A hierarchical formal modeling and safety verification method for automatic driving emergency braking logic, electronic equipment, computer readable storage medium and program

Abstract

The application discloses a kind of hierarchical formalization modeling and safety verification methods for automatic driving emergency brake logic, electronic equipment, computer readable storage medium and program, including obtaining and abstracting the environment perception information related to automatic driving emergency brake, vehicle operating state parameter, emergency brake trigger condition and brake control constraint, to form the basic formalization element of emergency brake logic;Then according to the processing flow of emergency brake logic, the emergency brake logic is divided into multiple functional levels, and each level is respectively formalized modeling, including describing the constraint relationship between each logic rule in the same level and the data transmission relationship between different functional levels, state evolution relationship and timing constraint relationship, define system safety attribute, input formalization verification platform to execute safety verification.The application reduces the overall modeling complexity and improves the verification efficiency.

Description

Technical Field

[0001] This invention relates to a formal modeling and safety verification method for autonomous driving safety, and particularly to a hierarchical formal modeling and safety verification method, electronic device, computer-readable storage medium, and program for emergency braking logic in autonomous driving. Background Technology

[0002] With the development of autonomous driving technology, the requirements for vehicle operation safety detection have become more stringent. Emergency braking logic, as one of the key functions in autonomous driving systems to ensure driving safety, is directly related to the safety and reliability of vehicles in complex traffic environments and sudden dangerous scenarios. Emergency braking (AEB) logic typically needs to integrate multiple factors such as environmental perception information, vehicle operating status, and control constraints to make the most likely correct braking decision in a very short time. Its processing logic structure is complex and its triggering conditions are diverse.

[0003] Currently, the verification of AEB logic mainly relies on simulation testing and road testing. While computer simulations of typical traffic scenarios or testing in real road environments can verify the correctness of emergency braking logic under common conditions to some extent, the high complexity and uncertainty of real traffic environments mean that emergency braking logic may face numerous boundary scenarios and extreme conditions during operation, making it difficult for traditional testing methods to cover all possible situations.

[0004] Especially when multiple triggering conditions, multiple decision rules, and execution constraints interact, simulation testing and road testing struggle to systematically uncover potential logical flaws and safety hazards in emergency braking logic due to high test scenario construction costs, long testing cycles, and safety risks. Test results also typically rely on limited samples, making it difficult to provide stringent safety guarantees for behavior in uncovered scenarios.

[0005] Existing formal verification techniques still face significant challenges when applied to AEB logic verification. First, modeling lacks decoupling: existing methods typically mix different dimensions of logic, such as perception triggering, decision-making, and execution constraints, in a unified model, resulting in overly tight internal connections and a lack of flexibility. Second, they suffer from state space explosion: emergency braking involves the interaction of multi-source perception data and dynamic physical boundaries; unified modeling leads to an exponential growth of the state space, resulting in extremely low verification efficiency. Finally, they suffer from poor engineering adaptability and scalability: the lack of structured modeling methods for AEB logic processing makes it difficult to adapt verification work to modular development requirements. Summary of the Invention

[0006] To address the shortcomings of the existing technology, this invention provides a hierarchical formal modeling and safety verification method for emergency braking logic in autonomous driving, overcoming the problem of low verification efficiency caused by overly tight internal correlations and exponential growth of the state space. This invention also provides an electronic device, a computer-readable storage medium, and a computer program product for implementing this hierarchical formal modeling and safety verification method.

[0007] The technical solution of the present invention is as follows:

[0008] A hierarchical formal modeling and safety verification method for emergency braking logic in autonomous driving includes:

[0009] S1. Obtain environmental perception information, vehicle operating status parameters, emergency braking trigger conditions, and braking control constraints related to autonomous driving emergency braking, and abstract them to form the basic formal elements of emergency braking logic.

[0010] S2. Based on the aforementioned basic formal elements, the emergency braking logic is divided into multiple functional levels according to the processing flow of the emergency braking logic, and formal modeling is performed on each level respectively.

[0011] S3. Construct a hierarchical formal model, which includes an intra-level logical relationship model describing the constraint relationships between logical rules within the same level, and an inter-level interaction relationship model describing the data transfer relationship, state evolution relationship, and timing constraint relationship between different functional levels.

[0012] S4. Define system security attributes that include trigger rationality, response timing, and execution security, and transform them into formal verifiable security constraints.

[0013] S5. Input the hierarchical formal model and security constraints into the formal verification platform to perform security verification, analyze whether there are logical paths that violate the system security attributes, and output the verification results.

[0014] Furthermore, the basic formal elements for forming the emergency braking logic in step S1 include: abstracting the environmental perception information and the relative motion state of the main vehicle into a target state vector containing relative distance, relative speed, predicted collision time, and target classification confidence; and abstracting the system's maximum braking capacity into a mechanical inequality. u is the braking force output, μ is the road surface adhesion coefficient, α is the road slope, m is the vehicle mass, and g is the gravitational acceleration; the system response time parameter is abstracted as the clock step or state transition delay in the logic state machine.

