An accident scene screening matching device and method for SOTIF test requirements

Abstract

This invention relates to the field of expected functional safety testing technology for autonomous vehicles, specifically to an accident scenario screening and matching device and method for SOTIF testing requirements. The device includes a processing system comprising an acquisition module, an analysis module, a risk modeling module, and a matching module. The risk modeling module uses Fault Tree Analysis (FTA) to perform a structured decomposition of SOTIF risk causative factors, quantifies the importance of risk elements through a combination of subjective and objective weighting, and outputs a comprehensive weight for each risk element. The matching module combines the comprehensive weight of risk elements to weight and enhance the accident scenario text, filtering out accident scenarios that match the test requirement text. This invention achieves precise matching between test requirements and accident scenarios by semantically associating risk elements with accident scenario text in an accident database.

Description

Technical Field

[0001] This invention relates to the field of expected functional safety testing technology for autonomous vehicles, and specifically to an accident scenario screening and matching device and method for SOTIF testing requirements. Background Technology

[0002] With the development of autonomous driving technology, autonomous driving systems based on perception, decision-making, and control algorithms are gradually being applied to real-world road traffic environments. Even in the absence of hardware or software malfunctions, autonomous driving systems may still pose safety risks due to insufficient perception capabilities, flawed decision-making logic, or reasonably foreseeable misuse. The international standard ISO 21448 defines such risks as Safety for Intended Functional Function (SOTIF) problems.

[0003] The core of SOTIF (Safety, Intended Functional Expectations, and Indications) testing for autonomous driving lies in achieving a precise match between accident case scenarios and corresponding test requirements. Existing autonomous driving system testing typically relies on pre-built test scenario libraries. For example, the literature "A Classification of Autonomous Driving Test Scenario Generation" mentions that test scenario construction methods for accident scenario reconstruction often rely on real traffic accident datasets to extract key accident elements and reproduce typical operating conditions that could trigger safety risks in autonomous driving systems. These methods often use statistical analysis and feature learning techniques to extract core information such as accident causes and scenario boundaries from real traffic accident data, providing SOTIF testing with scenario sources that closely match real-world risk conditions. Various real-world traffic accident databases, including the National Highway Traffic Safety Administration (NHTSA) accident dataset, the China Traffic Accident In-Depth Research Dataset, and the Apollo accident scenario dataset, provide SOTIF testing with massive amounts of real accident case texts and scenario data, making it possible to construct test cases that closely match real-world accident risk conditions, and also possessing good scalability. However, in existing technologies, whether rule-driven scenario selection methods or trajectory learning-based scenario generation methods, most rely on human experience or fixed rules to select test scenarios. They lack specific optimization for the matching logic between accident cases and SOTIF test requirements. This makes it difficult to accurately select highly representative accident scenarios strongly correlated with the test objectives from massive accident case data based on specific SOTIF test requirements. Consequently, test cases lack specificity and fail to effectively cover the risk points corresponding to the target test requirements. Furthermore, real-world accident cases are often recorded in unstructured text form. Traditional methods based on keyword matching or simple statistics cannot deeply explore the underlying SOTIF risk causal logic of accident cases, nor can they accurately depict the deep semantic connections and risk matching between SOTIF test requirements and accident cases. This severely restricts the execution efficiency and verification effectiveness of autonomous driving expected functional safety testing. Summary of the Invention

[0004] To address the aforementioned issues, this invention provides an accident scenario screening and matching device and method for SOTIF testing requirements. By systematically analyzing the expected functional safety concerns implicit in the testing requirements, these concerns are transformed into risk elements that can be structured and modeled. Furthermore, they are semantically associated with accident scenario texts in the accident database, thereby achieving accurate matching between testing requirements and accident scenarios.

[0005] To achieve the above objectives, the technical solution of the present invention is as follows: An accident scenario screening and matching device for SOTIF testing requirements, comprising a processing system, wherein the input interfaces of the processing system are respectively signal-connected to an accident database and an autonomous driving system, the autonomous driving system is used to transmit autonomous driving SOTIF testing requirement text, and the accident database is used to transmit accident scenario text; the processing system includes an acquisition module, an analysis module, a risk modeling module, and a matching module, wherein: The acquisition module is used to acquire test requirement text and accident scenario text, and through text standardization cleaning and semantic parsing, outputs a standardized text set and semantic set to the analysis module; The analysis module receives text and semantic sets, parses the content of the test requirement text, constructs the corresponding control structure model of the autonomous driving system based on the autonomous driving function modules involved in the test requirements, identifies SOTIF-related safety risks that deviate from safety constraints due to system design or performance limitations in scenarios where no hardware or software failures occur, constructs the causal scenarios corresponding to the SOTIF-related safety risks, and outputs the set of SOTIF-related safety risks and the set of causal scenarios to the risk modeling module. The risk modeling module receives a set of SOTIF-related safety risk issues and a set of causative scenarios. It uses the Fault Tree Analysis (FTA) method to perform a structured decomposition of SOTIF risk causative factors, determines the weights of risk elements, and defines risk elements as scenario factors that may affect the occurrence or severity of accidents, including traffic participant behavior, vehicle status, road environment, and weather conditions. It also extracts a standardized set of accident scenario texts from the semantic set, quantifies the importance of risk elements through a combination of subjective and objective weighting, and outputs the comprehensive weights of risk elements to the matching module. The matching module receives the comprehensive weight of risk elements, the text set, and the semantic set. Based on the semantic matching model, it matches the standardized test requirement text and the accident scenario text. It also combines the comprehensive weight of risk elements to perform weighted enhancement on the accident scenario text, completes the semantic similarity calculation, and filters out and outputs the accident scenarios that match the test requirement text.

