An FMEA risk assessment method, system, computer device and storage medium for functional safety hardware product development

Abstract

The application provides an FMEA risk assessment method and system for functional safety hardware product development, a computer device and a storage medium, and comprises the following steps: obtaining a double failure chain of a target product; obtaining a first evaluation dimension and a first functional safety characteristic parameter for evaluating a potential systematic failure risk, and constructing a third evaluation dimension; obtaining a second evaluation dimension and a second functional safety characteristic parameter for evaluating a potential random hardware failure risk, and constructing a fourth evaluation dimension; evaluating the risk of a potential systematic failure related to the safety of the target product according to the third evaluation dimension; and evaluating the risk of a potential random hardware failure related to the safety of the target product according to the fourth evaluation dimension. The scheme can directly associate risk assessment with functional safety requirements, and can simultaneously analyze the safety risks of systematic failure and random hardware failure, thereby improving the accuracy of product safety-related risk assessment.

Description

Technical Field

[0001] This invention relates to the field of functional safety hardware product development technology, and more particularly to an FMEA risk assessment method, system, computer equipment, and storage medium for functional safety hardware product development. Background Technology

[0002] In the development of functional safety hardware products, FMEA (Failure Mode and Effects Analysis) is one of the core tools for identifying and mitigating safety risks. Traditional FMEA (DFMEA / PFMEA / FMEA-MSR) generally adopts the "seven-step method" from the AIAG & VDA FMEA manual as its analysis process, including: Step 1: Planning and Preparation; Step 2: Structural Analysis; Step 3: Functional Analysis; Step 4: Failure Analysis; Step 5: Risk Analysis; Step 6: Optimization; Step 7: Results Documentation. Specifically, when conducting risk analysis and corresponding optimization, traditional FMEA primarily assesses design-related failure risks and the necessity and priority of optimization measures (DAP, O, S) based on three dimensions: severity (S), frequency (O), and detectability (D) of product failures.

[0003] However, traditional FMEA has significant limitations in its requirements for functional safety analysis. Functional safety standards need to address two types of failures: systemic failures (which can be avoided through technical specifications, development processes, etc.) and random hardware failures (which cannot be avoided and require safety mechanisms to diagnose such failures (including failure detection and / or failure response) to guide the product or the system it resides in into a safe state to mitigate safety risks).

[0004] Existing traditional DFMEA focuses on analyzing and addressing potential design-related failures (corresponding to systematic failures in functional safety standards), but cannot cover potential random hardware failures. Therefore, there is an urgent need for a hardware product development FMEA risk assessment method that can simultaneously analyze both systematic and random hardware failures and meet functional safety standard compliance requirements. Summary of the Invention

[0005] The purpose of this invention is to provide a method, system, computer device, and storage medium for FMEA risk assessment in the development of functional safety hardware products. This method can directly link risk assessment with functional safety requirements and can simultaneously analyze systematic failures and random hardware failures, thereby improving the accuracy, compliance, and adaptability of product safety risk assessment.

[0006] The technical solution provided by this invention is as follows: Firstly, this application provides an FMEA risk assessment method for the development of functional safety hardware products, including: Obtain the dual failure chains for each element in the target product structure, including potential systemic failure chains and potential random hardware failure chains; and confirm whether each potential failure chain is security-related, where security-related means that the occurrence of the failure would lead to a violation of security objectives or top-level security requirements; Obtain a first assessment dimension for evaluating potential systemic failures related to safety, and a first functional safety characteristic parameter; the first assessment dimension includes the first severity, frequency, and detectability of the potential systemic failure of the element; the first functional safety characteristic parameter includes at least the highest ASIL level; Obtain a second assessment dimension for evaluating potential random hardware failures related to safety, and a second functional safety characteristic parameter; the second assessment dimension includes the second severity, frequency, and diagnostic capability of the potential random hardware failure of the element; the second functional safety characteristic parameter includes at least the highest ASIL level of the failure element, the failure rate, and the failure diagnosis coverage of existing safety mechanisms. For potential systemic failures related to safety, a third assessment dimension is constructed by combining the first assessment dimension with the first functional safety characteristic parameters to assess the risk of potential systemic failures related to safety. For potential random hardware failures related to safety, a fourth evaluation dimension is constructed to assess the risk of potential random hardware failures related to safety by replacing the evaluation parameters in the second evaluation dimension with the second functional safety characteristic parameters. In the risk assessment process of the potential systemic failure chain related to safety, the risk of potential systemic failure related to the safety of the target product is assessed according to the third assessment dimension to obtain a first safety risk assessment result. The first safety risk assessment result is the priority of optimization actions for the potential systemic failure. In the risk assessment process of the potential random hardware failure chain related to security, the risk of potential random hardware failure related to security of the target product is assessed according to the fourth assessment dimension to obtain a second security risk assessment result. The second security risk assessment result includes the priority of optimization actions for the potential random hardware failure and the failure diagnosis coverage target to be optimized.