[0015] Furthermore, the functional hierarchy includes a perception triggering layer, a decision-making layer, and an execution constraint layer. The perception triggering layer describes the emergency braking triggering conditions based on environmental perception information; the decision-making layer describes the decision rules for the emergency braking strategy; and the execution constraint layer describes the braking control constraints during the braking execution process. This solution decouples the perception, decision-making, and execution logic, improving the model's understandability, scalability, and modular adaptability.

[0016] Furthermore, the perception triggering layer formally represents the emergency braking triggering condition as a logical predicate Trigger(S) p ), and defined as , among which, S p Let ttc represent the target state vector, d represent the estimated collision time, and θ represent the relative distance. ttc With θ d These are preset safety thresholds, used to characterize the safety boundaries of the system under different operating conditions; the decision-making layer models the emergency braking logic as a multi-state state transition system, including normal driving state, visual / auditory warning state, partial braking state, and maximum emergency braking state, with the state transition logic as: θ partial ≤ttc<θ warn At that time, the system switches from normal driving mode to visual / auditory warning mode, θ emergency ≤ttc<θ partial At that time, it enters a partial braking state, ttc < θ emergency At that time, the maximum emergency braking state is triggered, θ warn θ partial and θ emergency Here, θ represents the hazard level threshold. warn θ partial and θ emergency Satisfying θ warn >θ emergency >θ partial The execution constraint layer abstracts the emergency braking execution behavior into a control input function u=f(S). d ,C),S d C represents the current system decision state, and C represents the set of constraints related to vehicle dynamics and actuators.

[0017] Furthermore, the hierarchical logic of the perception triggering layer is that as long as any potential real state within the sensor measurement error range triggers the confidence-weighted safety boundary, the system determines that an intervention state is required; the hierarchical logic of the decision-making layer is that the decision threshold for the system to fall back from a higher-order intervention state to a lower-order state must be greater than the trigger threshold when entering that state, and a set hysteresis constant is added. The hierarchical logical relationship within the execution constraint layer is as follows: .

[0018] Further, in step S4, the safety constraint for triggering reasonableness is a minimum safe distance constraint based on the relative state of the vehicle and the obstacle; the safety constraint for response timing is a constraint condition for completing braking decision and braking execution within a preset time range after the emergency braking trigger condition is met; the safety constraint for execution safety is that the control commands output by the system must not violate the environmental adaptive physical constraint of the road adhesion coefficient under any circumstances, and the environmental adaptive physical constraint is... .

[0019] Furthermore, the security verification in step S5 includes: consistency verification to determine whether there are logical conflicts or constraint contradictions between different functional levels; and accessibility analysis for preset security attributes to check whether there is a system operating state that violates security constraints under extreme combinations such as dynamic physical boundary constraints.

[0020] Another technical solution of the present invention is: an electronic device, the electronic device comprising: at least one processor; and a memory communicatively connected to the at least one processor;

[0021] The memory stores a computer program that can be executed by the at least one processor, which enables the at least one processor to perform the aforementioned hierarchical formal modeling and safety verification method for emergency braking logic of autonomous driving.

[0022] Another technical solution of the present invention is: a computer-readable storage medium storing a computer program, the computer program being used to enable a processor to implement the aforementioned hierarchical formal modeling and safety verification method for emergency braking logic of autonomous driving.

[0023] Another technical solution of the present invention is: a computer program product, the computer program product comprising a computer program, which, when executed by a processor, implements the aforementioned hierarchical formal modeling and safety verification method for emergency braking logic of autonomous driving.

[0024] Compared with the prior art, the present invention has the following advantages:

[0025] 1. This invention uses a hierarchical formal modeling approach to clearly express the complex structure of AEB logic, reducing the overall modeling complexity, improving the understandability and scalability of the model, and increasing verification efficiency.

[0026] 2. This invention uses a formal verification method to systematically analyze the safety of emergency braking logic in the full state space, avoiding the problem of missing potential safety risks due to insufficient scenario coverage in traditional simulation testing and road testing;

[0027] 3. This invention provides a reusable and scalable technical means for the design verification and security assessment of AEB logic, and has good prospects for engineering applications;

[0028] 4. This invention addresses the problem of formal verification being "too idealistic" in the field of autonomous driving by introducing uncertainty modeling at the perception trigger layer. It can quantify the impact of sensor errors on emergency braking logic, providing mathematically provable boundary guarantees for the expected functional safety of AEB systems in complex dynamic environments, thus making the verification results more valuable for engineering reference. Attached Figure Description

[0029] Figure 1 This is a flowchart illustrating a hierarchical formal modeling and safety verification method for emergency braking logic in autonomous driving, as illustrated in this embodiment.

[0030] Figure 2 This is a schematic diagram of a hierarchical formal modeling and safety verification system for emergency braking logic in autonomous driving, as shown in the example.

[0031] Figure 3 This is a schematic diagram of the internal modules of the verification analysis module.