[0006] Furthermore, the acquisition module includes a text acquisition unit, a preprocessing unit, and a semantic parsing unit; The text acquisition unit receives test requirement text transmitted from the autonomous driving system and accident scenario text transmitted from the accident database and transmits them to the preprocessing unit. The preprocessing unit performs word segmentation, stop word removal, part-of-speech filtering, and synonym normalization operations through text standardization and cleaning. After the preprocessing unit completes the standardization and cleaning of all text, it eliminates the impact of text expression differences on subsequent calculations, generates a standardized set of test requirement text and a standardized set of accident scenario text, and outputs them to the semantic parsing unit.

[0007] Furthermore, the semantic parsing unit receives standardized test requirement text sets and standardized accident scenario text sets. Through semantic unit parsing, it extracts keywords and phrases from the test requirement text sets and accident scenario text sets. After completing the full text semantic extraction of the test requirement text sets and accident scenario text sets, it constructs the test text set and semantic set, and outputs them to the analysis module.

[0008] Furthermore, the analysis module includes a structural modeling unit and a problem identification and classification unit, wherein: The structural modeling unit receives text and semantic sets, and through system theory process analysis, specifically constructs a control structure model of the autonomous driving system covering the entire link of perception, decision-making, control, execution, and environment. After completing the construction of the control structure model, the structural modeling unit obtains safety constraint rules by clarifying the safety constraint boundaries, and outputs the control structure model to the problem identification and classification unit and the autonomous driving system, and outputs the safety constraint rules to the problem identification and classification unit.

[0009] Furthermore, the problem identification and classification unit receives the control structure model and safety constraint rules. Through unsafe control behavior identification, it identifies deviations from safety constraints caused by system design or performance limitations, environmental uncertainties, or insufficient human-computer interaction in scenarios where no hardware or software failures have occurred. After completing the identification of unsafe control behaviors, the problem identification and classification unit maps SOTIF-related problems and constructs corresponding causal scenarios. At the same time, it classifies the identified problems into six categories: perception problems, driver behavior problems, control algorithm problems, execution problems, data fusion problems, and system hardware and software problems. It also generates a set of SOTIF-related safety risk problems and a set of causal scenarios for the risk modeling module.

[0010] Furthermore, the risk modeling module includes an FTA risk element decomposition unit and a weighting unit. The FTA risk element decomposition unit receives the set of SOTIF-related safety risk issues and the set of causal scenarios output by the analysis module. Using the Fault Tree Analysis (FTA) method, it decomposes the causal factors of each type of SOTIF-related safety risk issue layer by layer from four dimensions: people, vehicles, roads, and environment. After completing the first-level risk element decomposition, the first-level risk elements are further decomposed to obtain second-level risk elements. At the same time, the causal factors corresponding to the set of SOTIF-related safety risk issues are classified and labeled to generate a global risk element set covering all SOTIF-related safety risk issues, which is then output to the weighting unit.

[0011] Furthermore, the weighting unit receives the global risk element set output by the FTA risk element decomposition unit and the standardized accident scenario text set output by the acquisition module. Through a combination of subjective and objective weighting methods, the subjective weight of the risk elements is first calculated using the Analytic Hierarchy Process (AHP) combined with the 1–9 scale method, and then the objective weight of the risk elements is calculated using the term frequency-inverse document frequency model. After the subjective and objective weights are calculated, a fusion coefficient is introduced to linearly weight and fuse the two types of weights to generate a comprehensive weight of risk elements that represents the relative importance of each risk element, which is then output to the matching module.

[0012] Furthermore, the matching module includes a semantic matching unit and a scene filtering unit, wherein: The semantic matching unit receives the comprehensive weights of risk elements, the text set, and the semantic set. Based on the pre-trained BERT semantic matching model, it first maps the standardized test requirement text and the standardized accident scenario text to the same semantic vector space, obtaining the test requirement semantic vector and the initial semantic vector of the accident scenario, respectively. After completing the semantic vectorization representation, it combines the comprehensive weights of risk elements to perform dimension-wise weighted enhancement on the dimensions corresponding to the risk elements in the initial semantic vector of the accident scenario, obtaining the risk-enhanced accident scenario semantic vector. Then, it calculates the cosine similarity between the test requirement semantic vector and the risk-enhanced accident scenario semantic vector. After the cosine similarity calculation is completed, the accident scenarios are filtered according to the preset similarity threshold, and the semantic similarity result set between the test requirement and each accident scenario is output to the filtering unit.

[0013] Furthermore, the scenario filtering unit receives the semantic similarity result set between the test requirements and each accident scenario. Through threshold filtering and matching, it retrieves a preset similarity threshold and compares the semantic similarity of each accident scenario with the preset similarity threshold one by one. When the semantic similarity of an accident scenario is greater than or equal to the preset similarity threshold, the accident scenario is determined to be a valid scenario that matches the test requirements. After completing the threshold comparison and filtering of all accident scenarios, a set of candidate accident scenarios that match the test requirement text is generated and output to the autonomous driving system.

[0014] The above approach has the following beneficial effects: 1. This solution adopts a modular architecture with sequentially linked acquisition, analysis, risk modeling, and matching modules. Driven by the actual testing needs of autonomous driving systems, it can directly connect to the autonomous driving system and accident database to establish a two-way data transmission link, realizing fully automated processing from test requirement input to matched accident scenario output. It breaks away from the limitations of traditional manual experience or rule-driven scenario selection mode, and can accurately select highly matching accident scenarios for different SOTIF test requirements, greatly improving the relevance of test cases and scenario selection efficiency, and reducing the manual and time costs of autonomous driving SOTIF testing.

