the safety target SG is decomposed into each electronic component of the electronic rearview mirror system, generating functional safety requirements FSRs assigned to each electronic component; the electronic components include at least the CMS electronic control unit ECU, the braking system controller ABS / EBS, and the vehicle controller VTCU.

[0007] Furthermore, the specific steps of step S1 are as follows: S11. Define the functions of the electronic rearview mirror system in the vehicle, specifically including: The electronic rearview mirror system is defined to provide left rearview, right rearview, forward downward view and right blind spot coverage through the corresponding controller subsystem, and optimize the display content according to the driving situation, whether driving forward, turning left or right, or reversing. Defines the user's manual adjustment function, automatic field of view adjustment mode selection function, camera heating function activation function and display brightness adjustment function for the electronic rearview mirror system through the door control panel; S12. Define the usage scenarios for the electronic rearview mirror system, specifically including: Analyze the expected functions and user interface (UI) prompts of the electronic rearview mirror system under various usage scenarios; the usage scenarios include at least straight driving without steering, forward turning, and reversing. S13. Define the initial architecture of the electronic rearview mirror system, specifically including: The electronic rearview mirror system is defined as including the main architecture items and vehicle-related items that interact with and depend on the electronic rearview mirror system; The main architecture includes a left camera, a right camera, a front camera, a left main screen, a right main screen, and a front view screen; The vehicle-related items include at least the power module, the braking system controller ABS / EBS, the door controller DCM, the body controller BCM, the vehicle controller VTCU, and the gateway controller GW; S14. Define the operating modes of the electronic rearview mirror system as sleep mode, standby mode, and normal operating mode; the normal operating mode includes at least CMS activation, manual adjustment function activation, forward turning function activation, reversing view function activation, and view switching function activation. S15. Define the CAN signal interface and hardware interface for data interaction between the electronic rearview mirror system and the outside world.

[0008] Furthermore, in step S14, the condition for CMS to start running mode is that any one of the following conditions is met: When the power mode is ON, the vehicle is unlocked, the door is opened, and the user presses the system activation button on the button panel; When the electronic rearview mirror system is activated from sleep mode, it pushes the camera signal to the monitor within a first set time period. When the electronic rearview mirror system is activated from standby mode, it pushes the camera signal to the monitor within a second set time period; the second set time period is shorter than the first set time period. In step S14, the view switching function activation mode is used to automatically switch between the default forward view, the reversing view, and the forward turning view. The switching logic is as follows: When the automatic view switch is turned on and the vehicle is in reverse gear, the view switches from the forward straight view to the reverse parking view. When the automatic view switch is off, or the forward straight driving speed is greater than the set speed threshold when the automatic view switch is on, switch from the reversing and moving view to the forward straight driving view. When the automatic view switch is turned on and the steering wheel angle signal is valid, the view switches from the forward straight view to the forward turning view. When the automatic view switch is off, or the forward straight speed exceeds the set speed threshold when the automatic view switch is on, the view will switch from the forward turning view to the forward straight view. When the vehicle is engaged in reverse gear, the view switches from the forward turning view to the reverse parking view. When the vehicle is in Drive (D) and the steering wheel angle signal is detected to be valid, switch from the reversing view to the forward turning view.

[0009] Furthermore, in step S2, the safety objectives SG derived from the hazard analysis and risk assessment include at least: First safety objective SG1: Prevent lag in electronic rearview mirror image display; Second safety objective SG2: Prevent electronic rearview mirror image display from freezing; Among them, the first safety objective SG1 and the second safety objective SG2 are both assigned a vehicle safety integrity level ASIL and a predetermined fault tolerance time FTTI. Step S2, which involves hazard analysis and risk assessment, specifically includes: Based on the usage scenarios and operating modes defined in step S1, the rating results of controllability C, severity S, and exposure E are determined. Based on the rating results of controllability (C), severity (S), and exposure (E), consult the ASIL level determination table defined in ISO 26262 to determine the ASIL level corresponding to each hazard event; Based on the aforementioned hazardous events and their corresponding ASIL levels, the safety target SG of the electronic rearview mirror system is determined.

[0010] Furthermore, the functional safety requirements (FSRs) derived in step S3 for the first safety objective SG1 and assigned to the CMS electronic control unit (ECU) include at least the following: First Functional Safety Requirement (FSR-1): The CMS electronic control unit (ECU) should be able to provide the driver with real-time environmental information. The corresponding safety condition is to set the electronic rearview mirror image to a black screen. The CMS system should have a preset fault detection time (FDT). Second Functional Safety Requirement FSR-2: The electronic rearview mirror system shall detect and confirm a fault in the CMS electronic control unit (ECU) that directly violates the first safety objective SG1 within the fault detection time (FDT), and enter the safe state within a time less than or equal to the preset fault response time (FRT). Third Functional Safety Requirement (FSR-3): The electronic rearview mirror system should be able to detect and confirm faults in the low-voltage power supply within the Fault Handling Time Interval (FHTI), including undervoltage, overvoltage, and drift; when the power supply voltage is less than the undervoltage threshold or greater than the overvoltage threshold, the electronic rearview mirror image should be set to black and an alarm message should be sent to the CAN bus. Fourth Functional Safety Requirement FSR-4: The electronic rearview mirror system should read the vehicle speed signal at the first preset cycle, the steering wheel angle signal at the second preset cycle, and the transmission gear signal at the third preset cycle after the CMS electronic control unit (ECU) is successfully initialized. Fifth Functional Safety Requirement (FSR-5): The electronic rearview mirror system shall implement safety mechanisms for vehicle speed signals, steering wheel angle signals, and transmission gear signals to detect signal loss, delay, unexpected duplication, insertion, incorrect sequence numbers, and damage; when a fault is detected and confirmed, the corresponding signal status shall be set to invalid within the fault response time (FRT). Sixth Functional Safety Requirement (FSR-6): When any of the vehicle speed signal, steering wheel angle signal, or transmission gear signal is invalid, the electronic rearview mirror system should be set to display a black screen for the electronic rearview mirror image.