[0007] In some implementations, prior to obtaining the dual failure chain for each element in the target product structure, the following steps are also included: The target product structure is decomposed and analyzed layer by layer from high to low, and the position and interaction relationship of each element in the product structure are defined, including the first element identified as a security mechanism and the second element identified as a security-related expected function. The function of each element in the product structure is analyzed, including the safety-related expected functions undertaken by the identified second element, and the failure detection and / or failure response functions undertaken by the identified first element.

[0008] For potential failures of expected functions, the potential failures of expected functions are classified into single-point failures, latent failures, and other types of failures based on the failure type.

[0009] In some implementations, a third assessment dimension is constructed by combining the first assessment dimension with the first functional safety characteristic parameter to assess potential systemic failure risks related to safety, including: Establish a mapping relationship between the first functional safety characteristic parameter and the first severity in the first evaluation dimension to form the third severity in the third evaluation dimension. The third evaluation dimension includes the third severity, frequency, and detectability of the potential systemic failure of the element. The first severity in the first assessment dimension is directly replaced by the first functional safety characteristic parameter to form the third assessment dimension. The third assessment dimension includes at least the frequency, detectability, and highest ASIL level of potential systemic failure of the element.

[0010] In some implementations, during the risk assessment of the potential systemic failure related to security, the third assessment dimension is used to conduct an independent risk assessment of each of the first and second elements to obtain the first security risk assessment result for addressing the potential systemic failure.

[0011] In some embodiments, the FMEA risk assessment method for developing functional safety hardware products provided in this application further includes: In the risk assessment of the potential random hardware failure chain related to security, the fourth assessment dimension is used to conduct an independent risk assessment for each of the first and second elements from the dimensions of highest ASIL level, failure rate, and failure diagnosis coverage of existing security mechanisms; or, an independent risk assessment is conducted for each of the first and second elements from the dimensions of highest ASIL level, failure rate, functional role, failure type, and failure diagnosis coverage of existing security mechanisms. To obtain the second security risk assessment results for dealing with potential random hardware failures.

[0012] In some embodiments, the FMEA risk assessment method for developing functional safety hardware products provided in this application further includes: Obtain the functional safety information of the target product, and annotate the functional safety information of each identified first element and each identified second element; Determine the failure diagnosis function undertaken by each of the first elements for the corresponding second elements, wherein the diagnosis function includes failure detection function, or failure response function, or failure detection and failure response function. For potential systemic failures of the expected functions of elements, construct a potential systemic failure chain that includes failure causes, failure modes, and failure effects; and establish a traceability relationship between failures and safety objectives / top-level safety requirements. For potential random hardware failures of expected functional elements, a potential random hardware failure chain is constructed for expected functional elements without the first element configured, including failure cause, failure mode, and failure impact; for expected functional elements with the first element configured, a potential random hardware failure chain is constructed, including failure cause, failure mode, failure impact, failure diagnosis, and mitigation impact; and a traceability relationship between failure and safety objectives / top-level safety requirements is established.

[0013] In some implementations, after obtaining the first security risk assessment result and the second security risk assessment result, the method further includes: Based on the first security risk assessment results and the second security risk assessment results, formulate corresponding optimization measures to avoid or reduce security risks, and evaluate the effectiveness of the optimization measures until the mitigation of security risks reaches the target requirements; Record the analysis process and results, and generate an FMEA report document in accordance with functional safety standards.

[0014] Secondly, this application provides an FMEA risk assessment system for the development of functional safety hardware products, comprising: The first acquisition module is used to acquire the dual failure chains of each element in the target product structure, the dual failure chains including potential systemic failure chains and potential random hardware failure chains; and to confirm whether each potential failure chain is security-related, the security-related meaning that the occurrence of the failure would lead to a violation of security objectives or top-level security requirements; The second acquisition module acquires a first assessment dimension for evaluating potential systemic failures related to safety, and a first functional safety characteristic parameter; the first assessment dimension includes the first severity, frequency, and detectability of the potential systemic failure of the element; the first functional safety characteristic parameter includes at least the highest ASIL level; The third acquisition module acquires a second assessment dimension for evaluating potential random hardware failures related to safety, and a second functional safety characteristic parameter; the second assessment dimension includes the second severity, frequency, and diagnostic capability of the potential random hardware failure of the element; the second functional safety characteristic parameter includes at least the highest ASIL level of the failure element, the failure rate, and the failure diagnosis coverage of existing safety mechanisms. The first construction module is used to construct a third assessment dimension for assessing the risk of potential systemic failures related to safety, by combining the first assessment dimension with the first functional safety characteristic parameters. The second building module is used to construct a fourth evaluation dimension for assessing the risk of potential random hardware failures related to safety by replacing the evaluation parameters in the second evaluation dimension with the second functional safety feature parameters. The first assessment module is used to assess the risk of potential systemic failures related to the safety of the target product according to the third assessment dimension during the risk assessment process of the potential systemic failure chain related to safety, and obtain a first safety risk assessment result. The first safety risk assessment result is the priority of optimization actions for the potential systemic failure. The second assessment module is used to assess the risk of potential random hardware failures related to the safety of the target product according to the fourth assessment dimension during the risk assessment process of the potential random hardware failure chain related to safety, and obtain a second safety risk assessment result. The second safety risk assessment result includes the priority of optimization actions for the potential random hardware failures and the failure diagnosis coverage target to be optimized.