[0015] 2. This solution, through the structural modeling unit and problem identification and classification unit of the analysis module, introduces the System Theory Process Analysis (STPA) method to systematically identify SOTIF-related safety risks of autonomous driving systems in scenarios without hardware or software faults, and completes the standardized classification of six typical SOTIF problems. Then, through the FTA risk element decomposition unit of the risk modeling module, the SOTIF causative factors are hierarchically decomposed from four dimensions: human, vehicle, and environment. This achieves full-dimensional and structured modeling of SOTIF risk factors, breaking the fragmented and unsystematic problems of traditional accident scenario analysis. It significantly enhances the systematicness, logic, and interpretability of the accident scenario screening process, ensuring that the screened scenarios accurately cover the core risk points of SOTIF testing.

[0016] 3. This solution employs a subjective and objective weighting method combining the Analytic Hierarchy Process (AHP) and the TF-IDF model in the weighting unit. This approach takes into account both expert experience and the importance of scenario keywords in research literature, achieving precise quantification of the importance of different risk elements. Furthermore, through the semantic matching unit of the matching module, the comprehensive weight of risk elements is integrated into the BERT semantic matching process. This enhances the semantic vector of the accident scenario by applying risk weights, amplifying the semantic features of high-weight core risk elements. This effectively mitigates the interference of unstructured textual descriptions of accident scenarios on the matching results, solves the pain point that traditional keyword matching cannot accurately depict the semantic relationship between test requirements and accident scenarios, and significantly improves the matching accuracy between test requirements and accident scenarios.

[0017] An incident scenario screening and matching method for SOTIF testing requirements, based on the aforementioned incident scenario screening and matching device for SOTIF testing requirements, includes the following steps: S1. Parameter Configuration: Connect the input interface of the processing system with the autonomous driving system and the accident database to establish a two-way data transmission link; pre-configure the basic operating parameters of the processing system, such as text standardization rules, autonomous driving system safety constraint boundaries, risk decomposition dimensions, subjective and objective weight fusion coefficients, and semantic similarity thresholds, to complete the initial configuration before the device is put into operation. S2. Preprocessing: The processing system sends a test requirement text retrieval instruction to the autonomous driving system and receives the test requirement text corresponding to the autonomous driving function to be verified from the autonomous driving system; at the same time, it sends an accident scene text retrieval instruction to the accident database and receives the full set of accident scene texts from the accident database; the preprocessing unit performs standardized cleaning to generate a standardized text set and a semantic set, thus completing the text preprocessing operation. S3, SOTIF Problem Identification and Analysis: The analysis module performs system theoretical process analysis on the test requirement text, constructs the control structure model of the autonomous driving system, identifies SOTIF-related safety risks where the system deviates from safety constraints due to design or performance limitations in the absence of hardware or software failures, and constructs the causal scenarios corresponding to the safety risk issues; S4. Risk Element Weight Confirmation: Based on the causative scenarios, the risk modeling module uses fault tree analysis to decompose the accident causative factors from multiple dimensions such as people, vehicles, roads, and environment, forming a set of risk elements corresponding to different system problems. Based on the risk element set, the importance of the risk elements is modeled. The determination of the risk element weight comprehensively considers the subjective weight modeling results based on expert experience and the objective weight modeling results based on the importance characteristics of scenario keywords in research literature, thereby obtaining a comprehensive weight that reflects the relative importance of the risk elements. S5. Semantic Matching and Accident Scene Screening: The matching module performs semantic representation and matching analysis on the test requirement text and accident scene text based on the semantic matching model. It combines the comprehensive weight of risk elements to complete the semantic similarity weighting calculation and screens the accident scenes corresponding to the test requirements from the accident database according to the matching results. S6. Result Output: The set of candidate accident scenarios that match the test requirement text is pushed to the autonomous driving system through the output interface of the processing system for the construction and test verification of SOTIF test cases of the autonomous driving system; at the same time, the test requirement text, risk element set, comprehensive weight parameters and matching results of this screening process are archived and stored to complete the entire process of accident scenario screening and matching.

[0018] Beneficial effects: 1. This solution achieves end-to-end accurate matching between test requirements and accident scenarios through a closed-loop operation of parameter pre-configuration, text preprocessing, SOTIF problem identification, risk element weighting, semantic matching and filtering, and result output archiving. It overcomes the limitations of traditional manual screening mode, which is inefficient and lacks specificity. It can quickly filter out accident scenarios that are highly consistent with test requirements from massive accident data, greatly improving the efficiency and effectiveness of test coverage in autonomous driving SOTIF testing.

[0019] 2. This solution employs a two-level analysis process: STPA system theoretical process analysis and FTA fault tree analysis. First, it identifies the core SOTIF issues at the system level without hardware or software faults. Then, it performs a hierarchical decomposition of risk-causing factors from multiple dimensions, including people, vehicles, roads, and the environment. This achieves a complete chain decomposition of SOTIF risks from system-level issues to underlying risk elements, providing the accident scenario screening process with complete theoretical support and a clear logical link. It effectively solves the problems of traditional scenario screening methods lacking systematicity and interpretability, ensuring that the screened scenarios accurately meet the core risk verification requirements of SOTIF testing.