[0011] Furthermore, the safety mechanisms in the fifth functional safety requirement, FSR-5, include: A timeout detection mechanism is used to detect signal loss and delay faults; The Alive Counter mechanism is used to detect unexpected signal repetition, signal loss, signal insertion, and incorrect sequence number faults. The CRC check mechanism is used to detect signal damage and faults.

[0012] Furthermore, the functional safety requirements (FSRs) derived in step S3 for safety objective SG1 and assigned to the braking system controller ABS / EBS include at least the following: Seventh Functional Safety Requirement FSR-7: The ABS / EBS brake system controller should be developed in accordance with the preset vehicle safety integrity level ASIL, corresponding to the safety state of sending an invalid steering wheel angle signal or not sending a steering wheel angle signal. The ABS / EBS brake system controller should have a preset first fault tolerance time FTTI. Functional Safety Requirement 8 (FSR-8): After the ABS / EBS controller is successfully initialized, it sends a steering wheel angle signal at the fourth preset cycle and uses the Alive Counter mechanism and CRC mechanism to protect the steering wheel angle signal.

[0013] Furthermore, the functional safety requirements (FSRs) derived from safety objective SG1 and assigned to the vehicle control unit (VTCU) include at least the following: Functional Safety Requirement 9 (FSR-9): The Vehicle Controller Unit (VTCU) should be developed in accordance with the preset Automotive Safety Integrity Level (ASIL), with the corresponding safety state being either sending invalid vehicle speed and gear signals or not sending invalid vehicle speed and gear signals. The VTCU should have a preset second fault tolerance time (FTTI). Tenth Functional Safety Requirement FSR-10: After successful initialization, the vehicle controller VTCU shall send vehicle speed signal and gear signal at the fifth preset cycle, and use Alive Counter mechanism and CRC mechanism to protect vehicle speed signal and gear signal.

[0014] Furthermore, it also includes alarm strategy requirements: If a fault that may violate the first safety objective SG1 is detected and confirmed, the electronic rearview mirror system should send a yellow alarm signal to the CAN bus within a preset third time period. If a critical fault that directly violates the first safety objective SG1 is detected and the system fails to enter a safe state in a timely manner, the electronic rearview mirror system should send a red alarm signal to the CAN bus within the preset fault response time FRT. The yellow and red alarm signals should be sent cyclically in a sixth preset cycle and protected using the AliveCounter and CRC mechanisms.

[0015] Furthermore, regarding the first safety objective SG1, the random hardware failure measurement target values ​​that the CMS electronic control unit (ECU), the braking system controller (ABS / EBS), and the vehicle controller (VTCU) must meet include at least the following: Single Point of Failure (SPFM) metric target value; Latent Fault Measurement Target Value (LFM) Target value for random hardware failure probability metric PMHF; The target values ​​for each metric are determined based on the Automotive Safety Integrity Level (ASIL) corresponding to the first safety target SG1.

[0016] As can be seen from the above technical solutions, this application has the following advantages: The functional safety concept phase analysis method for electronic rearview mirror systems provided in this application starts from the vehicle level and comprehensively covers functional definition, hazard analysis, risk assessment and safety requirement decomposition, ensuring close connection between each link and providing a foundation for the safety design of electronic rearview mirror systems. Through detailed definition of relevant items and in-depth hazard analysis and risk assessment, it accurately identifies the potential risks of electronic rearview mirror systems in different operating scenarios, determines specific safety objectives and corresponding vehicle safety integrity levels, making safety measures more targeted and effectively reducing driving safety risks. It clarifies the functional safety requirements of each electronic component, ensuring the reliable operation of the electronic rearview mirror system under various operating conditions, providing drivers with timely and accurate rear environment information, avoiding traffic accidents caused by system failure, and significantly improving vehicle driving safety. Based on the ISO 26262 standard, it ensures that the functional safety analysis and design of the electronic rearview mirror system meet the requirements. Ultimately, it improves the development efficiency of electronic rearview mirror systems, reduces development costs, and ensures timely and high-quality product delivery. Attached Figure Description

[0017] To more clearly illustrate the technical solution of this application, the accompanying drawings used in the description will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart illustrating the functional safety concept stage analysis method for the electronic rearview mirror system of the present invention.

[0019] Figure 2 This is a schematic diagram of the initial architecture of the electronic rearview mirror system of the present invention.

[0020] Figure 3 This is a schematic diagram illustrating the switching between sleep mode, standby mode, and normal working mode of the present invention.

[0021] Figure 4 This is a schematic diagram of the electronic rearview mirror field of view switching mode of the present invention. Detailed Implementation

[0022] Various embodiments of this disclosure will be described more fully in the following detailed description of the specific steps of the functional safety concept phase analysis method for electronic rearview mirror systems. This disclosure may have various embodiments, and adjustments and changes may be made therein. However, it should be understood that there is no intention to limit the various embodiments of this disclosure to the specific embodiments disclosed herein, but rather this disclosure should be understood to cover all adjustments, equivalents, and / or alternatives falling within the spirit and scope of the various embodiments of this disclosure.

[0023] This embodiment provides a functional safety concept stage analysis method for electronic rearview mirror systems, which comprehensively covers the process from functional definition to requirement decomposition, accurately identifies risks, and ensures driving safety.