[0015] Thirdly, this application provides a computer device including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the FMEA risk assessment method for developing functional safety hardware products as described in the first aspect.

[0016] Fourthly, this application provides a computer storage medium storing a computer program or instructions thereon, wherein when the computer program or instructions are executed by a processor, the steps of the FMEA risk assessment method for developing functional safety hardware products described in the first aspect are implemented.

[0017] The FMEA risk assessment method, system, computer equipment, and storage medium for functional safety hardware product development provided by this invention have at least the following technical effects: 1) This solution avoids underestimating the safety risks of safety elements by dynamically associating functional safety characteristic parameters; at the same time, it can use the functional safety characteristic parameter set to quickly assess the necessity of safety mechanisms and diagnostic capability requirements, thereby providing a basis for the design of safety mechanisms and the formulation and verification of safety concepts and safety strategies for the final product.

[0018] 2) This solution can directly embed relevant assessment logic into traditional FMEA tools to meet functional safety standard compliance requirements; it can avoid duplication of work between FMEA analysis and functional safety analysis, improve analysis efficiency, and reduce the preparation time of compliant safety deliverables.

[0019] 3) This solution supports seamless upgrades of existing FMEA tools without major changes to the analysis workflow framework; and through configurable parameters, it allows for dynamic adjustment of scoring strategies according to different project needs, and can adapt to future revisions of new standards. Attached Figure Description

[0020] The preferred embodiments will now be described in a clear and easy-to-understand manner, with reference to the accompanying drawings, to further explain the above-mentioned characteristics, technical features, advantages, and implementation methods of this solution.

[0021] Figure 1 This is a schematic diagram of the overall process of one embodiment of the present invention; Figure 2 This is a schematic diagram of the system structure according to an embodiment of the present invention.

[0022] The numbers in the diagram are: 10 - First acquisition module; 20 - Second acquisition module; 30 - Third acquisition module; 40 - First construction module; 50 - Second construction module; 60 - First evaluation module; 70 - Second evaluation module. Detailed Implementation

[0023] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the specific implementation methods of the present invention will be described below with reference to the accompanying drawings. Obviously, the drawings described below are merely some embodiments of the present invention. For those skilled in the art, other drawings and other implementation methods can be obtained based on these drawings without any creative effort.

[0024] To keep the drawings concise, only the parts relevant to the invention are shown schematically in each figure, and they do not represent the actual structure of the product. Furthermore, for ease of understanding, in some figures, only one of components with the same structure or function is shown schematically, or only one is labeled. In this document, "one" can mean not only "only one" but also "more than one".

[0025] In the development of functional safety hardware products, FMEA (Failure Mode and Effects Analysis) is one of the core tools for identifying and mitigating safety risks. Traditional FMEA generally employs a seven-step analysis process, including: Step 1: Planning and Preparation; Step 2: Structural Analysis; Step 3: Functional Analysis; Step 4: Failure Analysis; Step 5: Risk Analysis; Step 6: Optimization; and Step 7: Documentation of Results. Specifically, when conducting risk analysis and corresponding optimization, traditional FMEA primarily assesses design-related failure risks and the necessity and priority of optimization measures based on three dimensions: severity (S), frequency (O), and detectability (D) of product failure (DAP(O, D,S)).

[0026] However, traditional FMEA does not consider functional safety risk factors. Functional safety standards typically address two types of failures: systematic failures (which can be avoided through system, process, and technical measures) and random hardware failures (which cannot be avoided and can only be diagnosed through safety mechanisms (including detection and / or response) to guide the product or upper-level system into a safe state to mitigate safety risks). Traditional DFMEA processes can only analyze and assess the risk of potential design-related failures (corresponding to systematic failures in functional safety standards), but cannot assess the risk of potential random hardware failures. For potential random hardware failures, existing technologies can draw on Failure Mode and Effects Analysis-Monitoring (FMEA-MSR) to assess the risk of potential failures during product operation and evaluate optimization measures. From the perspective of functional safety hardware product design, the FMEA-MSR method can be used to assess the risk of potential random hardware failures and the corresponding safety mechanism's failure diagnosis (failure detection and / or system response) capabilities from three dimensions: severity (S), frequency (F), and diagnosability (M). However, existing technologies have the following limitations: Existing traditional DFMEA focuses on analyzing and addressing potential design-related failures (corresponding to systematic failures in functional safety standards), but cannot cover potential random hardware failures.

[0027] While FMEA-MSR aims to analyze and address potential failures during operation, and its analytical approach provides some guidance for the qualitative assessment of the diagnostic capabilities of security mechanisms (used to address potential random hardware failures), it has the following specific shortcomings when practically applied to hardware (including chips): 1) The risk parameters in FMEA-MSR reflect the combined effect of potential random hardware failures and potential systematic failures, and cannot assess the risk of random hardware failures alone; 2) The parameter evaluation standards of FMEA-MSR are usually aimed at the vehicle level or system level, lacking fine-grained evaluation of hardware (including chips); 3) Although the FMEA-MSR measurement parameters are related to the indicators for random hardware failures in the functional standards, they cannot be directly mapped.