[0032] Figure 4 This is a schematic diagram illustrating an application scenario for a hierarchical formal modeling and safety verification system for emergency braking logic in autonomous driving. Detailed Implementation

[0033] The present invention will be further described below with reference to embodiments, but these are not intended to limit the scope of the invention.

[0034] Please combine Figure 1 As shown in the figure, the hierarchical formal modeling and safety verification method for emergency braking logic in autonomous driving in this embodiment is as follows:

[0035] S1. Obtain environmental perception information, vehicle operating status parameters, emergency braking trigger conditions, and braking control constraints related to emergency braking of autonomous driving, and abstract them to form the basic formal elements of emergency braking logic.

[0036] This step first functionally deconstructs the AEB control logic in the autonomous driving system, identifies key elements related to emergency braking, and abstracts these key elements to form the basic formal elements of the emergency braking logic. This step aims to transform the complex physical operating environment and heterogeneous sensor signals into rigorous mathematical logic objects that can be processed by formal verification tools. Specifically, it includes two stages: "key element identification" and "formal abstraction."

[0037] (1) Identification of key elements

[0038] By analyzing the AEB logic processing flow, four types of core physical and logical information affecting braking decisions were identified:

[0039] Environmental perception information: This mainly involves dynamic environmental target data output from vehicle-mounted multi-source sensors (such as millimeter-wave radar, smart cameras, and LiDAR) after fusion processing. Specifically, it includes relative obstacle position parameters (such as longitudinal distance and lateral offset), relative velocity parameters, and target recognition confidence levels. To address the high uncertainty of real-world traffic environments, this information must also extract perception uncertainty parameters arising from the inherent properties of the sensors, at least including the sensor measurement error range.

[0040] Vehicle operating status parameters: Real-time reflection of the vehicle's own dynamic characteristics and kinematic state, including vehicle speed parameters, vehicle mass, acceleration status and heading angle, etc., which are used for subsequent accurate calculation of the vehicle's kinetic energy boundary and braking requirements.

[0041] Emergency braking trigger conditions: These refer to the preset safety thresholds or hazard assessment criteria of the autonomous driving system. Key parameters include the predicted time to collision (TTC) parameter calculated based on distance, the preset safe distance threshold, and the trigger conditions in the system's multi-level intervention logic.

[0042] Braking execution constraints: These describe the objective constraints imposed on the underlying actuators by the physical environment and vehicle hardware after receiving an emergency braking command. Specifically, they involve system braking capacity parameters (such as maximum achievable deceleration), system response time parameters characterizing hardware latency, and environmentally sensitive factors such as the road adhesion coefficient and road gradient.

[0043] (2) Formal abstraction

[0044] After identifying the multidimensional feature information, the aforementioned discrete physical parameters, which contain engineering noise, need to be mapped into logical vectors and set elements that can be directly computed by the formal verification platform. The basic formal element abstraction process in this embodiment is as follows:

[0045] Target state vectorization: Abstracting environmental perception information and the relative motion state of the vehicle into a standardized state vector S. p =(d,v r ,ttc,C type ,…), where d represents the relative distance to the target ahead, v r Represents relative velocity, ttc represents the predicted collision time, and C... type This represents the confidence score for the target classification (e.g., pedestrian, motor vehicle). The ellipsis indicates other state parameters related to safety determination that can be introduced according to system requirements. Through this vectorized expression, the system can reduce the complex three-dimensional physical space to a logical operation space.

[0046] Perception Error Interval Modeling: Breaking away from the traditional point-value assumption, interval logic is used to model worst-case scenarios for perception uncertainty parameters. This ensures that subsequent safety verification can cover all possible states within the error interval.

[0047] Invariant abstraction of physical boundaries: Transforming vehicle control constraint information into invariant constraints at the execution layer. Utilizing real-time acquired road adhesion coefficient μ, road slope α, and vehicle mass m, the system's maximum braking capacity is abstracted into a mechanical inequality. Where g is the acceleration due to gravity. This abstract formula will serve as an adaptive physical constraint for the environment, defining the boundary of the maximum braking force achievable by the vehicle in the verification model.

[0048] Discretization of response timing: The system response time parameters are abstracted into clock steps or state transition delays in a logic state machine, thereby converting physical time into step constraints in logical deduction, providing a theoretical foundation for subsequent verification of timing properties.

[0049] Through the aforementioned identification and abstraction mechanisms, this method strips away the redundant engineering implementation details while retaining the core states and physical limits that play a decisive role in system security, thus laying a high-precision and unambiguous data foundation for the subsequent construction of a decoupled hierarchical formal model.

[0050] S2. Based on the basic formal elements, the emergency braking logic is divided into multiple functional levels according to the processing flow of the emergency braking logic, and formal modeling is performed on each level.

[0051] This step involves hierarchical modeling of the AEB logic to reduce overall logical complexity and improve model verifiability.