[0024] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0025] Please see Figure 1 The diagram shows a flowchart of a functional safety concept phase analysis method for an electronic rearview mirror system in a specific embodiment. The method includes the following steps: S1. Define the functions, usage scenarios, initial architecture, operating modes, and external interfaces of the electronic rearview mirror system in the vehicle as relevant items; It should be noted that this step clarifies the basic structure and operational basis of the electronic rearview mirror system, providing the object and scope for hazard analysis, risk assessment and safety requirement decomposition, ensuring that the analysis process is purposeful and avoiding omission of important links, and is the foundation of the entire functional safety concept phase. S2. Based on the defined relevant items and combined with the main operating scenarios of the electronic rearview mirror system determined from the adaptation scenarios, conduct hazard analysis and risk assessment from three aspects: controllability C, severity S, and exposure E, and determine the safety target SG of the electronic rearview mirror system and the corresponding vehicle safety integrity level ASIL. It should be noted that this step can accurately identify the potential hazards and their risk levels in different scenarios, thereby determining a scientific, reasonable, and targeted safety target (SG) and the corresponding vehicle safety integrity level (ASIL). This provides direction for the subsequent decomposition of the safety target to each electronic component, ensuring that safety measures can effectively address the risks in actual operation and guarantee the functional safety of the electronic rearview mirror system. S3. Based on the determined safety target SG and the vehicle safety integrity level ASIL, and in conjunction with the defined initial architecture, the safety target SG is decomposed into each electronic component of the electronic rearview mirror system, generating functional safety requirements FSRs assigned to each electronic component; the electronic components include at least the CMS electronic control unit ECU, the braking system controller ABS / EBS, and the vehicle controller VTCU. It should be noted that this step ensures that each component clearly defines its safety responsibilities during the design, development, and testing process, and takes targeted safety measures to achieve the functional safety goals of the entire electronic rearview mirror system and ensure the overall safety of the electronic rearview mirror system.

[0026] This embodiment starts from the vehicle level, comprehensively defines key elements such as system functions, usage scenarios, initial architecture, operating modes and external interfaces, accurately conducts hazard analysis and risk assessment, scientifically and rationally decomposes safety objectives to each electronic component, generates clear functional safety requirements, provides a foundation for the safety design of the electronic rearview mirror system, improves vehicle driving safety, and meets industry standard requirements.

[0027] Furthermore, as a refinement and extension of the specific implementation methods of the above embodiments, in order to fully illustrate the specific implementation process of this embodiment, another functional safety concept stage analysis method for electronic rearview mirror systems is provided, which includes the following steps: S1. Define the functions, usage scenarios, initial architecture, operating modes, and external interfaces of the electronic rearview mirror system in the vehicle as relevant items; the specific steps of step S1 are as follows: S11. Define the functions of the electronic rearview mirror system in the vehicle, specifically including: The electronic rearview mirror system is defined to provide left rearview, right rearview, forward downward view and right blind spot coverage through the corresponding controller subsystem, and optimize the display content according to the driving situation, whether driving forward, turning left or right, or reversing. Defines the user's manual adjustment function, automatic field of view adjustment mode selection function, camera heating function activation function and display brightness adjustment function for the electronic rearview mirror system through the door control panel; For example, the field of view provision function: The electronic rearview mirror system consists of three controller subsystems, providing the driver with left rearview, right rearview, forward downward view, and right blind spot coverage. For three core driving scenarios—driving forward, turning left / right while driving forward, and reversing—image optimization algorithms are used to adjust the displayed content, ensuring the effectiveness and clarity of the field of view under different conditions.

[0028] User operation functions: The driver can perform four core operations through the door control panel: First, manually adjust the field of view to accurately adapt to personal observation habits; second, select the automatic field of view adjustment mode, and the system will automatically switch the field of view according to the driving status; third, activate the camera heating function to clear the lens fog or frost in low temperature and high humidity environments; fourth, adjust the brightness of the display screen to adapt to different lighting conditions (such as strong light, night, etc.) to avoid reflection or insufficient brightness affecting observation. S12. Define the usage scenarios for the electronic rearview mirror system, specifically including: Analyze the expected functions and user interface (UI) prompts of the electronic rearview mirror system under various usage scenarios; the usage scenarios include at least straight driving without steering, forward turning, and reversing. For example, based on the overall vehicle driving conditions, three core usage scenarios and corresponding system behaviors are identified: In a straight-ahead driving scenario without steering: the system provides a default forward view, and the display shows the standard field of view for left, right rear, and forward downward. The UI interface has no additional status reminders, ensuring that the driver focuses on the straight-ahead road conditions. In a vehicle turning scenario: the system monitors the steering wheel angle signal in real time, automatically adjusts the field of vision area, expands the observation range on the turning side, and reduces blind spots; at the same time, the UI interface displays a "steering field of vision" status reminder to inform the driver that the current field of vision is adapted to the turning condition; In the vehicle reversing scenario: the view is triggered to expand downwards and outwards, focusing on the area behind and to the sides of the vehicle in close proximity, assisting the driver in accurately judging the location of obstacles; the UI interface displays a "reversing view" status reminder, and simultaneously marks the range of view coverage; S13. Define the initial architecture of the electronic rearview mirror system, specifically including: The electronic rearview mirror system is defined as including the main architecture items and vehicle-related items that interact with and depend on the electronic rearview mirror system; such as... Figure 2 As shown; The main architecture includes a left camera, a right camera, a front camera, a left main screen, a right main screen, and a front view screen; The vehicle-related items include at least the power module, the braking system controller ABS / EBS, the door controller DCM, the body controller BCM, the vehicle controller VTCU, and the gateway controller GW; For example, the initial architecture of an electronic rearview mirror system includes main architecture items and vehicle-related items. The components achieve functional coordination through signal interaction, as detailed below: Main components: left camera, right camera, front camera (responsible for environmental image acquisition), left main screen, right main screen, front screen (responsible for image display), CMS electronic control unit ECU (responsible for signal processing, logic operation and function control).