[0028] In conclusion, FMEA-MSR is not entirely suitable for assessing the security risks of potential random hardware (including chips) failures.

[0029] Therefore, there is an urgent need for a hardware product development FMEA risk assessment method that can simultaneously analyze systematic failures and random hardware failures and meet functional safety standard compliance requirements.

[0030] This solution, while retaining the basic framework of traditional DFMEA risk analysis, enhances the risk scoring algorithm with a functional safety orientation. It integrates key functional safety parameters (highest ASIL level, functional role of elements, etc.) into the traditional DFMEA risk analysis framework to reflect the correlation between optimization measures for potential systemic failures and safety risks. Simultaneously, it analyzes the safety risks of potential random hardware failures and the necessity and priority of optimization measures (safety mechanisms), as well as failure diagnosis coverage requirements, by applying key functional safety parameters (highest ASIL level, functional role of elements, failure type, failure rate, and Fault Diagnostic Coverage of existing safety mechanisms, etc.). The following is a detailed description of this solution with reference to the accompanying figures: In one embodiment, refer to the appendix to the specification. Figure 1 This application provides a FMEA risk assessment method for the development of functional safety hardware products, including: S100. Obtain the dual failure chains for each element in the target product structure. The dual failure chains include potential systemic failure chains and potential random hardware failure chains. Confirm whether each potential failure chain is security-related. Security-related means that the occurrence of the failure would lead to a violation of security objectives or top-level security requirements.

[0031] This solution primarily improves upon steps five and six of the traditional FMEA (Design for Manufacturing) process's seven-step method. Traditional DFMEA can only analyze and assess the risk of potential design-related failures (corresponding to systematic failures in functional safety standards), deriving a failure chain typically as "failure cause → failure mode → failure effect" to identify possible failure causes, modes, and effects for each functional element. This solution comprehensively considers both potential systematic failures and potential random hardware failures, thus requiring the acquisition of a dual failure chain for each element in the target product, including both potential systematic and random hardware failure chains. Simultaneously, it confirms whether each potential failure chain is safety-related. Safety-related failures mean that their occurrence would violate safety objectives or top-level safety requirements. This application primarily targets safety-related failures; non-safety-related failures and risk analysis can be completed using traditional DFMEA.

[0032] S200. Obtain a first assessment dimension for evaluating potential systemic failures related to safety, and a first functional safety characteristic parameter; the first assessment dimension includes the first severity, frequency, and detectability of the potential systemic failure of the element; the first functional safety characteristic parameter includes at least the highest ASIL level.

[0033] For potential systemic failures related to safety, a first assessment dimension for evaluating potential systemic failures related to safety needs to be obtained. The first assessment dimension includes the first severity (S), frequency (O), and detectability (D) of the potential systemic failure of the element. At the same time, a first functional safety characteristic parameter also needs to be obtained, which includes at least the highest ASIL level.

[0034] ASIL (Automotive Safety Integrity Level) is a risk classification requirement for automotive electronic / electrical systems, based on the ISO 26262 functional safety standard. It determines the stringent safety measures that must be taken in the event of a functional failure. It categorizes risks into four levels, from low to high: ASIL A corresponds to the lowest safety requirements; ASIL B to medium safety requirements; ASIL C to higher safety requirements; and ASIL D to the highest safety requirements (failure could result in a fatal accident). Additionally, it includes a QM (Quality Management) level, indicating that it is unrelated to safety and only requires routine quality management.

[0035] The first assessment dimension is the risk assessment dimension for potential systemic failures used in the traditional FMEA process. In order to meet the functional safety requirements of the FMEA risk assessment, this application additionally obtains the first functional safety characteristic parameter. By combining the first functional safety characteristic parameter with the first assessment dimension, a new assessment dimension for assessing the risk of potential systemic failures related to safety is constructed (i.e., the third assessment dimension below).

[0036] S300, Obtain a second assessment dimension for evaluating potential random hardware failures related to safety, and a second functional safety characteristic parameter; the second assessment dimension includes the second severity, frequency, and diagnostic capability of the potential random hardware failure of the element; the second functional safety characteristic parameter includes at least the highest ASIL level of the failure element, the failure rate, and the failure diagnostic coverage of existing safety mechanisms.

[0037] For safety-related random hardware failures, a second assessment dimension is required to evaluate these failures. This second assessment dimension includes the second severity (S), frequency (F), and diagnostic capability (M) of the potential random hardware failure. Additionally, a second functional safety characteristic parameter is required, which includes at least the highest ASIL level of the failure element, the failure rate, and the failure diagnostic coverage of existing safety mechanisms.

[0038] The second assessment dimension is the assessment dimension for potential random hardware failure risk adopted by FMEA-MSR. In order to meet the functional safety requirements of FMEA risk assessment, this application additionally obtains the second functional safety characteristic parameter. By combining the second functional safety characteristic parameter with the second assessment dimension, a new assessment dimension for assessing the risk of potential random hardware failure related to safety is constructed (i.e., the fourth assessment dimension below).

[0039] S400. For potential systemic failures related to safety, a third assessment dimension is constructed by combining the first assessment dimension and the first functional safety characteristic parameters to assess the risk of potential systemic failures related to safety.