[0020] 3. This solution employs a combined subjective and objective weighting approach to quantify the importance of risk elements. Subjective weights incorporate SOTIF domain expert experience through the analytic hierarchy process, while objective weights are quantified using statistical features from literature, thus reflecting the importance of risk elements in relevant research. Simultaneously, risk weights are integrated into the semantic matching process of the pre-trained BERT model to enhance the semantic vectors of accident scenarios, effectively mitigating the impact of differences in unstructured accident text descriptions, strengthening the semantic features of core risk elements, significantly improving the accuracy of semantic matching between test requirements and accident scenarios, and avoiding the problem of high-risk core scenarios being masked by low-risk scenarios. Attached Figure Description

[0021] Figure 1 This is a schematic diagram of the system framework of an embodiment of the accident scenario screening and matching device for SOTIF testing requirements of the present invention. Figure 2 This is a schematic diagram of SOTIF risk element identification and decomposition based on STPA and FTA, representing an embodiment of the accident scenario screening and matching device for SOTIF testing requirements of the present invention. Figure 3 This is a schematic diagram of the risk-weighted dual-tower BERT semantic matching model architecture of an accident scenario screening and matching device for SOTIF testing requirements according to an embodiment of the present invention. Figure 4 This is a schematic diagram illustrating the steps of an embodiment of the accident scenario screening and matching method for SOTIF testing requirements according to the present invention. Detailed Implementation

[0022] The technical solution of the present invention will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0023] In the description of this invention, it should be noted that the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are used only for the convenience of describing the invention and for simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on the invention. Furthermore, the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0024] In the description of this invention, it should be noted that, unless otherwise explicitly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0025] The following detailed description illustrates the specific implementation method: Example 1: As attached Figure 1 As shown: An accident scenario screening and matching device for SOTIF testing requirements includes a processing system. The input interfaces of the processing system are respectively connected to an accident database and an autonomous driving system. The autonomous driving system is used to transmit autonomous driving SOTIF test requirement text, and the accident database is used to transmit accident scenario text. The processing system includes an acquisition module, an analysis module, a risk modeling module, and a matching module, wherein: The acquisition module is used to acquire test requirement text and accident scenario text, and output standardized text and semantic sets to the analysis module through text standardization cleaning and semantic parsing; the acquisition module includes a text acquisition unit, a preprocessing unit and a semantic parsing unit; The text acquisition unit receives test requirement text transmitted from the autonomous driving system and accident scenario text transmitted from the accident database and transmits them to the preprocessing unit. The preprocessing unit performs word segmentation, stop word removal, part-of-speech filtering, and synonym normalization operations through text standardization and cleaning. After the preprocessing unit completes the standardization and cleaning of all text, it eliminates the impact of text expression differences on subsequent calculations, generates a standardized set of test requirement text and a standardized set of accident scenario text, and outputs them to the semantic parsing unit. The semantic parsing unit receives standardized test requirement text sets and standardized accident scenario text sets. Through semantic unit parsing, it extracts keywords and phrases from the test requirement text sets and accident scenario text sets. After completing the full text semantic extraction of the test requirement text sets and accident scenario text sets, it constructs the test text set and semantic set, and outputs them to the analysis module.

[0026] The analysis module receives text and semantic sets, parses the test requirement text, constructs the corresponding control structure model of the autonomous driving system based on the autonomous driving function modules involved in the test requirements, identifies SOTIF-related safety risks that deviate from safety constraints due to system design or performance limitations in scenarios where no hardware or software failures occur, and constructs causal scenarios corresponding to the SOTIF-related safety risks. It then outputs the set of SOTIF-related safety risks and the set of causal scenarios to the risk modeling module. The analysis module includes a structural modeling unit and a problem identification and classification unit, wherein: The structural modeling unit receives text and semantic sets, and through system theory process analysis, specifically constructs a control structure model of the autonomous driving system covering the entire link of perception, decision-making, control, execution and environment. After completing the construction of the control structure model, the structural modeling unit obtains safety constraint rules by clarifying the safety constraint boundaries, and outputs the control structure model to the problem identification and classification unit and the autonomous driving system, and outputs the safety constraint rules to the problem identification and classification unit. The problem identification and classification unit receives the control structure model and safety constraint rules. It identifies unsafe control behaviors that deviate from safety constraints in scenarios where no hardware or software failures occur, due to system design or performance limitations, environmental uncertainties, or insufficient human-computer interaction. After completing the identification of unsafe control behaviors, the problem identification and classification unit maps SOTIF-related problems and constructs corresponding causal scenarios. At the same time, it classifies the identified problems into six categories: perception problems, driver behavior problems, control algorithm problems, execution problems, data fusion problems, and system hardware and software problems. It also generates a set of SOTIF-related safety risk problems and a set of causal scenarios for the risk modeling module.

[0027] The risk modeling module receives a set of SOTIF-related safety risk issues and a set of causative scenarios. It uses Fault Tree Analysis (FTA) to structurally decompose the causative factors of SOTIF risks, determining the weights of risk elements. Risk elements are scenario factors that may affect the occurrence or severity of accidents, including traffic participant behavior, vehicle status, road environment, and weather conditions. It also extracts a standardized set of accident scenario texts from the semantic set and quantifies the importance of risk elements through a combination of subjective and objective weighting methods. Finally, it outputs the comprehensive weights of the risk elements to the matching module. The risk modeling module includes an FTA risk element decomposition unit and a weighting... The weighting unit, in which the FTA risk element decomposition unit receives the set of SOTIF-related safety risk issues and the set of causal scenarios output by the analysis module, uses the fault tree analysis (FTA) method to specifically decompose the causal factors of each type of SOTIF-related safety risk issue from four dimensions: people, vehicles, roads, and environment. After the first-level risk element decomposition is completed, the first-level risk elements are further decomposed to obtain the second-level risk elements. At the same time, the causal factors corresponding to the set of SOTIF-related safety risk issues are classified and labeled to generate a global risk element set covering all SOTIF-related safety risk issues, which is then output to the weighting unit. The weighting unit receives the global risk element set output by the FTA risk element decomposition unit and the standardized accident scenario text set output by the acquisition module. It uses a combination of subjective and objective weighting methods. Specifically, it first uses the Analytic Hierarchy Process (AHP) combined with the 1–9 scale method to calculate the subjective weight of the risk elements, and then uses the term frequency-inverse document frequency model to calculate the objective weight of the risk elements. After the subjective and objective weights are calculated, a fusion coefficient is introduced to linearly weight and fuse the two types of weights to generate a comprehensive weight of risk elements that represents the relative importance of each risk element, which is then output to the matching module.