[0029] Vehicle-related components: Power module (provides stable 24V power supply), Braking system controller ABS / EBS (outputs steering wheel angle signal), Door controller DCM (receives and forwards door panel operation signals), Body controller BCM (outputs turn signal status, door status, etc.), Vehicle controller VTCU (outputs vehicle speed, gear position, vehicle high voltage power-on status, etc.), Gateway controller GW (realizes signal routing and forwarding across the CAN bus). S14. Define the operating modes of the electronic rearview mirror system as sleep mode, standby mode, and normal operating mode; the switching logic between sleep mode, standby mode, and normal operating mode is as follows: Figure 3 As shown; the normal operating mode includes at least CMS activation, manual adjustment function activation, forward turning function activation, reversing view function activation, and view switching function activation; In step S14, the CMS startup running mode is conditional upon satisfying any one of the following conditions: When the power mode is ON, the vehicle is unlocked, the door is opened, and the user presses the system activation button on the button panel; When the electronic rearview mirror system is activated from sleep mode, it pushes the camera signal to the monitor within a first set time period (e.g., 7 seconds). When the electronic rearview mirror system is activated from standby mode, the camera signal is pushed to the monitor within a second set time period (e.g., 1 second); the second set time period is shorter than the first set time period. In step S14, the view switching function activation mode is used to automatically switch between the default forward view, the reversing view, and the forward turning view. Among them, such as Figure 4 As shown, the switching logic for the view switching function's activation mode is as follows: When the automatic view switch is turned on and the vehicle is in reverse gear, the view switches from the forward straight view to the reverse parking view. When the automatic view switch is off, or when the forward straight driving speed is greater than the set speed threshold (e.g., 10km / h) under the automatic view switch on, switch from the reversing and maneuvering view to the forward straight driving view. When the automatic view switch is turned on and the steering wheel angle signal is valid, the view switches from the forward straight view to the forward turning view. When the automatic view switch is off, or when the forward straight driving speed is greater than the set speed threshold (e.g., 10km / h) under the automatic view switch on, the forward turning view will switch to the forward straight driving view. When the vehicle is engaged in reverse gear, the view switches from the forward turning view to the reverse parking view. When the vehicle is engaged in D gear and the steering wheel angle signal is detected to be valid, switch from the reversing and moving view to the forward turning view; For example, the system operating modes are divided into hibernation mode, standby mode, and normal operation mode, and the switching logic and behavior of each mode are defined as follows: Pattern Classification: Sleep mode: The system is in a low-power state, retaining only the core wake-up signal detection function, without image acquisition and display.

[0030] Standby mode: Some system components are on standby, and the camera and display are in a low-power ready state with a faster response speed than sleep mode.

[0031] Normal working mode: includes five sub-modes: CMS activation, manual adjustment function activation, forward turning function activation, reversing view function activation, and view switching function activation.

[0032] CMS startup conditions: It can be started if any of the following conditions are met: power mode is ON, vehicle is unlocked, door is opened, or user presses the "System Enable" button on the button panel. Specifically, when starting from sleep mode, the camera signal will be pushed to the monitor within 7 seconds; when starting from standby mode, the signal push will be completed within 1 second (the second set time period is shorter than the first set time period to ensure rapid response).

[0033] View switching logic: Forward driving view → Reverse parking view: Automatic view switch is on and the vehicle is in reverse gear.

[0034] Reversing and maneuvering view → Forward straight view: Automatic vision switch off, or forward straight speed > 10km / h with automatic vision on (can be calibrated).

[0035] Forward Straight View → Forward Turning View: Automatic Vision Switch is On and Steering Wheel Angle Signal is Valid.

[0036] Forward Turn View → Forward Straight View: Automatic Vision Switch Off, or Forward Straight Speed ​​> 10km / h with Automatic Vision Switch On (can be calibrated).

[0037] Forward turn view → Reverse parking view: The vehicle is in reverse gear.

[0038] Reversing and moving view → Forward turning view: The vehicle is in D gear and the steering wheel angle signal is detected as valid.

[0039] Manual adjustment mode supplementary rules: When the power mode is ON and the vehicle is stationary, the driver can manually adjust the field of vision using the left and right mirror selection buttons and the up, down, left, and right adjustment buttons; during the adjustment process, the system continuously monitors the button signals, and automatically exits the adjustment if there is no operation within 10 seconds; the system verifies the compliance of the field of vision in real time, and displays the non-compliant UI when it exceeds the regulatory requirements, and flashes the compliant UI when returning to the default field of vision; it supports pressing and holding the "Automatic Field of Vision Enable Switch" for 2 seconds to restore the default field of vision. S15. Define the CAN signal interface and hardware interface for data interaction between the electronic rearview mirror system and the outside world; For example, the system's interface with the outside world includes a CAN signal interface and a hardware interface, used to implement signal interaction and physical connection: CAN signal interface: covers signals such as current gear position of transmission (VTCU→CMS, GW forward), steering wheel angle (ABS / EBS→CMS, GW forward), vehicle speed (VTCU→CMS, GW forward), left / right main view adjustment (BCM→CMS), camera heating (BCM→CMS), one-key wake-up (BCM→CMS), door status (BCM→CMS), and vehicle high voltage power-on status (VTCU→CMS, GW forward).