[0040] Preferably, a third assessment dimension is constructed by combining the first assessment dimension and the first functional safety characteristic parameters to assess potential systemic failure risks related to safety, including: Establish a mapping relationship between the first functional safety characteristic parameters and the first severity in the first assessment dimension to form the third severity in the third assessment dimension. The third assessment dimension includes the third severity, frequency, and detectability of potential systemic failure of the element; or directly use the first functional safety characteristic parameters to replace the first severity in the first assessment dimension to form the third assessment dimension. The third assessment dimension includes at least the frequency, detectability, and highest ASIL level of potential systemic failure of the element.

[0041] ASIL ratings are used to quantify the safety severity of a failure's impact. All other things being equal, a higher ASIL rating indicates a higher safety severity after a failure. Since ASIL (S, E, C) also has a failure impact score (S), the scoring criteria differ from traditional DFMEA. For example, a very high failure impact score (typically 10 or 9) indicates an impact on the operational safety of the vehicle and / or other vehicles, the health of the driver, passengers, road users, or pedestrians, or non-compliance with regulations. Therefore, this solution can construct a mapping relationship between the first functional safety characteristic parameter and the first severity score in the first assessment dimension based on predefined mapping rules to form the third severity score in the third assessment dimension. In this case, the third assessment dimension includes the third severity, frequency, and detectability of the element's potential systemic failure. The predefined mapping rules can be adjusted according to the usage scenario or defined with reference to historical data; this application does not impose any restrictions. Alternatively, the first functional safety characteristic parameter can be directly used to replace the first severity score in the first assessment dimension to form the third assessment dimension. In this case, the third assessment dimension at least includes the frequency, detectability, and highest ASIL rating of the element's potential systemic failure.

[0042] S500: For potential random hardware failures related to safety, a fourth assessment dimension is constructed to assess the risk of potential random hardware failures related to safety by replacing the assessment parameters in the second assessment dimension with the second functional safety characteristic parameters.

[0043] To address the risk of random hardware failure, the primary assessment focuses on the necessity of configuring safety mechanisms for elements performing the intended safety functions and the required diagnostic capabilities. However, the FMEA-MSR risk assessment parameters and functional safety-related parameters cannot be directly mapped. For example, the FMEA-MSR risk assessment parameter F represents frequency (the probability of a failure occurring); risk assessment parameters related to core functional safety parameters include exposure E (the duration or frequency of a specific driving scenario), the failure rate λ of electronic components (caused by random hardware failure), and the Probabilistic Metric for Hardware Failure (PMHF). There is an indirect correlation between the two (higher E / λ / PMHF corresponds to higher F), but a clear quantitative mapping relationship is lacking. Similarly, the FMEA-MSR risk assessment parameter M represents failure diagnostic capability (the system's or personnel's ability to detect and / or respond to failures); risk assessment parameters related to core functional safety parameters include controllability C (personnel's ability to control and mitigate failures) and the coverage of safety mechanisms for failure diagnosis (detection and / or response) FDC. There is an indirect correlation between the two (both are related to the degree of safety risk mitigation), but a clear quantitative mapping relationship is lacking. Therefore, this application cannot directly establish a mapping relationship between the fourth evaluation dimension and the second evaluation dimension. Instead, it replaces the evaluation parameters in the second evaluation dimension with the second functional safety characteristic parameters to achieve risk assessment of random hardware failure.

[0044] S600. In the risk assessment process of potential systemic failure chains related to safety, the risk of potential systemic failures related to the safety of the target product is assessed according to the third assessment dimension to obtain the first safety risk assessment result. The first safety risk assessment result is the priority of optimization actions for potential systemic failures.

[0045] S700. In the risk assessment process of potential random hardware failure chains related to security, the risk of potential random hardware failures related to the security of the target product is assessed according to the fourth assessment dimension to obtain the second security risk assessment result. The second security risk assessment result includes the priority of optimization actions for potential random hardware failures and the failure diagnosis coverage target to be optimized.

[0046] This solution enables a direct link between risk assessment and functional safety requirements, and can simultaneously analyze systemic failures and random hardware failures, thereby improving the accuracy, compliance, and adaptability of product risk assessment.

[0047] In one embodiment, prior to obtaining the dual failure chain of each element in the target product structure, based on the foregoing embodiments, the method further includes: The target product structure is decomposed and analyzed layer by layer from top to bottom. The position and interaction relationships of each element in the product structure are defined, including the identified primary element used as a safety mechanism and the identified secondary element responsible for safety-related expected functions. The function of each element in the product structure is analyzed, including the safety-related expected functions of the identified secondary element and the failure detection and / or failure response functions of the identified primary element. Potential failures of expected functions are classified into single-point failures, latent failures, and other types of failures based on their failure type.