[0052] In this embodiment, the emergency braking logic is divided into multiple logical layers according to functional semantics and processing stages. These logical layers are connected through explicit data interfaces and state transmission relationships. Specifically, the logical layers include at least: a Perception Trigger Layer; a Decision Evaluation Layer; and an Execution Constraint Layer.

[0053] (1) Modeling of the perception triggering layer

[0054] The perception triggering layer describes the emergency braking triggering conditions based on environmental perception information. Its inputs include, but are not limited to, target state information obtained through fusion processing of multiple source sensors such as radar, cameras, and lidar. In one implementation, the target state information is the state vector S. p =(d,v r ,ttc,C type ,…).

[0055] The emergency braking trigger condition is formally represented as the logical predicate Trigger(S) p ), which is defined as follows: Where ttc represents the estimated collision time, d represents the relative distance, and θ ttc With θ d These are preset safety thresholds, used to characterize the safety boundaries of the system under different operating conditions. When the logical predicate Trigger(S) p When a condition is established, it indicates that there is a potential security risk in the current operating state, and subsequent security control procedures need to be triggered.

[0056] (2) Modeling of the decision-making layer

[0057] The decision-making layer describes the logical decision-making process of the system on whether to enter the emergency braking state when the emergency braking triggering conditions are met. In one embodiment, the emergency braking logic is modeled as a state transition system (S... d ,→) where S d This represents a set of decision states, including Normal, Warning (visual / auditory warning), Partial Braking, and Emergency Braking. By introducing multi-level states, the model can accurately describe the phased intervention logic of the system as the degree of danger increases, thus allowing for the analysis of the temporal rationality between different intervention stages during the formal verification phase.

[0058] In the decision-making layer modeling, the state transition relationship is based on a multidimensional threshold vector Θ=(θwarn , θ partial ,θ emergency Define θ, where Θ represents the multidimensional threshold vector in the decision-making layer. warn θ partial and θ emergency These are the preset danger level thresholds for the warning stage, partial braking stage, and full emergency braking stage, respectively, θ warn θ partial and θ emergency Satisfying θ warn >θ emergency >θ partial These thresholds are used to define the system's state transition logic as the degree of danger increases, enabling multi-level intervention determination and response boundary characterization during emergency braking. Specifically, the transition logic is described as follows: when θ partial ≤ttc<θ warn When θ emergency ≤ttc<θ partial When ttc < θ, the system enters partial braking mode, performing slight deceleration to alert the driver and pre-charge pressure; emergency At this time, the system triggers the maximum emergency braking state and outputs the maximum braking force. This multi-level transition model allows verification tools to detect logical defects such as "skip-level transitions" or "response lag".

[0059] By formally defining decision rules, we can systematically analyze the consistency and completeness of decisions under different combinations of triggering conditions.

[0060] (3) Modeling the constraint layer

[0061] The execution constraint layer describes the braking control constraints imposed during emergency braking to ensure that braking control meets safety requirements while conforming to vehicle dynamics. In one implementation, the emergency braking execution behavior is abstracted as a control input function u=f(S d C), where u represents the braking force output, S d C represents the current system decision state, and C represents the set of constraints related to vehicle dynamics and actuators.

[0062] S3. For each functional level, construct a hierarchical logical relationship model that describes the constraint relationship between logical rules within the same level, and construct an inter-level interaction relationship model that describes the data transmission relationship, state evolution relationship, and time sequence constraint relationship between different functional levels, forming a complete hierarchical formal model.

[0063] By constructing a hierarchical logical relationship model and an inter-hierarchical interaction relationship model, discrete functional modules are solidified into a complete and rigorous hierarchical formal model. This step is crucial for achieving logical decoupling description of AEB and reducing verification complexity. Specific implementation details are as follows:

[0064] Construct a logical relationship model within each functional level. For the three functional levels of perception, decision-making, and execution as defined in step S2, define the internal invariants and logical rules that they must follow through higher-order logic:

[0065] Intra-layer constraints of the perception trigger layer: This layer model focuses on addressing the "uncertainty" problem of sensor perception results. This embodiment introduces interval logic modeling within the perception layer. Specifically, the perception layer embeds perception uncertainty constraints, using the sensor measurement error range and target recognition confidence as core constraint terms. During modeling, the perception trigger condition is defined as a logic function Trigger_Uncertainty that considers uncertainty: This function introduces a deviation variable δ (constrained by the error boundary error_bound) and dynamically adjusts the safety threshold in conjunction with the confidence weight confidence_weight. Its core constraint logic is: as long as any potential real state within the sensor measurement error range triggers the confidence-weighted safety boundary, the system determines it to be a state requiring intervention. Through this type of uncertainty modeling, it is ensured that the AEB logic can still meet the SOTIF boundary guarantee under perception noise interference.

[0066] Intra-layer constraints of the decision-making layer: State transition stability constraints are constructed within the decision-making layer. To suppress frequent system command switching (i.e., "oscillation") caused by minor fluctuations in perceived data, this embodiment embeds hysteresis constraints into the model. The logical rule is defined as follows: the decision threshold for the system to revert from a higher-order intervention state to a lower-order state must be greater than the trigger threshold when entering that state, and a set hysteresis constant is added. .