[0040] Hardware interfaces include power and ground supplied by the low-voltage battery (24V power supply), brightness adjustment signal from the brightness adjustment button to the DCM, manual adjustment field of view signal from the manual adjustment button to the DCM, control signal from the enable / disable automatic field of view adjustment button to the DCM, and camera heating signal from the heating switch to the DCM. S2. Based on the defined relevant items and combined with the main operating scenarios of the electronic rearview mirror system determined from the adaptation scenarios, conduct hazard analysis and risk assessment from three aspects: controllability C, severity S, and exposure E, and determine the safety target SG of the electronic rearview mirror system and the corresponding vehicle safety integrity level ASIL. In step S2, the safety objectives SG derived from hazard analysis and risk assessment shall include at least the following: First safety objective SG1: Prevent lag in electronic rearview mirror image display; Second safety objective SG2: Prevent electronic rearview mirror image display from freezing; The first safety objective SG1 and the second safety objective SG2 are both assigned an Automotive Safety Integrity Level (ASIL) (e.g., Level B) as determined by the ISO 26262 standard, and are associated with a predetermined Fault Tolerance Time (FTTI) (e.g., 500ms). Step S2, which involves hazard analysis and risk assessment, specifically includes: Based on the usage scenarios and operating modes defined in step S1, the rating results of controllability C, severity S, and exposure E are determined. Based on the rating results of controllability (C), severity (S), and exposure (E), consult the ASIL level determination table defined in ISO 26262 to determine the ASIL level corresponding to each hazard event; Based on the aforementioned hazardous events and their corresponding ASIL levels, the safety target SG of the electronic rearview mirror system is determined. For example, based on the relevant items defined in step S1, combined with the main operating scenarios, and in accordance with the ISO 26262 standard, hazard analysis and risk assessment (HARA) are conducted from three dimensions: controllability (C), severity (S), and exposure (E) to clarify the safety objectives (SG) and the corresponding vehicle safety integrity level (ASIL).

[0041] Core hazard identification: The key hazards that may result from a malfunction of the electronic rearview mirror system are: delayed image display and image display freeze. Both hazards can prevent drivers from obtaining timely and accurate information about the rear environment, thereby leading to traffic accidents such as collisions. Safety objectives and ASIL level determination Based on HARA analysis, two core security objectives were identified, with specific parameters shown in Table 1 below: Table 1

[0042] It should be noted that ASIL level and FTTI are determined based on ISO 26262 standard, combined with the vehicle's safety requirements and the degree of impact of system failure. A black screen as a safe state can prevent drivers from making misjudgments based on failure images. Evaluation process description: Based on the usage scenarios (straight, turning, reversing) and operating modes (normal operation, mode switching, etc.) defined in step S1, identify potential hazardous events in each scenario (such as image lag when turning, image freezing when reversing). Each hazard event is rated using C, S, and E: Controllability (C) assesses the driver's ability to intervene in the hazard, Severity (S) assesses the potential accident consequences of the hazard, and Exposure (E) assesses the frequency of the hazard event. Based on the ASIL rating table of ISO 26262 standard, and combined with the C, S, and E rating results, the ASIL level corresponding to each hazard event is determined (in this embodiment, both core hazards are determined to be ASIL B). Based on hazard events and their corresponding ASIL levels, we extract the first system-level safety objective SG1 and the second system-level safety objective SG2 to ensure that the safety objectives cover critical hazards. S3. Based on the determined safety target SG and the vehicle safety integrity level ASIL, and in conjunction with the defined initial architecture, the safety target SG is decomposed into each electronic component of the electronic rearview mirror system, generating functional safety requirements FSRs assigned to each electronic component; the electronic components include at least the CMS electronic control unit ECU, the braking system controller ABS / EBS, and the vehicle controller VTCU. The functional safety requirements (FSRs) derived in step S3 for the first safety objective SG1 and assigned to the CMS electronic control unit (ECU) include at least the following: First Functional Safety Requirement (FSR-1): The CMS electronic control unit (ECU) should be able to provide the driver with real-time environmental information. The corresponding safety condition is to set the electronic rearview mirror image to a black screen. The CMS system should have a preset fault detection time (FDT) (e.g., 350ms). Second Functional Safety Requirement FSR-2: The electronic rearview mirror system shall detect and confirm a fault in the CMS electronic control unit (ECU) that directly violates the first safety objective SG1 within the fault detection time (FDT), and enter the safe state within a time less than or equal to the preset fault response time (FRT) (e.g., 100ms). Third Functional Safety Requirement (FSR-3): The electronic rearview mirror system should be able to detect and confirm faults in the low-voltage power supply during the Fault Handling Time Interval (FHTI), including undervoltage, overvoltage, and drift; when the power supply voltage is less than the undervoltage threshold (e.g., 16V) or greater than the overvoltage threshold (e.g., 32V), the electronic rearview mirror image should be set to black and an alarm message should be sent to the CAN bus. Fourth Functional Safety Requirement FSR-4: The electronic rearview mirror system should read the vehicle speed signal at the first preset cycle, the steering wheel angle signal at the second preset cycle, and the transmission gear signal at the third preset cycle after the CMS electronic control unit (ECU) is successfully initialized. Fifth Functional Safety Requirement (FSR-5): The electronic rearview mirror system shall implement safety mechanisms for vehicle speed signals, steering wheel angle signals, and transmission gear signals to detect signal loss, delay, unexpected duplication, insertion, incorrect sequence numbers, and damage; when a fault is detected and confirmed, the corresponding signal status shall be set to invalid within the fault response time (FRT). The safety mechanisms in the fifth functional safety requirement, FSR-5, include: A timeout detection mechanism is used to detect signal loss and delay faults; The Alive Counter mechanism is used to detect unexpected signal repetition, signal loss, signal insertion, and incorrect sequence number faults. CRC check mechanism is used to detect signal damage and faults; Sixth Functional Safety Requirement FSR-6: When any of the vehicle speed signal, steering wheel angle signal, or transmission gear signal is invalid, the electronic rearview mirror system should set the electronic rearview mirror image display to black. The functional safety requirements (FSRs) derived from safety objective SG1 and assigned to the braking system controller ABS / EBS in step S3 shall include at least the following: Seventh Functional Safety Requirement FSR-7: The ABS / EBS brake system controller should be developed in accordance with the preset vehicle safety integrity level ASIL (e.g., ISO 26262 ASIL B level), corresponding to the safety state of sending an invalid steering wheel angle signal or not sending a steering wheel angle signal. The ABS / EBS brake system controller should have a preset first fault tolerance time FTTI (e.g., 50ms). Functional Safety Requirement 8 (FSR-8): After the ABS / EBS controller is successfully initialized, it sends a steering wheel angle signal in the fourth preset cycle and uses the Alive Counter mechanism and CRC mechanism to protect the steering wheel angle signal; The functional safety requirements (FSRs) derived from safety objective SG1 and assigned to the vehicle control unit (VTCU) shall include at least the following: Functional Safety Requirement 9 (FSR-9): The vehicle controller (VTCU) shall be developed in accordance with the preset vehicle safety integrity level (ASIL) (e.g., ISO 26262 ASIL B level), and the corresponding safety state shall be sending invalid vehicle speed and gear signals or not sending invalid vehicle speed and gear signals. The VTCU shall have a preset second fault tolerance time (FTTI) (e.g., 100ms). Tenth Functional Safety Requirement FSR-10: After successful initialization, the vehicle controller VTCU should send vehicle speed signal and gear signal in the fifth preset cycle, and use Alive Counter mechanism and CRC mechanism to protect vehicle speed signal and gear signal; For the first safety objective SG1, the random hardware failure measurement target values ​​that the CMS electronic control unit (ECU), the braking system controller (ABS / EBS), and the vehicle control unit (VTCU) must meet include at least the following: Single point of failure metric target value SPFM (e.g., ≥90%); Latent Fault Measurement Target Value (e.g., ≥60%) Random hardware failure probability measurement target value PMHF (e.g., less than 60 FIT for CMS electronic control unit ECU, less than 20 FIT for braking system controller ABS / EBS, and less than 20 FIT for vehicle controller VTCU); Among them, each measurement target value is determined based on the vehicle safety integrity level ASIL corresponding to the first safety target SG1; For example, based on the determined safety objectives (SG) and ASIL levels, and in conjunction with the initial architecture, the safety objectives are decomposed into core electronic components such as the CMS electronic control unit (ECU), the braking system controller (ABS / EBS), and the vehicle control unit (VTCU), generating targeted functional safety requirements (FSRs). The following highlights the functional safety requirements corresponding to SG1 (preventing image display lag): Functional safety requirements assigned to the CMS electronic control unit (ECU): FSR-1: The CMS ECU should be able to provide the driver with real environmental information. In a safe state, the electronic rearview mirror image display is black, and the system's preset fault detection time (FDT) is 350ms.