[0048] In addition to the functional safety standard's common classification of failure types as systemic failures and random hardware failures, failures themselves can also be categorized into single-point failures (lack of safety mechanisms), latent failures (multi-point failures that cannot be detected by safety mechanisms or perceived by the driver), and other types of failures (failure types other than single-point and latent failures). This application, when conducting risk assessments of the target product, can not only decompose and analyze the target product structure layer by layer from high to low, defining the position and interaction relationships of each element in the product structure, including the identified primary element used as a safety mechanism and the identified secondary element used to perform safety-related expected functions; it can also assess the severity of safety risks corresponding to different failure types (single-point failures / latest failures / other types of failures), making the risk assessment more comprehensive and accurate.

[0049] Specifically, in the risk assessment process of potential systemic failure chains, the function of each element in the product structure is analyzed, including the safety-related expected functions undertaken by the identified second element, and the failure detection and / or failure response functions undertaken by the identified first element.

[0050] Preferably, before obtaining the dual failure chain of each element in the target product structure, the method further includes: Obtain functional safety information of the target product and label the functional safety information of each identified first element and each identified second element; determine the failure diagnosis function undertaken by each first element, including failure detection function, failure response function, or failure detection and failure response function; construct a potential systemic failure chain containing failure cause, failure mode, and failure impact for potential systemic failures of the element's expected function, and establish a traceability relationship between failure and safety objectives / top-level safety requirements. For potential random hardware failures of expected functional elements, a potential random hardware failure chain is constructed for expected functional elements without the first element configured, including failure cause, failure mode, and failure impact; for expected functional elements with the first element configured, a potential random hardware failure chain is constructed, including failure cause, failure mode, failure impact, failure diagnosis, and mitigation impact, and a traceability relationship between failure and security objectives / top-level security requirements is established.

[0051] Preferably, in the risk assessment process for potential systemic failures related to safety, a third assessment dimension is used to conduct independent risk assessments on each of the first and second elements to obtain the first safety risk assessment results for addressing potential systemic failures.

[0052] Preferably, in the risk assessment process of potential random hardware failure chains related to security, a fourth assessment dimension is used to conduct independent risk assessments on each of the first and second elements from the dimensions of the highest ASIL level, failure rate, and failure diagnosis coverage of existing security mechanisms; or independent risk assessments are conducted on each of the first and second elements from the dimensions of the highest ASIL level, failure rate, functional role, failure type, and failure diagnosis coverage of existing security mechanisms; in order to obtain a second security risk assessment result for addressing potential random hardware failures.

[0053] In one embodiment, based on the foregoing embodiments, after obtaining the first security risk assessment result and the second security risk assessment result, the method further includes: Based on the results of the first and second safety risk assessments, formulate corresponding optimization measures to avoid or reduce safety risks, and evaluate the effectiveness of the optimization measures until the mitigation of safety risks meets the target requirements; record the analysis process and results, and generate an FMEA report document in accordance with functional safety standards.

[0054] This solution breaks through the traditional static scoring model of FMEA and constructs a configurable functional safety characteristic parameter mapping algorithm. By establishing quantitative correlation rules between core functional safety parameters such as ASIL level, functional role of elements (expected function / safety mechanism), and failure type and traditional FMEA, it achieves automatic adaptation of risk assessment algorithms and safety requirements. Furthermore, it simultaneously handles systemic failures and random hardware failures within a single FMEA framework, solving the problem of fragmented traditional processes. Through the collaborative constraint mechanism of Failure Diagnosis Coverage (FDC) and Failure Tolerance Time Interval (FTTI), it ensures the technical feasibility of safety mechanism optimization. Moreover, as an independent algorithm module, this solution can be embedded and used without refactoring the existing FMEA process. It only requires input of failure chain data and functional safety characteristic parameters to output compliant functional safety risk assessment results, significantly reducing enterprise implementation costs. Specifically, the FMEA risk assessment method for functional safety hardware product development provided by this invention has at least the following technical effects: 1) This solution avoids underestimating the safety risks of safety elements by dynamically associating functional safety characteristic parameters; at the same time, it can use the functional safety characteristic parameter set to quickly assess the necessity of safety mechanisms and diagnostic capability requirements, thereby providing a basis for the design of safety mechanisms and the formulation and verification of safety concepts and safety strategies for the final product.

[0055] 2) This solution can directly embed relevant assessment logic into traditional FMEA tools to meet functional safety standard compliance requirements; it can avoid duplication of work between FMEA analysis and functional safety analysis, improve analysis efficiency, and reduce the preparation time of compliant safety deliverables.

[0056] 3) This solution supports seamless upgrades of existing FMEA tools without major changes to the analysis workflow framework; and through configurable parameters, it allows for dynamic adjustment of scoring strategies according to different project needs, and can adapt to future revisions of new standards.

[0057] In one embodiment, refer to the appendix to the specification. Figure 2 This application provides an FMEA risk assessment system for the development of functional safety hardware products, including: a first acquisition module 10, a second acquisition module 20, a third acquisition module 30, a first construction module 40, a second construction module 50, a first evaluation module 60, and a second evaluation module 70.

[0058] The first acquisition module 10 is used to acquire the dual failure chains of each element in the target product structure, including potential systemic failure chains and potential random hardware failure chains; and to confirm whether each potential failure chain is security-related, where security-related means that the occurrence of failure would lead to a violation of security objectives or top-level security requirements.