[0067] In the formal model, the threshold for backtracking from a higher-order intervention state to a lower-order state must satisfy [a certain condition]. ,in θ is the set hysteresis constant. back θ represents the threshold for determining whether the system reverts from a higher-order intervention state (such as maximum emergency braking) to a lower-order state (such as partial braking or warning state). trigger This represents the trigger threshold corresponding to entering this higher-order intervention state. By embedding such timing invariants into the model, this method can verify the smoothness and stability of AEB logic in executing instructions under extreme dynamic conditions.

[0068] Furthermore, the Isabelle / HOL proof lemma is used to ensure that the system can only be in a single decision state of warning, partial braking or emergency braking at any discrete time point, thus eliminating logical conflicts.

[0069] Intra-layer constraints of the execution constraint layer: An environment-adaptive physical constraint model is constructed within the execution layer. This constraint model dynamically calculates the maximum braking force boundary that the vehicle can achieve at the moment (i.e., based on the real-time acquired road adhesion coefficient and road slope) This constraint, as a physical invariant within the layer, is used to limit the feasible range of control inputs, ensuring that formal verification can detect whether the preset braking strategy exceeds physical limits under specific operating conditions (such as low-adhesion road surfaces).

[0070] Construct an interaction model between different functional levels. This interaction model describes the decoupling and collaborative working mechanisms between each level based on data flow and temporal dependencies.

[0071] Triggering interactions for perceived decisions: Describing the logical predicates generated by the perception layer (Trigger(S)). p How does the decision-making layer state machine evolve? When the risk probability determined by the perception layer exceeds the uncertainty constraint within the layer, the interaction interface will generate a trigger signal to guide the decision-making layer from the "normal state" to the corresponding "intervention state".

[0072] Control mapping from decision to execution: This describes how the decision scheme output by the decision layer is mapped to the control input function u of the execution layer. The interaction model requires that data transfer, state evolution, and timing constraints between different layers must maintain strong consistency, and logical decoupling of each functional stage is achieved through inter-layer interfaces.

[0073] S4. Define system security attributes that include trigger rationality, response timing and execution security, and transform them into formal verifiable security constraints.

[0074] Based on the complete hierarchical formal model constructed in step S3, this invention extracts and defines the core security requirements that AEB logic must satisfy, and transforms these security attributes described in natural language or engineering specifications into formal security constraints that can be read and proven by verification tools such as Isabelle / HOL. Specific implementation methods are as follows:

[0075] The core safety attributes are defined and classified according to the safety expectations and system requirements of autonomous driving. This embodiment divides the safety attributes that the AEB logic should satisfy into the following three dimensions:

[0076] Emergency braking triggering rationality constraint: This constraint aims to ensure that the system can intervene accurately in real dangerous scenarios while avoiding false triggering. Specifically, it is a minimum safe distance constraint based on the relative state of the vehicle and the obstacle. In its formal definition, it requires that when the predicted collision time (TTC) or relative distance output by the perception model exceeds the confidence-weighted safety threshold, the system must trigger the corresponding intervention command, thereby ensuring the core "collision avoidance" bottom line.

[0077] Emergency braking response timing constraints: This constraint focuses on the temporal relationship between emergency braking triggering conditions and braking execution. Specifically, it is a constraint that, after the emergency braking triggering conditions are met, braking decision-making and braking execution must be completed within a preset time range. By introducing timing logic extensions, this constraint can verify whether the system, when facing sudden dangers, exhibits a fatal "response lag" due to improper state machine transition design.

[0078] Braking execution safety constraints: These constraints focus on the physical boundaries and stability of the underlying execution, extracted based on vehicle dynamics and braking capabilities. Specifically, they are braking strength and stability constraints, requiring that the control commands output by the system must not violate environmental adaptive physical constraints such as the road adhesion coefficient under any circumstances, ensuring that the vehicle will not lose control due to brake lock-up or exceeding physical limits during emergency braking.

[0079] Formal transformation of security attributes: To enable the aforementioned system-level security attributes to be verified by machine-aided theorem provers, this invention rigorously transforms them into three types of mathematical attributes (theorems or lemmas) under higher-order logic (HOL) and temporal logic:

[0080] Triggerability attribute: Transforms the rationality of triggering into a reachability proof. Formalized as: For any condition satisfying the danger determination (perception vector S)... p In an environment where the system falls into a danger zone, all possible paths in the system state evolution diagram must eventually reach the "Emergency Braking" state. This property theoretically eliminates the safety blind spot caused by false negatives.

[0081] Consistency property: Used to ensure the determinism of decision-making logic. Translated into a higher-order logical expression: When the input is an equivalent perceptual vector S... p At that time, the decision state S output after mapping by the decision-making layer d It must be unique and definitive. This ensures that, under the same critical state, the system will not generate ambiguous or contradictory control commands.