[0043] FSR-2: The system should detect and confirm faults in the CMS ECU that directly violate SG1 (such as image processing delay or abnormal signal transmission) within FDT (350ms), and enter a black screen safety state within ≤ Fault Response Time (FRT, 100ms).

[0044] FSR-3: The system should be able to detect and confirm undervoltage, overvoltage, and drift faults of the low-voltage power supply during the Fault Handling Time Interval (FHTI); when the power supply voltage is <16V or >32V, the image should be set to black immediately and an alarm message should be sent to the CAN bus.

[0045] FSR-4: After the CMS ECU is successfully initialized, it reads key signals according to a preset cycle: vehicle speed signal at a cycle of 100ms, steering wheel angle signal at a cycle of 10ms, and transmission gear signal at a cycle of 100ms, to ensure real-time signal performance.

[0046] FSR-5: Implements a triple safety mechanism based on vehicle speed, steering wheel angle, and transmission gear position signals. Timeout detection mechanism: detects signal loss and delay faults.

[0047] Alive Counter mechanism: detects unexpected signal repetition, signal loss, signal insertion, and faulty sequence numbers.

[0048] CRC check mechanism: detects signal damage or faults.

[0049] When a fault is detected and confirmed, the corresponding signal status is set to invalid within FRT (100ms).

[0050] FSR-6: If any of the signals of vehicle speed, steering wheel angle, or transmission gear position is invalid, the system will immediately set the electronic rearview mirror image display to black screen to avoid image lag caused by switching the field of view based on invalid signals.

[0051] Functional safety requirements assigned to the ABS / EBS brake system controller: FSR-7: ABS / EBS should be developed in accordance with ISO 26262 ASIL B level. The safe state is to send an invalid steering wheel angle signal or not send the signal. The preset first fault tolerance time (FTTI) is 50ms.

[0052] FSR-8: After successful ABS / EBS initialization, it sends a steering wheel angle signal every 20ms and protects the signal through the AliveCounter and CRC mechanisms to prevent signal failure during transmission.

[0053] Additional requirements: ABS / EBS should detect and confirm its own faults related to SG1 (such as steering angle sensor failure) in FDT and enter a safe state in FRT; when the power supply voltage is <16V or >32V, it should send an invalid steering wheel angle signal or stop sending signals.

[0054] Functional safety requirements assigned to the vehicle control unit (VTCU): FSR-9: The VTCU should be developed in accordance with ISO 26262 ASIL B level. The safe state is to send invalid speed and gear signals or not send such signals. The preset second fault tolerance time (FTTI) is 100ms.

[0055] FSR-10: After successful VTCU initialization, it sends vehicle speed and gear signals at 100ms intervals and protects the signals through AliveCounter and CRC mechanisms to ensure signal accuracy and integrity.

[0056] Additional requirements: The VTCU should detect and confirm its own faults related to SG1 (such as vehicle speed sensor failure) in the FDT and enter a safe state in the FRT; when the power supply voltage is <16V or >32V, it should send invalid vehicle speed and gear signals or stop sending signals.

[0057] Alarm strategy requirements: Yellow Alarm: If a potential fault that may violate SG1 is detected and confirmed (such as signal transmission delay approaching the threshold), the system should send a yellow alarm signal (CMS_Yellowwarning_Signal) to the CAN bus within 1000ms.