[0059] The second acquisition module 20 acquires a first assessment dimension for evaluating potential systemic failures related to safety, and a first functional safety characteristic parameter; the first assessment dimension includes the first severity, frequency, and detectability of the potential systemic failure of the element; the first functional safety characteristic parameter includes at least the highest ASIL level.

[0060] The third acquisition module 30 acquires a second assessment dimension for evaluating potential random hardware failures related to safety, and a second functional safety characteristic parameter. The second assessment dimension includes the second severity, frequency, and diagnostic capability of the potential random hardware failure of the element. The second functional safety characteristic parameter includes at least the highest ASIL level of the failure element, the failure rate, and the failure diagnosis coverage of existing safety mechanisms.

[0061] The first building module 40 is used to construct a third assessment dimension for assessing the risk of potential systemic failures related to safety, by combining the first assessment dimension and the first functional safety characteristic parameters.

[0062] The second building module 50 is used to construct a fourth evaluation dimension for assessing the risk of potential random hardware failures related to safety by replacing the evaluation parameters in the second evaluation dimension with the second functional safety characteristic parameters.

[0063] The first assessment module 60 is used to assess the risk of potential systemic failures related to the safety of the target product based on the third assessment dimension during the risk assessment process of potential systemic failure chains related to safety, and obtain the first safety risk assessment result. The first safety risk assessment result is the priority of optimization actions for potential systemic failures.

[0064] The second assessment module 70 is used to assess the risk of potential random hardware failures related to the safety of the target product according to the fourth assessment dimension during the risk assessment process of potential random hardware failure chains related to safety, and obtain a second safety risk assessment result. The second safety risk assessment result includes the priority of optimization actions for potential random hardware failures, and the failure diagnosis coverage target to be optimized.

[0065] The technical concept of the FMEA risk assessment system for functional safety hardware product development provided in this embodiment is the same as that of the FMEA risk assessment method for functional safety hardware product development in the previous embodiment, and will not be described again here.

[0066] In one embodiment, based on the foregoing embodiments, this application provides a computer device including a memory, a processor, and a computer program stored in the memory. The processor executes the computer program to implement the steps of the FMEA risk assessment method for developing functional safety hardware products as described in the foregoing embodiments.

[0067] In one embodiment, based on the foregoing embodiments, this application provides a computer storage medium storing a computer program or instructions thereon, wherein when the computer program or instructions are executed by a processor, the steps of the FMEA risk assessment method for developing functional safety hardware products as described in the foregoing embodiments are implemented.

[0068] It should be noted that the above embodiments can be freely combined as needed. The above description is only a preferred embodiment of the present invention. It should be pointed out that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A FMEA risk assessment method for the development of functional safety hardware products, characterized in that, include: Obtain the dual failure chains for each element in the target product structure, including a potential systematic failure chain and a potential random hardware failure chain; And confirm whether each potential failure chain is security-related, wherein the failure would cause a violation of security objectives or top-level security requirements; Obtain a first assessment dimension for evaluating potential systemic failures related to safety, and a first functional safety characteristic parameter; the first assessment dimension includes the first severity, frequency, and detectability of the potential systemic failure of the element; the first functional safety characteristic parameter includes at least the highest ASIL level; Obtain a second assessment dimension for evaluating potential random hardware failures related to safety, and a second functional safety characteristic parameter; the second assessment dimension includes the second severity, frequency, and diagnostic capability of the potential random hardware failure of the element; the second functional safety characteristic parameter includes at least the highest ASIL level of the failure element, the failure rate, and the failure diagnosis coverage of existing safety mechanisms. For potential systemic failures related to safety, a third assessment dimension is constructed by combining the first assessment dimension with the first functional safety characteristic parameters to assess the risk of potential systemic failures related to safety. For potential random hardware failures related to safety, a fourth evaluation dimension is constructed to assess the risk of potential random hardware failures related to safety by replacing the evaluation parameters in the second evaluation dimension with the second functional safety characteristic parameters. In the risk assessment process of the potential systemic failure chain related to safety, the risk of potential systemic failure related to the safety of the target product is assessed according to the third assessment dimension to obtain a first safety risk assessment result. The first safety risk assessment result is the priority of optimization actions for the potential systemic failure. In the risk assessment process of the potential random hardware failure chain related to security, the risk of potential random hardware failure related to the security of the target product is assessed according to the fourth assessment dimension to obtain a second security risk assessment result. The second security risk assessment result includes the priority of optimization actions for the potential random hardware failure and the failure diagnosis coverage target to be optimized. Combining the first assessment dimension with the first functional safety characteristic parameters, a third assessment dimension is constructed to assess potential systemic failure risks related to safety, including: Establish a mapping relationship between the first functional safety characteristic parameter and the first severity in the first assessment dimension to form the third severity in the third assessment dimension. The third assessment dimension includes the third severity, frequency, and detectability of potential systemic failure of the element; or directly replace the first severity in the first assessment dimension with the first functional safety characteristic parameter to form the third assessment dimension. The third assessment dimension includes at least the frequency, detectability, and highest ASIL level of potential systemic failure of the element. In the risk assessment process for the potential systemic failure related to safety, the third assessment dimension is used to conduct an independent risk assessment for each of the first and second elements to obtain the first safety risk assessment result for addressing the potential systemic failure; In the risk assessment process of the potential random hardware failure chain related to security, the fourth assessment dimension is used to conduct independent risk assessments on each of the first and second elements from the dimensions of highest ASIL level, failure rate, and failure diagnosis coverage of existing security mechanisms; or, each of the first and second elements is independently assessed from the dimensions of highest ASIL level, failure rate, functional role, failure type, and failure diagnosis coverage of existing security mechanisms; to obtain the second security risk assessment result for addressing potential random hardware failures.