[0028] The matching module receives the comprehensive weight of risk elements, the text set, and the semantic set. Based on the semantic matching model, it matches the standardized test requirement text and accident scenario text. It also combines the comprehensive weight of risk elements to perform weighted enhancement on the accident scenario text, completes the semantic similarity calculation, and filters out and outputs the accident scenarios that match the test requirement text. The matching module includes a semantic matching unit and a scene filtering unit, wherein: The semantic matching unit receives the comprehensive weights of risk elements, the text set, and the semantic set. Based on the pre-trained BERT semantic matching model, it first maps the standardized test requirement text and the standardized accident scenario text to the same semantic vector space, obtaining the test requirement semantic vector and the initial semantic vector of the accident scenario, respectively. After the semantic vectorization is completed, the dimensions corresponding to the risk elements in the initial semantic vector of the accident scenario are weighted and enhanced dimension by dimension in combination with the comprehensive weights of risk elements, resulting in the risk-enhanced accident scenario semantic vector. Then, the cosine similarity between the test requirement semantic vector and the risk-enhanced accident scenario semantic vector is calculated. After the cosine similarity calculation is completed, the accident scenarios are filtered according to the preset similarity threshold, and the semantic similarity result set between the test requirement and each accident scenario is output to the filtering unit. The scenario filtering unit receives the semantic similarity result set between the test requirements and each accident scenario. It retrieves a preset similarity threshold through a threshold filtering and matching method, and compares the semantic similarity of each accident scenario with the preset similarity threshold one by one. When the semantic similarity of an accident scenario is greater than or equal to the preset similarity threshold, the accident scenario is determined to be a valid scenario that matches the test requirements. After completing the threshold comparison and filtering of all accident scenarios, a set of candidate accident scenarios that match the test requirement text is generated and output to the autonomous driving system.

[0029] The specific implementation process is as follows: First, obtain the test requirement text of the autonomous driving system and the accident scenario text from the accident database. The test requirement text describes the functional behaviors that the autonomous driving system needs to verify under different operating conditions, and the accident scenario text describes the environment, participants, and behavioral processes involved in real traffic accidents. The test requirement text is then constructed into a test requirement text set.

[0030] Construct the accident scene text into a collection of accident scene texts: in, This represents the i-th test requirement text. This represents the text of the j-th accident scenario.

[0031] To eliminate the impact of textual discrepancies on subsequent calculations, text standardization is performed on the test requirement text set T and the accident scenario text set A. Text standardization includes word segmentation, stop word removal, part-of-speech tagging, and synonym normalization, resulting in the standardized test requirement text set and the standardized accident scenario text set, respectively: Based on this, semantic unit parsing is performed on the standardized text to extract keywords and phrases from the test requirement text and the accident scenario text, and test requirement semantic unit sets and accident scenario semantic unit sets are constructed respectively: Subsequently, based on the System Theory Process Analysis (STPA) method, such as Figure 2 As shown, the expected functional safety issues involved in the test requirements text are analyzed. STPA analysis is used to identify potential risks to autonomous driving systems under expected normal functional conditions, caused by factors such as functional limitations, environmental uncertainties, or insufficient human-machine interaction, and the analysis results are mapped to SOTIF-related safety risk issues at the system level.

[0032] Based on the source and mechanism of the system problems, the identified SOTIF-related security risks are divided into the following six categories: in: S per Perception problems are used to describe system problems caused by insufficient perception capabilities, false detections, or missed detections. S drv Driver behavior problems are used to describe system problems caused by driver misoperation, mishandling, or improper human-machine interaction. S alg Control algorithm problems are used to describe system problems caused by unreasonable control strategies or improper parameter configurations. S exe : Execution problems, used to describe system problems caused by slow response or limited capacity of the executing mechanism; S fus Data fusion problem: This refers to system problems caused by inconsistencies or conflicts in the fusion of multi-source sensing data. S sys System hardware and software problems: These describe system issues caused by abnormalities in computing resources, communication, or hardware and software.

[0033] The above six types of system problems serve as a unified input for subsequent risk element decomposition and modeling.

[0034] For each type of system problem, Fault Tree Analysis (FTA) is used to decompose it layer by layer from four perspectives: "human-vehicle-road-environment," in order to identify the specific risk factors that cause the system problem. Construct a set of primary risk elements:

[0035] Further refining the primary risk elements yields a set of secondary risk elements: The system problems are then categorized and labeled according to the functional modules involved: Obtain the global set of risk elements: After obtaining the global set of risk elements, a unified quantitative model of the importance of each risk element is performed. The weighting of risk elements combines subjective and objective weighting to account for both expert knowledge and the importance of scenario keywords in the research literature. The subjective weighting of risk elements employs the analytic hierarchy process (AHP), specifically organizing risk elements into four levels: people, vehicles, roads, and environment. Based on a 1–9 scale, pairwise comparisons are performed on risk elements within the same level to construct a judgment matrix for the risk elements.