[0058] Red Alarm: If a critical fault that directly violates SG1 is detected and the system fails to enter a safe state in a timely manner (e.g., image lag exceeds 500ms), the system should send a red alarm signal (CMS_Redwarning_Signal) to the CAN bus within FRT (100ms).

[0059] Alarm signal protection: Yellow and red alarm signals are sent cyclically at 100ms intervals and protected by Alive Counter and CRC mechanisms to prevent the alarm signals from failing on their own.

[0060] Random hardware failure measurement target: For SG1, the CMS ECU, ABS / EBS, and VTCU must meet the following random hardware failure measurement targets to ensure hardware-level safety redundancy, as shown in Table 2: Table 2

[0061] It should be noted that the target values ​​for each metric are determined based on ASIL B level, which complies with the hardware security requirements of ISO 26262 standard.

[0062] In one embodiment of the present invention, unlike the embodiments described above, an alarm strategy requirement is also included: If a fault that may violate the first safety objective SG1 is detected and confirmed, the electronic rearview mirror system should send a yellow alarm signal to the CAN bus within a preset third time period (e.g., 1000ms). If a critical fault that directly violates the first safety objective SG1 is detected and the system fails to enter a safe state in a timely manner, the electronic rearview mirror system should send a red alarm signal to the CAN bus within the preset fault response time FRT. The yellow and red alarm signals should be sent cyclically in a sixth preset cycle and protected using the AliveCounter and CRC mechanisms.

[0063] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0064] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for functional safety concept phase analysis of an electronic rearview mirror system, characterized in that, Includes the following steps: S1. Define the functions, usage scenarios, initial architecture, operating modes, and external interfaces of the electronic rearview mirror system in the vehicle as relevant items; S2. Based on the defined relevant items and combined with the main operating scenarios of the electronic rearview mirror system determined from the adaptation scenarios, conduct hazard analysis and risk assessment from three aspects: controllability C, severity S, and exposure E, and determine the safety target SG of the electronic rearview mirror system and the corresponding vehicle safety integrity level ASIL. S3. Based on the determined safety target SG and the vehicle safety integrity level ASIL, and in conjunction with the defined initial architecture, the safety target SG is decomposed into each electronic component of the electronic rearview mirror system, generating functional safety requirements FSRs assigned to each electronic component; the electronic components include at least the CMS electronic control unit ECU, the braking system controller ABS / EBS, and the vehicle controller VTCU.

2. The functional safety concept stage analysis method for electronic rearview mirror systems according to claim 1, characterized in that, The specific steps of step S1 are as follows: S11. Define the functions of the electronic rearview mirror system in the vehicle, specifically including: The electronic rearview mirror system is defined to provide left rearview, right rearview, forward downward view and right blind spot coverage through the corresponding controller subsystem, and optimize the display content according to the driving situation, whether driving forward, turning left or right, or reversing. Defines the user's manual adjustment function, automatic field of view adjustment mode selection function, camera heating function activation function and display brightness adjustment function for the electronic rearview mirror system through the door control panel; S12. Define the usage scenarios for the electronic rearview mirror system, specifically including: Analyze the expected functions and user interface (UI) prompts of the electronic rearview mirror system under various usage scenarios; the usage scenarios include at least straight driving without steering, forward turning, and reversing. S13. Define the initial architecture of the electronic rearview mirror system, specifically including: The electronic rearview mirror system is defined as including the main architecture items and vehicle-related items that interact with and depend on the electronic rearview mirror system; The main architecture includes a left camera, a right camera, a front camera, a left main screen, a right main screen, and a front view screen; The vehicle-related items include at least the power module, the braking system controller ABS / EBS, the door controller DCM, the body controller BCM, the vehicle controller VTCU, and the gateway controller GW; S14. Define the operating modes of the electronic rearview mirror system as sleep mode, standby mode, and normal operating mode; the normal operating mode includes at least CMS activation, manual adjustment function activation, forward turning function activation, reversing view function activation, and view switching function activation. S15. Define the CAN signal interface and hardware interface for data interaction between the electronic rearview mirror system and the outside world.

3. The functional safety concept stage analysis method for electronic rearview mirror systems according to claim 1, characterized in that, In step S14, the CMS startup running mode is conditional upon satisfying any one of the following conditions: When the power mode is ON, the vehicle is unlocked, the door is opened, and the user presses the system activation button on the button panel; When the electronic rearview mirror system is activated from sleep mode, it pushes the camera signal to the monitor within a first set time period. When the electronic rearview mirror system is activated from standby mode, it pushes the camera signal to the monitor within a second set time period; the second set time period is shorter than the first set time period. In step S14, the view switching function activation mode is used to automatically switch between the default forward view, the reversing view, and the forward turning view. The switching logic is as follows: When the automatic view switch is turned on and the vehicle is in reverse gear, the view switches from the forward straight view to the reverse parking view. When the automatic view switch is off, or the forward straight driving speed is greater than the set speed threshold when the automatic view switch is on, switch from the reversing and moving view to the forward straight driving view. When the automatic view switch is turned on and the steering wheel angle signal is valid, the view switches from the forward straight view to the forward turning view. When the automatic view switch is off, or the forward straight speed exceeds the set speed threshold when the automatic view switch is on, the view will switch from the forward turning view to the forward straight view. When the vehicle is engaged in reverse gear, the view switches from the forward turning view to the reverse parking view. When the vehicle is in Drive (D) and the steering wheel angle signal is detected to be valid, switch from the reversing view to the forward turning view.