2. The FMEA risk assessment method for functional safety hardware product development according to claim 1, characterized in that, Before obtaining the dual failure chains for each element in the target product structure, the following is also included: The target product structure is decomposed and analyzed layer by layer from high to low, and the position and interaction relationship of each element in the product structure are defined, including the first element identified as a security mechanism and the second element identified as a security-related expected function. The function of each element in the product structure is analyzed, including the safety-related expected functions undertaken by the identified second element, and the failure detection and / or failure response functions undertaken by the identified first element. For potential failures of expected functions, the potential failures of expected functions are classified into single-point failures, latent failures, and other types of failures based on the failure type.

3. The FMEA risk assessment method for functional safety hardware product development according to claim 2, characterized in that, Also includes: Obtain the functional safety information of the target product, and annotate the functional safety information of each identified first element and each identified second element; Determine the diagnostic function undertaken by each of the first elements in response to the failure of the corresponding second element, wherein the diagnostic function includes a failure detection function, a failure response function, or a failure detection and failure response function. For potential systemic failures of the expected functions of elements, construct a potential systemic failure chain that includes failure causes, failure modes, and failure effects; and establish a traceability relationship between failures and safety objectives / top-level safety requirements. For potential random hardware failures of expected functional elements, a potential random hardware failure chain is constructed for expected functional elements without the first element configured, including failure cause, failure mode, and failure impact; for expected functional elements with the first element configured, a potential random hardware failure chain is constructed, including failure cause, failure mode, failure impact, failure diagnosis, and mitigation impact; and a traceability relationship between failure and safety objectives / top-level safety requirements is established.

4. The FMEA risk assessment method for functional safety hardware product development according to claim 1, characterized in that, After obtaining the first security risk assessment result and the second security risk assessment result, the process also includes: Based on the first security risk assessment results and the second security risk assessment results, formulate corresponding optimization measures to avoid or reduce security risks, and evaluate the effectiveness of the optimization measures until the mitigation of security risks reaches the target requirements; Record the analysis process and results, and generate an FMEA report document in accordance with functional safety standards.

5. A FMEA risk assessment system for the development of functional safety hardware products, based on the FMEA risk assessment method for the development of functional safety hardware products according to any one of claims 1-4, characterized in that, include: The first acquisition module is used to acquire the dual failure chain of each element in the target product structure, wherein the dual failure chain includes a potential systematic failure chain and a potential random hardware failure chain. And confirm whether each potential failure chain is security-related, wherein the failure would cause a violation of security objectives or top-level security requirements; The second acquisition module acquires a first assessment dimension for evaluating potential systemic failures related to safety, and a first functional safety characteristic parameter; the first assessment dimension includes the first severity, frequency, and detectability of the potential systemic failure of the element; the first functional safety characteristic parameter includes at least the highest ASIL level; The third acquisition module acquires a second assessment dimension for evaluating potential random hardware failures related to safety, and a second functional safety characteristic parameter; the second assessment dimension includes the second severity, frequency, and diagnostic capability of the potential random hardware failure of the element; the second functional safety characteristic parameter includes at least the highest ASIL level of the failure element, the failure rate, and the failure diagnosis coverage of existing safety mechanisms. The first construction module is used to construct a third assessment dimension for assessing the risk of potential systemic failures related to safety, by combining the first assessment dimension with the first functional safety characteristic parameters. The second building module is used to replace the evaluation parameters in the second evaluation dimension with the second functional safety characteristic parameters to construct a fourth evaluation dimension for evaluating the risk of potential random hardware failures related to safety. The first assessment module is used to assess the risk of potential systemic failures related to the safety of the target product according to the third assessment dimension during the risk assessment process of the potential systemic failure chain related to safety, and obtain a first safety risk assessment result. The first safety risk assessment result is the priority of optimization actions for the potential systemic failure. The second assessment module is used to assess the risk of potential random hardware failures related to the safety of the target product according to the fourth assessment dimension during the risk assessment process of the potential random hardware failure chain related to safety, and obtain a second safety risk assessment result. The second safety risk assessment result includes the priority of optimization actions for the potential random hardware failures and the failure diagnosis coverage target to be optimized.

6. A computer device, comprising a memory, a processor, and a computer program stored in the memory, characterized in that, The processor executes the computer program to implement the steps of the FMEA risk assessment method for developing functional safety hardware products as described in any one of claims 1-4.

7. A computer storage medium storing computer programs or instructions thereon, characterized in that, When the computer program or instructions are executed by the processor, they implement the steps of the FMEA risk assessment method for developing functional safety hardware products as described in any one of claims 1-4.

Images