[0036] in, This indicates the degree of importance of the i-th element relative to the j-th element in relation to a certain criterion at the higher level.

[0037] Assuming the judgment matrix passes the consistency test, the judgment matrix is ​​normalized, and the average value of each row's elements is calculated to obtain the subjective weight of each risk element. This leads to the construction of a subjective weight vector for the risk elements: in, This represents the subjective weight vector of risk elements obtained based on expert knowledge and system analysis.

[0038] In another implementation, a literature database is constructed based on relevant research literature. Statistical analysis is performed on the keywords of risk elements, and the objective weights of risk elements are calculated using a term frequency-inverse document frequency (TF-IDF) model to reflect the importance characteristics of each risk element in relevant research literature. Specifically, the term frequency of a risk element is defined as:

[0039] Inverse document frequency is defined as: Therefore, the TF-IDF weights of the risk elements are calculated: Furthermore, the TF-IDF values ​​of each risk element in relevant research literature were normalized to obtain the objective weights of the risk elements: Therefore, an objective weight vector for the risk elements is constructed: in, This represents the objective weight vector of risk elements obtained based on statistical analysis of literature corpora.

[0040] In obtaining the subjective weight vector of risk elements With objective weight vector Subsequently, to comprehensively reflect the importance characteristics of expert experience and scenario keywords in the research literature, a fusion coefficient was introduced to linearly weight the two types of weights, resulting in a comprehensive weight for the risk elements: in, (0≤) ≤1) is the fusion coefficient, used to adjust the relative proportion of objective weight and subjective weight in the overall weight.

[0041] Therefore, a comprehensive weight vector of risk elements is constructed: The comprehensive weight vector is used to characterize the relative importance of different risk elements in the accident scenario, and serves as the weight input for subsequent risk-enhanced semantic matching and accident scenario screening processes.

[0042] After obtaining the comprehensive weight vector of risk elements, in order to achieve accurate matching between test requirements and accident scenarios, a semantic encoding method based on a pre-trained language model is used to vectorize the standardized test requirement text and accident scenario text, mapping them to the same semantic vector space and introducing the risk element weights into the semantic matching process.

[0043] First, the standardized test requirement text For the i-th test requirement text Input into the BERT model, such as Figure 3 As shown, the semantic feature vectors related to the context are extracted to obtain the semantic vector of the test requirement text, which is represented as follows:

[0044] Similarly, the standardized accident scene text The text is input into the BERT model to obtain the semantics of the accident scene text, represented as follows: in, This represents the semantic encoding function of the BERT model, used to map text to the same semantic vector space.

[0045] Because the importance of risk elements varies across different accident scenarios, directly matching based on the original semantic vector can easily lead to high-risk accident scenarios being masked by low-risk scenarios. Therefore, in this embodiment, a comprehensive weighting of risk elements is introduced to weight and enhance the accident scenario semantic vector. Specifically, the accident scenario semantic vector... The dimensions corresponding to the risk elements, and the comprehensive weight vector of the risk elements. By performing dimension-wise weighting, we obtain the semantic vector of the accident scene after risk enhancement:

[0046] in, This represents element-wise multiplication. Through the above processing, high-weight risk elements are further amplified in the semantic representation of the accident scene, thereby enabling accident scenes containing key risk factors to achieve higher discriminative power in subsequent matching processes.

[0047] In obtaining the semantic vector of test requirements semantic vectors of accident scenarios with enhanced risk Next, the semantic similarity between the two is calculated. In one embodiment, cosine similarity is used as the matching metric, and its calculation formula is as follows:

[0048] in, This represents the semantic similarity between the i-th test requirement text and the j-th accident scenario text.

[0049] After calculating the semantic similarity between the test requirement text and the accident scenario text, a preset similarity threshold is applied. The accident scenarios are screened to construct a candidate accident scenario set as the output of accident scenarios for the expected functional safety testing requirements: Example 2: As attached Figure 4 As shown, the difference from Embodiment 1 is that an accident scenario screening and matching method for SOTIF testing requirements is operated based on the accident scenario screening and matching device for SOTIF testing requirements described in Embodiment 1, and includes the following steps: S1. Parameter Configuration: Connect the input interface of the processing system with the autonomous driving system and the accident database to establish a two-way data transmission link; pre-configure the basic operating parameters of the processing system, such as text standardization rules, autonomous driving system safety constraint boundaries, risk decomposition dimensions, subjective and objective weight fusion coefficients, and semantic similarity thresholds, to complete the initial configuration before the device is put into operation. S2. Preprocessing: The processing system sends a test requirement text retrieval instruction to the autonomous driving system and receives the test requirement text corresponding to the autonomous driving function to be verified from the autonomous driving system; at the same time, it sends an accident scene text retrieval instruction to the accident database and receives the full set of accident scene texts from the accident database; the preprocessing unit performs standardized cleaning to generate a standardized text set and a semantic set, thus completing the text preprocessing operation. S3, SOTIF Problem Identification and Analysis: The analysis module performs system theoretical process analysis on the test requirement text, constructs the control structure model of the autonomous driving system, identifies SOTIF-related safety risks where the system deviates from safety constraints due to design or performance limitations in the absence of hardware or software failures, and constructs the causal scenarios corresponding to the safety risk issues; S4. Risk Element Weight Confirmation: Based on the causative scenarios, the risk modeling module uses fault tree analysis to decompose the accident causative factors from multiple dimensions such as people, vehicles, roads, and environment, forming a set of risk elements corresponding to different system problems. Based on the risk element set, the importance of the risk elements is modeled. The determination of the risk element weight comprehensively considers the subjective weight modeling results based on expert experience and the objective weight modeling results based on the importance characteristics of scenario keywords in research literature, thereby obtaining a comprehensive weight that reflects the relative importance of the risk elements. S5. Semantic Matching and Accident Scene Screening: The matching module performs semantic representation and matching analysis on the test requirement text and accident scene text based on the semantic matching model. It combines the comprehensive weight of risk elements to complete the semantic similarity weighting calculation and screens the accident scenes corresponding to the test requirements from the accident database according to the matching results. S6. Result Output: The set of candidate accident scenarios that match the test requirement text is pushed to the autonomous driving system through the output interface of the processing system for the construction and test verification of SOTIF test cases of the autonomous driving system; at the same time, the test requirement text, risk element set, comprehensive weight parameters and matching results of this screening process are archived and stored to complete the entire process of accident scenario screening and matching.