[0082] Invariant properties: Transform execution safety into identity theorems that persist throughout the entire system's lifecycle. Prioritize defining core invariants such as "maximum braking force does not exceed the physical adhesion limit" or "the distance between the vehicle and the target is always greater than 0." These invariants must always be true (True) regardless of how the system state dynamically evolves, across all verification steps.

[0083] S5. Input the hierarchical model and security constraints into the formal verification platform to perform security verification, analyze whether there are logical paths that violate the system security attributes, and output the final verification results.

[0084] This invention maps the constructed hierarchical formal model and defined security constraints into machine-verifiable theoretical documents, and utilizes formal proof tools to complete rigorous derivation of the entire state space, counterexample extraction, and rule optimization. The specific implementation includes the following core steps:

[0085] (1) Formal mapping and semantic parsing: Using semantic analysis tools, the emergency braking rules described in natural language are deeply analyzed and structured, and their core predicates are extracted and mapped into standardized logical expressions that conform to the Isabelle / HOL grammar. For example, when realizing the formal connection between the perception layer and the decision layer, the uncertainty constraints of the perception layer are mapped to the following Isabelle / HOL theoretical fragment:

[0086] definition Trigger_Uncertainty :: "state_vector bool" where

[0087] "Trigger_Uncertainty Sp ≡

[0088] ( delta. abs delta ≤ (error_bound Sp) ∧

[0089] (dist Sp + delta < θ d * (confidence_weight Sp)))"

[0090] The `Trigger_Uncertainty` function is defined as "the sensing trigger condition considering uncertainty," `state_vector` represents the type of environmental sensing state vector acquired by the sensor, `Sp` represents the input parameter, i.e., the state vector, `abs delta` represents the absolute value of any possible deviation value `delta` within the measurement error range, `error_bound Sp` returns the measurement error boundary of the current sensor in state `Sp`, `dist Sp` returns the distance of the current sensor in state `Sp`, and θ... d " represents the preset distance safety threshold" and "confidence_weight Sp" represents the confidence weight of target recognition under state Sp, which is used to dynamically adjust the safety threshold according to the perceived reliability.

[0091] This code uses interval logic to model the uncertainty of the perception layer. By introducing a deviation variable delta that is constrained by the error boundary (error_bound) and combining it with a safety threshold that is dynamically adjusted based on confidence_weight, a safety verification mechanism under worst-case conditions is constructed. Its core logic is that as long as any potential real location within the sensor's measurement range triggers the confidence-weighted safety boundary, the system determines that an intervention state is required. This mathematically ensures that the emergency braking logic can still meet the stringent requirements of SOTIF under the interference of perception noise.

[0092] The above logical definition means that by introducing a bias variable delta, which is constrained by the sensor measurement error boundary (error_bound), and combining it with a safety threshold θ that is dynamically adjusted based on the target recognition confidence weight, the following approach is taken: d The core logic is that as long as any potential true location within the measurement error range triggers the confidence-weighted safety boundary, the system determines that the predicate is true, thus mathematically ensuring that the AEB logic still meets the SOTIF requirement under perceptual noise interference. Simultaneously, to ensure the consistency of the decision logic, mutually exclusive invariants such as lemma state_uniqueness are defined in the model to ensure that at any discrete time point, the same perceptual vector S... p Decision state S of the mapping output d (Such as Normal, Warning, or EmergencyBrake) must be unique.

[0093] (2) Verify the execution of the engine (consistency and reachability verification), combined with Figure 3As shown, the generated theoretical documents and extracted security attributes are received by the input interface and distribution unit, and then distributed to the underlying Isabelle / HOL formal verification platform. Utilizing the platform's high-order logic reasoning kernel and automated proof strategy (or interactive proof script), a rigorous security verification task is performed on the emergency braking logic, specifically including:

[0094] Consistency verification: Determine whether there are logical conflicts or constraint contradictions between different functional levels (e.g., check whether there is a temporal vacuum between the perception trigger interval and the decision lag constraint).

[0095] Reachability verification: Performs reachability analysis on preset security attributes to check whether there are system operating states that violate security constraints under extreme combinations such as dynamic physical boundary constraints.

[0096] (3) Illegal path extraction and automated scenario generation: The system executes branch logic based on the feedback from the inference engine: if the proof is successful, the decision is deemed safe and the conclusion is officially output; if the verification fails, the automated scenario generation process is triggered.

[0097] When the proof engine outputs a logical path that violates safety attributes (a counterexample), the system automatically extracts the state variables and time series information of each functional level from the counterexample. Subsequently, these formalized state variables are inversely mapped to specific physical parameters in the simulation environment (such as specific relative speeds, extremely low road adhesion coefficients, and sensor limit errors), and a description file conforming to the OpenSCENARIO standard is automatically generated. This file can be imported into the simulation testing system to accurately reproduce logical conflicts in the form of physical simulation, greatly reducing the cost of finding and reproducing boundary scenarios.