4. The functional safety concept stage analysis method for electronic rearview mirror systems according to claim 1, characterized in that, In step S2, the safety objectives SG derived from hazard analysis and risk assessment shall include at least the following: First safety objective SG1: Prevent lag in electronic rearview mirror image display; Second safety objective SG2: Prevent electronic rearview mirror image display from freezing; Among them, the first safety objective SG1 and the second safety objective SG2 are both assigned a vehicle safety integrity level ASIL and a predetermined fault tolerance time FTTI. Step S2, which involves hazard analysis and risk assessment, specifically includes: Based on the usage scenarios and operating modes defined in step S1, the rating results of controllability C, severity S, and exposure E are determined. Based on the rating results of controllability (C), severity (S), and exposure (E), consult the ASIL level determination table defined in ISO 26262 to determine the ASIL level corresponding to each hazard event; Based on the aforementioned hazardous events and their corresponding ASIL levels, the safety target SG of the electronic rearview mirror system is determined.

5. The functional safety concept stage analysis method for an electronic rearview mirror system according to claim 4, characterized in that, The functional safety requirements (FSRs) derived in step S3 for the first safety objective SG1 and assigned to the CMS electronic control unit (ECU) include at least the following: First Functional Safety Requirement (FSR-1): The CMS electronic control unit (ECU) should be able to provide the driver with real-time environmental information. The corresponding safety condition is to set the electronic rearview mirror image to a black screen. The CMS system should have a preset fault detection time (FDT). Second Functional Safety Requirement FSR-2: The electronic rearview mirror system shall detect and confirm a fault in the CMS electronic control unit (ECU) that directly violates the first safety objective SG1 within the fault detection time (FDT), and enter the safe state within a time less than or equal to the preset fault response time (FRT). Third Functional Safety Requirement (FSR-3): The electronic rearview mirror system should be able to detect and confirm faults in the low-voltage power supply within the Fault Handling Time Interval (FHTI), including undervoltage, overvoltage, and drift; when the power supply voltage is less than the undervoltage threshold or greater than the overvoltage threshold, the electronic rearview mirror image should be set to black and an alarm message should be sent to the CAN bus. Fourth Functional Safety Requirement FSR-4: The electronic rearview mirror system should read the vehicle speed signal at the first preset cycle, the steering wheel angle signal at the second preset cycle, and the transmission gear signal at the third preset cycle after the CMS electronic control unit (ECU) is successfully initialized. Fifth Functional Safety Requirement (FSR-5): The electronic rearview mirror system shall implement safety mechanisms for vehicle speed signals, steering wheel angle signals, and transmission gear signals to detect signal loss, delay, unexpected duplication, insertion, incorrect sequence numbers, and damage; when a fault is detected and confirmed, the corresponding signal status shall be set to invalid within the fault response time (FRT). Sixth Functional Safety Requirement (FSR-6): When any of the vehicle speed signal, steering wheel angle signal, or transmission gear signal is invalid, the electronic rearview mirror system should be set to display a black screen for the electronic rearview mirror image.

6. The functional safety concept stage analysis method for an electronic rearview mirror system according to claim 5, characterized in that, The safety mechanisms in the fifth functional safety requirement, FSR-5, include: A timeout detection mechanism is used to detect signal loss and delay faults; The Alive Counter mechanism is used to detect unexpected signal repetition, signal loss, signal insertion, and incorrect sequence number faults. The CRC check mechanism is used to detect signal damage and faults.

7. The functional safety concept stage analysis method for an electronic rearview mirror system according to claim 6, characterized in that, The functional safety requirements (FSRs) derived from safety objective SG1 and assigned to the braking system controller ABS / EBS in step S3 shall include at least the following: Seventh Functional Safety Requirement FSR-7: The ABS / EBS brake system controller should be developed in accordance with the preset vehicle safety integrity level ASIL, corresponding to the safety state of sending an invalid steering wheel angle signal or not sending a steering wheel angle signal. The ABS / EBS brake system controller should have a preset first fault tolerance time FTTI. Functional Safety Requirement 8 (FSR-8): After the ABS / EBS controller is successfully initialized, it sends a steering wheel angle signal at the fourth preset cycle and uses the Alive Counter mechanism and CRC mechanism to protect the steering wheel angle signal.

8. The functional safety concept stage analysis method for an electronic rearview mirror system according to claim 7, characterized in that, The functional safety requirements (FSRs) derived from safety objective SG1 and assigned to the vehicle control unit (VTCU) shall include at least the following: Functional Safety Requirement 9 (FSR-9): The Vehicle Controller Unit (VTCU) should be developed in accordance with the preset Automotive Safety Integrity Level (ASIL), with the corresponding safety state being either sending invalid vehicle speed and gear signals or not sending invalid vehicle speed and gear signals. The VTCU should have a preset second fault tolerance time (FTTI). Tenth Functional Safety Requirement FSR-10: After successful initialization, the vehicle controller VTCU shall send vehicle speed signal and gear signal at the fifth preset cycle, and use Alive Counter mechanism and CRC mechanism to protect vehicle speed signal and gear signal.

9. The functional safety concept stage analysis method for an electronic rearview mirror system according to claim 5, characterized in that, This also includes alarm policy requirements: If a fault that may violate the first safety objective SG1 is detected and confirmed, the electronic rearview mirror system should send a yellow alarm signal to the CAN bus within a preset third time period. If a critical fault that directly violates the first safety objective SG1 is detected and the system fails to enter a safe state in a timely manner, the electronic rearview mirror system should send a red alarm signal to the CAN bus within the preset fault response time FRT. The yellow and red alarm signals should be sent cyclically in a sixth preset cycle and protected using the AliveCounter and CRC mechanisms.

10. The functional safety concept stage analysis method for an electronic rearview mirror system according to claim 5, characterized in that, For the first safety objective SG1, the random hardware failure measurement target values ​​that the CMS electronic control unit (ECU), the braking system controller (ABS / EBS), and the vehicle control unit (VTCU) must meet include at least the following: Single Point of Failure (SPFM) metric target value; Latent Fault Measurement Target Value (LFM) Target value for random hardware failure probability metric PMHF; The target values ​​for each metric are determined based on the Automotive Safety Integrity Level (ASIL) corresponding to the first safety target SG1.

Images