[0050] Obviously, the above embodiments are merely illustrative examples for clear explanation and are not intended to limit the implementation. Those skilled in the art will recognize that other variations or modifications can be made based on the above description. It is neither necessary nor possible to exhaustively list all possible implementations here. However, obvious variations or modifications derived therefrom are still within the scope of protection of this invention.

Claims

1. An accident scenario screening and matching device for SOTIF testing requirements, characterized in that, The system includes a processing system whose input interfaces are connected to an accident database and an autonomous driving system. The autonomous driving system transmits SOTIF test requirement text for autonomous driving, and the accident database transmits accident scenario text. The processing system includes an acquisition module, an analysis module, a risk modeling module, and a matching module, wherein: The acquisition module is used to acquire test requirement text and accident scenario text, and through text standardization cleaning and semantic parsing, outputs a standardized text set and semantic set to the analysis module; The analysis module receives text and semantic sets, parses the content of the test requirement text, constructs the corresponding control structure model of the autonomous driving system based on the autonomous driving function modules involved in the test requirements, identifies SOTIF-related safety risks that deviate from safety constraints due to system design or performance limitations in scenarios where no hardware or software failures occur, constructs the causal scenarios corresponding to the SOTIF-related safety risks, and outputs the set of SOTIF-related safety risks and the set of causal scenarios to the risk modeling module. The risk modeling module receives a set of SOTIF-related safety risk issues and a set of causative scenarios. It uses the Fault Tree Analysis (FTA) method to perform a structured decomposition of SOTIF risk causative factors, determines the weights of risk elements, and defines risk elements as scenario factors that may affect the occurrence or severity of accidents, including traffic participant behavior, vehicle status, road environment, and weather conditions. It also extracts a standardized set of accident scenario texts from the semantic set, quantifies the importance of risk elements through a combination of subjective and objective weighting, and outputs the comprehensive weights of risk elements to the matching module. The matching module receives the comprehensive weight of risk elements, the text set, and the semantic set. Based on the semantic matching model, it matches the standardized test requirement text and the accident scenario text. It also combines the comprehensive weight of risk elements to perform weighted enhancement on the accident scenario text, completes the semantic similarity calculation, and filters out and outputs the accident scenarios that match the test requirement text.

2. The accident scenario screening and matching device for SOTIF testing requirements according to claim 1, characterized in that, The acquisition module includes a text acquisition unit, a preprocessing unit, and a semantic parsing unit; The text acquisition unit receives test requirement text transmitted from the autonomous driving system and accident scenario text transmitted from the accident database and transmits them to the preprocessing unit. The preprocessing unit performs word segmentation, stop word removal, part-of-speech filtering, and synonym normalization operations through text standardization and cleaning. After the preprocessing unit completes the standardization and cleaning of all text, it eliminates the impact of text expression differences on subsequent calculations, generates a standardized set of test requirement text and a standardized set of accident scenario text, and outputs them to the semantic parsing unit.

3. The accident scenario screening and matching device for SOTIF testing requirements according to claim 2, characterized in that, The semantic parsing unit receives standardized test requirement text sets and standardized accident scenario text sets. Through semantic unit parsing, it extracts keywords and phrases from the test requirement text sets and accident scenario text sets. After completing the full text semantic extraction of the test requirement text sets and accident scenario text sets, it constructs the test text set and semantic set, and outputs them to the analysis module.

4. The accident scenario screening and matching device for SOTIF testing requirements according to claim 3, characterized in that, The analysis module includes a structural modeling unit and a problem identification and classification unit, wherein: The structural modeling unit receives text and semantic sets, and through system theory process analysis, specifically constructs a control structure model of the autonomous driving system covering the entire link of perception, decision-making, control, execution, and environment. After completing the construction of the control structure model, the structural modeling unit obtains safety constraint rules by clarifying the safety constraint boundaries, and outputs the control structure model to the problem identification and classification unit and the autonomous driving system, and outputs the safety constraint rules to the problem identification and classification unit.

5. The accident scenario screening and matching device for SOTIF testing requirements according to claim 4, characterized in that, The problem identification and classification unit receives the control structure model and safety constraint rules. It identifies unsafe control behaviors that deviate from safety constraints in scenarios where no hardware or software failures occur, due to system design or performance limitations, environmental uncertainties, or insufficient human-computer interaction. After completing the identification of unsafe control behaviors, the problem identification and classification unit maps SOTIF-related problems and constructs corresponding causal scenarios. At the same time, it classifies the identified problems into six categories: perception problems, driver behavior problems, control algorithm problems, execution problems, data fusion problems, and system hardware and software problems. It also generates a set of SOTIF-related safety risk problems and a set of causal scenarios for the risk modeling module.