[0098] Data mining and rule optimization of the logical evolution path: In order to achieve continuous closed-loop optimization of the AEB logic, this invention performs in-depth analysis on the data generated during the verification process.

[0099] Path transactionalization: Record the logical evolution path in the verification and convert it into a transactional dataset containing states and constraints (e.g., map triggering conditions as "Trigger1" and decision conflicts as "Conflict1").

[0100] Rule mining: A minimum coverage threshold of 0.9 (i.e., attributes must cover at least 90% of the paths) and a minimum consistency score of 0.95 are set. Validation rules are generated using inference techniques, and coverage and consistency scores are calculated to filter and identify potential hidden security vulnerabilities.

[0101] Attribute Clustering and Validation Tree Construction: Based on the validation results, a similarity metric algorithm is used to measure the correlation between attributes, clustering different types of security attributes and violation characteristics into several categories. Based on the clustering results and the common features of each attribute, validation requirements are determined, and optimization rules are derived from positive and negative examples using logical reasoning. Subsequently, the common features of each attribute type are used as nodes to construct a "validation tree" and generate branching rules. Finally, these optimization rules are fed back and embedded into the original decision model for comparative experiments to quantitatively evaluate the change in the incidence of security vulnerabilities before and after validation.

[0102] This completes the closed-loop process of emergency braking logic safety verification, from abstraction of original elements to formal verification and rule optimization. This invention achieves systematic safety analysis of AEB logic through a layered formal modeling and safety verification method encompassing the above steps. Compared to existing technologies, this invention significantly reduces model complexity and improves verification efficiency while ensuring verification rigor, and effectively compensates for the shortcomings of traditional simulation testing in extreme and uncovered scenarios.

[0103] like Figure 2 , Figure 3 As shown, the present invention also provides a hierarchical formal modeling and safety verification system for emergency braking logic of autonomous driving, which includes:

[0104] Logic Analysis Module: Acquires and abstracts environmental perception information, vehicle operating status parameters, emergency braking trigger conditions, and braking control constraints related to emergency braking of autonomous driving, forming the basic formal elements of emergency braking logic;

[0105] Hierarchical modeling module: The emergency braking logic is divided into multiple functional levels according to the processing flow of the emergency braking logic, and formal modeling is performed on each level.

[0106] Hierarchical formal model construction module: Constructs hierarchical formal models, which include hierarchical logical relationship models that describe the constraint relationships between logical rules within the same level, and hierarchical interaction relationship models that describe the data transmission relationships, state evolution relationships, and timing constraint relationships between different functional levels.

[0107] Constraint building module: Defines system security attributes including trigger rationality, response timing and execution security, and transforms them into formal verifiable security constraints;

[0108] Verification and Analysis Module: Input the hierarchical formal model and security constraints into the formal verification platform to perform security verification, analyze whether there are logical paths that violate the system's security attributes, and output the verification results.

[0109] Each module communicates with the other in turn, working together to form a complete verification loop.

[0110] In terms of actual deployment and application, such as Figure 4 The simplified application scenario diagram illustrates that the aforementioned layered formal modeling and safety verification system can interact with external terminal devices via a network. Users send information about the autonomous driving system to be verified (such as perception data or control rules) to the system backend via their terminal devices. After completing complex logical analysis and theorem proofs, the system pushes the proof results, counterexample paths, and automatically generated simulation scenarios to the display interface. This terminal- and display-based architecture essentially provides an intuitive visualization tool for the AEB verification process. It transforms the obscure underlying mathematical derivations into a clear display of safety attribute verification results, enabling testing and R&D personnel to directly view the performance of the AEB logic under extreme conditions through the interface, thereby more efficiently locating logical defects and guiding subsequent optimization.

[0111] It is readily understood that the implementation of the methods in the above embodiments can be based on a computer program, which is a set of instructions that can be executed by a computer (i.e., by a processor). When executed by the processor, the computer program implements a hierarchical formal modeling and safety verification method for the emergency braking logic of autonomous driving.

[0112] Furthermore, at least some of the computer programs associated with the methods of the embodiments can be distributed in a computer program product including a computer-readable storage medium carrying computer-usable instructions for one or more processors. This computer-readable storage medium can be provided in various forms, including non-transitory forms, such as, but not limited to, one or more disks, optical discs, magnetic tapes, chips, and magnetic and electronic storage. Further, the computer program can also be stored in a memory, which is part of an electronic device that also has a processor electrically connected to the memory. The computer program stored in the memory can be executed by the processor, thereby implementing a hierarchical formal modeling and safety verification method for emergency braking logic in autonomous driving.