6. The accident scenario screening and matching device for SOTIF testing requirements according to claim 5, characterized in that, The risk modeling module includes an FTA risk element decomposition unit and a weighting unit. The FTA risk element decomposition unit receives the set of SOTIF-related safety risk issues and the set of causal scenarios output by the analysis module. Using the Fault Tree Analysis (FTA) method, it decomposes the causal factors of each type of SOTIF-related safety risk issue layer by layer from four dimensions: people, vehicles, roads, and environment. After completing the first-level risk element decomposition, the first-level risk elements are further decomposed to obtain second-level risk elements. At the same time, the causal factors corresponding to the set of SOTIF-related safety risk issues are classified and labeled to generate a global risk element set covering all SOTIF-related safety risk issues, which is then output to the weighting unit.

7. The accident scenario screening and matching device for SOTIF testing requirements according to claim 6, characterized in that, The weighting unit receives the global risk element set output by the FTA risk element decomposition unit and the standardized accident scenario text set output by the acquisition module. It uses a combination of subjective and objective weighting methods. Specifically, it first calculates the subjective weight of the risk elements using the Analytic Hierarchy Process (AHP) combined with the 1–9 scale method, and then calculates the objective weight of the risk elements using the term frequency-inverse document frequency model based on the literature corpus. After the subjective and objective weights are calculated, a fusion coefficient is introduced to linearly weight and fuse the two types of weights to generate a comprehensive weight of risk elements that represents the relative importance of each risk element, which is then output to the matching module.

8. The accident scenario screening and matching device for SOTIF testing requirements according to claim 7, characterized in that, The matching module includes a semantic matching unit and a scene filtering unit, wherein: The semantic matching unit receives the comprehensive weights of risk elements, the text set, and the semantic set. Based on the pre-trained BERT semantic matching model, it first maps the standardized test requirement text and the standardized accident scenario text to the same semantic vector space, obtaining the test requirement semantic vector and the initial semantic vector of the accident scenario, respectively. After completing the semantic vectorization representation, it combines the comprehensive weights of risk elements to perform dimension-wise weighted enhancement on the dimensions corresponding to the risk elements in the initial semantic vector of the accident scenario, obtaining the risk-enhanced accident scenario semantic vector. Then, it calculates the cosine similarity between the test requirement semantic vector and the risk-enhanced accident scenario semantic vector. After the cosine similarity calculation is completed, the accident scenarios are filtered according to the preset similarity threshold, and the semantic similarity result set between the test requirement and each accident scenario is output to the filtering unit.

9. The accident scenario screening and matching device for SOTIF testing requirements according to claim 8, characterized in that, The scenario filtering unit receives the semantic similarity result set between the test requirements and each accident scenario. It retrieves a preset similarity threshold through a threshold filtering and matching method, and compares the semantic similarity of each accident scenario with the preset similarity threshold one by one. When the semantic similarity of an accident scenario is greater than or equal to the preset similarity threshold, the accident scenario is determined to be a valid scenario that matches the test requirements. After completing the threshold comparison and filtering of all accident scenarios, a set of candidate accident scenarios that match the test requirement text is generated and output to the autonomous driving system.

10. A method for screening and matching accident scenarios to meet SOTIF testing requirements, operating based on the accident scenario screening and matching device for meeting SOTIF testing requirements as described in claims 1-9, characterized in that... Includes the following steps: S1. Parameter Configuration: Connect the input interface of the processing system with the autonomous driving system and the accident database to establish a two-way data transmission link; pre-configure the basic operating parameters of the processing system, such as text standardization rules, autonomous driving system safety constraint boundaries, risk decomposition dimensions, subjective and objective weight fusion coefficients, and semantic similarity thresholds, to complete the initial configuration before the device is put into operation. S2. Preprocessing: The processing system sends a test requirement text retrieval instruction to the autonomous driving system and receives the test requirement text corresponding to the autonomous driving function to be verified from the autonomous driving system; at the same time, it sends an accident scene text retrieval instruction to the accident database and receives the full set of accident scene texts from the accident database; the preprocessing unit performs standardized cleaning to generate a standardized text set and a semantic set, thus completing the text preprocessing operation. S3, SOTIF Problem Identification and Analysis: The analysis module performs system theoretical process analysis on the test requirement text, constructs the control structure model of the autonomous driving system, identifies SOTIF-related safety risks where the system deviates from safety constraints due to design or performance limitations in the absence of hardware or software failures, and constructs the causal scenarios corresponding to the safety risk issues; S4. Risk Element Weight Confirmation: Based on the causative scenarios, the risk modeling module uses the fault tree analysis method to decompose the accident causative factors from multiple dimensions such as people, vehicles, roads and environment, forming a set of risk elements corresponding to different system problems. Based on the set of risk elements, the importance of risk elements is modeled. The determination of the weight of risk elements comprehensively considers the subjective weight modeling results based on expert experience and the objective weight modeling results based on the statistical characteristics of literature corpus, so as to obtain a comprehensive weight that reflects the relative importance of risk elements. S5. Semantic Matching and Accident Scene Screening: The matching module performs semantic representation and matching analysis on the test requirement text and accident scene text based on the semantic matching model. It combines the comprehensive weight of risk elements to complete the semantic similarity weighting calculation and screens the accident scenes corresponding to the test requirements from the accident database according to the matching results. S6. Result Output: The set of candidate accident scenarios that match the test requirement text is pushed to the autonomous driving system through the output interface of the processing system for the construction and test verification of SOTIF test cases of the autonomous driving system; at the same time, the test requirement text, risk element set, comprehensive weight parameters and matching results of this screening process are archived and stored to complete the entire process of accident scenario screening and matching.

Images