Claims

1. A hierarchical formal modeling and safety verification method for emergency braking logic in autonomous driving, characterized in that, include: S1. Obtain environmental perception information, vehicle operating status parameters, emergency braking trigger conditions, and braking control constraints related to autonomous driving emergency braking, and abstract them to form the basic formal elements of emergency braking logic. S2. Based on the aforementioned basic formal elements, the emergency braking logic is divided into multiple functional levels according to the processing flow of the emergency braking logic, and formal modeling is performed on each level respectively. S3. Construct a hierarchical formal model, which includes an intra-level logical relationship model describing the constraint relationships between logical rules within the same level, and an inter-level interaction relationship model describing the data transfer relationship, state evolution relationship, and timing constraint relationship between different functional levels. S4. Define system security attributes that include trigger rationality, response timing, and execution security, and transform them into formal verifiable security constraints. S5. Input the hierarchical formal model and security constraints into the formal verification platform to perform security verification, analyze whether there are logical paths that violate the system security attributes, and output the verification results.

2. The hierarchical formal modeling and safety verification method for emergency braking logic in autonomous driving according to claim 1, characterized in that, The abstraction in step S1 forms the basic formal elements of the emergency braking logic, including: abstracting the environmental perception information and the relative motion state of the main vehicle into a target state vector containing relative distance, relative speed, predicted collision time, and target classification confidence; and abstracting the system's maximum braking capacity into a mechanical inequality. u is the braking force output, μ is the road surface adhesion coefficient, α is the road slope, m is the vehicle mass, and g is the gravitational acceleration; the system response time parameter is abstracted as the clock step or state transition delay in the logic state machine.

3. The hierarchical formal modeling and safety verification method for emergency braking logic in autonomous driving according to claim 2, characterized in that, The functional hierarchy includes a perception triggering layer, a decision-making layer, and an execution constraint layer. The perception triggering layer describes the emergency braking triggering conditions based on environmental perception information; the decision-making layer describes the decision rules for the emergency braking strategy; and the execution constraint layer describes the braking control constraints during the braking execution process.

4. The hierarchical formal modeling and safety verification method for emergency braking logic in autonomous driving according to claim 3, characterized in that, The sensing triggering layer formalizes the emergency braking triggering condition as a logical predicate Trigger(S) p ), and defined as , among which, S p Let ttc represent the target state vector, d represent the estimated collision time, and θ represent the relative distance. ttc With θ d These are preset safety thresholds, used to characterize the safety boundaries of the system under different operating conditions; the decision-making layer models the emergency braking logic as a multi-state state transition system, including normal driving state, visual / auditory warning state, partial braking state, and maximum emergency braking state, with the state transition logic as: θ partial ≤ttc<θ warn At that time, the system switches from normal driving mode to visual / auditory warning mode, θ emergency ≤ttc<θ partial At that time, it enters a partial braking state, ttc < θ emergency At that time, the maximum emergency braking state is triggered, θ warn θ partial and θ emergency Here, θ represents the hazard level threshold. warn θ partial and θ emergency Satisfying θ warn >θ emergency >θ partial The execution constraint layer abstracts the emergency braking execution behavior into a control input function u=f(S). d ,C),S d C represents the current system decision state, and C represents the set of constraints related to vehicle dynamics and actuators.

5. The hierarchical formal modeling and safety verification method for emergency braking logic in autonomous driving according to claim 3, characterized in that, The hierarchical logic of the perception triggering layer is that if any potential real state within the sensor measurement error range triggers the confidence-weighted safety boundary, the system determines that an intervention state is required. The hierarchical logic of the decision-making layer is that the decision threshold for the system to fall back from a higher-order intervention state to a lower-order state must be greater than the trigger threshold when entering that state, and a set hysteresis constant is added. The hierarchical logical relationship within the execution constraint layer is as follows: .

6. The hierarchical formal modeling and safety verification method for emergency braking logic of autonomous driving according to claim 1, characterized in that, In step S4, the safety constraint for triggering reasonableness is the minimum safe distance constraint based on the relative state of the vehicle and the obstacle; the safety constraint for response timing is the constraint condition for completing braking decision and braking execution within a preset time range after the emergency braking trigger condition is met; the safety constraint for execution safety is that the control commands output by the system must not violate the environmental adaptive physical constraint of the road adhesion coefficient under any circumstances. .

7. The hierarchical formal modeling and safety verification method for emergency braking logic of autonomous driving according to claim 1, characterized in that, The security verification in step S5 includes: consistency verification to determine whether there are logical conflicts or constraint contradictions between different functional levels; and accessibility analysis for preset security attributes to check whether there is a system operating state that violates security constraints under extreme combinations such as dynamic physical boundary constraints.

8. An electronic device, characterized in that, The electronic device includes: at least one processor; and a memory communicatively connected to the at least one processor; The memory stores a computer program that can be executed by the at least one processor, which is then executed by the at least one processor to enable the at least one processor to perform the hierarchical formal modeling and safety verification method for emergency braking logic of autonomous driving as described in any one of claims 1 to 7.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that enables a processor to implement, when executed, the hierarchical formal modeling and safety verification method for emergency braking logic of autonomous driving as described in any one of claims 1 to 7.

10. A computer program product, the computer program product comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the hierarchical formal modeling and safety verification method for emergency braking logic of autonomous driving as described in any one of claims 1 to 7.

Images